loki-mode 10.2.1 → 10.2.2

package/docs/v10/DEPS.md

@@ -0,0 +1,436 @@
+# Dependency Inventory (D35 DEP-01)
+
+Generated by `scripts/dep-inventory.py`. Lookup date: 2026-09-28.
+
+Inventory only. No dependency, lockfile, workflow or image was changed to produce this report. Manifests are discovered with `git ls-files`, never a filesystem walk. Network lookups are cached under the `--cache` directory so re-running against the same cache is byte-identical.
+
+## npm / bun
+
+| File | Name | Current | Latest stable | Bump | Note |
+|---|---|---|---|---|---|
+| `dashboard-ui/package.json` | `@playwright/test` | `^1.58.1` | `1.63.0` | minor |  |
+| `dashboard-ui/package.json` | `esbuild` | `^0.24.0` | `0.28.2` | 0.x breaking |  |
+| `dashboard-ui/package.json` | `jest` | `^29.7.0` | `30.5.2` | MAJOR |  |
+| `dashboard-ui/package.json` | `jest-environment-jsdom` | `^29.7.0` | `30.5.2` | MAJOR |  |
+| `dashboard-ui/package.json` | `jsdom` | `^24.0.0` | `30.1.1` | MAJOR |  |
+| `loki-ts/package.json` | `@anthropic-ai/claude-agent-sdk` | `0.3.283` | `0.3.283` | up-to-date |  |
+| `loki-ts/package.json` | `@anthropic-ai/sdk` | `^0.124.0` | `0.128.0` | 0.x breaking |  |
+| `loki-ts/package.json` | `@resvg/resvg-wasm` | `^2.6.2` | `2.6.2` | up-to-date |  |
+| `loki-ts/package.json` | `@types/bun` | `latest` | `1.4.2` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
+| `loki-ts/package.json` | `typescript` | `^5.6.0` | `7.0.2` | MAJOR |  |
+| `loki-ts/tests/engine10/fixtures/testmap/package.json` | `vitest` | `^2.0.0` | `5.0.2` | MAJOR | test fixture, not a real dependency |
+| `package.json` | `@resvg/resvg-wasm` | `^2.6.2` | `2.6.2` | up-to-date |  |
+| `package.json` | `@types/node` | `^25.2.0` | `26.6.3` | MAJOR |  |
+| `package.json` | `jest` | `^29.7.0` | `30.5.2` | MAJOR |  |
+| `package.json` | `jsdom` | `^24.0.0` | `30.1.1` | MAJOR |  |
+| `package.json` | `typescript` | `^5.9.3` | `7.0.2` | MAJOR |  |
+| `sdk/typescript/package.json` | `typescript` | `^5.9.3` | `7.0.2` | MAJOR |  |
+| `vscode-extension/package.json` | `@types/node` | `^20.10.0` | `26.6.3` | MAJOR |  |
+| `vscode-extension/package.json` | `@types/vscode` | `^1.85.0` | `1.138.0` | minor |  |
+| `vscode-extension/package.json` | `@typescript-eslint/eslint-plugin` | `^6.13.0` | `8.70.1` | MAJOR |  |
+| `vscode-extension/package.json` | `@typescript-eslint/parser` | `^6.13.0` | `8.70.1` | MAJOR |  |
+| `vscode-extension/package.json` | `@vscode/vsce` | `^2.22.0` | `4.0.0` | MAJOR |  |
+| `vscode-extension/package.json` | `esbuild` | `^0.19.8` | `0.28.2` | 0.x breaking |  |
+| `vscode-extension/package.json` | `eslint` | `^8.55.0` | `10.11.0` | MAJOR |  |
+| `vscode-extension/package.json` | `typescript` | `^5.3.2` | `7.0.2` | MAJOR |  |
+| `web-app/package.json` | `@monaco-editor/react` | `^4.7.0` | `4.7.0` | up-to-date |  |
+| `web-app/package.json` | `@xterm/addon-fit` | `^0.11.0` | `0.11.0` | up-to-date |  |
+| `web-app/package.json` | `@xterm/addon-web-links` | `^0.12.0` | `0.12.0` | up-to-date |  |
+| `web-app/package.json` | `@xterm/xterm` | `^6.0.0` | `6.0.0` | up-to-date |  |
+| `web-app/package.json` | `lucide-react` | `^0.577.0` | `1.48.0` | MAJOR |  |
+| `web-app/package.json` | `react` | `^19.0.0` | `19.3.0` | minor |  |
+| `web-app/package.json` | `react-dom` | `^19.0.0` | `19.3.0` | minor |  |
+| `web-app/package.json` | `react-resizable-panels` | `^4.7.3` | `4.14.1` | minor |  |
+| `web-app/package.json` | `react-router-dom` | `^7.13.1` | `7.18.4` | minor |  |
+| `web-app/package.json` | `@eslint/js` | `^9.21.0` | `10.0.1` | MAJOR |  |
+| `web-app/package.json` | `@playwright/test` | `^1.58.2` | `1.63.0` | minor |  |
+| `web-app/package.json` | `@types/react` | `^19.0.10` | `19.3.0` | minor |  |
+| `web-app/package.json` | `@types/react-dom` | `^19.0.4` | `19.3.0` | minor |  |
+| `web-app/package.json` | `@vitejs/plugin-react` | `^4.3.4` | `6.1.1` | MAJOR |  |
+| `web-app/package.json` | `autoprefixer` | `^10.4.20` | `10.6.1` | minor |  |
+| `web-app/package.json` | `eslint` | `^9.21.0` | `10.11.0` | MAJOR |  |
+| `web-app/package.json` | `eslint-plugin-react-hooks` | `^5.1.0` | `7.1.1` | MAJOR |  |
+| `web-app/package.json` | `eslint-plugin-react-refresh` | `^0.4.19` | `0.5.7` | 0.x breaking |  |
+| `web-app/package.json` | `globals` | `^15.15.0` | `17.12.0` | MAJOR |  |
+| `web-app/package.json` | `postcss` | `^8.5.3` | `8.5.28` | patch |  |
+| `web-app/package.json` | `tailwindcss` | `^3.4.17` | `4.3.3` | MAJOR |  |
+| `web-app/package.json` | `typescript` | `~5.7.2` | `7.0.2` | MAJOR |  |
+| `web-app/package.json` | `typescript-eslint` | `^8.24.1` | `8.70.1` | minor |  |
+| `web-app/package.json` | `vite` | `^6.2.0` | `8.3.1` | MAJOR |  |
+
+## Python (requirements*.txt)
+
+| File | Name | Current | Latest stable | Bump | Note |
+|---|---|---|---|---|---|
+| `dashboard/requirements.txt` | `fastapi` | `>=0.100.0,<1.0.0` | `0.141.1` | 0.x breaking |  |
+| `dashboard/requirements.txt` | `uvicorn` | `>=0.20.0,<1.0.0` | `0.54.0` | 0.x breaking |  |
+| `dashboard/requirements.txt` | `sqlalchemy` | `>=2.0.0,<3.0.0` | `2.1.1` | minor |  |
+| `dashboard/requirements.txt` | `aiosqlite` | `>=0.19.0,<1.0.0` | `0.22.1` | 0.x breaking |  |
+| `dashboard/requirements.txt` | `greenlet` | `>=3.0.0,<4.0.0` | `3.5.6` | minor |  |
+| `dashboard/requirements.txt` | `pydantic` | `>=2.0.0,<3.0.0` | `2.13.5` | minor |  |
+| `dashboard/requirements.txt` | `websockets` | `>=12.0,<16.0` | `17.1` | MAJOR |  |
+| `mcp/requirements.txt` | `mcp` | `>=1.0.0,<2.0.0` | `2.2.0` | MAJOR |  |
+| `mcp/requirements.txt` | `chromadb` | `>=1.0.0,<2.0.0` | `1.5.9` | minor |  |
+| `mcp/requirements.txt` | `anthropic` | `>=0.40,<1.0.0` | `1.8.0` | MAJOR |  |
+| `requirements-test.txt` | `pytest` | `(unpinned)` | `9.1.1` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
+| `requirements-test.txt` | `pytest-asyncio` | `(unpinned)` | `1.4.0` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
+| `requirements-test.txt` | `pytest-xdist` | `(unpinned)` | `3.8.0` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
+| `requirements-test.txt` | `mcp` | `>=1.0.0,<2.0.0` | `2.2.0` | MAJOR |  |
+| `requirements-test.txt` | `pydantic` | `(unpinned)` | `2.13.5` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
+| `requirements-test.txt` | `fastapi` | `(unpinned)` | `0.141.1` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
+| `requirements-test.txt` | `uvicorn` | `(unpinned)` | `0.54.0` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
+| `requirements-test.txt` | `httpx` | `(unpinned)` | `0.28.1` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
+| `requirements-test.txt` | `sqlalchemy` | `(unpinned)` | `2.1.1` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
+| `requirements-test.txt` | `aiosqlite` | `(unpinned)` | `0.22.1` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
+| `requirements-test.txt` | `cryptography` | `>=41.0.0` | `50.0.1` | MAJOR |  |
+| `requirements-test.txt` | `pyyaml` | `(unpinned)` | `6.0.3` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
+| `tests/fixtures/legacy-checkout-app/requirements.txt` | `flask` | `==3.0.0` | `3.1.3` | minor | test fixture, not a real dependency |
+| `tests/fixtures/legacy-checkout-app/requirements.txt` | `stripe` | `==7.0.0` | `15.6.1` | MAJOR | test fixture, not a real dependency |
+| `web-app/requirements-test.txt` | `pytest` | `>=7.4.0` | `9.1.1` | MAJOR |  |
+| `web-app/requirements-test.txt` | `pytest-asyncio` | `>=0.21.0` | `1.4.0` | MAJOR |  |
+| `web-app/requirements-test.txt` | `httpx` | `>=0.24.0` | `0.28.1` | 0.x breaking |  |
+| `web-app/requirements.txt` | `fastapi` | `>=0.100.0` | `0.141.1` | 0.x breaking |  |
+| `web-app/requirements.txt` | `uvicorn` | `>=0.20.0` | `0.54.0` | 0.x breaking |  |
+| `web-app/requirements.txt` | `pydantic` | `>=2.0.0` | `2.13.5` | minor |  |
+| `web-app/requirements.txt` | `httpx` | `>=0.24.0` | `0.28.1` | 0.x breaking |  |
+| `web-app/requirements.txt` | `python-multipart` | `>=0.0.9` | `0.0.32` | 0.x breaking |  |
+| `web-app/requirements.txt` | `pexpect` | `>=4.8.0` | `4.9.0` | minor |  |
+| `web-app/requirements.txt` | `watchdog` | `>=3.0.0` | `6.0.0` | MAJOR |  |
+| `web-app/requirements.txt` | `sqlalchemy` | `>=2.0.0` | `2.1.1` | minor |  |
+| `web-app/requirements.txt` | `asyncpg` | `>=0.28.0` | `0.31.0` | 0.x breaking |  |
+| `web-app/requirements.txt` | `aiosqlite` | `>=0.19.0` | `0.22.1` | 0.x breaking |  |
+| `web-app/requirements.txt` | `alembic` | `>=1.12.0` | `1.20.0` | minor |  |
+| `web-app/requirements.txt` | `python-jose` | `>=3.3.0` | `3.5.0` | minor |  |
+| `web-app/requirements.txt` | `passlib` | `>=1.7.4` | `1.7.4` | up-to-date |  |
+| `web-app/requirements.txt` | `cryptography` | `>=41.0.0` | `50.0.1` | MAJOR |  |
+| `web-app/requirements.txt` | `pyyaml` | `>=6.0` | `6.0.3` | patch |  |
+
+## Python (pyproject.toml)
+
+| File | Name | Current | Latest stable | Bump | Note |
+|---|---|---|---|---|---|
+| `loki-ts/tests/engine10/fixtures/testmap/pyproject.toml` | `(none declared)` | `` | `-` | n/a | test fixture, not a real dependency |
+| `loki-ts/tests/engine10/modernize/fixtures/inv/sample-repo/pyproject.toml` | `(none declared)` | `` | `-` | n/a | test fixture, not a real dependency |
+| `sdk/python/pyproject.toml` | `httpx` | `>=0.24.0` | `0.28.1` | 0.x breaking |  |
+| `sdk/python/pyproject.toml` | `pydantic` | `>=2.0.0` | `2.13.5` | minor |  |
+| `sdk/python/pyproject.toml` | `setuptools` | `>=68.0` | `84.0.0` | MAJOR |  |
+| `sdk/python/pyproject.toml` | `wheel` | `(unpinned)` | `0.48.0` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
+
+## GitHub Actions (`uses:`)
+
+| File | Name | Current | Latest stable | Bump | Note |
+|---|---|---|---|---|---|
+| `.github/workflows/arm64-runtime.yml` | `docker/setup-qemu-action@v3` | `v3 (resolves to v3.7.0)` | `v4.4.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v3 resolves to v3.7.0 (commit c7c53464625b), behind latest release v4.4.0 (commit 990126619549); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/bun-parity.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/bun-parity.yml` | `oven-sh/setup-bun@v2` | `v2 (resolves to v2.2.0)` | `v2.2.0` | up-to-date | tag-pinned (not SHA-pinned); floating tag v2 resolves to v2.2.0, which IS the latest release -- tracks latest within that major |
+| `.github/workflows/bun-parity.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/check-phase6-ready.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/check-phase6-ready.yml` | `oven-sh/setup-bun@v2` | `v2 (resolves to v2.2.0)` | `v2.2.0` | up-to-date | tag-pinned (not SHA-pinned); floating tag v2 resolves to v2.2.0, which IS the latest release -- tracks latest within that major |
+| `.github/workflows/check-phase6-ready.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/cla.yml` | `contributor-assistant/github-action@v2.6.1` | `v2.6.1` | `v2.6.1` | up-to-date | tag-pinned (not SHA-pinned); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/claude-code-review.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/claude-code-review.yml` | `anthropics/claude-code-action@v1` | `v1 (resolves to v1)` | `v1` | up-to-date | tag-pinned (not SHA-pinned); floating tag v1 resolves to v1, which IS the latest release -- tracks latest within that major |
+| `.github/workflows/coverage.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/coverage.yml` | `oven-sh/setup-bun@v2` | `v2 (resolves to v2.2.0)` | `v2.2.0` | up-to-date | tag-pinned (not SHA-pinned); floating tag v2 resolves to v2.2.0, which IS the latest release -- tracks latest within that major |
+| `.github/workflows/coverage.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/integrity-audit.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/integrity-audit.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/integrity-audit.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/integrity-audit.yml` | `azure/setup-helm@v4` | `v4 (resolves to v4.3.1)` | `v5.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.3.1 (commit 1a275c3b6953), behind latest release v5.0.1 (commit 9bc31f4ebc9c); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/loki-ci-example.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/loki-ci-example.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/loki-ci-example.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/loki-enterprise.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/loki-enterprise.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/loki-enterprise.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/loki-enterprise.yml` | `actions/download-artifact@v4` | `v4 (resolves to v4.3.0)` | `v8.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.3.0 (commit d3f86a106a0b), behind latest release v8.0.1 (commit 3e5f45b2cfb9); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/loki-issue-to-pr.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/loki-issue-to-pr.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/loki-issue-to-pr.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/loki-issue-to-pr.yml` | `actions/download-artifact@v4` | `v4 (resolves to v4.3.0)` | `v8.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.3.0 (commit d3f86a106a0b), behind latest release v8.0.1 (commit 3e5f45b2cfb9); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/model-catalog-probe.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/model-catalog-probe.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/mutation-testing.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/mutation-testing.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/mutation-testing.yml` | `oven-sh/setup-bun@v2` | `v2 (resolves to v2.2.0)` | `v2.2.0` | up-to-date | tag-pinned (not SHA-pinned); floating tag v2 resolves to v2.2.0, which IS the latest release -- tracks latest within that major |
+| `.github/workflows/mutation-testing.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/nightly.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/nightly.yml` | `oven-sh/setup-bun@v2` | `v2 (resolves to v2.2.0)` | `v2.2.0` | up-to-date | tag-pinned (not SHA-pinned); floating tag v2 resolves to v2.2.0, which IS the latest release -- tracks latest within that major |
+| `.github/workflows/nightly.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/nightly.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/parity-drift.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/parity-drift.yml` | `oven-sh/setup-bun@v2` | `v2 (resolves to v2.2.0)` | `v2.2.0` | up-to-date | tag-pinned (not SHA-pinned); floating tag v2 resolves to v2.2.0, which IS the latest release -- tracks latest within that major |
+| `.github/workflows/parity-drift.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/parity-drift.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/post-release-smoke.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/post-release-smoke.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/post-release-smoke.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/provenance.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/provenance.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/provenance.yml` | `oven-sh/setup-bun@v2` | `v2 (resolves to v2.2.0)` | `v2.2.0` | up-to-date | tag-pinned (not SHA-pinned); floating tag v2 resolves to v2.2.0, which IS the latest release -- tracks latest within that major |
+| `.github/workflows/provenance.yml` | `sigstore/cosign-installer@v3` | `v3 (resolves to v3.9.1)` | `v4.1.2` | MAJOR | tag-pinned (not SHA-pinned); floating tag v3 resolves to v3.9.1 (commit 398d4b0eeef1), behind latest release v4.1.2 (commit 6f9f17788090) |
+| `.github/workflows/provenance.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/provenance.yml` | `docker/login-action@v3` | `v3 (resolves to v3.7.0)` | `v4.6.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v3 resolves to v3.7.0 (commit c94ce9fb4685), behind latest release v4.6.0 (commit dbcb813823bd); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/release.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/release.yml` | `oven-sh/setup-bun@v2` | `v2 (resolves to v2.2.0)` | `v2.2.0` | up-to-date | tag-pinned (not SHA-pinned); floating tag v2 resolves to v2.2.0, which IS the latest release -- tracks latest within that major |
+| `.github/workflows/release.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/release.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/release.yml` | `docker/setup-buildx-action@v3` | `v3 (resolves to v3.12.0)` | `v4.4.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v3 resolves to v3.12.0 (commit 8d2750c68a42), behind latest release v4.4.1 (commit f87e5991a6d7); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/release.yml` | `docker/login-action@v3` | `v3 (resolves to v3.7.0)` | `v4.6.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v3 resolves to v3.7.0 (commit c94ce9fb4685), behind latest release v4.6.0 (commit dbcb813823bd); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/release.yml` | `docker/build-push-action@v5` | `v5 (resolves to v5.4.0)` | `v7.4.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.4.0 (commit ca052bb54ab0), behind latest release v7.4.0 (commit c3c9e263c25d); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/release.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/release.yml` | `actions/download-artifact@v4` | `v4 (resolves to v4.3.0)` | `v8.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.3.0 (commit d3f86a106a0b), behind latest release v8.0.1 (commit 3e5f45b2cfb9); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/release.yml` | `sigstore/cosign-installer@v3` | `v3 (resolves to v3.9.1)` | `v4.1.2` | MAJOR | tag-pinned (not SHA-pinned); floating tag v3 resolves to v3.9.1 (commit 398d4b0eeef1), behind latest release v4.1.2 (commit 6f9f17788090) |
+| `.github/workflows/release.yml` | `anchore/sbom-action@v0` | `v0 (resolves to v0.24.0)` | `v0.24.2` | patch | tag-pinned (not SHA-pinned); floating tag v0 resolves to v0.24.0 (commit e22c38990414), behind latest release v0.24.2 (commit 3ad7283483fc) |
+| `.github/workflows/release.yml` | `peter-evans/dockerhub-description@v4` | `v4 (resolves to v4.0.2)` | `v5.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.0.2 (commit 432a30c9e074), behind latest release v5.0.0 (commit 1b9a80c056b6); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/sbom.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/sbom.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/sbom.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/security-audit.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/security-audit.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/security-audit.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/security-audit.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/security-audit.yml` | `actions/checkout@11d5960a326750d5838078e36cf38b85af677262` | `11d5960a326750d5838078e36cf38b85af677262  # v4` | `v7.0.1` | MAJOR | SHA-pinned; action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/security-audit.yml` | `actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02` | `ea165f8d65b6e75b540449e92b4886f43607fa02  # v4` | `v7.0.1` | MAJOR | SHA-pinned; action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/security-audit.yml` | `github/codeql-action/init@f3712979fa5f215279b101dd0a2e3bdfb4353324` | `f3712979fa5f215279b101dd0a2e3bdfb4353324` | `codeql-bundle-v2.27.1` | unknown | SHA-pinned, no version comment; latest release is codeql-bundle-v2.27.1; action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/security-audit.yml` | `github/codeql-action/analyze@f3712979fa5f215279b101dd0a2e3bdfb4353324` | `f3712979fa5f215279b101dd0a2e3bdfb4353324` | `codeql-bundle-v2.27.1` | unknown | SHA-pinned, no version comment; latest release is codeql-bundle-v2.27.1; action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/security-audit.yml` | `oven-sh/setup-bun@v2` | `v2 (resolves to v2.2.0)` | `v2.2.0` | up-to-date | tag-pinned (not SHA-pinned); floating tag v2 resolves to v2.2.0, which IS the latest release -- tracks latest within that major |
+| `.github/workflows/sentrux-real.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/sentrux-real.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/sentrux-real.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/soak-monitor.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/soak-monitor.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/test.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/test.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/test.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/test.yml` | `oven-sh/setup-bun@v2` | `v2 (resolves to v2.2.0)` | `v2.2.0` | up-to-date | tag-pinned (not SHA-pinned); floating tag v2 resolves to v2.2.0, which IS the latest release -- tracks latest within that major |
+| `.github/workflows/test.yml` | `actions/cache@v4` | `v4 (resolves to v4.3.0)` | `v6.1.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.3.0 (commit 0057852bfaa8), behind latest release v6.1.0 (commit 55cc8345863c); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/test.yml` | `azure/setup-helm@v4` | `v4 (resolves to v4.3.1)` | `v5.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.3.1 (commit 1a275c3b6953), behind latest release v5.0.1 (commit 9bc31f4ebc9c); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/tier-a.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/tier-a.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/workflows/tier-a.yml` | `oven-sh/setup-bun@v2` | `v2 (resolves to v2.2.0)` | `v2.2.0` | up-to-date | tag-pinned (not SHA-pinned); floating tag v2 resolves to v2.2.0, which IS the latest release -- tracks latest within that major |
+| `.github/workflows/tier-a.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `action.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
+| `.github/actions/issue-to-pr/action.yml` | `(none found)` | `` | `-` | n/a | no `uses:` step found in this workflow/action file |
+| `.github/actions/review/action.yml` | `(none found)` | `` | `-` | n/a | no `uses:` step found in this workflow/action file |
+
+**Node 20 runtime deprecation:** GitHub's own Node 20 deprecation covers two distinct things and they must not be conflated. First, matrix jobs still targeting `node-version: 20` (files: .github/workflows/test.yml). Second, and separately: an action whose OWN `action.yml` declares `using: node20` IS the deprecated runtime itself, regardless of what version tag or SHA it is pinned to -- pinning to the latest release of such an action does not fix this until that action's maintainers migrate its action.yml to node22 or later. Every `uses:` target in this repo's workflows was checked at its pinned ref via the GitHub Contents API; action.yml itself declares node20 for: actions/cache, actions/checkout, actions/download-artifact, actions/setup-node, actions/setup-python, actions/upload-artifact, azure/setup-helm, contributor-assistant/github-action, docker/build-push-action, docker/login-action, docker/setup-buildx-action, docker/setup-qemu-action, github/codeql-action/analyze, github/codeql-action/init, peter-evans/dockerhub-description.
+
+## Runtime matrices
+
+Node.js current stable: 26.10.0 (cycle 26); Python current stable: 3.14.7 (cycle 3.14); Bun current stable: bun-v1.4.2.
+
+(The File column lists every workflow file pinning that version.)
+
+| File | Name | Current | Latest stable | Bump | Note |
+|---|---|---|---|---|---|
+| `.github/workflows/test.yml` | `Node.js` | `20` | `20.20.2 (newest line 26.10.0)` | EOL | EOL 2026-04-30 (past); EOL in current line; newest line is 26.10.0 |
+| `.github/workflows/integrity-audit.yml, .github/workflows/loki-ci-example.yml, .github/workflows/nightly.yml, .github/workflows/sentrux-real.yml, .github/workflows/test.yml, +1 more` | `Node.js` | `22` | `22.23.3 (newest line 26.10.0)` | MAJOR | EOL 2027-04-30 (not yet); minor in line; MAJOR to newest line |
+| `.github/workflows/test.yml` | `Node.js` | `24` | `24.21.0 (newest line 26.10.0)` | MAJOR | EOL 2028-04-30 (not yet); minor in line; MAJOR to newest line |
+| `.github/workflows/test.yml` | `Python` | `3.10` | `3.10.21 (newest line 3.14.7)` | minor | EOL 2026-10-31 (not yet); patch in line; minor to newest line |
+| `.github/workflows/test.yml` | `Python` | `3.11` | `3.11.16 (newest line 3.14.7)` | minor | EOL 2027-10-31 (not yet); patch in line; minor to newest line |
+| `.github/workflows/bun-parity.yml, .github/workflows/model-catalog-probe.yml, .github/workflows/nightly.yml, .github/workflows/parity-drift.yml, .github/workflows/test.yml, +1 more` | `Python` | `3.12` | `3.12.14 (newest line 3.14.7)` | minor | EOL 2028-10-31 (not yet); patch in line; minor to newest line |
+| `.github/workflows/test.yml` | `Python` | `3.13` | `3.13.15 (newest line 3.14.7)` | minor | EOL 2029-10-31 (not yet); patch in line; minor to newest line |
+| `.github/workflows/bun-parity.yml, .github/workflows/check-phase6-ready.yml, .github/workflows/coverage.yml, .github/workflows/mutation-testing.yml, .github/workflows/nightly.yml, +5 more` | `Bun` | `1.3.13` | `bun-v1.4.2` | minor |  |
+| `.github/workflows/nightly.yml, .github/workflows/test.yml` | `Bun` | `latest` | `-` | unknown | not a numeric version, skipped |
+
+## Docker / Compose images
+
+| File | Name | Current | Latest stable | Bump | Note |
+|---|---|---|---|---|---|
+| `Dockerfile` | `ubuntu:24.04` | `ubuntu:24.04` | `24.04.5 (newest line 26.04.1)` | MAJOR | EOL 2029-05-31 (not yet); patch in line; MAJOR to newest line |
+| `Dockerfile.purplelab-test` | `node:22-slim` | `node:22-slim` | `22.23.3 (newest line 26.10.0)` | MAJOR | EOL 2027-04-30 (not yet); minor in line; MAJOR to newest line |
+| `Dockerfile.sandbox` | `debian:bookworm-slim` | `debian:bookworm-slim` | `12.15 (newest line 13.7)` | MAJOR | EOL 2028-06-30 (not yet); minor in line; MAJOR to newest line |
+| `Dockerfile.sandbox` | `debian:bookworm-slim` | `debian:bookworm-slim` | `12.15 (newest line 13.7)` | MAJOR | EOL 2028-06-30 (not yet); minor in line; MAJOR to newest line |
+| `Dockerfile.test-runner` | `python:3.12-slim` | `python:3.12-slim` | `3.12.14 (newest line 3.14.7)` | minor | EOL 2028-10-31 (not yet); patch in line; minor to newest line |
+| `artifacts/observability/Dockerfile` | `nginx:1.27-alpine` | `nginx:1.27-alpine` | `1.27.5 (newest line 1.31.6)` | EOL | EOL 2025-06-24 (past); EOL in current line; newest line is 1.31.6 |
+| `dashboard/Dockerfile` | `python:3.11-slim-bookworm` | `python:3.11-slim-bookworm` | `3.11.16 (newest line 3.14.7)` | minor | EOL 2027-10-31 (not yet); patch in line; minor to newest line |
+| `web-app/Dockerfile` | `node:22-alpine` | `node:22-alpine` | `22.23.3 (newest line 26.10.0)` | MAJOR | EOL 2027-04-30 (not yet); minor in line; MAJOR to newest line |
+| `web-app/Dockerfile` | `python:3.12-slim` | `python:3.12-slim` | `3.12.14 (newest line 3.14.7)` | minor | EOL 2028-10-31 (not yet); patch in line; minor to newest line |
+| `dashboard/docker-compose.yml` | `loki-dashboard:latest` | `loki-dashboard:latest` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
+| `deploy/docker-compose/docker-compose.yml` | `asklokesh/loki-mode:latest` | `asklokesh/loki-mode:latest` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
+| `deploy/docker-compose/docker-compose.yml` | `otel/opentelemetry-collector-contrib:0.96.0` | `otel/opentelemetry-collector-contrib:0.96.0` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
+| `deploy/docker-compose/docker-compose.yml` | `jaegertracing/all-in-one:1.54` | `jaegertracing/all-in-one:1.54` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
+| `docker-compose.yml` | `loki-mode:latest` | `loki-mode:latest` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
+| `docker-compose.yml` | `chromadb/chroma:latest` | `chromadb/chroma:latest` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
+| `docker-compose.yml` | `loki-mode:latest` | `loki-mode:latest` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
+| `docker-compose.yml` | `loki-mode:latest` | `loki-mode:latest` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
+| `docker-compose.yml` | `redis:7-alpine` | `redis:7-alpine` | `7.4.11 (newest line 8.10.2)` | MAJOR | EOL 2029-12-01 (not yet); resolved floating tag '7' to cycle 7.4; minor in line; MAJOR to newest line |
+| `web-app/docker-compose.purple-lab.yml` | `postgres:16-alpine` | `postgres:16-alpine` | `16.15 (newest line 18.6)` | MAJOR | EOL 2028-11-09 (not yet); minor in line; MAJOR to newest line |
+| `web-app/docker-compose.purple-lab.yml` | `redis:7-alpine` | `redis:7-alpine` | `7.4.11 (newest line 8.10.2)` | MAJOR | EOL 2029-12-01 (not yet); resolved floating tag '7' to cycle 7.4; minor in line; MAJOR to newest line |
+| `docker-compose.test.yml` | `(none found)` | `` | `-` | n/a | no `FROM` / `image:` line found (build-context-only service, or a multi-stage FROM this pass did not match) |
+
+## Helm (every `Chart.yaml` found via `git ls-files`, any directory)
+
+| File | Name | Current | Latest stable | Bump | Note |
+|---|---|---|---|---|---|
+| `deploy/helm/autonomi/Chart.yaml` | `appVersion` | `7.93.0` | `10.2.1` | drifted | DRIFTED: chart appVersion does not track the product VERSION file (10.2.1) |
+| `deploy/helm/autonomi/Chart.yaml` | `chart dependencies` | `(none declared)` | `-` | n/a |  |
+| `deploy/helm/autonomi/templates/tests/test-controlplane-health.yaml` | `curlimages/curl:8.11.1` | `curlimages/curl:8.11.1` | `-` | unknown | floating/arbitrary registry tag, see Docker section for endoflife-mapped images |
+| `deploy/helm/autonomi/tests/test-connection.yaml` | `curlimages/curl:8.5.0` | `curlimages/curl:8.5.0` | `-` | unknown | floating/arbitrary registry tag, see Docker section for endoflife-mapped images |
+| `deploy/helm/autonomi/tests/test-health.yaml` | `curlimages/curl:8.5.0` | `curlimages/curl:8.5.0` | `-` | unknown | floating/arbitrary registry tag, see Docker section for endoflife-mapped images |
+| `deploy/helm/autonomi/values.yaml` | `alpine/git:latest` | `alpine/git:latest` | `-` | unknown | floating/arbitrary registry tag, see Docker section for endoflife-mapped images |
+| `deploy/helm/autonomi/values.yaml` | `image.repository` | `asklokesh/loki-mode:(defaults to appVersion)` | `-` | n/a | own product image, tracked via VERSION not a third-party dep |
+| `helm/loki-mode/Chart.yaml` | `appVersion` | `9.19.1` | `10.2.1` | drifted | DRIFTED: chart appVersion does not track the product VERSION file (10.2.1) |
+| `helm/loki-mode/Chart.yaml` | `chart dependencies` | `(none declared)` | `-` | n/a |  |
+| `helm/loki-mode/values.yaml` | `redis:7-alpine` | `redis:7-alpine` | `-` | unknown | floating/arbitrary registry tag, see Docker section for endoflife-mapped images |
+| `helm/loki-mode/values.yaml` | `image.repository` | `asklokesh/loki-mode:(defaults to appVersion)` | `-` | n/a | own product image, tracked via VERSION not a third-party dep |
+| `deploy/helm/autonomi/templates/configmap.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `deploy/helm/autonomi/templates/deployment-controlplane.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `deploy/helm/autonomi/templates/deployment-worker.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `deploy/helm/autonomi/templates/hpa-worker.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `deploy/helm/autonomi/templates/ingress.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `deploy/helm/autonomi/templates/job-worker.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `deploy/helm/autonomi/templates/keda-scaledjob.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `deploy/helm/autonomi/templates/keda-scaledobject.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `deploy/helm/autonomi/templates/namespace.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `deploy/helm/autonomi/templates/networkpolicy.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `deploy/helm/autonomi/templates/pdb.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `deploy/helm/autonomi/templates/pvc-audit.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `deploy/helm/autonomi/templates/pvc-checkpoints.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `deploy/helm/autonomi/templates/rbac.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `deploy/helm/autonomi/templates/secret.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `deploy/helm/autonomi/templates/service-controlplane.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `deploy/helm/autonomi/templates/service-worker.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `deploy/helm/autonomi/templates/serviceaccount.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `deploy/helm/autonomi/templates/servicemonitor.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `deploy/helm/autonomi/values-ha.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `deploy/helm/autonomi/values-production.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `helm/loki-mode/templates/networkpolicy.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `helm/loki-mode/templates/receiver-configmap.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `helm/loki-mode/templates/receiver-deployment.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `helm/loki-mode/templates/receiver-service.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `helm/loki-mode/templates/redis.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `helm/loki-mode/templates/secret.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `helm/loki-mode/templates/serviceaccount.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `helm/loki-mode/templates/tests/test-receiver-health.yaml` | `(none found)` | `` | `-` | n/a | test fixture; no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `helm/loki-mode/templates/worker-deployment.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+| `helm/loki-mode/templates/worker-hpa.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
+
+## Terraform providers
+
+| File | Name | Current | Latest stable | Bump | Note |
+|---|---|---|---|---|---|
+| `deploy/terraform/modules/aws-ecs/versions.tf` | `aws (hashicorp/aws)` | `>= 5.0` | `6.66.0` | MAJOR |  |
+| `deploy/terraform/modules/aws/versions.tf` | `aws (hashicorp/aws)` | `>= 5.0` | `6.66.0` | MAJOR |  |
+| `deploy/terraform/modules/azure/versions.tf` | `azurerm (hashicorp/azurerm)` | `>= 3.0` | `5.7.0` | MAJOR |  |
+| `deploy/terraform/modules/gcp/versions.tf` | `google (hashicorp/google)` | `>= 5.0` | `8.4.0` | MAJOR |  |
+| `deploy/terraform/examples/aws-eks/main.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
+| `deploy/terraform/examples/azure-aks/main.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
+| `deploy/terraform/examples/gcp-gke/main.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
+| `deploy/terraform/modules/aws-ecs/main.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
+| `deploy/terraform/modules/aws-ecs/outputs.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
+| `deploy/terraform/modules/aws-ecs/variables.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
+| `deploy/terraform/modules/aws/main.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
+| `deploy/terraform/modules/aws/outputs.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
+| `deploy/terraform/modules/aws/variables.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
+| `deploy/terraform/modules/azure/main.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
+| `deploy/terraform/modules/azure/outputs.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
+| `deploy/terraform/modules/azure/variables.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
+| `deploy/terraform/modules/gcp/main.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
+| `deploy/terraform/modules/gcp/outputs.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
+| `deploy/terraform/modules/gcp/variables.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
+
+## Homebrew
+
+Formula lives in a separate repo: `asklokesh/homebrew-tap`, `Formula/loki-mode.rb` (updated by `.github/workflows/release.yml` job `update-homebrew` via the GitHub Contents API on every release).
+
+| File | Name | Current | Latest stable | Bump | Note |
+|---|---|---|---|---|---|
+| `asklokesh/homebrew-tap:Formula/loki-mode.rb` | `loki-mode` | `10.2.1` | `10.2.1` | up-to-date | repo VERSION file is 10.2.1 |
+
+## Summary
+
+Counts are all from the single `Bump` column (current line vs newest line in the product; see the Latest column for the current-line patch when it differs from the newest line). `0.x breaking` and `drifted` are their own columns, not folded into MAJOR, since they are not the same computation.
+
+| Ecosystem | patch | minor | 0.x breaking | MAJOR | EOL | drifted | unknown | up-to-date | other |
+|---|---|---|---|---|---|---|---|---|---|
+| npm/bun | 1 | 11 | 4 | 24 | 0 | 0 | 1 | 7 | 0 |
+| Python (requirements) | 1 | 9 | 10 | 9 | 0 | 0 | 10 | 1 | 0 |
+| Python (pyproject) | 0 | 1 | 1 | 1 | 0 | 0 | 1 | 0 | 0 |
+| GitHub Actions | 1 | 0 | 0 | 75 | 0 | 0 | 2 | 13 | 2 |
+| Runtimes | 0 | 5 | 0 | 2 | 1 | 0 | 1 | 0 | 0 |
+| Docker/Compose | 0 | 3 | 0 | 8 | 1 | 0 | 8 | 0 | 1 |
+| Helm | 0 | 0 | 0 | 0 | 0 | 2 | 5 | 0 | 34 |
+| Terraform | 0 | 0 | 0 | 4 | 0 | 0 | 0 | 0 | 15 |
+| Homebrew | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 1 | 0 |
+
+## Proposed slice list (D35)
+
+- **LOW - npm/bun patch+minor batch** (one slice for the whole ecosystem, touching every file below; lockfiles regenerated and committed):
+  - `dashboard-ui/package.json`: @playwright/test ^1.58.1->1.63.0
+  - `vscode-extension/package.json`: @types/vscode ^1.85.0->1.138.0
+  - `web-app/package.json`: @playwright/test ^1.58.2->1.63.0, @types/react ^19.0.10->19.3.0, @types/react-dom ^19.0.4->19.3.0, autoprefixer ^10.4.20->10.6.1, postcss ^8.5.3->8.5.28, react ^19.0.0->19.3.0, react-dom ^19.0.0->19.3.0, react-resizable-panels ^4.7.3->4.14.1, react-router-dom ^7.13.1->7.18.4, typescript-eslint ^8.24.1->8.70.1
+- **LOW - Python patch+minor batch** (one slice for the whole ecosystem, touching every file below; lockfiles regenerated and committed):
+  - `dashboard/requirements.txt`: greenlet >=3.0.0,<4.0.0->3.5.6, pydantic >=2.0.0,<3.0.0->2.13.5, sqlalchemy >=2.0.0,<3.0.0->2.1.1
+  - `mcp/requirements.txt`: chromadb >=1.0.0,<2.0.0->1.5.9
+  - `web-app/requirements.txt`: alembic >=1.12.0->1.20.0, pexpect >=4.8.0->4.9.0, pydantic >=2.0.0->2.13.5, python-jose >=3.3.0->3.5.0, pyyaml >=6.0->6.0.3, sqlalchemy >=2.0.0->2.1.1
+- **LOW - Python (pyproject) patch+minor batch** (one slice for the whole ecosystem, touching every file below; lockfiles regenerated and committed):
+  - `sdk/python/pyproject.toml`: pydantic >=2.0.0->2.13.5
+- **MEDIUM - one slice per MAJOR (or 0.x-breaking) package**, deduped across manifests:
+  - `@eslint/js` -> `10.0.1` (MAJOR): web-app/package.json
+  - `@types/node` -> `26.6.3` (MAJOR): package.json, vscode-extension/package.json
+  - `@typescript-eslint/eslint-plugin` -> `8.70.1` (MAJOR): vscode-extension/package.json
+  - `@typescript-eslint/parser` -> `8.70.1` (MAJOR): vscode-extension/package.json
+  - `@vitejs/plugin-react` -> `6.1.1` (MAJOR): web-app/package.json
+  - `@vscode/vsce` -> `4.0.0` (MAJOR): vscode-extension/package.json
+  - `aiosqlite` -> `0.22.1` (0.x breaking): dashboard/requirements.txt, web-app/requirements.txt
+  - `anthropic` -> `1.8.0` (MAJOR): mcp/requirements.txt
+  - `asyncpg` -> `0.31.0` (0.x breaking): web-app/requirements.txt
+  - `cryptography` -> `50.0.1` (MAJOR): requirements-test.txt, web-app/requirements.txt
+  - `esbuild` -> `0.28.2` (0.x breaking): dashboard-ui/package.json, vscode-extension/package.json
+  - `eslint` -> `10.11.0` (MAJOR): vscode-extension/package.json, web-app/package.json
+  - `eslint-plugin-react-hooks` -> `7.1.1` (MAJOR): web-app/package.json
+  - `eslint-plugin-react-refresh` -> `0.5.7` (0.x breaking): web-app/package.json
+  - `fastapi` -> `0.141.1` (0.x breaking): dashboard/requirements.txt, web-app/requirements.txt
+  - `globals` -> `17.12.0` (MAJOR): web-app/package.json
+  - `httpx` -> `0.28.1` (0.x breaking): sdk/python/pyproject.toml, web-app/requirements-test.txt, web-app/requirements.txt
+  - `jest` -> `30.5.2` (MAJOR): dashboard-ui/package.json, package.json
+  - `jest-environment-jsdom` -> `30.5.2` (MAJOR): dashboard-ui/package.json
+  - `jsdom` -> `30.1.1` (MAJOR): dashboard-ui/package.json, package.json
+  - `lucide-react` -> `1.48.0` (MAJOR): web-app/package.json
+  - `mcp` -> `2.2.0` (MAJOR): mcp/requirements.txt, requirements-test.txt
+  - `pytest` -> `9.1.1` (MAJOR): web-app/requirements-test.txt
+  - `pytest-asyncio` -> `1.4.0` (MAJOR): web-app/requirements-test.txt
+  - `python-multipart` -> `0.0.32` (0.x breaking): web-app/requirements.txt
+  - `setuptools` -> `84.0.0` (MAJOR): sdk/python/pyproject.toml
+  - `tailwindcss` -> `4.3.3` (MAJOR): web-app/package.json
+  - `typescript` -> `7.0.2` (MAJOR): loki-ts/package.json, package.json, sdk/typescript/package.json, vscode-extension/package.json, web-app/package.json
+  - `uvicorn` -> `0.54.0` (0.x breaking): dashboard/requirements.txt, web-app/requirements.txt
+  - `vite` -> `8.3.1` (MAJOR): web-app/package.json
+  - `watchdog` -> `6.0.0` (MAJOR): web-app/requirements.txt
+  - `websockets` -> `17.1` (MAJOR): dashboard/requirements.txt
+- **MEDIUM - one slice per Actions MAJOR**, deduped by action across workflows (bump to latest major AND SHA-pin with a `# vN` comment in the same slice, per D35):
+  - `actions/cache` v4 (resolves to v4.3.0) -> `v6.1.0`: .github/workflows/test.yml
+  - `actions/checkout` 11d5960a326750d5838078e36cf38b85af677262, v4 (resolves to v4.4.0) -> `v7.0.1`: .github/workflows/bun-parity.yml, .github/workflows/check-phase6-ready.yml, .github/workflows/claude-code-review.yml, .github/workflows/coverage.yml, .github/workflows/integrity-audit.yml, +16 more
+  - `actions/download-artifact` v4 (resolves to v4.3.0) -> `v8.0.1`: .github/workflows/loki-enterprise.yml, .github/workflows/loki-issue-to-pr.yml, .github/workflows/release.yml
+  - `actions/setup-node` v4 (resolves to v4.4.0) -> `v7.0.0`: .github/workflows/integrity-audit.yml, .github/workflows/loki-ci-example.yml, .github/workflows/loki-enterprise.yml, .github/workflows/loki-issue-to-pr.yml, .github/workflows/mutation-testing.yml, +10 more
+  - `actions/setup-python` v5 (resolves to v5.6.0) -> `v7.0.0`: .github/workflows/bun-parity.yml, .github/workflows/integrity-audit.yml, .github/workflows/model-catalog-probe.yml, .github/workflows/nightly.yml, .github/workflows/parity-drift.yml, +5 more
+  - `actions/upload-artifact` ea165f8d65b6e75b540449e92b4886f43607fa02, v4 (resolves to v4.6.2) -> `v7.0.1`: .github/workflows/check-phase6-ready.yml, .github/workflows/coverage.yml, .github/workflows/loki-ci-example.yml, .github/workflows/loki-enterprise.yml, .github/workflows/loki-issue-to-pr.yml, +8 more
+  - `azure/setup-helm` v4 (resolves to v4.3.1) -> `v5.0.1`: .github/workflows/integrity-audit.yml, .github/workflows/test.yml
+  - `docker/build-push-action` v5 (resolves to v5.4.0) -> `v7.4.0`: .github/workflows/release.yml
+  - `docker/login-action` v3 (resolves to v3.7.0) -> `v4.6.0`: .github/workflows/provenance.yml, .github/workflows/release.yml
+  - `docker/setup-buildx-action` v3 (resolves to v3.12.0) -> `v4.4.1`: .github/workflows/release.yml
+  - `docker/setup-qemu-action` v3 (resolves to v3.7.0) -> `v4.4.0`: .github/workflows/arm64-runtime.yml
+  - `peter-evans/dockerhub-description` v4 (resolves to v4.0.2) -> `v5.0.0`: .github/workflows/release.yml
+  - `sigstore/cosign-installer` v3 (resolves to v3.9.1) -> `v4.1.2`: .github/workflows/provenance.yml, .github/workflows/release.yml
+- **LOW - Actions SHA-pinning** (already on latest major, just needs pinning): convert every tag-pinned `uses:` to a SHA pin with a trailing `# vN` comment (the pattern already used for `actions/checkout` and `actions/upload-artifact` in security-audit.yml):
+  - `anchore/sbom-action`: .github/workflows/release.yml
+  - `anthropics/claude-code-action`: .github/workflows/claude-code-review.yml
+  - `contributor-assistant/github-action`: .github/workflows/cla.yml
+  - `oven-sh/setup-bun`: .github/workflows/bun-parity.yml, .github/workflows/check-phase6-ready.yml, .github/workflows/coverage.yml, .github/workflows/mutation-testing.yml, .github/workflows/nightly.yml, +6 more
+- **MEDIUM - one slice per Terraform provider MAJOR**:
+  - `deploy/terraform/modules/aws-ecs/versions.tf`: `aws (hashicorp/aws)` >= 5.0 -> 6.66.0
+  - `deploy/terraform/modules/aws/versions.tf`: `aws (hashicorp/aws)` >= 5.0 -> 6.66.0
+  - `deploy/terraform/modules/azure/versions.tf`: `azurerm (hashicorp/azurerm)` >= 3.0 -> 5.7.0
+  - `deploy/terraform/modules/gcp/versions.tf`: `google (hashicorp/google)` >= 5.0 -> 8.4.0
+- **MEDIUM - runtime matrix refresh**:
+  - `Node.js` 20 is EOL (EOL 2026-04-30 (past); EOL in current line; newest line is 26.10.0), pinned by: .github/workflows/test.yml
+  - Node 20 is named in the upstream Actions runtime deprecation warnings even where not yet past its endoflife.date EOL; pinned by: .github/workflows/test.yml
+- **MEDIUM - SDKs with the 5-task eval**: `@anthropic-ai/claude-agent-sdk` 0.3.283 -> 0.3.283 (up-to-date, `loki-ts/package.json`); `@anthropic-ai/sdk` ^0.124.0 -> 0.128.0 (0.x breaking, `loki-ts/package.json`). Gated on the 5-task eval per D35, not the plain patch/minor batch.
+- **LOW - Docker/Helm digest pass**: pin every `FROM` / `image:` tag by digest instead of a mutable tag (own-product images and `:latest` floating tags are out of scope for a version bump and tracked via VERSION instead).
+  - EOL now: `nginx:1.27-alpine` in `artifacts/observability/Dockerfile` (EOL 2025-06-24 (past); EOL in current line; newest line is 1.31.6)
+- **FINDING - Helm chart appVersion has drifted from the product VERSION**:
+  - `deploy/helm/autonomi/Chart.yaml`: appVersion `7.93.0` vs VERSION `10.2.1`
+  - `helm/loki-mode/Chart.yaml`: appVersion `9.19.1` vs VERSION `10.2.1`
+

package/docs/v10/PROGRESS.md

@@ -1,5 +1,15 @@
 # Progress
 
+## 2026-09-28T16:30Z: D37 release cadence in force; "20 waiting slices" were already shipped; drift audit (turn 468)
+- Founder directive 16:20Z (D37): cut at :00, :20, :40 whenever main is green and a merged-unreleased slice exists; trains overlap after publish-npm; release blockers are P0 with a guard. Session cron 0b6676af runs the Release Manager tick at :00/:20/:40.
+- Reconciliation: `git log v10.2.1..origin/main` showed only 2 docs commits (03911808, 4bbda895); every BOARD row marked merged had all its cited commits as ancestors of a published tag (`git merge-base --is-ancestor`), so the "20 merged slices waiting" were stale BOARD cells, not unreleased work. 27 rows flipped to released with their tag (E-71, E-73 corrected to v10.1.0 from their merge 172bec99). E-90 automates this after each publish; E-89 adds RELEASE_CADENCE to the pulse (building, wf_aa962a0e-002).
+- Release notes (D36): six GitHub releases (v9.80.1 to v10.2.1) had placeholder bodies because release.yml's awk never matched dated headings; backfilled from CHANGELOG with `gh release edit`; E-88 enforces it.
+- Drift audit: last 6h shipped v10.1.1 and v10.2.1 (2 releases; 10.2.0 blocked by a Security Audit false positive and a dispatch path the gate cannot count, both now guarded: E-86, E-87). Main red once in the window (9d483688, fixed by E-83). Throughput gap: releases waited on me reviewing and on hand-run bumps; the cadence cron and E-89 remove that.
+
+## 2026-09-28T16:05Z: v10.2.1 shipped (carries the unpublished 10.2.0)
+- Release run 36446416984 success; Security Audit 36446416943 success on 815640d9; `npm view loki-mode dist-tags` latest 10.2.1, gitHead 815640d9 = release commit; GitHub release v10.2.1 published 15:53:56Z; `loki --version` from a fresh prefix prints "Loki Mode v10.2.1" (rc=0).
+- In flight: wave E23 (M-07, M-10, M-11, M-12, E-67, E-79..E-81 reworks), wave E24 (EV-12S rebase, EV-12A/B/C large tasks; 2 of 5 needed large tasks passed review so far: lg-werkzeug-1513, lg-werkzeug-1680), E-86 rework (4 reproduced fail-opens in the pre-push gitleaks check), DEP-01 rework in review.
+
 ## 2026-09-28T15:45Z: 10.2.0 cannot publish by dispatch; re-release as 10.2.1; drift audit (turn 456)
 - Security Audit dispatched on 8e7d21f2 (run 36442754156) completed success, but Release dispatched on main (run 36443541666) sat in required-ci: release.yml counts only event=="push" runs, and Security Audit runs on push only when VERSION changes, so a dispatched audit is never counted. Cancelled before its 40-minute deadline. Re-release follows the 10.0.1 precedent: push the train, Tests and Bun Parity green, bump to 10.2.1 so the VERSION push runs Security Audit and Release. E-87 cut for the dispatch path.
 - Gitleaks root cause: the pub-werkzeug-3271 prompt (upstream issue text) contains a sourcegraph.com URL, which arms the sourcegraph-access-token rule, which then matches the 40-hex repo.ref. Local `gitleaks git` (8.30.0 and 8.30.1) does not reproduce it; `gitleaks dir eval/loki10/tasks` with v8.30.0 does (1 finding). E-86 (pre-push check) uses dir mode with the pinned v8.30.0.
@@ -8,7 +18,7 @@
 
 ## 2026-09-28T15:20Z: v10.2.0 publish blocked by Security Audit (gitleaks false positive)
 - Release run 36440534050 failed at required-ci: Security Audit 36440534022 failed with 1 new gitleaks finding (report artifact gitleaks-report): rule sourcegraph-access-token at eval/loki10/tasks/pub-werkzeug-3271/task.json:8, commit 82e39c29 (EV-11a). The value is repo.ref, a 40-hex pallets/werkzeug commit (`gh api repos/pallets/werkzeug/commits/<ref>` resolves, dated 2026-09-13). Not a credential.
-- Fix: that exact commit-qualified fingerprint added to .gitleaksignore with a justification (no path or rule suppression). Nothing was tagged or published for 10.2.0; the Release workflow is re-dispatched on main once Tests, Bun Parity and Security Audit are green on the fix commit.
+- Allowlist: that exact commit-qualified fingerprint added to .gitleaksignore in 8e7d21f2 with a justification (no path or rule suppression); Security Audit run 36446416943 on the 10.2.1 VERSION push reported zero unmatched findings. Nothing was tagged or published for 10.2.0.
 - Recurrence risk: every pub-*/lg-* task pins a 40-hex SHA; E-85 asks the CTO for a narrowly scoped rule. TRAIN_LATE read 681 min because the pulse only reads ~/loki-ci-logs/push-*.log, which plain `git push` never writes; E-84 fixes it.
 
 ## 2026-09-28T14:58Z: main red on train E22, E-83 fix-forward (c5ace6e1; Tests green on 378a2e13)

package/loki-ts/dist/loki.js

@@ -1,5 +1,5 @@
 // @bun
-var Un=Object.create;var{getPrototypeOf:On,defineProperty:zG,getOwnPropertyNames:Mn}=Object;var Nn=Object.prototype.hasOwnProperty;function jn($){return this[$]}var Ln,An,Cn=($,Z,Q)=>{var X=$!=null&&typeof $==="object";if(X){var J=Z?Ln??=new WeakMap:An??=new WeakMap,K=J.get($);if(K)return K}Q=$!=null?Un(On($)):{};let Y=Z||!$||!$.__esModule?zG(Q,"default",{value:$,enumerable:!0}):Q;for(let V of Mn($))if(!Nn.call(Y,V))zG(Y,V,{get:jn.bind($,V),enumerable:!0});if(X)J.set($,Y);return Y};var sJ=($,Z)=>()=>(Z||$((Z={exports:{}}).exports,Z),Z.exports);var Tn=($)=>$;function Dn($,Z){this[$]=Tn.bind(null,Z)}var R0=($,Z)=>{for(var Q in Z)zG($,Q,{get:Z[Q],enumerable:!0,configurable:!0,set:Dn.bind(Z,Q)})};var v=($,Z)=>()=>($&&(Z=$($=0)),Z);var D7=import.meta.require;var lC={};R0(lC,{lokiDir:()=>T0,homeLokiDir:()=>E4,findRepoRootForVersion:()=>qG,REPO_ROOT:()=>i0});import{resolve as F7,dirname as WG}from"path";import{fileURLToPath as Fn}from"url";import{existsSync as rJ}from"fs";import{homedir as In}from"os";function wn(){let $=cC;for(let Z=0;Z<6;Z++){if(rJ(F7($,"VERSION"))&&rJ(F7($,"autonomy/run.sh")))return $;let Q=WG($);if(Q===$)break;$=Q}return F7(cC,"..","..","..")}function qG($){let Z=$;for(let Q=0;Q<6;Q++){if(rJ(F7(Z,"VERSION"))&&rJ(F7(Z,"autonomy/run.sh")))return Z;let X=WG(Z);if(X===Z)break;Z=X}return F7($,"..","..","..")}function T0(){return process.env.LOKI_DIR??F7(process.cwd(),".loki")}function E4(){return F7(In(),".loki")}var cC,i0;var X8=v(()=>{cC=WG(Fn(import.meta.url));i0=wn()});import{readFileSync as Rn}from"fs";import{resolve as Pn,dirname as En}from"path";import{fileURLToPath as kn}from"url";function I7(){if(k4!==null)return k4;let $="10.2.1";if(typeof $==="string"&&$.length>0)return k4=$,k4;try{let Z=En(kn(import.meta.url)),Q=qG(Z);k4=Rn(Pn(Q,"VERSION"),"utf-8").trim()}catch{k4="unknown"}return k4}var k4=null;var I$=v(()=>{X8()});var tC={};R0(tC,{runOrThrow:()=>an,run:()=>D0,readStreamCapped:()=>tJ,commandVersion:()=>nn,commandExists:()=>J9,ShellError:()=>HG,MAX_STDOUT_BYTES:()=>rC});async function tJ($,Z=rC){let Q=$.getReader(),X=new TextDecoder,J="",K=0;try{while(K<Z){let{done:Y,value:V}=await Q.read();if(Y)break;if(!V)continue;if(K+=V.byteLength,K>Z){let z=V.byteLength-(K-Z);J+=X.decode(V.subarray(0,z),{stream:!0});break}J+=X.decode(V,{stream:!0})}J+=X.decode()}finally{try{await Q.cancel()}catch{}Q.releaseLock()}return J}async function D0($,Z={}){let Q=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:Z.env?{...process.env,...Z.env}:process.env,cwd:Z.cwd}),X,J;if(Z.timeoutMs&&Z.timeoutMs>0)X=setTimeout(()=>{try{Q.kill("SIGTERM")}catch{}J=setTimeout(()=>{try{Q.kill("SIGKILL")}catch{}},2000)},Z.timeoutMs);try{let[K,Y,V]=await Promise.all([tJ(Q.stdout),new Response(Q.stderr).text(),Q.exited]);return{stdout:K,stderr:Y,exitCode:V}}finally{if(X)clearTimeout(X);if(J)clearTimeout(J)}}async function an($,Z={}){let Q=await D0($,Z);if(Q.exitCode!==0)throw new HG(`command failed (${Q.exitCode}): ${$.join(" ")}`,Q.exitCode,Q.stdout,Q.stderr);return Q}async function J9($){let Z=on($),Q=await D0(["sh","-c",`command -v ${Z}`],{timeoutMs:5000});if(Q.exitCode===0)return Q.stdout.trim()||null;return null}function on($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function nn($,Z="--version"){if(!await J9($))return null;let X=await D0([$,Z],{timeoutMs:5000});if(X.exitCode!==0)return null;return((X.stdout||X.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var rC=16777216,HG;var K9=v(()=>{HG=class HG extends Error{message;exitCode;stdout;stderr;constructor($,Z,Q,X){super($);this.message=$;this.exitCode=Z;this.stdout=Q;this.stderr=X;this.name="ShellError"}}});function w7($){return sn?"":$}var sn,k0,P8,d0,T28,J8,j8,Y9,p;var l5=v(()=>{sn=(process.env.NO_COLOR??"").length>0;k0=w7("\x1B[0;31m"),P8=w7("\x1B[0;32m"),d0=w7("\x1B[1;33m"),T28=w7("\x1B[0;34m"),J8=w7("\x1B[0;36m"),j8=w7("\x1B[1m"),Y9=w7("\x1B[2m"),p=w7("\x1B[0m")});import{accessSync as Ys,constants as Vs,existsSync as zs,statSync as Ws}from"fs";async function r6(){if(w$!==void 0)return w$;let $="/opt/homebrew/bin/python3.12";if(zs($))return w$=$,$;let Z=await J9("python3.12");if(Z)return w$=Z,Z;let Q=await J9("python3");return w$=Q,Q}async function M6($,Z={}){let Q=await r6();if(!Q)return{stdout:"",stderr:"python3 not found",exitCode:127};return D0([Q,"-c",$],Z)}async function R7(){let $=(process.env.PATH??"").split(":").filter((Z)=>Z.startsWith("/"));for(let Z of[...Gs,...$.map((Q)=>`${Q}/python3`)])try{if(!Ws(Z).isFile())continue;if(Ys(Z,Vs.X_OK),(await D0([Z,"-I","-S","-c",""],{timeoutMs:1e4})).exitCode===0)return Z}catch{}return null}var w$,qs,Gs;var C5=v(()=>{K9();qs=["/usr/bin/python3","/bin/python3"],Gs=qs});var jT={};R0(jT,{runStatus:()=>fs});import{existsSync as V9,readFileSync as $2,readdirSync as qT,statSync as GT}from"fs";import{resolve as u8,basename as Rs}from"path";import{homedir as Ps}from"os";function HT($){let Z=Math.trunc($);if(Z>=1e6)return`${(Math.trunc(Z/1e6*10)/10).toFixed(1)}M`;if(Z>=1000)return`${(Math.trunc(Z/1000*10)/10).toFixed(1)}K`;return String(Z)}function BT($,Z,Q){if(Z===0)return null;let X=Math.trunc($*100/Z),J=Math.trunc($*$K/Z);if(J>$K)J=$K;let K=$K-J,Y=P8;if(X>=80)Y=k0;else if(X>=50)Y=d0;let V="=".repeat(Math.max(0,J))+" ".repeat(Math.max(0,K)),z=HT($),W=HT(Z);return`  ${j8}${Q}${p} ${Y}[${V}]${p} ${X}% (${z} / ${W})`}async function ks(){if(await J9("jq"))return!0;return process.stdout.write(`${k0}Error: jq is required but not installed.${p}
+var Un=Object.create;var{getPrototypeOf:On,defineProperty:zG,getOwnPropertyNames:Mn}=Object;var Nn=Object.prototype.hasOwnProperty;function jn($){return this[$]}var Ln,An,Cn=($,Z,Q)=>{var X=$!=null&&typeof $==="object";if(X){var J=Z?Ln??=new WeakMap:An??=new WeakMap,K=J.get($);if(K)return K}Q=$!=null?Un(On($)):{};let Y=Z||!$||!$.__esModule?zG(Q,"default",{value:$,enumerable:!0}):Q;for(let V of Mn($))if(!Nn.call(Y,V))zG(Y,V,{get:jn.bind($,V),enumerable:!0});if(X)J.set($,Y);return Y};var sJ=($,Z)=>()=>(Z||$((Z={exports:{}}).exports,Z),Z.exports);var Tn=($)=>$;function Dn($,Z){this[$]=Tn.bind(null,Z)}var R0=($,Z)=>{for(var Q in Z)zG($,Q,{get:Z[Q],enumerable:!0,configurable:!0,set:Dn.bind(Z,Q)})};var v=($,Z)=>()=>($&&(Z=$($=0)),Z);var D7=import.meta.require;var lC={};R0(lC,{lokiDir:()=>T0,homeLokiDir:()=>E4,findRepoRootForVersion:()=>qG,REPO_ROOT:()=>i0});import{resolve as F7,dirname as WG}from"path";import{fileURLToPath as Fn}from"url";import{existsSync as rJ}from"fs";import{homedir as In}from"os";function wn(){let $=cC;for(let Z=0;Z<6;Z++){if(rJ(F7($,"VERSION"))&&rJ(F7($,"autonomy/run.sh")))return $;let Q=WG($);if(Q===$)break;$=Q}return F7(cC,"..","..","..")}function qG($){let Z=$;for(let Q=0;Q<6;Q++){if(rJ(F7(Z,"VERSION"))&&rJ(F7(Z,"autonomy/run.sh")))return Z;let X=WG(Z);if(X===Z)break;Z=X}return F7($,"..","..","..")}function T0(){return process.env.LOKI_DIR??F7(process.cwd(),".loki")}function E4(){return F7(In(),".loki")}var cC,i0;var X8=v(()=>{cC=WG(Fn(import.meta.url));i0=wn()});import{readFileSync as Rn}from"fs";import{resolve as Pn,dirname as En}from"path";import{fileURLToPath as kn}from"url";function I7(){if(k4!==null)return k4;let $="10.2.2";if(typeof $==="string"&&$.length>0)return k4=$,k4;try{let Z=En(kn(import.meta.url)),Q=qG(Z);k4=Rn(Pn(Q,"VERSION"),"utf-8").trim()}catch{k4="unknown"}return k4}var k4=null;var I$=v(()=>{X8()});var tC={};R0(tC,{runOrThrow:()=>an,run:()=>D0,readStreamCapped:()=>tJ,commandVersion:()=>nn,commandExists:()=>J9,ShellError:()=>HG,MAX_STDOUT_BYTES:()=>rC});async function tJ($,Z=rC){let Q=$.getReader(),X=new TextDecoder,J="",K=0;try{while(K<Z){let{done:Y,value:V}=await Q.read();if(Y)break;if(!V)continue;if(K+=V.byteLength,K>Z){let z=V.byteLength-(K-Z);J+=X.decode(V.subarray(0,z),{stream:!0});break}J+=X.decode(V,{stream:!0})}J+=X.decode()}finally{try{await Q.cancel()}catch{}Q.releaseLock()}return J}async function D0($,Z={}){let Q=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:Z.env?{...process.env,...Z.env}:process.env,cwd:Z.cwd}),X,J;if(Z.timeoutMs&&Z.timeoutMs>0)X=setTimeout(()=>{try{Q.kill("SIGTERM")}catch{}J=setTimeout(()=>{try{Q.kill("SIGKILL")}catch{}},2000)},Z.timeoutMs);try{let[K,Y,V]=await Promise.all([tJ(Q.stdout),new Response(Q.stderr).text(),Q.exited]);return{stdout:K,stderr:Y,exitCode:V}}finally{if(X)clearTimeout(X);if(J)clearTimeout(J)}}async function an($,Z={}){let Q=await D0($,Z);if(Q.exitCode!==0)throw new HG(`command failed (${Q.exitCode}): ${$.join(" ")}`,Q.exitCode,Q.stdout,Q.stderr);return Q}async function J9($){let Z=on($),Q=await D0(["sh","-c",`command -v ${Z}`],{timeoutMs:5000});if(Q.exitCode===0)return Q.stdout.trim()||null;return null}function on($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function nn($,Z="--version"){if(!await J9($))return null;let X=await D0([$,Z],{timeoutMs:5000});if(X.exitCode!==0)return null;return((X.stdout||X.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var rC=16777216,HG;var K9=v(()=>{HG=class HG extends Error{message;exitCode;stdout;stderr;constructor($,Z,Q,X){super($);this.message=$;this.exitCode=Z;this.stdout=Q;this.stderr=X;this.name="ShellError"}}});function w7($){return sn?"":$}var sn,k0,P8,d0,T28,J8,j8,Y9,p;var l5=v(()=>{sn=(process.env.NO_COLOR??"").length>0;k0=w7("\x1B[0;31m"),P8=w7("\x1B[0;32m"),d0=w7("\x1B[1;33m"),T28=w7("\x1B[0;34m"),J8=w7("\x1B[0;36m"),j8=w7("\x1B[1m"),Y9=w7("\x1B[2m"),p=w7("\x1B[0m")});import{accessSync as Ys,constants as Vs,existsSync as zs,statSync as Ws}from"fs";async function r6(){if(w$!==void 0)return w$;let $="/opt/homebrew/bin/python3.12";if(zs($))return w$=$,$;let Z=await J9("python3.12");if(Z)return w$=Z,Z;let Q=await J9("python3");return w$=Q,Q}async function M6($,Z={}){let Q=await r6();if(!Q)return{stdout:"",stderr:"python3 not found",exitCode:127};return D0([Q,"-c",$],Z)}async function R7(){let $=(process.env.PATH??"").split(":").filter((Z)=>Z.startsWith("/"));for(let Z of[...Gs,...$.map((Q)=>`${Q}/python3`)])try{if(!Ws(Z).isFile())continue;if(Ys(Z,Vs.X_OK),(await D0([Z,"-I","-S","-c",""],{timeoutMs:1e4})).exitCode===0)return Z}catch{}return null}var w$,qs,Gs;var C5=v(()=>{K9();qs=["/usr/bin/python3","/bin/python3"],Gs=qs});var jT={};R0(jT,{runStatus:()=>fs});import{existsSync as V9,readFileSync as $2,readdirSync as qT,statSync as GT}from"fs";import{resolve as u8,basename as Rs}from"path";import{homedir as Ps}from"os";function HT($){let Z=Math.trunc($);if(Z>=1e6)return`${(Math.trunc(Z/1e6*10)/10).toFixed(1)}M`;if(Z>=1000)return`${(Math.trunc(Z/1000*10)/10).toFixed(1)}K`;return String(Z)}function BT($,Z,Q){if(Z===0)return null;let X=Math.trunc($*100/Z),J=Math.trunc($*$K/Z);if(J>$K)J=$K;let K=$K-J,Y=P8;if(X>=80)Y=k0;else if(X>=50)Y=d0;let V="=".repeat(Math.max(0,J))+" ".repeat(Math.max(0,K)),z=HT($),W=HT(Z);return`  ${j8}${Q}${p} ${Y}[${V}]${p} ${X}% (${z} / ${W})`}async function ks(){if(await J9("jq"))return!0;return process.stdout.write(`${k0}Error: jq is required but not installed.${p}
 `),process.stdout.write(`Install with:
 `),process.stdout.write(`  brew install jq    (macOS)
 `),process.stdout.write(`  apt install jq     (Debian/Ubuntu)
@@ -1494,4 +1494,4 @@ Set LOKI_LEGACY_BASH=1 to force the bash CLI for every command.
 `),2}case"start":{let{runStart:X}=await Promise.resolve().then(() => (el(),tl));return X(Q)}case"engine10":{let{runEngine10:X}=await Promise.resolve().then(() => (Qi(),Zi)),{registryLoader:J}=await Promise.resolve().then(() => (wq(),Kn));return X(Q,J)}default:return process.stderr.write(`Unknown command: ${Z}
 `),process.stderr.write(Yn),2}}zT();process.on("SIGINT",()=>process.exit(130));process.on("SIGTERM",()=>process.exit(143));var J28=await X28(Bun.argv.slice(2));process.exit(J28);
 
-//# debugId=BC06E14209F62A17482CF642F56CD89C
+//# debugId=D83A23029A7C37E06F0C62EB09B6DF92

package/mcp/__init__.py

@@ -75,4 +75,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '10.2.1'
+__version__ = '10.2.2'

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "loki-mode",
   "mcpName": "io.github.asklokesh/loki-mode",
-  "version": "10.2.1",
+  "version": "10.2.2",
   "description": "Loki Mode by Autonomi. Autonomous spec-to-product system: takes a PRD, GitHub issue, OpenAPI/JSON/YAML, or one-line brief to a deployed app via the RARV-C closure loop with 8 quality gates. Provider-agnostic (Claude Code, OpenAI Codex, Cline, Aider, opencode).",
   "keywords": [
     "agent",

package/plugins/loki-mode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "loki-mode",
   "displayName": "Loki Mode",
-  "version": "10.2.1",
+  "version": "10.2.2",
   "description": "Autonomous spec-to-product build system with a built-in trust layer (RARV-C closure loop, 8 quality gates, completion council). Ships Loki's spec-hardening, drift-detection, and deterministic PR verification commands plus the Loki MCP server.",
   "author": {
     "name": "Autonomi",