Bump package versions to latest upstream releases

[github-actions]

Automated bump from check-releases.yml. Merging rebuilds and republishes the apt repository.

[gafferongames]

Review of PR #63: Bump package versions to latest upstream releases

Head SHA: 13266496fc8ef9f9ef0a5d469dc7c9fff3ac3af2
Verdict: HOLD
Score: 5/10

---

Summary

PR #63 is an automated bump generated by check-releases.yml updating versions.env to the latest upstream release tags across all five pinned packages:

• SERIALIZE_VERSION: 1.15.0 -> 1.17.0
• RELIABLE_VERSION: 1.4.0 -> 1.4.5
• NETCODE_VERSION: 1.4.3 -> 1.4.8
• YOJIMBO_VERSION: 1.10.1 -> 1.13.5
• SCHEMA_VERSION: 2.0.0 -> 2.5.0

While check-releases.sh correctly verifies that these tags represent the latest upstream releases, this PR cannot be merged as-is because it breaks CI and packaging builds across all supported distribution targets. Specifically, upstream changes in yojimbo 1.13.5 break debian packaging in packages/yojimbo/debian/rules (and official/yojimbo/debian/rules).

---

Verification Evidence

1. 3-Way Merge Simulation

Tested merge against origin/main using git merge-tree:

git merge-tree --write-tree origin/main 13266496fc8ef9f9ef0a5d469dc7c9fff3ac3af2
# Output tree: b29a89813c730f307eb547db1f51834460e5bb6f (Exit code 0)

Merge is structurally clean with zero git conflicts against current main.

2. Upstream Release Verification (check-releases.sh)

Ran ./scripts/check-releases.sh in an isolated scratch worktree tracking commit 13266496fc8ef9f9ef0a5d469dc7c9fff3ac3af2:

all pinned versions are current
(Exit code 0)

3. Negative Controls / Red-Testing

Verified sensitivity of ./scripts/check-releases.sh:

• Test 1 (Single stale dependency): Mutated YOJIMBO_VERSION=1.10.1 in versions.env. Script reported:

  yojimbo: pinned 1.10.1, latest 1.13.5
  (Exit code 1)
  

• Test 2 (Multiple stale dependencies): Mutated both YOJIMBO_VERSION=1.10.1 and SCHEMA_VERSION=2.0.0. Script accurately detected both out-of-date entries and exited with code 1.
• Test 3 (--update flag): Verified that running ./scripts/check-releases.sh --update against the mutated versions.env successfully queried GitHub API and restored YOJIMBO_VERSION=1.13.5.

4. Remote CI Results & Build Implications

Inspection of GitHub Actions runs for commit 13266496fc8ef9f9ef0a5d469dc7c9fff3ac3af2:

• build workflow run 35434652308 was triggered via workflow_dispatch on branch bump-versions-20260919 (commit 13266496fc8ef9f9ef0a5d469dc7c9fff3ac3af2).
• All 10 distro/arch matrix targets failed (ubuntu:22.04, ubuntu:24.04, ubuntu:26.04, debian:12, debian:13 on both amd64 and arm64).

Root Cause Analysis:
In yojimbo 1.13.5, upstream relocated build artifacts under ${CMAKE_BINARY_DIR}/bin and integrated CTest support (commit note YJ-06):

set(CMAKE_RUNTIME_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}/bin")
enable_testing()
add_test(NAME yojimbo_test COMMAND yojimbo_test)

However, packages/yojimbo/debian/rules (and official/yojimbo/debian/rules) currently specifies:

override_dh_auto_test:
ifeq (,$(filter nocheck,$(DEB_BUILD_OPTIONS)))
	$(CURDIR)/bin/test
endif

Because debhelper builds out-of-tree (e.g. in obj-<triplet>), $(CURDIR)/bin/test does not exist, causing every build job to fail with:

make[1]: /__w/apt/apt/build/yojimbo/yojimbo-1.13.5/bin/test: No such file or directory
make[1]: *** [debian/rules:20: override_dh_auto_test] Error 127

---

Recommendation & Required Changes

Do not merge PR #63 until packaging rules are updated:

1. Update packages/yojimbo/debian/rules and official/yojimbo/debian/rules to either remove the override_dh_auto_test block entirely (letting default dh_auto_test execute the upstream CTest suite, consistent with packages/reliable/debian/rules) or point directly to the binary in the build directory.
2. Verify that build.yml and official.yml pass with the updated debian rules before merging.

READ-COST: reader=Emma model=gemini-2.5-pro seconds=168 tokens=unknown plan=max