Bump package versions to latest upstream releases

[github-actions]

Automated bump from check-releases.yml. Merging rebuilds and republishes the apt repository.

[gafferongames]

Review of PR #52 (Bump package versions to latest upstream releases)

Score: 2/10
Verdict: HOLD
Head SHA: f1d7ed42befbbc55459c5fcf82fd84eaaa604db9 (branch: bump-versions-20260908)
Base: origin/main (8ba166a51f3a0d7761d73f3e64d285f3c8ab256d)

Executive Summary

PR #52 was automatically opened on 2026-09-08 by check-releases.yml to bump upstream package versions in versions.env:

• SERIALIZE_VERSION: 1.15.0 -> 1.16.0
• RELIABLE_VERSION: 1.4.0 -> 1.4.2
• NETCODE_VERSION: 1.4.3 -> 1.4.5
• YOJIMBO_VERSION: 1.10.1 -> 1.13.0
• SCHEMA_VERSION: 2.0.0 -> 2.5.0

This PR is unbuildable and superseded:

1. Broken Dependency Floor: Upstream mas-bandwidth/yojimbo v1.13.0's dependencies.manifest requires serialize >= 1.16.2. However, upstream serialize never published a v1.16.2 release (jumping directly from v1.16.0 to v1.17.0). Pairing yojimbo 1.13.0 with serialize 1.16.0 causes CMake configuration to fail across all 10 matrix build configurations.
2. Superseded: Upstream releases have advanced significantly since 2026-09-08 (serialize is at 1.17.0, reliable at 1.4.5, netcode at 1.4.8, yojimbo at 1.13.5). Subsequent automated daily runs have opened PRs up to PR Bump package versions to latest upstream releases #65 (bump-versions-20260921).

This PR should be closed in favor of the latest version bump PR once packaging rules are updated for newer upstream releases.

---

Detailed Verification Evidence

1. 3-Way Merge & Git Status

• Clean 3-way merge against origin/main (8ba166a51f3a0d7761d73f3e64d285f3c8ab256d).
• Command:

  git merge-tree --write-tree origin/main f1d7ed42befbbc55459c5fcf82fd84eaaa604db9

  Result tree: ae920b2baa46d3082962fdd52483075862d40d77 (exit code: 0).
• Diff verification: Strictly isolated to versions.env (+5 / -5 lines).

2. Stale Release Verification

Ran ./scripts/check-releases.sh at commit f1d7ed42befbbc55459c5fcf82fd84eaaa604db9:

• Output:

  serialize: pinned 1.16.0, latest 1.17.0
  reliable: pinned 1.4.2, latest 1.4.5
  netcode: pinned 1.4.5, latest 1.4.8
  yojimbo: pinned 1.13.0, latest 1.13.5
  

• Exit code: 1 (demonstrating that 4 of the 5 pinned packages are now superseded by newer upstream releases).

3. Negative Controls / Red-Tests

• Red-test (mismatched version): Mutated versions.env locally to SCHEMA_VERSION=99.99.99. ./scripts/check-releases.sh detected the mismatch, reported schema: pinned 99.99.99, latest 2.5.0, and exited with status 1.
• Green control: Applied ./scripts/check-releases.sh --update to pull live upstream releases (1.17.0, 1.4.5, 1.4.8, 1.13.5, 2.5.0). Re-running ./scripts/check-releases.sh reported all pinned versions are current and exited with status 0.

4. Remote CI Results & Failure Analysis

Examined remote GitHub Actions workflow runs for commit f1d7ed42befbbc55459c5fcf82fd84eaaa604db9 (branch bump-versions-20260908):

• Run 34210214511 (event: pull_request): action_required (external bot trigger).
• Run 34210211670 (event: workflow_dispatch on bump-versions-20260908):
  • autopkgtest-schema: Passed (1m3s).
  • All 10 matrix build jobs (Debian 12/13, Ubuntu 22.04/24.04/26.04 on amd64 and arm64) failed during scripts/build-all.sh:

    CMake Error at cmake/YojimboSystemDeps.cmake:19 (message):
      yojimbo: the installed serialize is 1.16.0, but yojimbo requires 1.16.2 or
      later (from /usr/include/serialize.h).  See dependencies.manifest.
    

• Root Cause:
  In mas-bandwidth/yojimbo v1.13.0, dependencies.manifest specified:

  serialize  1.16.2  v1.16.2  1.16.2
  reliable   1.4.2   v1.4.2   1.4.2
  netcode    1.4.5   v1.4.5   1.4.5
  

  scripts/build-all.sh builds and installs serialize first, then builds yojimbo with -DYOJIMBO_SYSTEM_DEPS=ON. Because serialize 1.16.0 was installed instead of the required >= 1.16.2, CMake aborted configuration with exit code 1.

---

Conclusion & Recommendation

Verdict is HOLD (Score: 2/10). PR #52 cannot be built as-is due to the conflicting serialize floor in yojimbo 1.13.0, and it has been fully superseded by subsequent daily bumps (up to PR #65). This PR can be safely closed without merging.

READ-COST: reader=Emma model=gemini-2.5-pro seconds=182 tokens=unknown plan=max