loki-mode 10.9.1 → 10.10.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (107) hide show
  1. package/.github/actions/issue-to-pr/action.yml +2 -2
  2. package/README.md +9 -3
  3. package/SKILL.md +12 -2
  4. package/VERSION +1 -1
  5. package/autonomy/lib/proof-generator.py +1 -0
  6. package/autonomy/loki +39 -9
  7. package/autonomy/receipt_jwt.py +46 -1
  8. package/autonomy/run.sh +1 -1
  9. package/autonomy/telemetry.sh +1 -1
  10. package/autonomy/trigger-server.py +1 -0
  11. package/bin/loki +12 -1
  12. package/bin/loki-postinstall.js +12 -0
  13. package/dashboard/__init__.py +1 -1
  14. package/docs/CLI-REFERENCE.md +139 -0
  15. package/docs/INSTALLATION.md +1 -1
  16. package/docs/LOKI-10-BUILD-PROMPT.md +2 -2
  17. package/docs/PLANS-INDEX.md +2 -3
  18. package/docs/SLO.md +3 -3
  19. package/docs/alternative-installations.md +1 -1
  20. package/docs/bug-fixes/agent-04-memory-fixes.md +1 -1
  21. package/docs/dev/release-checklist.md +1 -1
  22. package/{.github/workflows/loki-issue-to-pr.yml → docs/examples/loki-issue-to-pr.yml.example} +2 -0
  23. package/docs/{ONE-RUN-AUDIT.md → history/one-run-audit.md} +6 -0
  24. package/docs/{BUG-AUDIT-v6.61.0.md → history/v6.61.0-audit.md} +6 -0
  25. package/docs/{V8-AGENT-SDK-PLAN.md → history/v8-agent-sdk-plan.md} +6 -0
  26. package/docs/{CONFIG-FILE-PLAN.md → history/v8-config-plan.md} +6 -0
  27. package/docs/test-scenarios/enterprise-scenarios.md +1 -1
  28. package/docs/v10/BOARD.md +3 -0
  29. package/docs/v10/CLI-MODERN.md +190 -0
  30. package/docs/v10/DEPS.md +148 -169
  31. package/docs/v10/FAILURE-CLASSES.md +18 -0
  32. package/docs/v10/LEGACY-REMOVAL.md +334 -25
  33. package/docs/v10/PROGRESS.md +15 -0
  34. package/loki-ts/dist/loki.js +1570 -1790
  35. package/mcp/__init__.py +1 -1
  36. package/package.json +3 -2
  37. package/packages/control-plane/dist/server.js +424 -327
  38. package/packages/control-plane/src/db/fixture-cleanup.ts +47 -0
  39. package/packages/control-plane/src/server/app.ts +2 -0
  40. package/packages/control-plane/src/server/integrity.ts +48 -9
  41. package/packages/control-plane/src/server/routes/stats.ts +16 -5
  42. package/packages/control-plane/src/server/runs.ts +16 -4
  43. package/packages/control-plane/ui/dist/assets/index-NAMkcA9N.js +165 -0
  44. package/packages/control-plane/ui/dist/index.html +1 -1
  45. package/plugins/loki-mode/.claude-plugin/plugin.json +1 -1
  46. package/schemas/status-result.schema.json +13 -22
  47. package/skills/release-cadence.md +5 -5
  48. package/web-app/dist/assets/{AdminPage-DqMnfZrH.js → AdminPage-B8RjG3sy.js} +1 -1
  49. package/web-app/dist/assets/{Avatar-BEof29du.js → Avatar-Dttmvqc-.js} +1 -1
  50. package/web-app/dist/assets/{Badge-WD53OL5m.js → Badge-Bvyp8VrD.js} +1 -1
  51. package/web-app/dist/assets/{Button-Rzk5flhU.js → Button-DtY5ZrZw.js} +1 -1
  52. package/web-app/dist/assets/{CockpitPage-Bqz3PCMh.js → CockpitPage-B2gbOwRp.js} +1 -1
  53. package/web-app/dist/assets/{ComparePage-Byo2NzAZ.js → ComparePage-CHi5nZTU.js} +1 -1
  54. package/web-app/dist/assets/{ErrorBoundary-BuE0kH3W.js → ErrorBoundary-BUuTj-OQ.js} +1 -1
  55. package/web-app/dist/assets/{EvidenceReceiptPanel-CKFHOPBx.js → EvidenceReceiptPanel-C5aOn4ES.js} +1 -1
  56. package/web-app/dist/assets/{GitHubIssuesPanel-Df_kTMqI.js → GitHubIssuesPanel-isVxxHXb.js} +1 -1
  57. package/web-app/dist/assets/{GitHubPRsPanel-CouvcKrZ.js → GitHubPRsPanel-DtDpxyQl.js} +1 -1
  58. package/web-app/dist/assets/{HomePage-dEpLzj0x.js → HomePage-Casf-LUB.js} +2 -2
  59. package/web-app/dist/assets/{LoginPage-6DVjUND5.js → LoginPage-DvB78691.js} +1 -1
  60. package/web-app/dist/assets/{MagicPage-BDQ9MOfY.js → MagicPage-DU6hmbnC.js} +1 -1
  61. package/web-app/dist/assets/{MetricsPage-CXiJ04G_.js → MetricsPage-DcPwzoS8.js} +1 -1
  62. package/web-app/dist/assets/{NotFoundPage-BaXhZvyj.js → NotFoundPage-Bs6WxAZ8.js} +1 -1
  63. package/web-app/dist/assets/{ProjectPage-BzE4V7Ti.js → ProjectPage-RBIqC-DJ.js} +3 -3
  64. package/web-app/dist/assets/{ProjectsPage-ipf6TLMX.js → ProjectsPage-CogXD7jM.js} +1 -1
  65. package/web-app/dist/assets/{SettingsPage-BDxkUKN6.js → SettingsPage-pAyJAfPt.js} +1 -1
  66. package/web-app/dist/assets/{ShowcasePage-YQXD72SM.js → ShowcasePage-D6bT2bDd.js} +1 -1
  67. package/web-app/dist/assets/{SystemSettingsPage-Dou7zHS0.js → SystemSettingsPage-CE8xiJRh.js} +1 -1
  68. package/web-app/dist/assets/{TeamsPage-CQarfcYr.js → TeamsPage-wMS55TDT.js} +1 -1
  69. package/web-app/dist/assets/{TemplatesPage-CPi1R8Xj.js → TemplatesPage-COJNVQqu.js} +1 -1
  70. package/web-app/dist/assets/{TerminalOutput-WiGhWdYD.js → TerminalOutput-Cc2XASxd.js} +1 -1
  71. package/web-app/dist/assets/{activity-DOa7ejQA.js → activity-C6eHFDjL.js} +1 -1
  72. package/web-app/dist/assets/{bell-CX-VAlYN.js → bell-BJpVYj4n.js} +1 -1
  73. package/web-app/dist/assets/{bot-EDXaZmHc.js → bot-BwRVVUQL.js} +1 -1
  74. package/web-app/dist/assets/{check-CnBdKk3L.js → check-CGDwoKy8.js} +1 -1
  75. package/web-app/dist/assets/{chevron-left-BJ_ydRQW.js → chevron-left-CF2Nilj6.js} +1 -1
  76. package/web-app/dist/assets/{circle-alert-tz8ufhc_.js → circle-alert-D0RyRec1.js} +1 -1
  77. package/web-app/dist/assets/{clock-DFBZPSsH.js → clock-xeF3gW0W.js} +1 -1
  78. package/web-app/dist/assets/{cloud-uy3p_5Q7.js → cloud-D5Sy69ZZ.js} +1 -1
  79. package/web-app/dist/assets/{code-xml-3CbYD9YL.js → code-xml-C6-5Ql9I.js} +1 -1
  80. package/web-app/dist/assets/{database-YiNBXc9c.js → database-BSjG1_z0.js} +1 -1
  81. package/web-app/dist/assets/{dollar-sign-D0wBa4Cv.js → dollar-sign-FnDR2QUu.js} +1 -1
  82. package/web-app/dist/assets/{file-code-corner-DDdZVZ5v.js → file-code-corner-BiOK9vR6.js} +1 -1
  83. package/web-app/dist/assets/{file-plus-D09LTBqt.js → file-plus-3WALQDEE.js} +1 -1
  84. package/web-app/dist/assets/{globe-BirTPwff.js → globe-vUdUrQqp.js} +1 -1
  85. package/web-app/dist/assets/{hammer-DaE5qgnd.js → hammer-0VwHUEpa.js} +1 -1
  86. package/web-app/dist/assets/{index-D8t7KnQf.js → index-BMKIwteZ.js} +3 -3
  87. package/web-app/dist/assets/{layers-DVVrckRY.js → layers-C6q8kzST.js} +1 -1
  88. package/web-app/dist/assets/{loader-circle-2-nMGmcb.js → loader-circle-B4Tz724d.js} +1 -1
  89. package/web-app/dist/assets/{lock-D0Xj43pC.js → lock-yxvEA65n.js} +1 -1
  90. package/web-app/dist/assets/{package-BB7S3egm.js → package-BpKD0Ot0.js} +1 -1
  91. package/web-app/dist/assets/{plus-BLhoMrn3.js → plus-Ibqx_Vo9.js} +1 -1
  92. package/web-app/dist/assets/{refresh-cw-DMc2uPLw.js → refresh-cw-C9auyvi-.js} +1 -1
  93. package/web-app/dist/assets/{rotate-ccw-DM3IP9x7.js → rotate-ccw-2cEiXm6O.js} +1 -1
  94. package/web-app/dist/assets/{scroll-text-lH2uW7rB.js → scroll-text-BPAWML-w.js} +1 -1
  95. package/web-app/dist/assets/{server-BkerZcdR.js → server-CZh6B1zx.js} +1 -1
  96. package/web-app/dist/assets/{shield-alert-B8ohcUfu.js → shield-alert-CivolUIx.js} +1 -1
  97. package/web-app/dist/assets/{thumbs-up-CTIxLzPD.js → thumbs-up-BP9covEH.js} +1 -1
  98. package/web-app/dist/assets/{trash-2-C3zIpsH5.js → trash-2-BCDfTcNx.js} +1 -1
  99. package/web-app/dist/assets/{trending-down-BTT7wV4Y.js → trending-down-5LypivXh.js} +1 -1
  100. package/web-app/dist/assets/{trending-up-BzHdCDvF.js → trending-up-DNt4SFdk.js} +1 -1
  101. package/web-app/dist/assets/{upload-HxR34-A8.js → upload-DBmHbY6y.js} +1 -1
  102. package/web-app/dist/assets/{usePolling-DDj6Fupy.js → usePolling-DOPZcbUL.js} +1 -1
  103. package/web-app/dist/assets/{user-qH5y9yNy.js → user-BQTJJDCG.js} +1 -1
  104. package/web-app/dist/index.html +1 -1
  105. package/docs/BRANCH-LIFECYCLE-PLAN.md +0 -354
  106. package/docs/EXECUTION-COCKPIT-PLAN.md +0 -289
  107. package/packages/control-plane/ui/dist/assets/index-Dbhu244h.js +0 -155
package/docs/v10/DEPS.md CHANGED
@@ -1,6 +1,6 @@
1
1
  # Dependency Inventory (D35 DEP-01)
2
2
 
3
- Generated by `scripts/dep-inventory.py`. Lookup date: 2026-09-28.
3
+ Generated by `scripts/dep-inventory.py`. Lookup date: 2026-10-03.
4
4
 
5
5
  Inventory only. No dependency, lockfile, workflow or image was changed to produce this report. Manifests are discovered with `git ls-files`, never a filesystem walk. Network lookups are cached under the `--cache` directory so re-running against the same cache is byte-identical.
6
6
 
@@ -8,118 +8,118 @@ Inventory only. No dependency, lockfile, workflow or image was changed to produc
8
8
 
9
9
  | File | Name | Current | Latest stable | Bump | Note |
10
10
  |---|---|---|---|---|---|
11
- | `legacy-ui/package.json` | `@playwright/test` | `^1.58.1` | `1.63.0` | minor | |
12
- | `legacy-ui/package.json` | `esbuild` | `^0.24.0` | `0.28.2` | 0.x breaking | |
13
- | `legacy-ui/package.json` | `jest` | `^29.7.0` | `30.5.2` | MAJOR | |
14
- | `legacy-ui/package.json` | `jest-environment-jsdom` | `^29.7.0` | `30.5.2` | MAJOR | |
15
- | `legacy-ui/package.json` | `jsdom` | `^24.0.0` | `30.1.1` | MAJOR | |
16
- | `loki-ts/package.json` | `@anthropic-ai/claude-agent-sdk` | `0.3.283` | `0.3.283` | up-to-date | |
17
- | `loki-ts/package.json` | `@anthropic-ai/sdk` | `^0.124.0` | `0.128.0` | 0.x breaking | |
11
+ | `loki-ts/package.json` | `@anthropic-ai/claude-agent-sdk` | `0.3.288` | `0.3.288` | up-to-date | |
12
+ | `loki-ts/package.json` | `@anthropic-ai/sdk` | `^0.124.0` | `0.131.0` | 0.x breaking | |
18
13
  | `loki-ts/package.json` | `@resvg/resvg-wasm` | `^2.6.2` | `2.6.2` | up-to-date | |
19
14
  | `loki-ts/package.json` | `@types/bun` | `latest` | `1.4.2` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
20
15
  | `loki-ts/package.json` | `typescript` | `^5.6.0` | `7.0.2` | MAJOR | |
21
- | `loki-ts/tests/engine10/fixtures/testmap/package.json` | `vitest` | `^2.0.0` | `5.0.2` | MAJOR | test fixture, not a real dependency |
16
+ | `loki-ts/tests/engine10/fixtures/testmap/package.json` | `vitest` | `^2.0.0` | `5.0.3` | MAJOR | test fixture, not a real dependency |
17
+ | `loki-ts/tests/fixtures/project-model/firelater-17/backend/package.json` | `vitest` | `^1.0.0` | `5.0.3` | MAJOR | test fixture, not a real dependency |
22
18
  | `package.json` | `@resvg/resvg-wasm` | `^2.6.2` | `2.6.2` | up-to-date | |
23
- | `package.json` | `@types/node` | `^25.2.0` | `26.6.3` | MAJOR | |
19
+ | `package.json` | `@types/node` | `^25.2.0` | `26.6.4` | MAJOR | |
24
20
  | `package.json` | `jest` | `^29.7.0` | `30.5.2` | MAJOR | |
25
21
  | `package.json` | `jsdom` | `^24.0.0` | `30.1.1` | MAJOR | |
26
22
  | `package.json` | `typescript` | `^5.9.3` | `7.0.2` | MAJOR | |
27
- | `packages/control-plane/package.json` | `drizzle-kit` | `^0.31.11` | `0.31.11` | up-to-date | |
28
23
  | `packages/control-plane/package.json` | `drizzle-orm` | `^0.45.3` | `0.45.3` | up-to-date | |
29
24
  | `packages/control-plane/package.json` | `hono` | `^4.13.12` | `4.13.12` | up-to-date | |
25
+ | `packages/control-plane/package.json` | `yaml` | `^2.9.1` | `2.9.1` | up-to-date | |
26
+ | `packages/control-plane/package.json` | `@playwright/test` | `1.58.1` | `1.63.0` | minor | |
27
+ | `packages/control-plane/package.json` | `axe-core` | `4.13.0` | `4.13.0` | up-to-date | |
28
+ | `packages/control-plane/package.json` | `drizzle-kit` | `^0.31.11` | `0.31.11` | up-to-date | |
29
+ | `packages/control-plane/ui/package.json` | `lucide-react` | `^0.577.0` | `1.51.0` | MAJOR | |
30
+ | `packages/control-plane/ui/package.json` | `react` | `^19.3.0` | `19.3.0` | up-to-date | |
31
+ | `packages/control-plane/ui/package.json` | `react-dom` | `^19.3.0` | `19.3.0` | up-to-date | |
30
32
  | `packages/control-plane/ui/package.json` | `@happy-dom/global-registrator` | `^18.0.1` | `20.14.5` | MAJOR | |
31
33
  | `packages/control-plane/ui/package.json` | `@testing-library/react` | `^16.3.0` | `16.3.3` | patch | |
32
34
  | `packages/control-plane/ui/package.json` | `@types/react` | `^19.0.0` | `19.3.0` | minor | |
33
- | `packages/control-plane/ui/package.json` | `@types/react-dom` | `^19.0.0` | `unknown` | unknown | |
35
+ | `packages/control-plane/ui/package.json` | `@types/react-dom` | `^19.0.0` | `19.3.0` | minor | |
34
36
  | `packages/control-plane/ui/package.json` | `@vitejs/plugin-react` | `^4.3.4` | `6.1.1` | MAJOR | |
35
37
  | `packages/control-plane/ui/package.json` | `autoprefixer` | `^10.6.1` | `10.6.1` | up-to-date | |
36
- | `packages/control-plane/ui/package.json` | `lucide-react` | `^0.577.0` | `1.49.0` | MAJOR | |
37
38
  | `packages/control-plane/ui/package.json` | `postcss` | `^8.5.28` | `8.5.28` | up-to-date | |
38
- | `packages/control-plane/ui/package.json` | `react` | `^19.3.0` | `19.3.0` | up-to-date | |
39
- | `packages/control-plane/ui/package.json` | `react-dom` | `^19.3.0` | `19.3.0` | up-to-date | |
40
39
  | `packages/control-plane/ui/package.json` | `tailwindcss` | `^3.4.17` | `4.3.3` | MAJOR | |
41
40
  | `packages/control-plane/ui/package.json` | `typescript` | `~5.7.2` | `7.0.2` | MAJOR | |
42
41
  | `packages/control-plane/ui/package.json` | `vite` | `^6.2.0` | `8.3.2` | MAJOR | |
43
42
  | `sdk/typescript/package.json` | `typescript` | `^5.9.3` | `7.0.2` | MAJOR | |
44
- | `vscode-extension/package.json` | `@types/node` | `^20.10.0` | `26.6.3` | MAJOR | |
45
- | `vscode-extension/package.json` | `@types/vscode` | `^1.85.0` | `1.138.0` | minor | |
46
- | `vscode-extension/package.json` | `@typescript-eslint/eslint-plugin` | `^6.13.0` | `8.70.1` | MAJOR | |
47
- | `vscode-extension/package.json` | `@typescript-eslint/parser` | `^6.13.0` | `8.70.1` | MAJOR | |
43
+ | `vscode-extension/package.json` | `@types/node` | `^20.10.0` | `26.6.4` | MAJOR | |
44
+ | `vscode-extension/package.json` | `@types/vscode` | `^1.85.0` | `1.140.0` | minor | |
45
+ | `vscode-extension/package.json` | `@typescript-eslint/eslint-plugin` | `^6.13.0` | `8.71.0` | MAJOR | |
46
+ | `vscode-extension/package.json` | `@typescript-eslint/parser` | `^6.13.0` | `8.71.0` | MAJOR | |
48
47
  | `vscode-extension/package.json` | `@vscode/vsce` | `^2.22.0` | `4.0.0` | MAJOR | |
49
48
  | `vscode-extension/package.json` | `esbuild` | `^0.19.8` | `0.28.2` | 0.x breaking | |
50
- | `vscode-extension/package.json` | `eslint` | `^8.55.0` | `10.11.0` | MAJOR | |
49
+ | `vscode-extension/package.json` | `eslint` | `^8.55.0` | `10.12.0` | MAJOR | |
51
50
  | `vscode-extension/package.json` | `typescript` | `^5.3.2` | `7.0.2` | MAJOR | |
52
51
  | `web-app/package.json` | `@monaco-editor/react` | `^4.7.0` | `4.7.0` | up-to-date | |
53
52
  | `web-app/package.json` | `@xterm/addon-fit` | `^0.11.0` | `0.11.0` | up-to-date | |
54
53
  | `web-app/package.json` | `@xterm/addon-web-links` | `^0.12.0` | `0.12.0` | up-to-date | |
55
54
  | `web-app/package.json` | `@xterm/xterm` | `^6.0.0` | `6.0.0` | up-to-date | |
56
- | `web-app/package.json` | `lucide-react` | `^0.577.0` | `1.48.0` | MAJOR | |
57
- | `web-app/package.json` | `react` | `^19.0.0` | `19.3.0` | minor | |
58
- | `web-app/package.json` | `react-dom` | `^19.0.0` | `19.3.0` | minor | |
59
- | `web-app/package.json` | `react-resizable-panels` | `^4.7.3` | `4.14.1` | minor | |
60
- | `web-app/package.json` | `react-router-dom` | `^7.13.1` | `7.18.4` | minor | |
55
+ | `web-app/package.json` | `lucide-react` | `^0.577.0` | `1.51.0` | MAJOR | |
56
+ | `web-app/package.json` | `react` | `^19.3.0` | `19.3.0` | up-to-date | |
57
+ | `web-app/package.json` | `react-dom` | `^19.3.0` | `19.3.0` | up-to-date | |
58
+ | `web-app/package.json` | `react-resizable-panels` | `^4.14.1` | `4.14.2` | patch | |
59
+ | `web-app/package.json` | `react-router-dom` | `^7.18.4` | `7.18.4` | up-to-date | |
61
60
  | `web-app/package.json` | `@eslint/js` | `^9.21.0` | `10.0.1` | MAJOR | |
62
- | `web-app/package.json` | `@playwright/test` | `^1.58.2` | `1.63.0` | minor | |
63
- | `web-app/package.json` | `@types/react` | `^19.0.10` | `19.3.0` | minor | |
64
- | `web-app/package.json` | `@types/react-dom` | `^19.0.4` | `19.3.0` | minor | |
61
+ | `web-app/package.json` | `@playwright/test` | `^1.63.0` | `1.63.0` | up-to-date | |
62
+ | `web-app/package.json` | `@types/react` | `^19.3.0` | `19.3.0` | up-to-date | |
63
+ | `web-app/package.json` | `@types/react-dom` | `^19.3.0` | `19.3.0` | up-to-date | |
65
64
  | `web-app/package.json` | `@vitejs/plugin-react` | `^4.3.4` | `6.1.1` | MAJOR | |
66
- | `web-app/package.json` | `autoprefixer` | `^10.4.20` | `10.6.1` | minor | |
67
- | `web-app/package.json` | `eslint` | `^9.21.0` | `10.11.0` | MAJOR | |
65
+ | `web-app/package.json` | `autoprefixer` | `^10.6.1` | `10.6.1` | up-to-date | |
66
+ | `web-app/package.json` | `eslint` | `^9.21.0` | `10.12.0` | MAJOR | |
68
67
  | `web-app/package.json` | `eslint-plugin-react-hooks` | `^5.1.0` | `7.1.1` | MAJOR | |
69
68
  | `web-app/package.json` | `eslint-plugin-react-refresh` | `^0.4.19` | `0.5.7` | 0.x breaking | |
70
- | `web-app/package.json` | `globals` | `^15.15.0` | `17.12.0` | MAJOR | |
71
- | `web-app/package.json` | `postcss` | `^8.5.3` | `8.5.28` | patch | |
69
+ | `web-app/package.json` | `globals` | `^15.15.0` | `17.13.0` | MAJOR | |
70
+ | `web-app/package.json` | `postcss` | `^8.5.28` | `8.5.28` | up-to-date | |
72
71
  | `web-app/package.json` | `tailwindcss` | `^3.4.17` | `4.3.3` | MAJOR | |
73
72
  | `web-app/package.json` | `typescript` | `~5.7.2` | `7.0.2` | MAJOR | |
74
- | `web-app/package.json` | `typescript-eslint` | `^8.24.1` | `8.70.1` | minor | |
75
- | `web-app/package.json` | `vite` | `^6.2.0` | `8.3.1` | MAJOR | |
73
+ | `web-app/package.json` | `typescript-eslint` | `^8.70.1` | `8.71.0` | minor | |
74
+ | `web-app/package.json` | `vite` | `^6.2.0` | `8.3.2` | MAJOR | |
75
+ | `loki-ts/tests/fixtures/project-model/firelater-17/frontend/package.json` | `(none found)` | `` | `-` | n/a | test fixture; no dependencies or devDependencies declared |
76
76
 
77
77
  ## Python (requirements*.txt)
78
78
 
79
79
  | File | Name | Current | Latest stable | Bump | Note |
80
80
  |---|---|---|---|---|---|
81
- | `dashboard/requirements.txt` | `fastapi` | `>=0.100.0,<1.0.0` | `0.141.1` | 0.x breaking | |
81
+ | `dashboard/requirements.txt` | `fastapi` | `>=0.100.0,<1.0.0` | `0.142.2` | 0.x breaking | |
82
82
  | `dashboard/requirements.txt` | `uvicorn` | `>=0.20.0,<1.0.0` | `0.54.0` | 0.x breaking | |
83
- | `dashboard/requirements.txt` | `sqlalchemy` | `>=2.0.0,<3.0.0` | `2.1.1` | minor | |
83
+ | `dashboard/requirements.txt` | `sqlalchemy` | `>=2.1.1,<3.0.0` | `2.1.3` | patch | |
84
84
  | `dashboard/requirements.txt` | `aiosqlite` | `>=0.19.0,<1.0.0` | `0.22.1` | 0.x breaking | |
85
- | `dashboard/requirements.txt` | `greenlet` | `>=3.0.0,<4.0.0` | `3.5.6` | minor | |
86
- | `dashboard/requirements.txt` | `pydantic` | `>=2.0.0,<3.0.0` | `2.13.5` | minor | |
87
- | `dashboard/requirements.txt` | `websockets` | `>=12.0,<16.0` | `17.1` | MAJOR | |
88
- | `mcp/requirements.txt` | `mcp` | `>=1.0.0,<2.0.0` | `2.2.0` | MAJOR | |
89
- | `mcp/requirements.txt` | `chromadb` | `>=1.0.0,<2.0.0` | `1.5.9` | minor | |
90
- | `mcp/requirements.txt` | `anthropic` | `>=0.40,<1.0.0` | `1.8.0` | MAJOR | |
85
+ | `dashboard/requirements.txt` | `greenlet` | `>=3.5.6,<4.0.0` | `3.5.6` | up-to-date | |
86
+ | `dashboard/requirements.txt` | `pydantic` | `>=2.13.5,<3.0.0` | `2.13.5` | up-to-date | |
87
+ | `dashboard/requirements.txt` | `websockets` | `>=12.0,<16.0` | `17.2` | MAJOR | |
88
+ | `mcp/requirements.txt` | `mcp` | `>=1.0.0,<2.0.0` | `2.3.0` | MAJOR | |
89
+ | `mcp/requirements.txt` | `chromadb` | `>=1.5.9,<2.0.0` | `1.5.9` | up-to-date | |
90
+ | `mcp/requirements.txt` | `anthropic` | `>=0.40,<1.0.0` | `1.11.0` | MAJOR | |
91
91
  | `requirements-test.txt` | `pytest` | `(unpinned)` | `9.1.1` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
92
92
  | `requirements-test.txt` | `pytest-asyncio` | `(unpinned)` | `1.4.0` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
93
93
  | `requirements-test.txt` | `pytest-xdist` | `(unpinned)` | `3.8.0` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
94
- | `requirements-test.txt` | `mcp` | `>=1.0.0,<2.0.0` | `2.2.0` | MAJOR | |
94
+ | `requirements-test.txt` | `mcp` | `>=1.0.0,<2.0.0` | `2.3.0` | MAJOR | |
95
95
  | `requirements-test.txt` | `pydantic` | `(unpinned)` | `2.13.5` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
96
- | `requirements-test.txt` | `fastapi` | `(unpinned)` | `0.141.1` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
96
+ | `requirements-test.txt` | `fastapi` | `(unpinned)` | `0.142.2` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
97
97
  | `requirements-test.txt` | `uvicorn` | `(unpinned)` | `0.54.0` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
98
98
  | `requirements-test.txt` | `httpx` | `(unpinned)` | `0.28.1` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
99
- | `requirements-test.txt` | `sqlalchemy` | `(unpinned)` | `2.1.1` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
99
+ | `requirements-test.txt` | `sqlalchemy` | `(unpinned)` | `2.1.3` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
100
100
  | `requirements-test.txt` | `aiosqlite` | `(unpinned)` | `0.22.1` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
101
- | `requirements-test.txt` | `cryptography` | `>=41.0.0` | `50.0.1` | MAJOR | |
101
+ | `requirements-test.txt` | `cryptography` | `>=41.0.0` | `50.0.2` | MAJOR | |
102
102
  | `requirements-test.txt` | `pyyaml` | `(unpinned)` | `6.0.3` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
103
103
  | `tests/fixtures/legacy-checkout-app/requirements.txt` | `flask` | `==3.0.0` | `3.1.3` | minor | test fixture, not a real dependency |
104
- | `tests/fixtures/legacy-checkout-app/requirements.txt` | `stripe` | `==7.0.0` | `15.6.1` | MAJOR | test fixture, not a real dependency |
104
+ | `tests/fixtures/legacy-checkout-app/requirements.txt` | `stripe` | `==7.0.0` | `16.0.0` | MAJOR | test fixture, not a real dependency |
105
105
  | `web-app/requirements-test.txt` | `pytest` | `>=7.4.0` | `9.1.1` | MAJOR | |
106
106
  | `web-app/requirements-test.txt` | `pytest-asyncio` | `>=0.21.0` | `1.4.0` | MAJOR | |
107
107
  | `web-app/requirements-test.txt` | `httpx` | `>=0.24.0` | `0.28.1` | 0.x breaking | |
108
- | `web-app/requirements.txt` | `fastapi` | `>=0.100.0` | `0.141.1` | 0.x breaking | |
108
+ | `web-app/requirements.txt` | `fastapi` | `>=0.100.0` | `0.142.2` | 0.x breaking | |
109
109
  | `web-app/requirements.txt` | `uvicorn` | `>=0.20.0` | `0.54.0` | 0.x breaking | |
110
- | `web-app/requirements.txt` | `pydantic` | `>=2.0.0` | `2.13.5` | minor | |
110
+ | `web-app/requirements.txt` | `pydantic` | `>=2.13.5` | `2.13.5` | up-to-date | |
111
111
  | `web-app/requirements.txt` | `httpx` | `>=0.24.0` | `0.28.1` | 0.x breaking | |
112
112
  | `web-app/requirements.txt` | `python-multipart` | `>=0.0.9` | `0.0.32` | 0.x breaking | |
113
- | `web-app/requirements.txt` | `pexpect` | `>=4.8.0` | `4.9.0` | minor | |
113
+ | `web-app/requirements.txt` | `pexpect` | `>=4.9.0` | `4.9.0` | up-to-date | |
114
114
  | `web-app/requirements.txt` | `watchdog` | `>=3.0.0` | `6.0.0` | MAJOR | |
115
- | `web-app/requirements.txt` | `sqlalchemy` | `>=2.0.0` | `2.1.1` | minor | |
115
+ | `web-app/requirements.txt` | `sqlalchemy` | `>=2.1.1` | `2.1.3` | patch | |
116
116
  | `web-app/requirements.txt` | `asyncpg` | `>=0.28.0` | `0.31.0` | 0.x breaking | |
117
117
  | `web-app/requirements.txt` | `aiosqlite` | `>=0.19.0` | `0.22.1` | 0.x breaking | |
118
- | `web-app/requirements.txt` | `alembic` | `>=1.12.0` | `1.20.0` | minor | |
119
- | `web-app/requirements.txt` | `python-jose` | `>=3.3.0` | `3.5.0` | minor | |
118
+ | `web-app/requirements.txt` | `alembic` | `>=1.20.0` | `1.20.0` | up-to-date | |
119
+ | `web-app/requirements.txt` | `python-jose` | `>=3.5.0` | `3.5.0` | up-to-date | |
120
120
  | `web-app/requirements.txt` | `passlib` | `>=1.7.4` | `1.7.4` | up-to-date | |
121
- | `web-app/requirements.txt` | `cryptography` | `>=41.0.0` | `50.0.1` | MAJOR | |
122
- | `web-app/requirements.txt` | `pyyaml` | `>=6.0` | `6.0.3` | patch | |
121
+ | `web-app/requirements.txt` | `cryptography` | `>=41.0.0` | `50.0.2` | MAJOR | |
122
+ | `web-app/requirements.txt` | `pyyaml` | `>=6.0.3` | `6.0.3` | up-to-date | |
123
123
 
124
124
  ## Python (pyproject.toml)
125
125
 
@@ -128,7 +128,7 @@ Inventory only. No dependency, lockfile, workflow or image was changed to produc
128
128
  | `loki-ts/tests/engine10/fixtures/testmap/pyproject.toml` | `(none declared)` | `` | `-` | n/a | test fixture, not a real dependency |
129
129
  | `loki-ts/tests/engine10/modernize/fixtures/inv/sample-repo/pyproject.toml` | `(none declared)` | `` | `-` | n/a | test fixture, not a real dependency |
130
130
  | `sdk/python/pyproject.toml` | `httpx` | `>=0.24.0` | `0.28.1` | 0.x breaking | |
131
- | `sdk/python/pyproject.toml` | `pydantic` | `>=2.0.0` | `2.13.5` | minor | |
131
+ | `sdk/python/pyproject.toml` | `pydantic` | `>=2.13.5` | `2.13.5` | up-to-date | |
132
132
  | `sdk/python/pyproject.toml` | `setuptools` | `>=68.0` | `84.0.0` | MAJOR | |
133
133
  | `sdk/python/pyproject.toml` | `wheel` | `(unpinned)` | `0.48.0` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
134
134
 
@@ -136,49 +136,31 @@ Inventory only. No dependency, lockfile, workflow or image was changed to produc
136
136
 
137
137
  | File | Name | Current | Latest stable | Bump | Note |
138
138
  |---|---|---|---|---|---|
139
- | `.github/workflows/arm64-runtime.yml` | `docker/setup-qemu-action@v3` | `v3 (resolves to v3.7.0)` | `v4.4.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v3 resolves to v3.7.0 (commit c7c53464625b), behind latest release v4.4.0 (commit 990126619549); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
140
139
  | `.github/workflows/bun-parity.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
141
- | `.github/workflows/bun-parity.yml` | `oven-sh/setup-bun@v2` | `v2 (resolves to v2.2.0)` | `v2.2.0` | up-to-date | tag-pinned (not SHA-pinned); floating tag v2 resolves to v2.2.0, which IS the latest release -- tracks latest within that major |
140
+ | `.github/workflows/bun-parity.yml` | `oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6` | `0c5077e51419868618aeaa5fe8019c62421857d6 # v2` | `v2.2.0` | minor | SHA-pinned |
142
141
  | `.github/workflows/bun-parity.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
143
- | `.github/workflows/check-phase6-ready.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
144
- | `.github/workflows/check-phase6-ready.yml` | `oven-sh/setup-bun@v2` | `v2 (resolves to v2.2.0)` | `v2.2.0` | up-to-date | tag-pinned (not SHA-pinned); floating tag v2 resolves to v2.2.0, which IS the latest release -- tracks latest within that major |
145
- | `.github/workflows/check-phase6-ready.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
146
- | `.github/workflows/cla.yml` | `contributor-assistant/github-action@v2.6.1` | `v2.6.1` | `v2.6.1` | up-to-date | tag-pinned (not SHA-pinned); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
142
+ | `.github/workflows/cla.yml` | `contributor-assistant/github-action@ca4a40a7d1004f18d9960b404b97e5f30a505a08` | `ca4a40a7d1004f18d9960b404b97e5f30a505a08 # v2.6.1` | `v2.6.1` | up-to-date | SHA-pinned; action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
147
143
  | `.github/workflows/claude-code-review.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
148
- | `.github/workflows/claude-code-review.yml` | `anthropics/claude-code-action@v1` | `v1 (resolves to v1)` | `v1` | up-to-date | tag-pinned (not SHA-pinned); floating tag v1 resolves to v1, which IS the latest release -- tracks latest within that major |
144
+ | `.github/workflows/claude-code-review.yml` | `anthropics/claude-code-action@8ce9314fa9a404564fa7e954cd84f25bcba2b829` | `8ce9314fa9a404564fa7e954cd84f25bcba2b829 # v1` | `v1` | up-to-date | SHA-pinned |
149
145
  | `.github/workflows/coverage.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
150
- | `.github/workflows/coverage.yml` | `oven-sh/setup-bun@v2` | `v2 (resolves to v2.2.0)` | `v2.2.0` | up-to-date | tag-pinned (not SHA-pinned); floating tag v2 resolves to v2.2.0, which IS the latest release -- tracks latest within that major |
146
+ | `.github/workflows/coverage.yml` | `oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6` | `0c5077e51419868618aeaa5fe8019c62421857d6 # v2` | `v2.2.0` | minor | SHA-pinned |
147
+ | `.github/workflows/coverage.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
151
148
  | `.github/workflows/coverage.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
152
149
  | `.github/workflows/first-run-gate.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
153
- | `.github/workflows/first-run-gate.yml` | `oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6` | `0c5077e51419868618aeaa5fe8019c62421857d6 # v2` | `v2.2.0` | up-to-date | SHA-pinned |
150
+ | `.github/workflows/first-run-gate.yml` | `oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6` | `0c5077e51419868618aeaa5fe8019c62421857d6 # v2` | `v2.2.0` | minor | SHA-pinned |
154
151
  | `.github/workflows/first-run-gate.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
155
152
  | `.github/workflows/integrity-audit.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
156
153
  | `.github/workflows/integrity-audit.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
157
154
  | `.github/workflows/integrity-audit.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
158
155
  | `.github/workflows/integrity-audit.yml` | `azure/setup-helm@v4` | `v4 (resolves to v4.3.1)` | `v5.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.3.1 (commit 1a275c3b6953), behind latest release v5.0.1 (commit 9bc31f4ebc9c); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
159
- | `.github/workflows/loki-ci-example.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
160
- | `.github/workflows/loki-ci-example.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
161
- | `.github/workflows/loki-ci-example.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
162
- | `.github/workflows/loki-enterprise.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
163
- | `.github/workflows/loki-enterprise.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
164
- | `.github/workflows/loki-enterprise.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
165
- | `.github/workflows/loki-enterprise.yml` | `actions/download-artifact@v4` | `v4 (resolves to v4.3.0)` | `v8.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.3.0 (commit d3f86a106a0b), behind latest release v8.0.1 (commit 3e5f45b2cfb9); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
166
- | `.github/workflows/loki-issue-to-pr.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
167
- | `.github/workflows/loki-issue-to-pr.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
168
- | `.github/workflows/loki-issue-to-pr.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
169
- | `.github/workflows/loki-issue-to-pr.yml` | `actions/download-artifact@v4` | `v4 (resolves to v4.3.0)` | `v8.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.3.0 (commit d3f86a106a0b), behind latest release v8.0.1 (commit 3e5f45b2cfb9); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
170
156
  | `.github/workflows/model-catalog-probe.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
171
157
  | `.github/workflows/model-catalog-probe.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
172
- | `.github/workflows/mutation-testing.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
173
- | `.github/workflows/mutation-testing.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
174
- | `.github/workflows/mutation-testing.yml` | `oven-sh/setup-bun@v2` | `v2 (resolves to v2.2.0)` | `v2.2.0` | up-to-date | tag-pinned (not SHA-pinned); floating tag v2 resolves to v2.2.0, which IS the latest release -- tracks latest within that major |
175
- | `.github/workflows/mutation-testing.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
176
158
  | `.github/workflows/nightly.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
177
- | `.github/workflows/nightly.yml` | `oven-sh/setup-bun@v2` | `v2 (resolves to v2.2.0)` | `v2.2.0` | up-to-date | tag-pinned (not SHA-pinned); floating tag v2 resolves to v2.2.0, which IS the latest release -- tracks latest within that major |
159
+ | `.github/workflows/nightly.yml` | `oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6` | `0c5077e51419868618aeaa5fe8019c62421857d6 # v2` | `v2.2.0` | minor | SHA-pinned |
178
160
  | `.github/workflows/nightly.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
179
161
  | `.github/workflows/nightly.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
180
162
  | `.github/workflows/parity-drift.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
181
- | `.github/workflows/parity-drift.yml` | `oven-sh/setup-bun@v2` | `v2 (resolves to v2.2.0)` | `v2.2.0` | up-to-date | tag-pinned (not SHA-pinned); floating tag v2 resolves to v2.2.0, which IS the latest release -- tracks latest within that major |
163
+ | `.github/workflows/parity-drift.yml` | `oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6` | `0c5077e51419868618aeaa5fe8019c62421857d6 # v2` | `v2.2.0` | minor | SHA-pinned |
182
164
  | `.github/workflows/parity-drift.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
183
165
  | `.github/workflows/parity-drift.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
184
166
  | `.github/workflows/post-release-smoke.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
@@ -186,24 +168,19 @@ Inventory only. No dependency, lockfile, workflow or image was changed to produc
186
168
  | `.github/workflows/post-release-smoke.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
187
169
  | `.github/workflows/promote.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
188
170
  | `.github/workflows/promote.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
171
+ | `.github/workflows/promote.yml` | `oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6` | `0c5077e51419868618aeaa5fe8019c62421857d6 # v2` | `v2.2.0` | minor | SHA-pinned |
189
172
  | `.github/workflows/promote.yml` | `docker/login-action@v3` | `v3 (resolves to v3.7.0)` | `v4.6.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v3 resolves to v3.7.0 (commit c94ce9fb4685), behind latest release v4.6.0 (commit dbcb813823bd); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
190
- | `.github/workflows/provenance.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
191
- | `.github/workflows/provenance.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
192
- | `.github/workflows/provenance.yml` | `oven-sh/setup-bun@v2` | `v2 (resolves to v2.2.0)` | `v2.2.0` | up-to-date | tag-pinned (not SHA-pinned); floating tag v2 resolves to v2.2.0, which IS the latest release -- tracks latest within that major |
193
- | `.github/workflows/provenance.yml` | `sigstore/cosign-installer@v3` | `v3 (resolves to v3.9.1)` | `v4.1.2` | MAJOR | tag-pinned (not SHA-pinned); floating tag v3 resolves to v3.9.1 (commit 398d4b0eeef1), behind latest release v4.1.2 (commit 6f9f17788090) |
194
- | `.github/workflows/provenance.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
195
- | `.github/workflows/provenance.yml` | `docker/login-action@v3` | `v3 (resolves to v3.7.0)` | `v4.6.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v3 resolves to v3.7.0 (commit c94ce9fb4685), behind latest release v4.6.0 (commit dbcb813823bd); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
196
173
  | `.github/workflows/release.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
197
- | `.github/workflows/release.yml` | `oven-sh/setup-bun@v2` | `v2 (resolves to v2.2.0)` | `v2.2.0` | up-to-date | tag-pinned (not SHA-pinned); floating tag v2 resolves to v2.2.0, which IS the latest release -- tracks latest within that major |
198
- | `.github/workflows/release.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
174
+ | `.github/workflows/release.yml` | `oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6` | `0c5077e51419868618aeaa5fe8019c62421857d6 # v2` | `v2.2.0` | minor | SHA-pinned |
199
175
  | `.github/workflows/release.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
176
+ | `.github/workflows/release.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
200
177
  | `.github/workflows/release.yml` | `docker/setup-buildx-action@v3` | `v3 (resolves to v3.12.0)` | `v4.4.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v3 resolves to v3.12.0 (commit 8d2750c68a42), behind latest release v4.4.1 (commit f87e5991a6d7); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
201
178
  | `.github/workflows/release.yml` | `docker/login-action@v3` | `v3 (resolves to v3.7.0)` | `v4.6.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v3 resolves to v3.7.0 (commit c94ce9fb4685), behind latest release v4.6.0 (commit dbcb813823bd); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
202
179
  | `.github/workflows/release.yml` | `docker/build-push-action@v5` | `v5 (resolves to v5.4.0)` | `v7.4.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.4.0 (commit ca052bb54ab0), behind latest release v7.4.0 (commit c3c9e263c25d); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
203
180
  | `.github/workflows/release.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
204
181
  | `.github/workflows/release.yml` | `actions/download-artifact@v4` | `v4 (resolves to v4.3.0)` | `v8.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.3.0 (commit d3f86a106a0b), behind latest release v8.0.1 (commit 3e5f45b2cfb9); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
205
182
  | `.github/workflows/release.yml` | `sigstore/cosign-installer@v3` | `v3 (resolves to v3.9.1)` | `v4.1.2` | MAJOR | tag-pinned (not SHA-pinned); floating tag v3 resolves to v3.9.1 (commit 398d4b0eeef1), behind latest release v4.1.2 (commit 6f9f17788090) |
206
- | `.github/workflows/release.yml` | `anchore/sbom-action@v0` | `v0 (resolves to v0.24.0)` | `v0.24.2` | patch | tag-pinned (not SHA-pinned); floating tag v0 resolves to v0.24.0 (commit e22c38990414), behind latest release v0.24.2 (commit 3ad7283483fc) |
183
+ | `.github/workflows/release.yml` | `anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610` | `e22c389904149dbc22b58101806040fa8d37a610 # v0` | `v0.24.3` | minor | SHA-pinned |
207
184
  | `.github/workflows/release.yml` | `peter-evans/dockerhub-description@v4` | `v4 (resolves to v4.0.2)` | `v5.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.0.2 (commit 432a30c9e074), behind latest release v5.0.0 (commit 1b9a80c056b6); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
208
185
  | `.github/workflows/sbom.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
209
186
  | `.github/workflows/sbom.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
@@ -216,7 +193,7 @@ Inventory only. No dependency, lockfile, workflow or image was changed to produc
216
193
  | `.github/workflows/security-audit.yml` | `actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02` | `ea165f8d65b6e75b540449e92b4886f43607fa02 # v4` | `v7.0.1` | MAJOR | SHA-pinned; action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
217
194
  | `.github/workflows/security-audit.yml` | `github/codeql-action/init@f3712979fa5f215279b101dd0a2e3bdfb4353324` | `f3712979fa5f215279b101dd0a2e3bdfb4353324` | `codeql-bundle-v2.27.1` | unknown | SHA-pinned, no version comment; latest release is codeql-bundle-v2.27.1; action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
218
195
  | `.github/workflows/security-audit.yml` | `github/codeql-action/analyze@f3712979fa5f215279b101dd0a2e3bdfb4353324` | `f3712979fa5f215279b101dd0a2e3bdfb4353324` | `codeql-bundle-v2.27.1` | unknown | SHA-pinned, no version comment; latest release is codeql-bundle-v2.27.1; action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
219
- | `.github/workflows/security-audit.yml` | `oven-sh/setup-bun@v2` | `v2 (resolves to v2.2.0)` | `v2.2.0` | up-to-date | tag-pinned (not SHA-pinned); floating tag v2 resolves to v2.2.0, which IS the latest release -- tracks latest within that major |
196
+ | `.github/workflows/security-audit.yml` | `oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6` | `0c5077e51419868618aeaa5fe8019c62421857d6 # v2` | `v2.2.0` | minor | SHA-pinned |
220
197
  | `.github/workflows/sentrux-real.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
221
198
  | `.github/workflows/sentrux-real.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
222
199
  | `.github/workflows/sentrux-real.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
@@ -225,52 +202,53 @@ Inventory only. No dependency, lockfile, workflow or image was changed to produc
225
202
  | `.github/workflows/test.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
226
203
  | `.github/workflows/test.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
227
204
  | `.github/workflows/test.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
228
- | `.github/workflows/test.yml` | `oven-sh/setup-bun@v2` | `v2 (resolves to v2.2.0)` | `v2.2.0` | up-to-date | tag-pinned (not SHA-pinned); floating tag v2 resolves to v2.2.0, which IS the latest release -- tracks latest within that major |
205
+ | `.github/workflows/test.yml` | `oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6` | `0c5077e51419868618aeaa5fe8019c62421857d6 # v2` | `v2.2.0` | minor | SHA-pinned |
229
206
  | `.github/workflows/test.yml` | `actions/cache@v4` | `v4 (resolves to v4.3.0)` | `v6.1.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.3.0 (commit 0057852bfaa8), behind latest release v6.1.0 (commit 55cc8345863c); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
230
207
  | `.github/workflows/test.yml` | `azure/setup-helm@v4` | `v4 (resolves to v4.3.1)` | `v5.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.3.1 (commit 1a275c3b6953), behind latest release v5.0.1 (commit 9bc31f4ebc9c); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
231
208
  | `.github/workflows/tier-a.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
232
209
  | `.github/workflows/tier-a.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
233
- | `.github/workflows/tier-a.yml` | `oven-sh/setup-bun@v2` | `v2 (resolves to v2.2.0)` | `v2.2.0` | up-to-date | tag-pinned (not SHA-pinned); floating tag v2 resolves to v2.2.0, which IS the latest release -- tracks latest within that major |
210
+ | `.github/workflows/tier-a.yml` | `oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6` | `0c5077e51419868618aeaa5fe8019c62421857d6 # v2` | `v2.2.0` | minor | SHA-pinned |
234
211
  | `.github/workflows/tier-a.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
235
212
  | `action.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
236
213
  | `.github/actions/issue-to-pr/action.yml` | `(none found)` | `` | `-` | n/a | no `uses:` step found in this workflow/action file |
237
214
  | `.github/actions/review/action.yml` | `(none found)` | `` | `-` | n/a | no `uses:` step found in this workflow/action file |
238
215
 
239
- **Node 20 runtime deprecation:** GitHub's own Node 20 deprecation covers two distinct things and they must not be conflated. First, matrix jobs still targeting `node-version: 20` (files: .github/workflows/test.yml). Second, and separately: an action whose OWN `action.yml` declares `using: node20` IS the deprecated runtime itself, regardless of what version tag or SHA it is pinned to -- pinning to the latest release of such an action does not fix this until that action's maintainers migrate its action.yml to node22 or later. Every `uses:` target in this repo's workflows was checked at its pinned ref via the GitHub Contents API; action.yml itself declares node20 for: actions/cache, actions/checkout, actions/download-artifact, actions/setup-node, actions/setup-python, actions/upload-artifact, azure/setup-helm, contributor-assistant/github-action, docker/build-push-action, docker/login-action, docker/setup-buildx-action, docker/setup-qemu-action, github/codeql-action/analyze, github/codeql-action/init, peter-evans/dockerhub-description.
216
+ **Node 20 runtime deprecation:** GitHub's own Node 20 deprecation covers two distinct things and they must not be conflated. First, matrix jobs still targeting `node-version: 20` (files: .github/workflows/test.yml). Second, and separately: an action whose OWN `action.yml` declares `using: node20` IS the deprecated runtime itself, regardless of what version tag or SHA it is pinned to -- pinning to the latest release of such an action does not fix this until that action's maintainers migrate its action.yml to node22 or later. Every `uses:` target in this repo's workflows was checked at its pinned ref via the GitHub Contents API; action.yml itself declares node20 for: actions/cache, actions/checkout, actions/download-artifact, actions/setup-node, actions/setup-python, actions/upload-artifact, azure/setup-helm, contributor-assistant/github-action, docker/build-push-action, docker/login-action, docker/setup-buildx-action, github/codeql-action/analyze, github/codeql-action/init, peter-evans/dockerhub-description.
240
217
 
241
218
  ## Runtime matrices
242
219
 
243
- Node.js current stable: 26.10.0 (cycle 26); Python current stable: 3.14.7 (cycle 3.14); Bun current stable: bun-v1.4.2.
220
+ Node.js current stable: 26.10.0 (cycle 26); Python current stable: 3.14.8 (cycle 3.14); Bun current stable: bun-v1.4.2.
244
221
 
245
222
  (The File column lists every workflow file pinning that version.)
246
223
 
247
224
  | File | Name | Current | Latest stable | Bump | Note |
248
225
  |---|---|---|---|---|---|
249
226
  | `.github/workflows/test.yml` | `Node.js` | `20` | `20.20.2 (newest line 26.10.0)` | EOL | EOL 2026-04-30 (past); EOL in current line; newest line is 26.10.0 |
250
- | `.github/workflows/integrity-audit.yml, .github/workflows/loki-ci-example.yml, .github/workflows/nightly.yml, .github/workflows/sentrux-real.yml, .github/workflows/test.yml, +1 more` | `Node.js` | `22` | `22.23.3 (newest line 26.10.0)` | MAJOR | EOL 2027-04-30 (not yet); minor in line; MAJOR to newest line |
227
+ | `.github/workflows/integrity-audit.yml, .github/workflows/nightly.yml, .github/workflows/sentrux-real.yml, .github/workflows/test.yml, .github/workflows/tier-a.yml` | `Node.js` | `22` | `22.23.3 (newest line 26.10.0)` | MAJOR | EOL 2027-04-30 (not yet); minor in line; MAJOR to newest line |
251
228
  | `.github/workflows/test.yml` | `Node.js` | `24` | `24.21.0 (newest line 26.10.0)` | MAJOR | EOL 2028-04-30 (not yet); minor in line; MAJOR to newest line |
252
- | `.github/workflows/test.yml` | `Python` | `3.10` | `3.10.21 (newest line 3.14.7)` | minor | EOL 2026-10-31 (not yet); patch in line; minor to newest line |
253
- | `.github/workflows/test.yml` | `Python` | `3.11` | `3.11.16 (newest line 3.14.7)` | minor | EOL 2027-10-31 (not yet); patch in line; minor to newest line |
254
- | `.github/workflows/bun-parity.yml, .github/workflows/model-catalog-probe.yml, .github/workflows/nightly.yml, .github/workflows/parity-drift.yml, .github/workflows/test.yml, +1 more` | `Python` | `3.12` | `3.12.14 (newest line 3.14.7)` | minor | EOL 2028-10-31 (not yet); patch in line; minor to newest line |
255
- | `.github/workflows/test.yml` | `Python` | `3.13` | `3.13.15 (newest line 3.14.7)` | minor | EOL 2029-10-31 (not yet); patch in line; minor to newest line |
256
- | `.github/workflows/bun-parity.yml, .github/workflows/check-phase6-ready.yml, .github/workflows/coverage.yml, .github/workflows/mutation-testing.yml, .github/workflows/nightly.yml, +5 more` | `Bun` | `1.3.13` | `bun-v1.4.2` | minor | |
229
+ | `.github/workflows/test.yml` | `Python` | `3.10` | `3.10.22 (newest line 3.14.8)` | EOL | EOL 2026-10-01 (past); EOL in current line; newest line is 3.14.8 |
230
+ | `.github/workflows/test.yml` | `Python` | `3.11` | `3.11.17 (newest line 3.14.8)` | minor | EOL 2027-10-31 (not yet); patch in line; minor to newest line |
231
+ | `.github/workflows/bun-parity.yml, .github/workflows/coverage.yml, .github/workflows/model-catalog-probe.yml, .github/workflows/nightly.yml, .github/workflows/parity-drift.yml, +3 more` | `Python` | `3.12` | `3.12.15 (newest line 3.14.8)` | minor | EOL 2028-10-31 (not yet); patch in line; minor to newest line |
232
+ | `.github/workflows/test.yml` | `Python` | `3.13` | `3.13.16 (newest line 3.14.8)` | minor | EOL 2029-10-31 (not yet); patch in line; minor to newest line |
233
+ | `.github/workflows/bun-parity.yml, .github/workflows/coverage.yml, .github/workflows/first-run-gate.yml, .github/workflows/nightly.yml, .github/workflows/parity-drift.yml, +4 more` | `Bun` | `1.3.13` | `bun-v1.4.2` | minor | |
257
234
  | `.github/workflows/nightly.yml, .github/workflows/test.yml` | `Bun` | `latest` | `-` | unknown | not a numeric version, skipped |
258
235
 
259
236
  ## Docker / Compose images
260
237
 
261
238
  | File | Name | Current | Latest stable | Bump | Note |
262
239
  |---|---|---|---|---|---|
240
+ | `Dockerfile` | `oven/bun:${BUN_VERSION}` | `oven/bun:${BUN_VERSION}` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
263
241
  | `Dockerfile` | `ubuntu:24.04` | `ubuntu:24.04` | `24.04.5 (newest line 26.04.1)` | MAJOR | EOL 2029-05-31 (not yet); patch in line; MAJOR to newest line |
264
- | `Dockerfile.control-plane` | `oven/bun:1.4.2` | `oven/bun:1.4.2` | `-` | unknown | floating/arbitrary registry tag, see Docker section for endoflife-mapped images |
265
- | `Dockerfile.control-plane` | `oven/bun:1.4.2-slim` | `oven/bun:1.4.2-slim` | `-` | unknown | floating/arbitrary registry tag, see Docker section for endoflife-mapped images |
242
+ | `Dockerfile.control-plane` | `oven/bun:${BUN_VERSION}` | `oven/bun:${BUN_VERSION}` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
243
+ | `Dockerfile.control-plane` | `oven/bun:${BUN_VERSION}-slim` | `oven/bun:${BUN_VERSION}-slim` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
266
244
  | `Dockerfile.purplelab-test` | `node:22-slim` | `node:22-slim` | `22.23.3 (newest line 26.10.0)` | MAJOR | EOL 2027-04-30 (not yet); minor in line; MAJOR to newest line |
267
245
  | `Dockerfile.sandbox` | `debian:bookworm-slim` | `debian:bookworm-slim` | `12.15 (newest line 13.7)` | MAJOR | EOL 2028-06-30 (not yet); minor in line; MAJOR to newest line |
268
246
  | `Dockerfile.sandbox` | `debian:bookworm-slim` | `debian:bookworm-slim` | `12.15 (newest line 13.7)` | MAJOR | EOL 2028-06-30 (not yet); minor in line; MAJOR to newest line |
269
- | `Dockerfile.test-runner` | `python:3.12-slim` | `python:3.12-slim` | `3.12.14 (newest line 3.14.7)` | minor | EOL 2028-10-31 (not yet); patch in line; minor to newest line |
247
+ | `Dockerfile.test-runner` | `python:3.12-slim` | `python:3.12-slim` | `3.12.15 (newest line 3.14.8)` | minor | EOL 2028-10-31 (not yet); patch in line; minor to newest line |
270
248
  | `artifacts/observability/Dockerfile` | `nginx:1.27-alpine` | `nginx:1.27-alpine` | `1.27.5 (newest line 1.31.6)` | EOL | EOL 2025-06-24 (past); EOL in current line; newest line is 1.31.6 |
271
- | `dashboard/Dockerfile` | `python:3.11-slim-bookworm` | `python:3.11-slim-bookworm` | `3.11.16 (newest line 3.14.7)` | minor | EOL 2027-10-31 (not yet); patch in line; minor to newest line |
249
+ | `dashboard/Dockerfile` | `python:3.11-slim-bookworm` | `python:3.11-slim-bookworm` | `3.11.17 (newest line 3.14.8)` | minor | EOL 2027-10-31 (not yet); patch in line; minor to newest line |
272
250
  | `web-app/Dockerfile` | `node:22-alpine` | `node:22-alpine` | `22.23.3 (newest line 26.10.0)` | MAJOR | EOL 2027-04-30 (not yet); minor in line; MAJOR to newest line |
273
- | `web-app/Dockerfile` | `python:3.12-slim` | `python:3.12-slim` | `3.12.14 (newest line 3.14.7)` | minor | EOL 2028-10-31 (not yet); patch in line; minor to newest line |
251
+ | `web-app/Dockerfile` | `python:3.12-slim` | `python:3.12-slim` | `3.12.15 (newest line 3.14.8)` | minor | EOL 2028-10-31 (not yet); patch in line; minor to newest line |
274
252
  | `dashboard/docker-compose.yml` | `loki-dashboard:latest` | `loki-dashboard:latest` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
275
253
  | `deploy/docker-compose/docker-compose.yml` | `asklokesh/loki-mode:latest` | `asklokesh/loki-mode:latest` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
276
254
  | `deploy/docker-compose/docker-compose.yml` | `otel/opentelemetry-collector-contrib:0.96.0` | `otel/opentelemetry-collector-contrib:0.96.0` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
@@ -288,20 +266,26 @@ Node.js current stable: 26.10.0 (cycle 26); Python current stable: 3.14.7 (cycle
288
266
 
289
267
  | File | Name | Current | Latest stable | Bump | Note |
290
268
  |---|---|---|---|---|---|
291
- | `deploy/helm/autonomi/Chart.yaml` | `appVersion` | `7.93.0` | `10.2.1` | drifted | DRIFTED: chart appVersion does not track the product VERSION file (10.2.1) |
269
+ | `deploy/helm/autonomi/Chart.yaml` | `appVersion` | `7.93.0` | `10.9.1` | drifted | DRIFTED: chart appVersion does not track the product VERSION file (10.9.1) |
292
270
  | `deploy/helm/autonomi/Chart.yaml` | `chart dependencies` | `(none declared)` | `-` | n/a | |
293
271
  | `deploy/helm/autonomi/templates/tests/test-controlplane-health.yaml` | `curlimages/curl:8.11.1` | `curlimages/curl:8.11.1` | `-` | unknown | floating/arbitrary registry tag, see Docker section for endoflife-mapped images |
294
272
  | `deploy/helm/autonomi/tests/test-connection.yaml` | `curlimages/curl:8.5.0` | `curlimages/curl:8.5.0` | `-` | unknown | floating/arbitrary registry tag, see Docker section for endoflife-mapped images |
295
273
  | `deploy/helm/autonomi/tests/test-health.yaml` | `curlimages/curl:8.5.0` | `curlimages/curl:8.5.0` | `-` | unknown | floating/arbitrary registry tag, see Docker section for endoflife-mapped images |
296
274
  | `deploy/helm/autonomi/values.yaml` | `alpine/git:latest` | `alpine/git:latest` | `-` | unknown | floating/arbitrary registry tag, see Docker section for endoflife-mapped images |
297
275
  | `deploy/helm/autonomi/values.yaml` | `image.repository` | `asklokesh/loki-mode:(defaults to appVersion)` | `-` | n/a | own product image, tracked via VERSION not a third-party dep |
298
- | `deploy/helm/control-plane/Chart.yaml` | `appVersion` | `10.6.7` | `10.6.7` | up-to-date | repo VERSION file is 10.6.7 |
276
+ | `deploy/helm/control-plane/Chart.yaml` | `appVersion` | `10.6.7` | `10.9.1` | drifted | DRIFTED: chart appVersion does not track the product VERSION file (10.9.1) |
299
277
  | `deploy/helm/control-plane/Chart.yaml` | `chart dependencies` | `(none declared)` | `-` | n/a | |
300
- | `helm/loki-mode/Chart.yaml` | `appVersion` | `9.19.1` | `10.2.1` | drifted | DRIFTED: chart appVersion does not track the product VERSION file (10.2.1) |
278
+ | `deploy/helm/control-plane/values.yaml` | `image.repository` | `asklokesh/loki-control-plane:(defaults to appVersion)` | `-` | n/a | own product image, tracked via VERSION not a third-party dep |
279
+ | `helm/loki-mode/Chart.yaml` | `appVersion` | `9.19.1` | `10.9.1` | drifted | DRIFTED: chart appVersion does not track the product VERSION file (10.9.1) |
301
280
  | `helm/loki-mode/Chart.yaml` | `chart dependencies` | `(none declared)` | `-` | n/a | |
302
281
  | `helm/loki-mode/values.yaml` | `redis:7-alpine` | `redis:7-alpine` | `-` | unknown | floating/arbitrary registry tag, see Docker section for endoflife-mapped images |
303
282
  | `helm/loki-mode/values.yaml` | `image.repository` | `asklokesh/loki-mode:(defaults to appVersion)` | `-` | n/a | own product image, tracked via VERSION not a third-party dep |
283
+ | `deploy/helm/control-plane/templates/deployment.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
284
+ | `deploy/helm/control-plane/templates/ingress.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
285
+ | `deploy/helm/control-plane/templates/pvc.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
286
+ | `deploy/helm/control-plane/templates/service.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
304
287
  | `deploy/helm/autonomi/templates/configmap.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
288
+ | `deploy/helm/autonomi/templates/control-token-secret.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
305
289
  | `deploy/helm/autonomi/templates/deployment-controlplane.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
306
290
  | `deploy/helm/autonomi/templates/deployment-worker.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
307
291
  | `deploy/helm/autonomi/templates/hpa-worker.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
@@ -314,6 +298,7 @@ Node.js current stable: 26.10.0 (cycle 26); Python current stable: 3.14.7 (cycle
314
298
  | `deploy/helm/autonomi/templates/pdb.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
315
299
  | `deploy/helm/autonomi/templates/pvc-audit.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
316
300
  | `deploy/helm/autonomi/templates/pvc-checkpoints.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
301
+ | `deploy/helm/autonomi/templates/pvc-control-db.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
317
302
  | `deploy/helm/autonomi/templates/rbac.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
318
303
  | `deploy/helm/autonomi/templates/secret.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
319
304
  | `deploy/helm/autonomi/templates/service-controlplane.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
@@ -337,10 +322,10 @@ Node.js current stable: 26.10.0 (cycle 26); Python current stable: 3.14.7 (cycle
337
322
 
338
323
  | File | Name | Current | Latest stable | Bump | Note |
339
324
  |---|---|---|---|---|---|
340
- | `deploy/terraform/modules/aws-ecs/versions.tf` | `aws (hashicorp/aws)` | `>= 5.0` | `6.66.0` | MAJOR | |
341
- | `deploy/terraform/modules/aws/versions.tf` | `aws (hashicorp/aws)` | `>= 5.0` | `6.66.0` | MAJOR | |
342
- | `deploy/terraform/modules/azure/versions.tf` | `azurerm (hashicorp/azurerm)` | `>= 3.0` | `5.7.0` | MAJOR | |
343
- | `deploy/terraform/modules/gcp/versions.tf` | `google (hashicorp/google)` | `>= 5.0` | `8.4.0` | MAJOR | |
325
+ | `deploy/terraform/modules/aws-ecs/versions.tf` | `aws (hashicorp/aws)` | `>= 5.0` | `6.67.0` | MAJOR | |
326
+ | `deploy/terraform/modules/aws/versions.tf` | `aws (hashicorp/aws)` | `>= 5.0` | `6.67.0` | MAJOR | |
327
+ | `deploy/terraform/modules/azure/versions.tf` | `azurerm (hashicorp/azurerm)` | `>= 3.0` | `5.8.0` | MAJOR | |
328
+ | `deploy/terraform/modules/gcp/versions.tf` | `google (hashicorp/google)` | `>= 5.0` | `8.5.0` | MAJOR | |
344
329
  | `deploy/terraform/examples/aws-eks/main.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
345
330
  | `deploy/terraform/examples/azure-aks/main.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
346
331
  | `deploy/terraform/examples/gcp-gke/main.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
@@ -363,7 +348,7 @@ Formula lives in a separate repo: `asklokesh/homebrew-tap`, `Formula/loki-mode.r
363
348
 
364
349
  | File | Name | Current | Latest stable | Bump | Note |
365
350
  |---|---|---|---|---|---|
366
- | `asklokesh/homebrew-tap:Formula/loki-mode.rb` | `loki-mode` | `10.2.1` | `10.2.1` | up-to-date | repo VERSION file is 10.2.1 |
351
+ | `asklokesh/homebrew-tap:Formula/loki-mode.rb` | `loki-mode` | `10.7.1` | `10.7.1` | up-to-date | repo VERSION file is 10.9.1 |
367
352
 
368
353
  ## Summary
369
354
 
@@ -371,92 +356,86 @@ Counts are all from the single `Bump` column (current line vs newest line in the
371
356
 
372
357
  | Ecosystem | patch | minor | 0.x breaking | MAJOR | EOL | drifted | unknown | up-to-date | other |
373
358
  |---|---|---|---|---|---|---|---|---|---|
374
- | npm/bun | 1 | 11 | 4 | 24 | 0 | 0 | 1 | 7 | 0 |
375
- | Python (requirements) | 1 | 9 | 10 | 9 | 0 | 0 | 10 | 1 | 0 |
376
- | Python (pyproject) | 0 | 1 | 1 | 1 | 0 | 0 | 1 | 0 | 0 |
377
- | GitHub Actions | 1 | 0 | 0 | 75 | 0 | 0 | 2 | 13 | 2 |
378
- | Runtimes | 0 | 5 | 0 | 2 | 1 | 0 | 1 | 0 | 0 |
379
- | Docker/Compose | 0 | 3 | 0 | 8 | 1 | 0 | 10 | 0 | 1 |
380
- | Helm | 0 | 0 | 0 | 0 | 0 | 2 | 5 | 1 | 35 |
359
+ | npm/bun | 2 | 5 | 3 | 27 | 0 | 0 | 1 | 24 | 0 |
360
+ | Python (requirements) | 2 | 0 | 10 | 9 | 0 | 0 | 10 | 9 | 0 |
361
+ | Python (pyproject) | 0 | 0 | 1 | 1 | 0 | 0 | 1 | 1 | 0 |
362
+ | GitHub Actions | 0 | 11 | 0 | 59 | 0 | 0 | 2 | 2 | 2 |
363
+ | Runtimes | 0 | 4 | 0 | 2 | 2 | 0 | 1 | 0 | 0 |
364
+ | Docker/Compose | 0 | 3 | 0 | 8 | 1 | 0 | 11 | 0 | 1 |
365
+ | Helm | 0 | 0 | 0 | 0 | 0 | 3 | 5 | 0 | 42 |
381
366
  | Terraform | 0 | 0 | 0 | 4 | 0 | 0 | 0 | 0 | 15 |
382
367
  | Homebrew | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 1 | 0 |
383
368
 
384
369
  ## Proposed slice list (D35)
385
370
 
386
371
  - **LOW - npm/bun patch+minor batch** (one slice for the whole ecosystem, touching every file below; lockfiles regenerated and committed):
387
- - `legacy-ui/package.json`: @playwright/test ^1.58.1->1.63.0
388
- - `vscode-extension/package.json`: @types/vscode ^1.85.0->1.138.0
389
- - `web-app/package.json`: @playwright/test ^1.58.2->1.63.0, @types/react ^19.0.10->19.3.0, @types/react-dom ^19.0.4->19.3.0, autoprefixer ^10.4.20->10.6.1, postcss ^8.5.3->8.5.28, react ^19.0.0->19.3.0, react-dom ^19.0.0->19.3.0, react-resizable-panels ^4.7.3->4.14.1, react-router-dom ^7.13.1->7.18.4, typescript-eslint ^8.24.1->8.70.1
372
+ - `packages/control-plane/package.json`: @playwright/test 1.58.1->1.63.0
373
+ - `packages/control-plane/ui/package.json`: @testing-library/react ^16.3.0->16.3.3, @types/react ^19.0.0->19.3.0, @types/react-dom ^19.0.0->19.3.0
374
+ - `vscode-extension/package.json`: @types/vscode ^1.85.0->1.140.0
375
+ - `web-app/package.json`: react-resizable-panels ^4.14.1->4.14.2, typescript-eslint ^8.70.1->8.71.0
390
376
  - **LOW - Python patch+minor batch** (one slice for the whole ecosystem, touching every file below; lockfiles regenerated and committed):
391
- - `dashboard/requirements.txt`: greenlet >=3.0.0,<4.0.0->3.5.6, pydantic >=2.0.0,<3.0.0->2.13.5, sqlalchemy >=2.0.0,<3.0.0->2.1.1
392
- - `mcp/requirements.txt`: chromadb >=1.0.0,<2.0.0->1.5.9
393
- - `web-app/requirements.txt`: alembic >=1.12.0->1.20.0, pexpect >=4.8.0->4.9.0, pydantic >=2.0.0->2.13.5, python-jose >=3.3.0->3.5.0, pyyaml >=6.0->6.0.3, sqlalchemy >=2.0.0->2.1.1
394
- - **LOW - Python (pyproject) patch+minor batch** (one slice for the whole ecosystem, touching every file below; lockfiles regenerated and committed):
395
- - `sdk/python/pyproject.toml`: pydantic >=2.0.0->2.13.5
377
+ - `dashboard/requirements.txt`: sqlalchemy >=2.1.1,<3.0.0->2.1.3
378
+ - `web-app/requirements.txt`: sqlalchemy >=2.1.1->2.1.3
396
379
  - **MEDIUM - one slice per MAJOR (or 0.x-breaking) package**, deduped across manifests:
397
380
  - `@eslint/js` -> `10.0.1` (MAJOR): web-app/package.json
398
- - `@types/node` -> `26.6.3` (MAJOR): package.json, vscode-extension/package.json
399
- - `@typescript-eslint/eslint-plugin` -> `8.70.1` (MAJOR): vscode-extension/package.json
400
- - `@typescript-eslint/parser` -> `8.70.1` (MAJOR): vscode-extension/package.json
401
- - `@vitejs/plugin-react` -> `6.1.1` (MAJOR): web-app/package.json
381
+ - `@happy-dom/global-registrator` -> `20.14.5` (MAJOR): packages/control-plane/ui/package.json
382
+ - `@types/node` -> `26.6.4` (MAJOR): package.json, vscode-extension/package.json
383
+ - `@typescript-eslint/eslint-plugin` -> `8.71.0` (MAJOR): vscode-extension/package.json
384
+ - `@typescript-eslint/parser` -> `8.71.0` (MAJOR): vscode-extension/package.json
385
+ - `@vitejs/plugin-react` -> `6.1.1` (MAJOR): packages/control-plane/ui/package.json, web-app/package.json
402
386
  - `@vscode/vsce` -> `4.0.0` (MAJOR): vscode-extension/package.json
403
387
  - `aiosqlite` -> `0.22.1` (0.x breaking): dashboard/requirements.txt, web-app/requirements.txt
404
- - `anthropic` -> `1.8.0` (MAJOR): mcp/requirements.txt
388
+ - `anthropic` -> `1.11.0` (MAJOR): mcp/requirements.txt
405
389
  - `asyncpg` -> `0.31.0` (0.x breaking): web-app/requirements.txt
406
- - `cryptography` -> `50.0.1` (MAJOR): requirements-test.txt, web-app/requirements.txt
407
- - `esbuild` -> `0.28.2` (0.x breaking): legacy-ui/package.json, vscode-extension/package.json
408
- - `eslint` -> `10.11.0` (MAJOR): vscode-extension/package.json, web-app/package.json
390
+ - `cryptography` -> `50.0.2` (MAJOR): requirements-test.txt, web-app/requirements.txt
391
+ - `esbuild` -> `0.28.2` (0.x breaking): vscode-extension/package.json
392
+ - `eslint` -> `10.12.0` (MAJOR): vscode-extension/package.json, web-app/package.json
409
393
  - `eslint-plugin-react-hooks` -> `7.1.1` (MAJOR): web-app/package.json
410
394
  - `eslint-plugin-react-refresh` -> `0.5.7` (0.x breaking): web-app/package.json
411
- - `fastapi` -> `0.141.1` (0.x breaking): dashboard/requirements.txt, web-app/requirements.txt
412
- - `globals` -> `17.12.0` (MAJOR): web-app/package.json
395
+ - `fastapi` -> `0.142.2` (0.x breaking): dashboard/requirements.txt, web-app/requirements.txt
396
+ - `globals` -> `17.13.0` (MAJOR): web-app/package.json
413
397
  - `httpx` -> `0.28.1` (0.x breaking): sdk/python/pyproject.toml, web-app/requirements-test.txt, web-app/requirements.txt
414
- - `jest` -> `30.5.2` (MAJOR): legacy-ui/package.json, package.json
415
- - `jest-environment-jsdom` -> `30.5.2` (MAJOR): legacy-ui/package.json
416
- - `jsdom` -> `30.1.1` (MAJOR): legacy-ui/package.json, package.json
417
- - `lucide-react` -> `1.48.0` (MAJOR): web-app/package.json
418
- - `mcp` -> `2.2.0` (MAJOR): mcp/requirements.txt, requirements-test.txt
398
+ - `jest` -> `30.5.2` (MAJOR): package.json
399
+ - `jsdom` -> `30.1.1` (MAJOR): package.json
400
+ - `lucide-react` -> `1.51.0` (MAJOR): packages/control-plane/ui/package.json, web-app/package.json
401
+ - `mcp` -> `2.3.0` (MAJOR): mcp/requirements.txt, requirements-test.txt
419
402
  - `pytest` -> `9.1.1` (MAJOR): web-app/requirements-test.txt
420
403
  - `pytest-asyncio` -> `1.4.0` (MAJOR): web-app/requirements-test.txt
421
404
  - `python-multipart` -> `0.0.32` (0.x breaking): web-app/requirements.txt
422
405
  - `setuptools` -> `84.0.0` (MAJOR): sdk/python/pyproject.toml
423
- - `tailwindcss` -> `4.3.3` (MAJOR): web-app/package.json
424
- - `typescript` -> `7.0.2` (MAJOR): loki-ts/package.json, package.json, sdk/typescript/package.json, vscode-extension/package.json, web-app/package.json
406
+ - `tailwindcss` -> `4.3.3` (MAJOR): packages/control-plane/ui/package.json, web-app/package.json
407
+ - `typescript` -> `7.0.2` (MAJOR): loki-ts/package.json, package.json, packages/control-plane/ui/package.json, sdk/typescript/package.json, vscode-extension/package.json, +1 more
425
408
  - `uvicorn` -> `0.54.0` (0.x breaking): dashboard/requirements.txt, web-app/requirements.txt
426
- - `vite` -> `8.3.1` (MAJOR): web-app/package.json
409
+ - `vite` -> `8.3.2` (MAJOR): packages/control-plane/ui/package.json, web-app/package.json
427
410
  - `watchdog` -> `6.0.0` (MAJOR): web-app/requirements.txt
428
- - `websockets` -> `17.1` (MAJOR): dashboard/requirements.txt
411
+ - `websockets` -> `17.2` (MAJOR): dashboard/requirements.txt
429
412
  - **MEDIUM - one slice per Actions MAJOR**, deduped by action across workflows (bump to latest major AND SHA-pin with a `# vN` comment in the same slice, per D35):
430
413
  - `actions/cache` v4 (resolves to v4.3.0) -> `v6.1.0`: .github/workflows/test.yml
431
- - `actions/checkout` 11d5960a326750d5838078e36cf38b85af677262, v4 (resolves to v4.4.0) -> `v7.0.1`: .github/workflows/bun-parity.yml, .github/workflows/check-phase6-ready.yml, .github/workflows/claude-code-review.yml, .github/workflows/coverage.yml, .github/workflows/integrity-audit.yml, +18 more
432
- - `actions/download-artifact` v4 (resolves to v4.3.0) -> `v8.0.1`: .github/workflows/loki-enterprise.yml, .github/workflows/loki-issue-to-pr.yml, .github/workflows/release.yml
433
- - `actions/setup-node` v4 (resolves to v4.4.0) -> `v7.0.0`: .github/workflows/integrity-audit.yml, .github/workflows/loki-ci-example.yml, .github/workflows/loki-enterprise.yml, .github/workflows/loki-issue-to-pr.yml, .github/workflows/mutation-testing.yml, +11 more
434
- - `actions/setup-python` v5 (resolves to v5.6.0) -> `v7.0.0`: .github/workflows/bun-parity.yml, .github/workflows/integrity-audit.yml, .github/workflows/model-catalog-probe.yml, .github/workflows/nightly.yml, .github/workflows/parity-drift.yml, +5 more
435
- - `actions/upload-artifact` ea165f8d65b6e75b540449e92b4886f43607fa02, v4 (resolves to v4.6.2) -> `v7.0.1`: .github/workflows/check-phase6-ready.yml, .github/workflows/coverage.yml, .github/workflows/loki-ci-example.yml, .github/workflows/loki-enterprise.yml, .github/workflows/loki-issue-to-pr.yml, +9 more
414
+ - `actions/checkout` 11d5960a326750d5838078e36cf38b85af677262, v4 (resolves to v4.4.0) -> `v7.0.1`: .github/workflows/bun-parity.yml, .github/workflows/claude-code-review.yml, .github/workflows/coverage.yml, .github/workflows/first-run-gate.yml, .github/workflows/integrity-audit.yml, +12 more
415
+ - `actions/download-artifact` v4 (resolves to v4.3.0) -> `v8.0.1`: .github/workflows/release.yml
416
+ - `actions/setup-node` v4 (resolves to v4.4.0) -> `v7.0.0`: .github/workflows/integrity-audit.yml, .github/workflows/nightly.yml, .github/workflows/post-release-smoke.yml, .github/workflows/promote.yml, .github/workflows/release.yml, +6 more
417
+ - `actions/setup-python` v5 (resolves to v5.6.0) -> `v7.0.0`: .github/workflows/bun-parity.yml, .github/workflows/coverage.yml, .github/workflows/integrity-audit.yml, .github/workflows/model-catalog-probe.yml, .github/workflows/nightly.yml, +6 more
418
+ - `actions/upload-artifact` ea165f8d65b6e75b540449e92b4886f43607fa02, v4 (resolves to v4.6.2) -> `v7.0.1`: .github/workflows/coverage.yml, .github/workflows/first-run-gate.yml, .github/workflows/parity-drift.yml, .github/workflows/release.yml, .github/workflows/sbom.yml, +3 more
436
419
  - `azure/setup-helm` v4 (resolves to v4.3.1) -> `v5.0.1`: .github/workflows/integrity-audit.yml, .github/workflows/test.yml
437
420
  - `docker/build-push-action` v5 (resolves to v5.4.0) -> `v7.4.0`: .github/workflows/release.yml
438
- - `docker/login-action` v3 (resolves to v3.7.0) -> `v4.6.0`: .github/workflows/promote.yml, .github/workflows/provenance.yml, .github/workflows/release.yml
421
+ - `docker/login-action` v3 (resolves to v3.7.0) -> `v4.6.0`: .github/workflows/promote.yml, .github/workflows/release.yml
439
422
  - `docker/setup-buildx-action` v3 (resolves to v3.12.0) -> `v4.4.1`: .github/workflows/release.yml
440
- - `docker/setup-qemu-action` v3 (resolves to v3.7.0) -> `v4.4.0`: .github/workflows/arm64-runtime.yml
441
423
  - `peter-evans/dockerhub-description` v4 (resolves to v4.0.2) -> `v5.0.0`: .github/workflows/release.yml
442
- - `sigstore/cosign-installer` v3 (resolves to v3.9.1) -> `v4.1.2`: .github/workflows/provenance.yml, .github/workflows/release.yml
443
- - **LOW - Actions SHA-pinning** (already on latest major, just needs pinning): convert every tag-pinned `uses:` to a SHA pin with a trailing `# vN` comment (the pattern already used for `actions/checkout` and `actions/upload-artifact` in security-audit.yml):
444
- - `anchore/sbom-action`: .github/workflows/release.yml
445
- - `anthropics/claude-code-action`: .github/workflows/claude-code-review.yml
446
- - `contributor-assistant/github-action`: .github/workflows/cla.yml
447
- - `oven-sh/setup-bun`: .github/workflows/bun-parity.yml, .github/workflows/check-phase6-ready.yml, .github/workflows/coverage.yml, .github/workflows/mutation-testing.yml, .github/workflows/nightly.yml, +6 more
424
+ - `sigstore/cosign-installer` v3 (resolves to v3.9.1) -> `v4.1.2`: .github/workflows/release.yml
448
425
  - **MEDIUM - one slice per Terraform provider MAJOR**:
449
- - `deploy/terraform/modules/aws-ecs/versions.tf`: `aws (hashicorp/aws)` >= 5.0 -> 6.66.0
450
- - `deploy/terraform/modules/aws/versions.tf`: `aws (hashicorp/aws)` >= 5.0 -> 6.66.0
451
- - `deploy/terraform/modules/azure/versions.tf`: `azurerm (hashicorp/azurerm)` >= 3.0 -> 5.7.0
452
- - `deploy/terraform/modules/gcp/versions.tf`: `google (hashicorp/google)` >= 5.0 -> 8.4.0
426
+ - `deploy/terraform/modules/aws-ecs/versions.tf`: `aws (hashicorp/aws)` >= 5.0 -> 6.67.0
427
+ - `deploy/terraform/modules/aws/versions.tf`: `aws (hashicorp/aws)` >= 5.0 -> 6.67.0
428
+ - `deploy/terraform/modules/azure/versions.tf`: `azurerm (hashicorp/azurerm)` >= 3.0 -> 5.8.0
429
+ - `deploy/terraform/modules/gcp/versions.tf`: `google (hashicorp/google)` >= 5.0 -> 8.5.0
453
430
  - **MEDIUM - runtime matrix refresh**:
454
431
  - `Node.js` 20 is EOL (EOL 2026-04-30 (past); EOL in current line; newest line is 26.10.0), pinned by: .github/workflows/test.yml
432
+ - `Python` 3.10 is EOL (EOL 2026-10-01 (past); EOL in current line; newest line is 3.14.8), pinned by: .github/workflows/test.yml
455
433
  - Node 20 is named in the upstream Actions runtime deprecation warnings even where not yet past its endoflife.date EOL; pinned by: .github/workflows/test.yml
456
- - **MEDIUM - SDKs with the 5-task eval**: `@anthropic-ai/claude-agent-sdk` 0.3.283 -> 0.3.283 (up-to-date, `loki-ts/package.json`); `@anthropic-ai/sdk` ^0.124.0 -> 0.128.0 (0.x breaking, `loki-ts/package.json`). Gated on the 5-task eval per D35, not the plain patch/minor batch.
434
+ - **MEDIUM - SDKs with the 5-task eval**: `@anthropic-ai/claude-agent-sdk` 0.3.288 -> 0.3.288 (up-to-date, `loki-ts/package.json`); `@anthropic-ai/sdk` ^0.124.0 -> 0.131.0 (0.x breaking, `loki-ts/package.json`). Gated on the 5-task eval per D35, not the plain patch/minor batch.
457
435
  - **LOW - Docker/Helm digest pass**: pin every `FROM` / `image:` tag by digest instead of a mutable tag (own-product images and `:latest` floating tags are out of scope for a version bump and tracked via VERSION instead).
458
436
  - EOL now: `nginx:1.27-alpine` in `artifacts/observability/Dockerfile` (EOL 2025-06-24 (past); EOL in current line; newest line is 1.31.6)
459
437
  - **FINDING - Helm chart appVersion has drifted from the product VERSION**:
460
- - `deploy/helm/autonomi/Chart.yaml`: appVersion `7.93.0` vs VERSION `10.2.1`
461
- - `helm/loki-mode/Chart.yaml`: appVersion `9.19.1` vs VERSION `10.2.1`
438
+ - `deploy/helm/autonomi/Chart.yaml`: appVersion `7.93.0` vs VERSION `10.9.1`
439
+ - `deploy/helm/control-plane/Chart.yaml`: appVersion `10.6.7` vs VERSION `10.9.1`
440
+ - `helm/loki-mode/Chart.yaml`: appVersion `9.19.1` vs VERSION `10.9.1`
462
441