Bump package versions to latest upstream releases

[github-actions]

Automated bump from check-releases.yml. Merging rebuilds and republishes the apt repository.

[gafferongames]

Review of PR #47 (Bump package versions to latest upstream releases)

Score: 7/10
Verdict: HOLD
Head SHA: 0cec06adf437d4be9caacad4de0cf4deecb14e42 (branch: bump-versions-20260903)
Base: origin/main (8ba166a51f3a0d7761d73f3e64d285f3c8ab256d)

Executive Summary

PR #47 was automatically generated on 2026-09-03 by check-releases.yml to bump pinned dependency versions in versions.env:

• RELIABLE_VERSION: 1.4.0 -> 1.4.1
• NETCODE_VERSION: 1.4.3 -> 1.4.4
• YOJIMBO_VERSION: 1.10.1 -> 1.11.0
• SCHEMA_VERSION: 2.0.0 -> 2.4.0
• SERIALIZE_VERSION: remains 1.15.0

From an implementation and packaging standpoint, PR #47 is sound: 3-way merge is clean, and CI workflow run 33739123849 demonstrated that all 10 matrix build configurations (Debian 12/13, Ubuntu 22.04/24.04/26.04 on amd64 and arm64), smoke tests, and autopkgtests compile and pass cleanly.

However, a HOLD verdict is recommended because this PR is from 18 days ago and has been superseded by subsequent daily bumps (culminating in PR #65 on 2026-09-21, which includes serialize 1.17.0, reliable 1.4.5, netcode 1.4.8, yojimbo 1.13.5, and schema 2.5.0). Merging PR #47 would publish intermediate versions from September 3rd.

---

Detailed Verification Evidence

1. 3-Way Merge & Git Status

• Clean merge against origin/main.
• Command:

  git merge-tree --write-tree origin/main 0cec06adf437d4be9caacad4de0cf4deecb14e42

  Result tree: 51227352c658618e52a4f75ec8f43eba11c746c2 (exit code: 0).
• Diff verification: Strictly isolated to versions.env (+4 / -4 lines).

2. Upstream Release Verification

Verified existence and metadata of the pinned releases via GitHub API:

• mas-bandwidth/reliable: tag v1.4.1 (created 2026-08-26)
• mas-bandwidth/netcode: tag v1.4.4 (created 2026-08-26)
• mas-bandwidth/yojimbo: tag v1.11.0 (created 2026-08-26)
• mas-bandwidth/schema: tag v2.4.0 (created 2026-09-01)
• mas-bandwidth/serialize: tag v1.15.0 (created 2026-08-25)

3. Release Check Script (scripts/check-releases.sh)

Ran ./scripts/check-releases.sh at commit 0cec06adf437d4be9caacad4de0cf4deecb14e42:

• Accurately detected that upstream repositories have released newer versions since 2026-09-03:
  • serialize: pinned 1.15.0, latest 1.17.0
  • reliable: pinned 1.4.1, latest 1.4.5
  • netcode: pinned 1.4.4, latest 1.4.8
  • yojimbo: pinned 1.11.0, latest 1.13.5
  • schema: pinned 2.4.0, latest 2.5.0
• Exited with status 1 as designed.

4. Negative Controls / Red-Tests

• Script sensitivity test (negative control): Mutated versions.env with invalid version SERIALIZE_VERSION=9.9.9. ./scripts/check-releases.sh caught the discrepancy (serialize: pinned 9.9.9, latest 1.17.0) and exited with code 1.
• Positive control: Executed ./scripts/check-releases.sh --update to synchronize versions.env with current upstream releases; subsequent run returned all pinned versions are current and exited with code 0.

5. CI Build Analysis & Remote Verification

In GitHub Actions workflow run 33739123849 (build.yml on branch bump-versions-20260903):

• autopkgtest-schema: Passed (1m20s).
• All 10 matrix build jobs passed:
  • debian:12 (amd64 / arm64): Passed (3m8s / 1m35s)
  • debian:13 (amd64 / arm64): Passed (1m50s / 1m54s)
  • ubuntu:22.04 (amd64 / arm64): Passed (2m16s / 1m50s)
  • ubuntu:24.04 (amd64 / arm64): Passed (2m7s / 1m50s)
  • ubuntu:26.04 (amd64 / arm64): Passed (2m15s / 1m59s)
• All .deb artifacts were generated, smoke tests passed, and artifacts were uploaded.
• The only failed step in the run was publish, which failed with:
  Branch "bump-versions-20260903" is not allowed to deploy to github-pages due to environment protection rules.
  This is expected for branch dispatches; deployments to github-pages are restricted to main.
• Pull request event runs (33739126701, 33739126893) triggered by github-actions[bot] remain in action_required status awaiting maintainer approval.

---

Recommendation

1. Option A (Recommended - Close as superseded): Close PR Bump package versions to latest upstream releases #47 in favor of the current upstream release bump once PR Bump package versions to latest upstream releases #65 (bump-versions-20260921) resolves the yojimbo 1.13.5 packaging build issue.
2. Option B (Merge to publish intermediate releases): If the project desires publishing the 2026-09-03 package versions to the apt repository before advancing to later versions, PR Bump package versions to latest upstream releases #47 is verified, builds cleanly, and is safe to merge.

READ-COST: reader=Emma model=gemini-2.5-pro seconds=162 tokens=unknown plan=max