loki-mode 10.1.1 → 10.2.2

package/docs/v10/DEPS.md

@@ -0,0 +1,436 @@
+# Dependency Inventory (D35 DEP-01)
+
+Generated by `scripts/dep-inventory.py`. Lookup date: 2026-09-28.
+
+Inventory only. No dependency, lockfile, workflow or image was changed to produce this report. Manifests are discovered with `git ls-files`, never a filesystem walk. Network lookups are cached under the `--cache` directory so re-running against the same cache is byte-identical.
+
+## npm / bun
+
+| File | Name | Current | Latest stable | Bump | Note |
+|---|---|---|---|---|---|
+| `dashboard-ui/package.json` | `@playwright/test` | `^1.58.1` | `1.63.0` | minor |  |
+| `dashboard-ui/package.json` | `esbuild` | `^0.24.0` | `0.28.2` | 0.x breaking |  |
+| `dashboard-ui/package.json` | `jest` | `^29.7.0` | `30.5.2` | MAJOR |  |
+| `dashboard-ui/package.json` | `jest-environment-jsdom` | `^29.7.0` | `30.5.2` | MAJOR |  |
+| `dashboard-ui/package.json` | `jsdom` | `^24.0.0` | `30.1.1` | MAJOR |  |
+| `loki-ts/package.json` | `@anthropic-ai/claude-agent-sdk` | `0.3.283` | `0.3.283` | up-to-date |  |
+| `loki-ts/package.json` | `@anthropic-ai/sdk` | `^0.124.0` | `0.128.0` | 0.x breaking |  |
+| `loki-ts/package.json` | `@resvg/resvg-wasm` | `^2.6.2` | `2.6.2` | up-to-date |  |
+| `loki-ts/package.json` | `@types/bun` | `latest` | `1.4.2` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
+| `loki-ts/package.json` | `typescript` | `^5.6.0` | `7.0.2` | MAJOR |  |
+| `loki-ts/tests/engine10/fixtures/testmap/package.json` | `vitest` | `^2.0.0` | `5.0.2` | MAJOR | test fixture, not a real dependency |
+| `package.json` | `@resvg/resvg-wasm` | `^2.6.2` | `2.6.2` | up-to-date |  |
+| `package.json` | `@types/node` | `^25.2.0` | `26.6.3` | MAJOR |  |
+| `package.json` | `jest` | `^29.7.0` | `30.5.2` | MAJOR |  |
+| `package.json` | `jsdom` | `^24.0.0` | `30.1.1` | MAJOR |  |
+| `package.json` | `typescript` | `^5.9.3` | `7.0.2` | MAJOR |  |
+| `sdk/typescript/package.json` | `typescript` | `^5.9.3` | `7.0.2` | MAJOR |  |
+| `vscode-extension/package.json` | `@types/node` | `^20.10.0` | `26.6.3` | MAJOR |  |
+| `vscode-extension/package.json` | `@types/vscode` | `^1.85.0` | `1.138.0` | minor |  |
+| `vscode-extension/package.json` | `@typescript-eslint/eslint-plugin` | `^6.13.0` | `8.70.1` | MAJOR |  |
+| `vscode-extension/package.json` | `@typescript-eslint/parser` | `^6.13.0` | `8.70.1` | MAJOR |  |
+| `vscode-extension/package.json` | `@vscode/vsce` | `^2.22.0` | `4.0.0` | MAJOR |  |
+| `vscode-extension/package.json` | `esbuild` | `^0.19.8` | `0.28.2` | 0.x breaking |  |
+| `vscode-extension/package.json` | `eslint` | `^8.55.0` | `10.11.0` | MAJOR |  |
+| `vscode-extension/package.json` | `typescript` | `^5.3.2` | `7.0.2` | MAJOR |  |
+| `web-app/package.json` | `@monaco-editor/react` | `^4.7.0` | `4.7.0` | up-to-date |  |
+| `web-app/package.json` | `@xterm/addon-fit` | `^0.11.0` | `0.11.0` | up-to-date |  |
+| `web-app/package.json` | `@xterm/addon-web-links` | `^0.12.0` | `0.12.0` | up-to-date |  |
+| `web-app/package.json` | `@xterm/xterm` | `^6.0.0` | `6.0.0` | up-to-date |  |
+| `web-app/package.json` | `lucide-react` | `^0.577.0` | `1.48.0` | MAJOR |  |
+| `web-app/package.json` | `react` | `^19.0.0` | `19.3.0` | minor |  |
+| `web-app/package.json` | `react-dom` | `^19.0.0` | `19.3.0` | minor |  |
+| `web-app/package.json` | `react-resizable-panels` | `^4.7.3` | `4.14.1` | minor |  |
+| `web-app/package.json` | `react-router-dom` | `^7.13.1` | `7.18.4` | minor |  |
+| `web-app/package.json` | `@eslint/js` | `^9.21.0` | `10.0.1` | MAJOR |  |
+| `web-app/package.json` | `@playwright/test` | `^1.58.2` | `1.63.0` | minor |  |
+| `web-app/package.json` | `@types/react` | `^19.0.10` | `19.3.0` | minor |  |
+| `web-app/package.json` | `@types/react-dom` | `^19.0.4` | `19.3.0` | minor |  |
+| `web-app/package.json` | `@vitejs/plugin-react` | `^4.3.4` | `6.1.1` | MAJOR |  |
+| `web-app/package.json` | `autoprefixer` | `^10.4.20` | `10.6.1` | minor |  |
+| `web-app/package.json` | `eslint` | `^9.21.0` | `10.11.0` | MAJOR |  |
+| `web-app/package.json` | `eslint-plugin-react-hooks` | `^5.1.0` | `7.1.1` | MAJOR |  |
+| `web-app/package.json` | `eslint-plugin-react-refresh` | `^0.4.19` | `0.5.7` | 0.x breaking |  |
+| `web-app/package.json` | `globals` | `^15.15.0` | `17.12.0` | MAJOR |  |
+| `web-app/package.json` | `postcss` | `^8.5.3` | `8.5.28` | patch |  |
+| `web-app/package.json` | `tailwindcss` | `^3.4.17` | `4.3.3` | MAJOR |  |
+| `web-app/package.json` | `typescript` | `~5.7.2` | `7.0.2` | MAJOR |  |
+| `web-app/package.json` | `typescript-eslint` | `^8.24.1` | `8.70.1` | minor |  |
+| `web-app/package.json` | `vite` | `^6.2.0` | `8.3.1` | MAJOR |  |
+
+## Python (requirements*.txt)
+
+| File | Name | Current | Latest stable | Bump | Note |
+|---|---|---|---|---|---|
+| `dashboard/requirements.txt` | `fastapi` | `>=0.100.0,<1.0.0` | `0.141.1` | 0.x breaking |  |
+| `dashboard/requirements.txt` | `uvicorn` | `>=0.20.0,<1.0.0` | `0.54.0` | 0.x breaking |  |
+| `dashboard/requirements.txt` | `sqlalchemy` | `>=2.0.0,<3.0.0` | `2.1.1` | minor |  |
+| `dashboard/requirements.txt` | `aiosqlite` | `>=0.19.0,<1.0.0` | `0.22.1` | 0.x breaking |  |
+| `dashboard/requirements.txt` | `greenlet` | `>=3.0.0,<4.0.0` | `3.5.6` | minor |  |
+| `dashboard/requirements.txt` | `pydantic` | `>=2.0.0,<3.0.0` | `2.13.5` | minor |  |
+| `dashboard/requirements.txt` | `websockets` | `>=12.0,<16.0` | `17.1` | MAJOR |  |
+| `mcp/requirements.txt` | `mcp` | `>=1.0.0,<2.0.0` | `2.2.0` | MAJOR |  |
+| `mcp/requirements.txt` | `chromadb` | `>=1.0.0,<2.0.0` | `1.5.9` | minor |  |
+| `mcp/requirements.txt` | `anthropic` | `>=0.40,<1.0.0` | `1.8.0` | MAJOR |  |
+| `requirements-test.txt` | `pytest` | `(unpinned)` | `9.1.1` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
+| `requirements-test.txt` | `pytest-asyncio` | `(unpinned)` | `1.4.0` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
+| `requirements-test.txt` | `pytest-xdist` | `(unpinned)` | `3.8.0` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
+| `requirements-test.txt` | `mcp` | `>=1.0.0,<2.0.0` | `2.2.0` | MAJOR |  |
+| `requirements-test.txt` | `pydantic` | `(unpinned)` | `2.13.5` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
+| `requirements-test.txt` | `fastapi` | `(unpinned)` | `0.141.1` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
+| `requirements-test.txt` | `uvicorn` | `(unpinned)` | `0.54.0` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
+| `requirements-test.txt` | `httpx` | `(unpinned)` | `0.28.1` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
+| `requirements-test.txt` | `sqlalchemy` | `(unpinned)` | `2.1.1` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
+| `requirements-test.txt` | `aiosqlite` | `(unpinned)` | `0.22.1` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
+| `requirements-test.txt` | `cryptography` | `>=41.0.0` | `50.0.1` | MAJOR |  |
+| `requirements-test.txt` | `pyyaml` | `(unpinned)` | `6.0.3` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
+| `tests/fixtures/legacy-checkout-app/requirements.txt` | `flask` | `==3.0.0` | `3.1.3` | minor | test fixture, not a real dependency |
+| `tests/fixtures/legacy-checkout-app/requirements.txt` | `stripe` | `==7.0.0` | `15.6.1` | MAJOR | test fixture, not a real dependency |
+| `web-app/requirements-test.txt` | `pytest` | `>=7.4.0` | `9.1.1` | MAJOR |  |
+| `web-app/requirements-test.txt` | `pytest-asyncio` | `>=0.21.0` | `1.4.0` | MAJOR |  |
+| `web-app/requirements-test.txt` | `httpx` | `>=0.24.0` | `0.28.1` | 0.x breaking |  |
+| `web-app/requirements.txt` | `fastapi` | `>=0.100.0` | `0.141.1` | 0.x breaking |  |
+| `web-app/requirements.txt` | `uvicorn` | `>=0.20.0` | `0.54.0` | 0.x breaking |  |
+| `web-app/requirements.txt` | `pydantic` | `>=2.0.0` | `2.13.5` | minor |  |
+| `web-app/requirements.txt` | `httpx` | `>=0.24.0` | `0.28.1` | 0.x breaking |  |
+| `web-app/requirements.txt` | `python-multipart` | `>=0.0.9` | `0.0.32` | 0.x breaking |  |
+| `web-app/requirements.txt` | `pexpect` | `>=4.8.0` | `4.9.0` | minor |  |
+| `web-app/requirements.txt` | `watchdog` | `>=3.0.0` | `6.0.0` | MAJOR |  |
+| `web-app/requirements.txt` | `sqlalchemy` | `>=2.0.0` | `2.1.1` | minor |  |
+| `web-app/requirements.txt` | `asyncpg` | `>=0.28.0` | `0.31.0` | 0.x breaking |  |
+| `web-app/requirements.txt` | `aiosqlite` | `>=0.19.0` | `0.22.1` | 0.x breaking |  |
+| `web-app/requirements.txt` | `alembic` | `>=1.12.0` | `1.20.0` | minor |  |
+| `web-app/requirements.txt` | `python-jose` | `>=3.3.0` | `3.5.0` | minor |  |
+| `web-app/requirements.txt` | `passlib` | `>=1.7.4` | `1.7.4` | up-to-date |  |
+| `web-app/requirements.txt` | `cryptography` | `>=41.0.0` | `50.0.1` | MAJOR |  |
+| `web-app/requirements.txt` | `pyyaml` | `>=6.0` | `6.0.3` | patch |  |
+
+## Python (pyproject.toml)
+
+| File | Name | Current | Latest stable | Bump | Note |
+|---|---|---|---|---|---|
+| `loki-ts/tests/engine10/fixtures/testmap/pyproject.toml` | `(none declared)` | `` | `-` | n/a | test fixture, not a real dependency |
+| `loki-ts/tests/engine10/modernize/fixtures/inv/sample-repo/pyproject.toml` | `(none declared)` | `` | `-` | n/a | test fixture, not a real dependency |
+| `sdk/python/pyproject.toml` | `httpx` | `>=0.24.0` | `0.28.1` | 0.x breaking |  |
+| `sdk/python/pyproject.toml` | `pydantic` | `>=2.0.0` | `2.13.5` | minor |  |
+| `sdk/python/pyproject.toml` | `setuptools` | `>=68.0` | `84.0.0` | MAJOR |  |
+| `sdk/python/pyproject.toml` | `wheel` | `(unpinned)` | `0.48.0` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
+
+## GitHub Actions (`uses:`)
+
+| File | Name | Current | Latest stable | Bump | Note |
+|---|---|---|---|---|---|
+| `.github/workflows/arm64-runtime.yml` | `docker/setup-qemu-action@v3` | `v3 (resolves to v3.7.0)` | `v4.4.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v3 resolves to v3.7.0 (commit c7c53464625b), behind latest release v4.4.0 (commit 990126619549); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/bun-parity.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/bun-parity.yml` | `oven-sh/setup-bun@v2` | `v2 (resolves to v2.2.0)` | `v2.2.0` | up-to-date | tag-pinned (not SHA-pinned); floating tag v2 resolves to v2.2.0, which IS the latest release -- tracks latest within that major |
+| `.github/workflows/bun-parity.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/check-phase6-ready.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/check-phase6-ready.yml` | `oven-sh/setup-bun@v2` | `v2 (resolves to v2.2.0)` | `v2.2.0` | up-to-date | tag-pinned (not SHA-pinned); floating tag v2 resolves to v2.2.0, which IS the latest release -- tracks latest within that major |
+| `.github/workflows/check-phase6-ready.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/cla.yml` | `contributor-assistant/github-action@v2.6.1` | `v2.6.1` | `v2.6.1` | up-to-date | tag-pinned (not SHA-pinned); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/claude-code-review.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/claude-code-review.yml` | `anthropics/claude-code-action@v1` | `v1 (resolves to v1)` | `v1` | up-to-date | tag-pinned (not SHA-pinned); floating tag v1 resolves to v1, which IS the latest release -- tracks latest within that major |
+| `.github/workflows/coverage.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/coverage.yml` | `oven-sh/setup-bun@v2` | `v2 (resolves to v2.2.0)` | `v2.2.0` | up-to-date | tag-pinned (not SHA-pinned); floating tag v2 resolves to v2.2.0, which IS the latest release -- tracks latest within that major |
+| `.github/workflows/coverage.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/integrity-audit.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/integrity-audit.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/integrity-audit.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/integrity-audit.yml` | `azure/setup-helm@v4` | `v4 (resolves to v4.3.1)` | `v5.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.3.1 (commit 1a275c3b6953), behind latest release v5.0.1 (commit 9bc31f4ebc9c); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/loki-ci-example.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/loki-ci-example.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/loki-ci-example.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/loki-enterprise.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/loki-enterprise.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/loki-enterprise.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/loki-enterprise.yml` | `actions/download-artifact@v4` | `v4 (resolves to v4.3.0)` | `v8.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.3.0 (commit d3f86a106a0b), behind latest release v8.0.1 (commit 3e5f45b2cfb9); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/loki-issue-to-pr.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/loki-issue-to-pr.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/loki-issue-to-pr.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/loki-issue-to-pr.yml` | `actions/download-artifact@v4` | `v4 (resolves to v4.3.0)` | `v8.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.3.0 (commit d3f86a106a0b), behind latest release v8.0.1 (commit 3e5f45b2cfb9); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/model-catalog-probe.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/model-catalog-probe.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/mutation-testing.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/mutation-testing.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/mutation-testing.yml` | `oven-sh/setup-bun@v2` | `v2 (resolves to v2.2.0)` | `v2.2.0` | up-to-date | tag-pinned (not SHA-pinned); floating tag v2 resolves to v2.2.0, which IS the latest release -- tracks latest within that major |
+| `.github/workflows/mutation-testing.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/nightly.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/nightly.yml` | `oven-sh/setup-bun@v2` | `v2 (resolves to v2.2.0)` | `v2.2.0` | up-to-date | tag-pinned (not SHA-pinned); floating tag v2 resolves to v2.2.0, which IS the latest release -- tracks latest within that major |
+| `.github/workflows/nightly.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/nightly.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/parity-drift.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/parity-drift.yml` | `oven-sh/setup-bun@v2` | `v2 (resolves to v2.2.0)` | `v2.2.0` | up-to-date | tag-pinned (not SHA-pinned); floating tag v2 resolves to v2.2.0, which IS the latest release -- tracks latest within that major |
+| `.github/workflows/parity-drift.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/parity-drift.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/post-release-smoke.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/post-release-smoke.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/post-release-smoke.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/provenance.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/provenance.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/provenance.yml` | `oven-sh/setup-bun@v2` | `v2 (resolves to v2.2.0)` | `v2.2.0` | up-to-date | tag-pinned (not SHA-pinned); floating tag v2 resolves to v2.2.0, which IS the latest release -- tracks latest within that major |
+| `.github/workflows/provenance.yml` | `sigstore/cosign-installer@v3` | `v3 (resolves to v3.9.1)` | `v4.1.2` | MAJOR | tag-pinned (not SHA-pinned); floating tag v3 resolves to v3.9.1 (commit 398d4b0eeef1), behind latest release v4.1.2 (commit 6f9f17788090) |
+| `.github/workflows/provenance.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/provenance.yml` | `docker/login-action@v3` | `v3 (resolves to v3.7.0)` | `v4.6.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v3 resolves to v3.7.0 (commit c94ce9fb4685), behind latest release v4.6.0 (commit dbcb813823bd); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/release.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/release.yml` | `oven-sh/setup-bun@v2` | `v2 (resolves to v2.2.0)` | `v2.2.0` | up-to-date | tag-pinned (not SHA-pinned); floating tag v2 resolves to v2.2.0, which IS the latest release -- tracks latest within that major |
+| `.github/workflows/release.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/release.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/release.yml` | `docker/setup-buildx-action@v3` | `v3 (resolves to v3.12.0)` | `v4.4.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v3 resolves to v3.12.0 (commit 8d2750c68a42), behind latest release v4.4.1 (commit f87e5991a6d7); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/release.yml` | `docker/login-action@v3` | `v3 (resolves to v3.7.0)` | `v4.6.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v3 resolves to v3.7.0 (commit c94ce9fb4685), behind latest release v4.6.0 (commit dbcb813823bd); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/release.yml` | `docker/build-push-action@v5` | `v5 (resolves to v5.4.0)` | `v7.4.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.4.0 (commit ca052bb54ab0), behind latest release v7.4.0 (commit c3c9e263c25d); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/release.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/release.yml` | `actions/download-artifact@v4` | `v4 (resolves to v4.3.0)` | `v8.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.3.0 (commit d3f86a106a0b), behind latest release v8.0.1 (commit 3e5f45b2cfb9); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/release.yml` | `sigstore/cosign-installer@v3` | `v3 (resolves to v3.9.1)` | `v4.1.2` | MAJOR | tag-pinned (not SHA-pinned); floating tag v3 resolves to v3.9.1 (commit 398d4b0eeef1), behind latest release v4.1.2 (commit 6f9f17788090) |
+| `.github/workflows/release.yml` | `anchore/sbom-action@v0` | `v0 (resolves to v0.24.0)` | `v0.24.2` | patch | tag-pinned (not SHA-pinned); floating tag v0 resolves to v0.24.0 (commit e22c38990414), behind latest release v0.24.2 (commit 3ad7283483fc) |
+| `.github/workflows/release.yml` | `peter-evans/dockerhub-description@v4` | `v4 (resolves to v4.0.2)` | `v5.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.0.2 (commit 432a30c9e074), behind latest release v5.0.0 (commit 1b9a80c056b6); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/sbom.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/sbom.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/sbom.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/security-audit.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/security-audit.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/security-audit.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/security-audit.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/security-audit.yml` | `actions/checkout@11d5960a326750d5838078e36cf38b85af677262` | `11d5960a326750d5838078e36cf38b85af677262  # v4` | `v7.0.1` | MAJOR | SHA-pinned; action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/security-audit.yml` | `actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02` | `ea165f8d65b6e75b540449e92b4886f43607fa02  # v4` | `v7.0.1` | MAJOR | SHA-pinned; action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/security-audit.yml` | `github/codeql-action/init@f3712979fa5f215279b101dd0a2e3bdfb4353324` | `f3712979fa5f215279b101dd0a2e3bdfb4353324` | `codeql-bundle-v2.27.1` | unknown | SHA-pinned, no version comment; latest release is codeql-bundle-v2.27.1; action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/security-audit.yml` | `github/codeql-action/analyze@f3712979fa5f215279b101dd0a2e3bdfb4353324` | `f3712979fa5f215279b101dd0a2e3bdfb4353324` | `codeql-bundle-v2.27.1` | unknown | SHA-pinned, no version comment; latest release is codeql-bundle-v2.27.1; action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/security-audit.yml` | `oven-sh/setup-bun@v2` | `v2 (resolves to v2.2.0)` | `v2.2.0` | up-to-date | tag-pinned (not SHA-pinned); floating tag v2 resolves to v2.2.0, which IS the latest release -- tracks latest within that major |
+| `.github/workflows/sentrux-real.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/sentrux-real.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/sentrux-real.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/soak-monitor.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/soak-monitor.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/test.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/test.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/test.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/test.yml` | `oven-sh/setup-bun@v2` | `v2 (resolves to v2.2.0)` | `v2.2.0` | up-to-date | tag-pinned (not SHA-pinned); floating tag v2 resolves to v2.2.0, which IS the latest release -- tracks latest within that major |
+| `.github/workflows/test.yml` | `actions/cache@v4` | `v4 (resolves to v4.3.0)` | `v6.1.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.3.0 (commit 0057852bfaa8), behind latest release v6.1.0 (commit 55cc8345863c); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/test.yml` | `azure/setup-helm@v4` | `v4 (resolves to v4.3.1)` | `v5.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.3.1 (commit 1a275c3b6953), behind latest release v5.0.1 (commit 9bc31f4ebc9c); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/tier-a.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/tier-a.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/tier-a.yml` | `oven-sh/setup-bun@v2` | `v2 (resolves to v2.2.0)` | `v2.2.0` | up-to-date | tag-pinned (not SHA-pinned); floating tag v2 resolves to v2.2.0, which IS the latest release -- tracks latest within that major |
+| `.github/workflows/tier-a.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `action.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/actions/issue-to-pr/action.yml` | `(none found)` | `` | `-` | n/a | no `uses:` step found in this workflow/action file |
+| `.github/actions/review/action.yml` | `(none found)` | `` | `-` | n/a | no `uses:` step found in this workflow/action file |
+
+**Node 20 runtime deprecation:** GitHub's own Node 20 deprecation covers two distinct things and they must not be conflated. First, matrix jobs still targeting `node-version: 20` (files: .github/workflows/test.yml). Second, and separately: an action whose OWN `action.yml` declares `using: node20` IS the deprecated runtime itself, regardless of what version tag or SHA it is pinned to -- pinning to the latest release of such an action does not fix this until that action's maintainers migrate its action.yml to node22 or later. Every `uses:` target in this repo's workflows was checked at its pinned ref via the GitHub Contents API; action.yml itself declares node20 for: actions/cache, actions/checkout, actions/download-artifact, actions/setup-node, actions/setup-python, actions/upload-artifact, azure/setup-helm, contributor-assistant/github-action, docker/build-push-action, docker/login-action, docker/setup-buildx-action, docker/setup-qemu-action, github/codeql-action/analyze, github/codeql-action/init, peter-evans/dockerhub-description.
+
+## Runtime matrices
+
+Node.js current stable: 26.10.0 (cycle 26); Python current stable: 3.14.7 (cycle 3.14); Bun current stable: bun-v1.4.2.
+
+(The File column lists every workflow file pinning that version.)
+
+| File | Name | Current | Latest stable | Bump | Note |
+|---|---|---|---|---|---|
+| `.github/workflows/test.yml` | `Node.js` | `20` | `20.20.2 (newest line 26.10.0)` | EOL | EOL 2026-04-30 (past); EOL in current line; newest line is 26.10.0 |
+| `.github/workflows/integrity-audit.yml, .github/workflows/loki-ci-example.yml, .github/workflows/nightly.yml, .github/workflows/sentrux-real.yml, .github/workflows/test.yml, +1 more` | `Node.js` | `22` | `22.23.3 (newest line 26.10.0)` | MAJOR | EOL 2027-04-30 (not yet); minor in line; MAJOR to newest line |
+| `.github/workflows/test.yml` | `Node.js` | `24` | `24.21.0 (newest line 26.10.0)` | MAJOR | EOL 2028-04-30 (not yet); minor in line; MAJOR to newest line |
+| `.github/workflows/test.yml` | `Python` | `3.10` | `3.10.21 (newest line 3.14.7)` | minor | EOL 2026-10-31 (not yet); patch in line; minor to newest line |
+| `.github/workflows/test.yml` | `Python` | `3.11` | `3.11.16 (newest line 3.14.7)` | minor | EOL 2027-10-31 (not yet); patch in line; minor to newest line |
+| `.github/workflows/bun-parity.yml, .github/workflows/model-catalog-probe.yml, .github/workflows/nightly.yml, .github/workflows/parity-drift.yml, .github/workflows/test.yml, +1 more` | `Python` | `3.12` | `3.12.14 (newest line 3.14.7)` | minor | EOL 2028-10-31 (not yet); patch in line; minor to newest line |
+| `.github/workflows/test.yml` | `Python` | `3.13` | `3.13.15 (newest line 3.14.7)` | minor | EOL 2029-10-31 (not yet); patch in line; minor to newest line |
+| `.github/workflows/bun-parity.yml, .github/workflows/check-phase6-ready.yml, .github/workflows/coverage.yml, .github/workflows/mutation-testing.yml, .github/workflows/nightly.yml, +5 more` | `Bun` | `1.3.13` | `bun-v1.4.2` | minor |  |
+| `.github/workflows/nightly.yml, .github/workflows/test.yml` | `Bun` | `latest` | `-` | unknown | not a numeric version, skipped |
+
+## Docker / Compose images
+
+| File | Name | Current | Latest stable | Bump | Note |
+|---|---|---|---|---|---|
+| `Dockerfile` | `ubuntu:24.04` | `ubuntu:24.04` | `24.04.5 (newest line 26.04.1)` | MAJOR | EOL 2029-05-31 (not yet); patch in line; MAJOR to newest line |
+| `Dockerfile.purplelab-test` | `node:22-slim` | `node:22-slim` | `22.23.3 (newest line 26.10.0)` | MAJOR | EOL 2027-04-30 (not yet); minor in line; MAJOR to newest line |
+| `Dockerfile.sandbox` | `debian:bookworm-slim` | `debian:bookworm-slim` | `12.15 (newest line 13.7)` | MAJOR | EOL 2028-06-30 (not yet); minor in line; MAJOR to newest line |
+| `Dockerfile.sandbox` | `debian:bookworm-slim` | `debian:bookworm-slim` | `12.15 (newest line 13.7)` | MAJOR | EOL 2028-06-30 (not yet); minor in line; MAJOR to newest line |
+| `Dockerfile.test-runner` | `python:3.12-slim` | `python:3.12-slim` | `3.12.14 (newest line 3.14.7)` | minor | EOL 2028-10-31 (not yet); patch in line; minor to newest line |
+| `artifacts/observability/Dockerfile` | `nginx:1.27-alpine` | `nginx:1.27-alpine` | `1.27.5 (newest line 1.31.6)` | EOL | EOL 2025-06-24 (past); EOL in current line; newest line is 1.31.6 |
+| `dashboard/Dockerfile` | `python:3.11-slim-bookworm` | `python:3.11-slim-bookworm` | `3.11.16 (newest line 3.14.7)` | minor | EOL 2027-10-31 (not yet); patch in line; minor to newest line |
+| `web-app/Dockerfile` | `node:22-alpine` | `node:22-alpine` | `22.23.3 (newest line 26.10.0)` | MAJOR | EOL 2027-04-30 (not yet); minor in line; MAJOR to newest line |
+| `web-app/Dockerfile` | `python:3.12-slim` | `python:3.12-slim` | `3.12.14 (newest line 3.14.7)` | minor | EOL 2028-10-31 (not yet); patch in line; minor to newest line |
+| `dashboard/docker-compose.yml` | `loki-dashboard:latest` | `loki-dashboard:latest` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
+| `deploy/docker-compose/docker-compose.yml` | `asklokesh/loki-mode:latest` | `asklokesh/loki-mode:latest` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
+| `deploy/docker-compose/docker-compose.yml` | `otel/opentelemetry-collector-contrib:0.96.0` | `otel/opentelemetry-collector-contrib:0.96.0` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
+| `deploy/docker-compose/docker-compose.yml` | `jaegertracing/all-in-one:1.54` | `jaegertracing/all-in-one:1.54` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
+| `docker-compose.yml` | `loki-mode:latest` | `loki-mode:latest` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
+| `docker-compose.yml` | `chromadb/chroma:latest` | `chromadb/chroma:latest` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
+| `docker-compose.yml` | `loki-mode:latest` | `loki-mode:latest` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
+| `docker-compose.yml` | `loki-mode:latest` | `loki-mode:latest` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
+| `docker-compose.yml` | `redis:7-alpine` | `redis:7-alpine` | `7.4.11 (newest line 8.10.2)` | MAJOR | EOL 2029-12-01 (not yet); resolved floating tag '7' to cycle 7.4; minor in line; MAJOR to newest line |
+| `web-app/docker-compose.purple-lab.yml` | `postgres:16-alpine` | `postgres:16-alpine` | `16.15 (newest line 18.6)` | MAJOR | EOL 2028-11-09 (not yet); minor in line; MAJOR to newest line |
+| `web-app/docker-compose.purple-lab.yml` | `redis:7-alpine` | `redis:7-alpine` | `7.4.11 (newest line 8.10.2)` | MAJOR | EOL 2029-12-01 (not yet); resolved floating tag '7' to cycle 7.4; minor in line; MAJOR to newest line |
+| `docker-compose.test.yml` | `(none found)` | `` | `-` | n/a | no `FROM` / `image:` line found (build-context-only service, or a multi-stage FROM this pass did not match) |
+
+## Helm (every `Chart.yaml` found via `git ls-files`, any directory)
+
+| File | Name | Current | Latest stable | Bump | Note |
+|---|---|---|---|---|---|
+| `deploy/helm/autonomi/Chart.yaml` | `appVersion` | `7.93.0` | `10.2.1` | drifted | DRIFTED: chart appVersion does not track the product VERSION file (10.2.1) |
+| `deploy/helm/autonomi/Chart.yaml` | `chart dependencies` | `(none declared)` | `-` | n/a |  |
+| `deploy/helm/autonomi/templates/tests/test-controlplane-health.yaml` | `curlimages/curl:8.11.1` | `curlimages/curl:8.11.1` | `-` | unknown | floating/arbitrary registry tag, see Docker section for endoflife-mapped images |
+| `deploy/helm/autonomi/tests/test-connection.yaml` | `curlimages/curl:8.5.0` | `curlimages/curl:8.5.0` | `-` | unknown | floating/arbitrary registry tag, see Docker section for endoflife-mapped images |
+| `deploy/helm/autonomi/tests/test-health.yaml` | `curlimages/curl:8.5.0` | `curlimages/curl:8.5.0` | `-` | unknown | floating/arbitrary registry tag, see Docker section for endoflife-mapped images |
+| `deploy/helm/autonomi/values.yaml` | `alpine/git:latest` | `alpine/git:latest` | `-` | unknown | floating/arbitrary registry tag, see Docker section for endoflife-mapped images |
+| `deploy/helm/autonomi/values.yaml` | `image.repository` | `asklokesh/loki-mode:(defaults to appVersion)` | `-` | n/a | own product image, tracked via VERSION not a third-party dep |
+| `helm/loki-mode/Chart.yaml` | `appVersion` | `9.19.1` | `10.2.1` | drifted | DRIFTED: chart appVersion does not track the product VERSION file (10.2.1) |
+| `helm/loki-mode/Chart.yaml` | `chart dependencies` | `(none declared)` | `-` | n/a |  |
+| `helm/loki-mode/values.yaml` | `redis:7-alpine` | `redis:7-alpine` | `-` | unknown | floating/arbitrary registry tag, see Docker section for endoflife-mapped images |
+| `helm/loki-mode/values.yaml` | `image.repository` | `asklokesh/loki-mode:(defaults to appVersion)` | `-` | n/a | own product image, tracked via VERSION not a third-party dep |
+| `deploy/helm/autonomi/templates/configmap.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `deploy/helm/autonomi/templates/deployment-controlplane.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `deploy/helm/autonomi/templates/deployment-worker.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `deploy/helm/autonomi/templates/hpa-worker.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `deploy/helm/autonomi/templates/ingress.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `deploy/helm/autonomi/templates/job-worker.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `deploy/helm/autonomi/templates/keda-scaledjob.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `deploy/helm/autonomi/templates/keda-scaledobject.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `deploy/helm/autonomi/templates/namespace.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `deploy/helm/autonomi/templates/networkpolicy.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `deploy/helm/autonomi/templates/pdb.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `deploy/helm/autonomi/templates/pvc-audit.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `deploy/helm/autonomi/templates/pvc-checkpoints.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `deploy/helm/autonomi/templates/rbac.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `deploy/helm/autonomi/templates/secret.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `deploy/helm/autonomi/templates/service-controlplane.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `deploy/helm/autonomi/templates/service-worker.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `deploy/helm/autonomi/templates/serviceaccount.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `deploy/helm/autonomi/templates/servicemonitor.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `deploy/helm/autonomi/values-ha.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `deploy/helm/autonomi/values-production.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `helm/loki-mode/templates/networkpolicy.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `helm/loki-mode/templates/receiver-configmap.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `helm/loki-mode/templates/receiver-deployment.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `helm/loki-mode/templates/receiver-service.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `helm/loki-mode/templates/redis.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `helm/loki-mode/templates/secret.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `helm/loki-mode/templates/serviceaccount.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `helm/loki-mode/templates/tests/test-receiver-health.yaml` | `(none found)` | `` | `-` | n/a | test fixture; no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `helm/loki-mode/templates/worker-deployment.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `helm/loki-mode/templates/worker-hpa.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+
+## Terraform providers
+
+| File | Name | Current | Latest stable | Bump | Note |
+|---|---|---|---|---|---|
+| `deploy/terraform/modules/aws-ecs/versions.tf` | `aws (hashicorp/aws)` | `>= 5.0` | `6.66.0` | MAJOR |  |
+| `deploy/terraform/modules/aws/versions.tf` | `aws (hashicorp/aws)` | `>= 5.0` | `6.66.0` | MAJOR |  |
+| `deploy/terraform/modules/azure/versions.tf` | `azurerm (hashicorp/azurerm)` | `>= 3.0` | `5.7.0` | MAJOR |  |
+| `deploy/terraform/modules/gcp/versions.tf` | `google (hashicorp/google)` | `>= 5.0` | `8.4.0` | MAJOR |  |
+| `deploy/terraform/examples/aws-eks/main.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
+| `deploy/terraform/examples/azure-aks/main.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
+| `deploy/terraform/examples/gcp-gke/main.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
+| `deploy/terraform/modules/aws-ecs/main.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
+| `deploy/terraform/modules/aws-ecs/outputs.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
+| `deploy/terraform/modules/aws-ecs/variables.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
+| `deploy/terraform/modules/aws/main.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
+| `deploy/terraform/modules/aws/outputs.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
+| `deploy/terraform/modules/aws/variables.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
+| `deploy/terraform/modules/azure/main.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
+| `deploy/terraform/modules/azure/outputs.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
+| `deploy/terraform/modules/azure/variables.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
+| `deploy/terraform/modules/gcp/main.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
+| `deploy/terraform/modules/gcp/outputs.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
+| `deploy/terraform/modules/gcp/variables.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
+
+## Homebrew
+
+Formula lives in a separate repo: `asklokesh/homebrew-tap`, `Formula/loki-mode.rb` (updated by `.github/workflows/release.yml` job `update-homebrew` via the GitHub Contents API on every release).
+
+| File | Name | Current | Latest stable | Bump | Note |
+|---|---|---|---|---|---|
+| `asklokesh/homebrew-tap:Formula/loki-mode.rb` | `loki-mode` | `10.2.1` | `10.2.1` | up-to-date | repo VERSION file is 10.2.1 |
+
+## Summary
+
+Counts are all from the single `Bump` column (current line vs newest line in the product; see the Latest column for the current-line patch when it differs from the newest line). `0.x breaking` and `drifted` are their own columns, not folded into MAJOR, since they are not the same computation.
+
+| Ecosystem | patch | minor | 0.x breaking | MAJOR | EOL | drifted | unknown | up-to-date | other |
+|---|---|---|---|---|---|---|---|---|---|
+| npm/bun | 1 | 11 | 4 | 24 | 0 | 0 | 1 | 7 | 0 |
+| Python (requirements) | 1 | 9 | 10 | 9 | 0 | 0 | 10 | 1 | 0 |
+| Python (pyproject) | 0 | 1 | 1 | 1 | 0 | 0 | 1 | 0 | 0 |
+| GitHub Actions | 1 | 0 | 0 | 75 | 0 | 0 | 2 | 13 | 2 |
+| Runtimes | 0 | 5 | 0 | 2 | 1 | 0 | 1 | 0 | 0 |
+| Docker/Compose | 0 | 3 | 0 | 8 | 1 | 0 | 8 | 0 | 1 |
+| Helm | 0 | 0 | 0 | 0 | 0 | 2 | 5 | 0 | 34 |
+| Terraform | 0 | 0 | 0 | 4 | 0 | 0 | 0 | 0 | 15 |
+| Homebrew | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 1 | 0 |
+
+## Proposed slice list (D35)
+
+- **LOW - npm/bun patch+minor batch** (one slice for the whole ecosystem, touching every file below; lockfiles regenerated and committed):
+  - `dashboard-ui/package.json`: @playwright/test ^1.58.1->1.63.0
+  - `vscode-extension/package.json`: @types/vscode ^1.85.0->1.138.0
+  - `web-app/package.json`: @playwright/test ^1.58.2->1.63.0, @types/react ^19.0.10->19.3.0, @types/react-dom ^19.0.4->19.3.0, autoprefixer ^10.4.20->10.6.1, postcss ^8.5.3->8.5.28, react ^19.0.0->19.3.0, react-dom ^19.0.0->19.3.0, react-resizable-panels ^4.7.3->4.14.1, react-router-dom ^7.13.1->7.18.4, typescript-eslint ^8.24.1->8.70.1
+- **LOW - Python patch+minor batch** (one slice for the whole ecosystem, touching every file below; lockfiles regenerated and committed):
+  - `dashboard/requirements.txt`: greenlet >=3.0.0,<4.0.0->3.5.6, pydantic >=2.0.0,<3.0.0->2.13.5, sqlalchemy >=2.0.0,<3.0.0->2.1.1
+  - `mcp/requirements.txt`: chromadb >=1.0.0,<2.0.0->1.5.9
+  - `web-app/requirements.txt`: alembic >=1.12.0->1.20.0, pexpect >=4.8.0->4.9.0, pydantic >=2.0.0->2.13.5, python-jose >=3.3.0->3.5.0, pyyaml >=6.0->6.0.3, sqlalchemy >=2.0.0->2.1.1
+- **LOW - Python (pyproject) patch+minor batch** (one slice for the whole ecosystem, touching every file below; lockfiles regenerated and committed):
+  - `sdk/python/pyproject.toml`: pydantic >=2.0.0->2.13.5
+- **MEDIUM - one slice per MAJOR (or 0.x-breaking) package**, deduped across manifests:
+  - `@eslint/js` -> `10.0.1` (MAJOR): web-app/package.json
+  - `@types/node` -> `26.6.3` (MAJOR): package.json, vscode-extension/package.json
+  - `@typescript-eslint/eslint-plugin` -> `8.70.1` (MAJOR): vscode-extension/package.json
+  - `@typescript-eslint/parser` -> `8.70.1` (MAJOR): vscode-extension/package.json
+  - `@vitejs/plugin-react` -> `6.1.1` (MAJOR): web-app/package.json
+  - `@vscode/vsce` -> `4.0.0` (MAJOR): vscode-extension/package.json
+  - `aiosqlite` -> `0.22.1` (0.x breaking): dashboard/requirements.txt, web-app/requirements.txt
+  - `anthropic` -> `1.8.0` (MAJOR): mcp/requirements.txt
+  - `asyncpg` -> `0.31.0` (0.x breaking): web-app/requirements.txt
+  - `cryptography` -> `50.0.1` (MAJOR): requirements-test.txt, web-app/requirements.txt
+  - `esbuild` -> `0.28.2` (0.x breaking): dashboard-ui/package.json, vscode-extension/package.json
+  - `eslint` -> `10.11.0` (MAJOR): vscode-extension/package.json, web-app/package.json
+  - `eslint-plugin-react-hooks` -> `7.1.1` (MAJOR): web-app/package.json
+  - `eslint-plugin-react-refresh` -> `0.5.7` (0.x breaking): web-app/package.json
+  - `fastapi` -> `0.141.1` (0.x breaking): dashboard/requirements.txt, web-app/requirements.txt
+  - `globals` -> `17.12.0` (MAJOR): web-app/package.json
+  - `httpx` -> `0.28.1` (0.x breaking): sdk/python/pyproject.toml, web-app/requirements-test.txt, web-app/requirements.txt
+  - `jest` -> `30.5.2` (MAJOR): dashboard-ui/package.json, package.json
+  - `jest-environment-jsdom` -> `30.5.2` (MAJOR): dashboard-ui/package.json
+  - `jsdom` -> `30.1.1` (MAJOR): dashboard-ui/package.json, package.json
+  - `lucide-react` -> `1.48.0` (MAJOR): web-app/package.json
+  - `mcp` -> `2.2.0` (MAJOR): mcp/requirements.txt, requirements-test.txt
+  - `pytest` -> `9.1.1` (MAJOR): web-app/requirements-test.txt
+  - `pytest-asyncio` -> `1.4.0` (MAJOR): web-app/requirements-test.txt
+  - `python-multipart` -> `0.0.32` (0.x breaking): web-app/requirements.txt
+  - `setuptools` -> `84.0.0` (MAJOR): sdk/python/pyproject.toml
+  - `tailwindcss` -> `4.3.3` (MAJOR): web-app/package.json
+  - `typescript` -> `7.0.2` (MAJOR): loki-ts/package.json, package.json, sdk/typescript/package.json, vscode-extension/package.json, web-app/package.json
+  - `uvicorn` -> `0.54.0` (0.x breaking): dashboard/requirements.txt, web-app/requirements.txt
+  - `vite` -> `8.3.1` (MAJOR): web-app/package.json
+  - `watchdog` -> `6.0.0` (MAJOR): web-app/requirements.txt
+  - `websockets` -> `17.1` (MAJOR): dashboard/requirements.txt
+- **MEDIUM - one slice per Actions MAJOR**, deduped by action across workflows (bump to latest major AND SHA-pin with a `# vN` comment in the same slice, per D35):
+  - `actions/cache` v4 (resolves to v4.3.0) -> `v6.1.0`: .github/workflows/test.yml
+  - `actions/checkout` 11d5960a326750d5838078e36cf38b85af677262, v4 (resolves to v4.4.0) -> `v7.0.1`: .github/workflows/bun-parity.yml, .github/workflows/check-phase6-ready.yml, .github/workflows/claude-code-review.yml, .github/workflows/coverage.yml, .github/workflows/integrity-audit.yml, +16 more
+  - `actions/download-artifact` v4 (resolves to v4.3.0) -> `v8.0.1`: .github/workflows/loki-enterprise.yml, .github/workflows/loki-issue-to-pr.yml, .github/workflows/release.yml
+  - `actions/setup-node` v4 (resolves to v4.4.0) -> `v7.0.0`: .github/workflows/integrity-audit.yml, .github/workflows/loki-ci-example.yml, .github/workflows/loki-enterprise.yml, .github/workflows/loki-issue-to-pr.yml, .github/workflows/mutation-testing.yml, +10 more
+  - `actions/setup-python` v5 (resolves to v5.6.0) -> `v7.0.0`: .github/workflows/bun-parity.yml, .github/workflows/integrity-audit.yml, .github/workflows/model-catalog-probe.yml, .github/workflows/nightly.yml, .github/workflows/parity-drift.yml, +5 more
+  - `actions/upload-artifact` ea165f8d65b6e75b540449e92b4886f43607fa02, v4 (resolves to v4.6.2) -> `v7.0.1`: .github/workflows/check-phase6-ready.yml, .github/workflows/coverage.yml, .github/workflows/loki-ci-example.yml, .github/workflows/loki-enterprise.yml, .github/workflows/loki-issue-to-pr.yml, +8 more
+  - `azure/setup-helm` v4 (resolves to v4.3.1) -> `v5.0.1`: .github/workflows/integrity-audit.yml, .github/workflows/test.yml
+  - `docker/build-push-action` v5 (resolves to v5.4.0) -> `v7.4.0`: .github/workflows/release.yml
+  - `docker/login-action` v3 (resolves to v3.7.0) -> `v4.6.0`: .github/workflows/provenance.yml, .github/workflows/release.yml
+  - `docker/setup-buildx-action` v3 (resolves to v3.12.0) -> `v4.4.1`: .github/workflows/release.yml
+  - `docker/setup-qemu-action` v3 (resolves to v3.7.0) -> `v4.4.0`: .github/workflows/arm64-runtime.yml
+  - `peter-evans/dockerhub-description` v4 (resolves to v4.0.2) -> `v5.0.0`: .github/workflows/release.yml
+  - `sigstore/cosign-installer` v3 (resolves to v3.9.1) -> `v4.1.2`: .github/workflows/provenance.yml, .github/workflows/release.yml
+- **LOW - Actions SHA-pinning** (already on latest major, just needs pinning): convert every tag-pinned `uses:` to a SHA pin with a trailing `# vN` comment (the pattern already used for `actions/checkout` and `actions/upload-artifact` in security-audit.yml):
+  - `anchore/sbom-action`: .github/workflows/release.yml
+  - `anthropics/claude-code-action`: .github/workflows/claude-code-review.yml
+  - `contributor-assistant/github-action`: .github/workflows/cla.yml
+  - `oven-sh/setup-bun`: .github/workflows/bun-parity.yml, .github/workflows/check-phase6-ready.yml, .github/workflows/coverage.yml, .github/workflows/mutation-testing.yml, .github/workflows/nightly.yml, +6 more
+- **MEDIUM - one slice per Terraform provider MAJOR**:
+  - `deploy/terraform/modules/aws-ecs/versions.tf`: `aws (hashicorp/aws)` >= 5.0 -> 6.66.0
+  - `deploy/terraform/modules/aws/versions.tf`: `aws (hashicorp/aws)` >= 5.0 -> 6.66.0
+  - `deploy/terraform/modules/azure/versions.tf`: `azurerm (hashicorp/azurerm)` >= 3.0 -> 5.7.0
+  - `deploy/terraform/modules/gcp/versions.tf`: `google (hashicorp/google)` >= 5.0 -> 8.4.0
+- **MEDIUM - runtime matrix refresh**:
+  - `Node.js` 20 is EOL (EOL 2026-04-30 (past); EOL in current line; newest line is 26.10.0), pinned by: .github/workflows/test.yml
+  - Node 20 is named in the upstream Actions runtime deprecation warnings even where not yet past its endoflife.date EOL; pinned by: .github/workflows/test.yml
+- **MEDIUM - SDKs with the 5-task eval**: `@anthropic-ai/claude-agent-sdk` 0.3.283 -> 0.3.283 (up-to-date, `loki-ts/package.json`); `@anthropic-ai/sdk` ^0.124.0 -> 0.128.0 (0.x breaking, `loki-ts/package.json`). Gated on the 5-task eval per D35, not the plain patch/minor batch.
+- **LOW - Docker/Helm digest pass**: pin every `FROM` / `image:` tag by digest instead of a mutable tag (own-product images and `:latest` floating tags are out of scope for a version bump and tracked via VERSION instead).
+  - EOL now: `nginx:1.27-alpine` in `artifacts/observability/Dockerfile` (EOL 2025-06-24 (past); EOL in current line; newest line is 1.31.6)
+- **FINDING - Helm chart appVersion has drifted from the product VERSION**:
+  - `deploy/helm/autonomi/Chart.yaml`: appVersion `7.93.0` vs VERSION `10.2.1`
+  - `helm/loki-mode/Chart.yaml`: appVersion `9.19.1` vs VERSION `10.2.1`
+

package/docs/v10/PROGRESS.md

@@ -1,5 +1,41 @@
 # Progress
 
+## 2026-09-28T16:30Z: D37 release cadence in force; "20 waiting slices" were already shipped; drift audit (turn 468)
+- Founder directive 16:20Z (D37): cut at :00, :20, :40 whenever main is green and a merged-unreleased slice exists; trains overlap after publish-npm; release blockers are P0 with a guard. Session cron 0b6676af runs the Release Manager tick at :00/:20/:40.
+- Reconciliation: `git log v10.2.1..origin/main` showed only 2 docs commits (03911808, 4bbda895); every BOARD row marked merged had all its cited commits as ancestors of a published tag (`git merge-base --is-ancestor`), so the "20 merged slices waiting" were stale BOARD cells, not unreleased work. 27 rows flipped to released with their tag (E-71, E-73 corrected to v10.1.0 from their merge 172bec99). E-90 automates this after each publish; E-89 adds RELEASE_CADENCE to the pulse (building, wf_aa962a0e-002).
+- Release notes (D36): six GitHub releases (v9.80.1 to v10.2.1) had placeholder bodies because release.yml's awk never matched dated headings; backfilled from CHANGELOG with `gh release edit`; E-88 enforces it.
+- Drift audit: last 6h shipped v10.1.1 and v10.2.1 (2 releases; 10.2.0 blocked by a Security Audit false positive and a dispatch path the gate cannot count, both now guarded: E-86, E-87). Main red once in the window (9d483688, fixed by E-83). Throughput gap: releases waited on me reviewing and on hand-run bumps; the cadence cron and E-89 remove that.
+
+## 2026-09-28T16:05Z: v10.2.1 shipped (carries the unpublished 10.2.0)
+- Release run 36446416984 success; Security Audit 36446416943 success on 815640d9; `npm view loki-mode dist-tags` latest 10.2.1, gitHead 815640d9 = release commit; GitHub release v10.2.1 published 15:53:56Z; `loki --version` from a fresh prefix prints "Loki Mode v10.2.1" (rc=0).
+- In flight: wave E23 (M-07, M-10, M-11, M-12, E-67, E-79..E-81 reworks), wave E24 (EV-12S rebase, EV-12A/B/C large tasks; 2 of 5 needed large tasks passed review so far: lg-werkzeug-1513, lg-werkzeug-1680), E-86 rework (4 reproduced fail-opens in the pre-push gitleaks check), DEP-01 rework in review.
+
+## 2026-09-28T15:45Z: 10.2.0 cannot publish by dispatch; re-release as 10.2.1; drift audit (turn 456)
+- Security Audit dispatched on 8e7d21f2 (run 36442754156) completed success, but Release dispatched on main (run 36443541666) sat in required-ci: release.yml counts only event=="push" runs, and Security Audit runs on push only when VERSION changes, so a dispatched audit is never counted. Cancelled before its 40-minute deadline. Re-release follows the 10.0.1 precedent: push the train, Tests and Bun Parity green, bump to 10.2.1 so the VERSION push runs Security Audit and Release. E-87 cut for the dispatch path.
+- Gitleaks root cause: the pub-werkzeug-3271 prompt (upstream issue text) contains a sourcegraph.com URL, which arms the sourcegraph-access-token rule, which then matches the 40-hex repo.ref. Local `gitleaks git` (8.30.0 and 8.30.1) does not reproduce it; `gitleaks dir eval/loki10/tasks` with v8.30.0 does (1 finding). E-86 (pre-push check) uses dir mode with the pinned v8.30.0.
+- DEP-01 built (2cceecd2, in review): docs/v10/DEPS.md from scripts/dep-inventory.py, 98 manifests. MAJOR bumps pending: npm 24, Python 10, GitHub Actions 74 uses, Docker 8, Terraform 4. EOL: Node 20 in test.yml (EOL 2026-04-30), nginx:1.27-alpine. Homebrew formula at 10.1.1.
+- Drift audit: since 14:00Z, 3 releases (v10.1.1 shipped; v10.2.0 blocked twice: red Tests on 9d483688, then Security Audit), main red once (9d483688, fixed forward E-83), release volume 23 per 24h against a 30 target. Deviations: train checks ran only tests/engine10 (now the full loki-ts suite plus the dist test); a release dispatch path that cannot pass.
+
+## 2026-09-28T15:20Z: v10.2.0 publish blocked by Security Audit (gitleaks false positive)
+- Release run 36440534050 failed at required-ci: Security Audit 36440534022 failed with 1 new gitleaks finding (report artifact gitleaks-report): rule sourcegraph-access-token at eval/loki10/tasks/pub-werkzeug-3271/task.json:8, commit 82e39c29 (EV-11a). The value is repo.ref, a 40-hex pallets/werkzeug commit (`gh api repos/pallets/werkzeug/commits/<ref>` resolves, dated 2026-09-13). Not a credential.
+- Allowlist: that exact commit-qualified fingerprint added to .gitleaksignore in 8e7d21f2 with a justification (no path or rule suppression); Security Audit run 36446416943 on the 10.2.1 VERSION push reported zero unmatched findings. Nothing was tagged or published for 10.2.0.
+- Recurrence risk: every pub-*/lg-* task pins a 40-hex SHA; E-85 asks the CTO for a narrowly scoped rule. TRAIN_LATE read 681 min because the pulse only reads ~/loki-ci-logs/push-*.log, which plain `git push` never writes; E-84 fixes it.
+
+## 2026-09-28T14:58Z: main red on train E22, E-83 fix-forward (c5ace6e1; Tests green on 378a2e13)
+- Tests red on 9d483688 (run 36438012977): spawn env guard (M-16 codemod.ts spawn with no env) and tests/test-engine10-dist.sh "bundle contains prStage" (E-66's offset deleted the alias the dist test greps for). Both passed review because reviewers and the Chief of Staff ran only `bun test tests/engine10/`.
+- Fixed in E-83 (c5ace6e1). Rule from now: every train touching loki-ts/src runs the full `cd loki-ts && bun test` and `bash tests/test-engine10-dist.sh` before push, and slice cards say so.
+- D34 (CTO) recorded: large tier from real upstream PRs, one size gate, legacy to M-27; EV-12S and EV-12A/B/C building (wf_6aea81c7-823).
+
+## 2026-09-28T14:50Z: train E22 and drift audit (turn 444)
+- Wave E21 (28 agents, ESTIMATE 3,652,703 subagent tokens) plus E21b: 13 of 16 slices approved. Train E22 (9042e964) merges E-66, E-61, M-24, M-16, M-19, M-04, E-74, E-75, E-77, EV-11a, E-82: `bun test tests/engine10/` 547 pass 0 fail, tsc 0, pulse 107 passed, eval harness 108 passed, shard drift 6 passed. Core engine 4,998 of 5,000 (D33).
+- Held: M-07 (core would read 5,000), EV-11b and E-62 (both conflict with EV-11a in the eval harness; serialized next), E-78 (TL CONCERN).
+- EV-12 blocked for a CTO tier ruling after 4 review rounds (size bar met by deleted docstrings; uncommitted generator; untested counted code; no legacy tasks left).
+- Drift audit: the 6-hour window is mostly the 04:48Z-14:00Z access stall (no work possible). Since 14:00Z: v10.1.1 released, 2 trains, main green on each push checked (Tests on 3fb56a4b, 5f295fba). Deviation: the wave script passed "-B" as the reviewers' branch name (all reviews still cited the right SHAs); fixed in the next script.
+
+## 2026-09-28T14:30Z: v10.1.1 shipped
+- Release run 36434253412 success; `npm view loki-mode dist-tags.latest` 10.1.1, gitHead 580540f9 = release commit. Tests and Bun Parity green on 3fb56a4b before the bump; version-only bump produced no dist churn (E-72 working).
+- Wave E21 (wf_39ab3f7d-8f3) in flight: 12 builders, 4 reviews. Ready queue refilled with E-78..E-82.
+
 ## 2026-09-28T14:10Z: resumed after a 9-hour stall -- read first on resume
 - Shipped before the stall: v10.0.1 (npm gitHead 76ec1c24) and v10.1.0 (Release run for b60ca0ef all jobs success; `npm view loki-mode@10.1.0 gitHead` b60ca0ef; dist-tag latest 10.1.0).
 - Stall: every model call from 04:48Z failed with "Your organization has disabled Claude subscription access for Claude Code" (workflow failures in wf_bd919989-941 and wf_1efd6e89-1f3); nothing ran until about 14:00Z. The pulse raised no violation for it; E-77 adds SESSION_STALLED.