Bump package versions to latest upstream releases

[github-actions]

Automated bump from check-releases.yml. Merging rebuilds and republishes the apt repository.

[gafferongames]

Review of PR #61 (Bump package versions to latest upstream releases)

Score: 4/10
Verdict: HOLD
Head SHA: b87df09d569af554d70ca866fe5a786c073a368c (branch: bump-versions-20260917)
Base: origin/main (8ba166a51f3a0d7761d73f3e64d285f3c8ab256d)

---

Executive Summary

PR #61 is an automated version bump generated by check-releases.yml on 2026-09-17 updating pinned dependency versions in versions.env:

• SERIALIZE_VERSION: 1.15.0 -> 1.17.0
• RELIABLE_VERSION: 1.4.0 -> 1.4.5
• NETCODE_VERSION: 1.4.3 -> 1.4.8
• YOJIMBO_VERSION: 1.10.1 -> 1.13.5
• SCHEMA_VERSION: 2.0.0 -> 2.5.0

While the git 3-way merge is clean and all 5 upstream release tags are genuine, this PR cannot be merged because remote CI fails 100% across all 10 matrix build targets (Debian 12/13, Ubuntu 22.04/24.04/26.04 on amd64 and arm64). Upstream yojimbo 1.13.5 outputs built binaries to ${CMAKE_BINARY_DIR}/bin and wired native CTest, breaking packages/yojimbo/debian/rules which expects test binaries at $(CURDIR)/bin/test. Furthermore, this branch has been superseded by subsequent daily bumps (up through PR #65).

---

Detailed Verification Evidence

1. 3-Way Merge & Git Status

• Clean merge against origin/main:

  git merge-tree --write-tree origin/main b87df09d569af554d70ca866fe5a786c073a368c

  Result tree: b29a89813c730f307eb547db1f51834460e5bb6f (exit code: 0).
• Diff verification against origin/main: strictly isolated to versions.env (+5 / -5 lines).

2. Upstream Release Verification & check-releases.sh

• Verified release tags across upstream repositories:
  • mas-bandwidth/serialize: tag v1.17.0 (HTTP 200)
  • mas-bandwidth/reliable: tag v1.4.5 (HTTP 200)
  • mas-bandwidth/netcode: tag v1.4.8 (HTTP 200)
  • mas-bandwidth/yojimbo: tag v1.13.5 (HTTP 200)
  • mas-bandwidth/schema: tag v2.5.0 (HTTP 200)
• Ran ./scripts/check-releases.sh at commit b87df09d569af554d70ca866fe5a786c073a368c:
  • Output: all pinned versions are current
  • Exit code: 0.

3. Negative Controls / Red-Tests

• Script sensitivity test: Mutated versions.env locally to set SERIALIZE_VERSION=1.15.0. Ran ./scripts/check-releases.sh. It immediately detected the stale version, printed serialize: pinned 1.15.0, latest 1.17.0, and exited with status 1.
• HTTP 404 test: Queried non-existent release tag v99.99.99 via GitHub API; received HTTP 404 Not Found as expected.

4. Remote CI Build Analysis & Root Cause

• Workflow run 35205426681 (event: workflow_dispatch, head SHA b87df09d569af554d70ca866fe5a786c073a368c on branch bump-versions-20260917):
  • autopkgtest-schema: Passed.
  • All 10 container matrix builds failed during scripts/build-all.sh when compiling yojimbo:

    make[1]: Entering directory '/__w/apt/apt/build/yojimbo/yojimbo-1.13.5'
    make[1]: /__w/apt/apt/build/yojimbo/yojimbo-1.13.5/bin/test: No such file or directory
    /__w/apt/apt/build/yojimbo/yojimbo-1.13.5/bin/test
    make[1]: Leaving directory '/__w/apt/apt/build/yojimbo/yojimbo-1.13.5'
    make[1]: *** [debian/rules:20: override_dh_auto_test] Error 127
    dpkg-buildpackage: error: debian/rules binary subprocess returned exit status 2
    

• Root Cause:
  In packages/yojimbo/debian/rules:

  override_dh_auto_test:
  ifeq (,$(filter nocheck,$(DEB_BUILD_OPTIONS)))
  	$(CURDIR)/bin/test
  endif

  Upstream yojimbo 1.13.5 places output binaries into ${CMAKE_BINARY_DIR}/bin/ (e.g. obj-${DEB_HOST_GNU_TYPE}/bin/test) rather than the source directory root $(CURDIR)/bin/test.

---

Required Packaging Fix

Before any version bump containing yojimbo 1.13.5 can land:

1. Update packages/yojimbo/debian/rules to remove override_dh_auto_test (allowing standard dh_auto_test to drive CTest natively), mirroring packages/reliable/debian/rules.
2. Close or supersede PR Bump package versions to latest upstream releases #61 in favor of the latest daily bump (PR Bump package versions to latest upstream releases #65).

READ-COST: reader=Emma model=gemini-2.5-pro seconds=195 tokens=unknown plan=max