Bump package versions to latest upstream releases

[github-actions]

Automated bump from check-releases.yml. Merging rebuilds and republishes the apt repository.

[gafferongames]

Review for PR #57 (mas-bandwidth/apt)

• Head SHA: d1a4722349bfd063191e6cbf5206840e5eaf8e4e
• Branch: bump-versions-20260913
• Base: origin/main
• Verdict: CHANGES REQUESTED (HOLD / DO NOT MERGE)
• Score: 3/10

---

Executive Summary

PR #57 attempts to bump pinned library versions in versions.env. While the git 3-way merge is clean and the file formatting is correct, this PR fails CI completely across all 10 distro/architecture matrix builds and is superseded by later releases.

The build failure is caused by an upstream CMake build layout change in Yojimbo 1.13.1 that breaks Debian packaging in packages/yojimbo/debian/rules. Furthermore, this PR was opened on 2026-09-13 and has been superseded by subsequent daily bumps up to PR #65.

---

Verification Evidence

1. 3-Way Merge Check

• Ran: git merge-tree --write-tree origin/main d1a4722349bfd063191e6cbf5206840e5eaf8e4e
• Result: Clean merge (exit code 0), tree SHA 23f220c034d90aeed306ebfdcf18470fd04a1871.

2. Diff Inspection (versions.env)

-SERIALIZE_VERSION=1.15.0
-RELIABLE_VERSION=1.4.0
-NETCODE_VERSION=1.4.3
-YOJIMBO_VERSION=1.10.1
-SCHEMA_VERSION=2.0.0
+SERIALIZE_VERSION=1.17.0
+RELIABLE_VERSION=1.4.3
+NETCODE_VERSION=1.4.6
+YOJIMBO_VERSION=1.13.1
+SCHEMA_VERSION=2.5.0

3. Script Execution (./scripts/check-releases.sh)

• Ran ./scripts/check-releases.sh against commit d1a4722349bfd063191e6cbf5206840e5eaf8e4e.
• Result: Exited with code 1. Pinned versions in this PR are already out of date relative to current upstream releases:
  • reliable: pinned 1.4.3, latest upstream is 1.4.5
  • netcode: pinned 1.4.6, latest upstream is 1.4.8
  • yojimbo: pinned 1.13.1, latest upstream is 1.13.5
  • serialize: pinned 1.17.0 (current)
  • schema: pinned 2.5.0 (current)
• Successive daily automated bump PRs have already been opened up through PR Bump package versions to latest upstream releases #65 (bump-versions-20260921).

4. Sensitivity & Negative Control Verification

• Green verification: Ran ./scripts/check-releases.sh --update. Versions updated to current latest releases, followed by re-running ./scripts/check-releases.sh which exited 0 with message "all pinned versions are current".
• Red test / Negative control: Mutated SERIALIZE_VERSION=0.0.1. Script exited 1 and correctly reported serialize: pinned 0.0.1, latest 1.17.0. Sensitivity verified.

5. CI Build Failure & Root Cause Analysis

• Inspected remote GitHub Actions run 34750439980 on branch bump-versions-20260913.
• Status: Failed across all 10 container matrix jobs:
  • debian:12 (amd64, arm64)
  • debian:13 (amd64, arm64)
  • ubuntu:22.04 (amd64, arm64)
  • ubuntu:24.04 (amd64, arm64)
  • ubuntu:26.04 (amd64, arm64)
• Failure point: build all packages fails when building yojimbo_1.13.1-1:

  debian/rules override_dh_auto_test
  make[1]: /__w/apt/apt/build/yojimbo/yojimbo-1.13.1/bin/test: No such file or directory
  make[1]: *** [debian/rules:20: override_dh_auto_test] Error 127
  make: *** [debian/rules:7: binary] Error 2
  dpkg-buildpackage: error: debian/rules binary subprocess returned exit status 2
  

• Root Cause:
  In packages/yojimbo/debian/rules:

  override_dh_auto_test:
  ifeq (,$(filter nocheck,$(DEB_BUILD_OPTIONS)))
  	$(CURDIR)/bin/test
  endif

  In upstream yojimbo 1.10.1, CMakeLists.txt set CMAKE_RUNTIME_OUTPUT_DIRECTORY to ${CMAKE_CURRENT_SOURCE_DIR}/bin.
  In upstream yojimbo 1.13.1, CMakeLists.txt (lines 72–76) changed CMAKE_RUNTIME_OUTPUT_DIRECTORY to ${CMAKE_BINARY_DIR}/bin and wired up CTest.
  Because debhelper performs an out-of-source CMake build in obj-<triplet>, the test executable is placed in <builddir>/bin/test rather than $(CURDIR)/bin/test. Thus $(CURDIR)/bin/test does not exist and the build fails.

---

Action Items / Recommendations

1. Update packages/yojimbo/debian/rules to either use dh_auto_test (or run CTest / reference the build directory test binary) to accommodate upstream CMake output directory changes.
2. Close or supersede PR Bump package versions to latest upstream releases #57 in favor of PR Bump package versions to latest upstream releases #65 (or subsequent daily bump) once the packaging rule fix lands.

READ-COST: reader=Emma model=gemini-2.5-pro seconds=149 tokens=unknown plan=max