Bump package versions to latest upstream releases

[github-actions]

Automated bump from check-releases.yml. Merging rebuilds and republishes the apt repository.

[gafferongames]

Review of PR #65 (Bump package versions to latest upstream releases)

Score: 4/10
Verdict: HOLD
Head SHA: 0733e3b0552d177e0cd2ecd6d672b46d9ba97d62 (branch: bump-versions-20260921)
Base: origin/main (8ba166a51f3a0d7761d73f3e64d285f3c8ab256d)

Executive Summary

PR #65 was automatically generated by check-releases.yml to bump pinned dependency versions in versions.env:

• SERIALIZE_VERSION: 1.15.0 -> 1.17.0
• RELIABLE_VERSION: 1.4.0 -> 1.4.5
• NETCODE_VERSION: 1.4.3 -> 1.4.8
• YOJIMBO_VERSION: 1.10.1 -> 1.13.5
• SCHEMA_VERSION: 2.0.0 -> 2.5.0

While all 5 upstream releases are valid and exist on GitHub, this PR fails CI across all 10 matrix build configurations (Debian 12/13, Ubuntu 22.04/24.04/26.04 on amd64 and arm64). Upstream yojimbo 1.13.5 changed its runtime output directory to ${CMAKE_BINARY_DIR}/bin and wired native CTest, breaking packages/yojimbo/debian/rules which expects test binaries at $(CURDIR)/bin/test.

A packaging fix in packages/yojimbo/debian/rules is required before this bump can be merged.

---

Detailed Verification Evidence

1. 3-Way Merge & Git Status

• Clean merge against origin/main.
• Command:

  git merge-tree --write-tree origin/main 0733e3b0552d177e0cd2ecd6d672b46d9ba97d62

  Result tree: b29a89813c730f307eb547db1f51834460e5bb6f (exit code: 0).
• Diff verification: Strictly isolated to versions.env (+5 / -5 lines).

2. Upstream Release & Manifest Verification

Verified the latest releases and tarballs for all 5 repositories:

• mas-bandwidth/serialize: tag v1.17.0 (HTTP 200)
• mas-bandwidth/reliable: tag v1.4.5 (HTTP 200)
• mas-bandwidth/netcode: tag v1.4.8 (HTTP 200)
• mas-bandwidth/yojimbo: tag v1.13.5 (HTTP 200)
• mas-bandwidth/schema: tag v2.5.0 (HTTP 200)

Ran ./scripts/check-releases.sh at commit 0733e3b0552d177e0cd2ecd6d672b46d9ba97d62:

• Output: all pinned versions are current
• Exit code: 0

3. Negative Controls / Red-Tests

• Script sensitivity test: Mutated versions.env locally with outdated version SERIALIZE_VERSION=1.15.0. ./scripts/check-releases.sh caught the mismatch, reported serialize: pinned 1.15.0, latest 1.17.0, and exited with status 1.
• HTTP 404 control: Verified requesting non-existent release tarball tag v99.99.99 returns HTTP 404.

4. CI Build Failure & Root Cause Analysis

In GitHub Actions workflow run 35584101703 (triggered for branch bump-versions-20260921):

• autopkgtest-schema: Succeeded (1m11s).
• All 10 matrix build jobs failed during scripts/build-all.sh when building yojimbo:

  debian/rules override_dh_auto_test
  make[1]: /__w/apt/apt/build/yojimbo/yojimbo-1.13.5/bin/test: No such file or directory
  make[1]: *** [debian/rules:20: override_dh_auto_test] Error 127
  dpkg-buildpackage: error: debian/rules binary subprocess returned exit status 2
  

• Root Cause:
  In packages/yojimbo/debian/rules:

  override_dh_auto_test:
  ifeq (,$(filter nocheck,$(DEB_BUILD_OPTIONS)))
  	$(CURDIR)/bin/test
  endif

  Upstream yojimbo 1.13.5 outputs built binaries to ${CMAKE_BINARY_DIR}/bin (e.g. obj-${DEB_HOST_GNU_TYPE}/bin/test) rather than $(CURDIR)/bin/test, and enabled CTest (enable_testing() / add_test(NAME yojimbo_test ...)). Because $(CURDIR)/bin/test no longer exists, the test step fails.

---

Required Fix

To land this version bump:

1. Update packages/yojimbo/debian/rules to remove override_dh_auto_test (allowing default dh_auto_test to drive CTest), consistent with packages/reliable/debian/rules.
2. Re-run CI build to verify all 10 matrix targets compile and pass tests.

READ-COST: reader=Emma model=gemini-2.5-pro seconds=137 tokens=unknown plan=max