loki-mode 10.9.1 → 10.10.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.github/actions/issue-to-pr/action.yml +2 -2
- package/README.md +9 -3
- package/SKILL.md +12 -2
- package/VERSION +1 -1
- package/autonomy/lib/proof-generator.py +1 -0
- package/autonomy/loki +39 -9
- package/autonomy/receipt_jwt.py +46 -1
- package/autonomy/run.sh +1 -1
- package/autonomy/telemetry.sh +1 -1
- package/autonomy/trigger-server.py +1 -0
- package/bin/loki +12 -1
- package/bin/loki-postinstall.js +12 -0
- package/dashboard/__init__.py +1 -1
- package/docs/CLI-REFERENCE.md +139 -0
- package/docs/INSTALLATION.md +1 -1
- package/docs/LOKI-10-BUILD-PROMPT.md +2 -2
- package/docs/PLANS-INDEX.md +2 -3
- package/docs/SLO.md +3 -3
- package/docs/alternative-installations.md +1 -1
- package/docs/bug-fixes/agent-04-memory-fixes.md +1 -1
- package/docs/dev/release-checklist.md +1 -1
- package/{.github/workflows/loki-issue-to-pr.yml → docs/examples/loki-issue-to-pr.yml.example} +2 -0
- package/docs/{ONE-RUN-AUDIT.md → history/one-run-audit.md} +6 -0
- package/docs/{BUG-AUDIT-v6.61.0.md → history/v6.61.0-audit.md} +6 -0
- package/docs/{V8-AGENT-SDK-PLAN.md → history/v8-agent-sdk-plan.md} +6 -0
- package/docs/{CONFIG-FILE-PLAN.md → history/v8-config-plan.md} +6 -0
- package/docs/test-scenarios/enterprise-scenarios.md +1 -1
- package/docs/v10/BOARD.md +3 -0
- package/docs/v10/CLI-MODERN.md +190 -0
- package/docs/v10/DEPS.md +148 -169
- package/docs/v10/FAILURE-CLASSES.md +23 -2
- package/docs/v10/GUARDS.md +18 -0
- package/docs/v10/LEGACY-REMOVAL.md +334 -25
- package/docs/v10/PROGRESS.md +15 -0
- package/loki-ts/dist/loki.js +1574 -1794
- package/mcp/__init__.py +1 -1
- package/package.json +3 -2
- package/packages/control-plane/dist/server.js +733 -397
- package/packages/control-plane/src/db/fixture-cleanup.ts +47 -0
- package/packages/control-plane/src/server/app.ts +2 -0
- package/packages/control-plane/src/server/integrity.ts +48 -9
- package/packages/control-plane/src/server/routes/stats.ts +16 -5
- package/packages/control-plane/src/server/runs.ts +16 -4
- package/packages/control-plane/ui/dist/assets/index-BinL6h3i.css +1 -0
- package/packages/control-plane/ui/dist/assets/index-BrA22FUs.js +152 -0
- package/packages/control-plane/ui/dist/index.html +2 -2
- package/plugins/loki-mode/.claude-plugin/plugin.json +1 -1
- package/schemas/status-result.schema.json +13 -22
- package/skills/release-cadence.md +5 -5
- package/web-app/dist/assets/{AdminPage-DqMnfZrH.js → AdminPage-BvbxMtZO.js} +1 -1
- package/web-app/dist/assets/{Avatar-BEof29du.js → Avatar-Dc7Scg02.js} +1 -1
- package/web-app/dist/assets/{Badge-WD53OL5m.js → Badge-BmVuOqbM.js} +1 -1
- package/web-app/dist/assets/{Button-Rzk5flhU.js → Button-DvzqhxRU.js} +1 -1
- package/web-app/dist/assets/{CockpitPage-Bqz3PCMh.js → CockpitPage-D8AZo7Ha.js} +1 -1
- package/web-app/dist/assets/{ComparePage-Byo2NzAZ.js → ComparePage-NmqaTXDz.js} +1 -1
- package/web-app/dist/assets/{ErrorBoundary-BuE0kH3W.js → ErrorBoundary-PGl8Kzoq.js} +1 -1
- package/web-app/dist/assets/{EvidenceReceiptPanel-CKFHOPBx.js → EvidenceReceiptPanel-2NY4n9gv.js} +1 -1
- package/web-app/dist/assets/{GitHubIssuesPanel-Df_kTMqI.js → GitHubIssuesPanel-DBO_LHHM.js} +1 -1
- package/web-app/dist/assets/{GitHubPRsPanel-CouvcKrZ.js → GitHubPRsPanel-K7m9uJ1N.js} +1 -1
- package/web-app/dist/assets/{HomePage-dEpLzj0x.js → HomePage-qNQzAJxM.js} +2 -2
- package/web-app/dist/assets/{LoginPage-6DVjUND5.js → LoginPage-esu3OK65.js} +1 -1
- package/web-app/dist/assets/{MagicPage-BDQ9MOfY.js → MagicPage-CCdVvXrA.js} +1 -1
- package/web-app/dist/assets/{MetricsPage-CXiJ04G_.js → MetricsPage-bEvugU2t.js} +1 -1
- package/web-app/dist/assets/{NotFoundPage-BaXhZvyj.js → NotFoundPage-BlEjQ1wX.js} +1 -1
- package/web-app/dist/assets/{ProjectPage-BzE4V7Ti.js → ProjectPage-Bnug_Yzv.js} +3 -3
- package/web-app/dist/assets/{ProjectsPage-ipf6TLMX.js → ProjectsPage-M8r1vfpn.js} +1 -1
- package/web-app/dist/assets/{SettingsPage-BDxkUKN6.js → SettingsPage-NqAJpB48.js} +1 -1
- package/web-app/dist/assets/{ShowcasePage-YQXD72SM.js → ShowcasePage-8FggxL1P.js} +1 -1
- package/web-app/dist/assets/{SystemSettingsPage-Dou7zHS0.js → SystemSettingsPage-3Sz3kFOO.js} +1 -1
- package/web-app/dist/assets/{TeamsPage-CQarfcYr.js → TeamsPage-nV-6vdWM.js} +1 -1
- package/web-app/dist/assets/{TemplatesPage-CPi1R8Xj.js → TemplatesPage-Brbc_VR9.js} +1 -1
- package/web-app/dist/assets/{TerminalOutput-WiGhWdYD.js → TerminalOutput-D1yta5ac.js} +1 -1
- package/web-app/dist/assets/{activity-DOa7ejQA.js → activity-oEeKuqFe.js} +1 -1
- package/web-app/dist/assets/{bell-CX-VAlYN.js → bell-3NJtqBRR.js} +1 -1
- package/web-app/dist/assets/{bot-EDXaZmHc.js → bot-CuvJZ6x1.js} +1 -1
- package/web-app/dist/assets/{check-CnBdKk3L.js → check-n4289IZw.js} +1 -1
- package/web-app/dist/assets/{chevron-left-BJ_ydRQW.js → chevron-left-CmQeio7h.js} +1 -1
- package/web-app/dist/assets/{circle-alert-tz8ufhc_.js → circle-alert-CmmVW-Pd.js} +1 -1
- package/web-app/dist/assets/{clock-DFBZPSsH.js → clock-QFqk7GlA.js} +1 -1
- package/web-app/dist/assets/{cloud-uy3p_5Q7.js → cloud-BNkSokmq.js} +1 -1
- package/web-app/dist/assets/{code-xml-3CbYD9YL.js → code-xml-nWeketqj.js} +1 -1
- package/web-app/dist/assets/{database-YiNBXc9c.js → database-C83MXTmJ.js} +1 -1
- package/web-app/dist/assets/{dollar-sign-D0wBa4Cv.js → dollar-sign-Blg6TO4y.js} +1 -1
- package/web-app/dist/assets/{file-code-corner-DDdZVZ5v.js → file-code-corner-Tk11oUzm.js} +1 -1
- package/web-app/dist/assets/{file-plus-D09LTBqt.js → file-plus-DF_eyA6I.js} +1 -1
- package/web-app/dist/assets/{globe-BirTPwff.js → globe-D5hDqqmn.js} +1 -1
- package/web-app/dist/assets/{hammer-DaE5qgnd.js → hammer-C2hm9lzl.js} +1 -1
- package/web-app/dist/assets/{index-D8t7KnQf.js → index-pMxOIwXq.js} +3 -3
- package/web-app/dist/assets/{layers-DVVrckRY.js → layers-XWQKGXg0.js} +1 -1
- package/web-app/dist/assets/{loader-circle-2-nMGmcb.js → loader-circle-BRuvorm2.js} +1 -1
- package/web-app/dist/assets/{lock-D0Xj43pC.js → lock-BSGvQf5v.js} +1 -1
- package/web-app/dist/assets/{package-BB7S3egm.js → package-3FJYUYgJ.js} +1 -1
- package/web-app/dist/assets/{plus-BLhoMrn3.js → plus-CeIx6g9P.js} +1 -1
- package/web-app/dist/assets/{refresh-cw-DMc2uPLw.js → refresh-cw-ChutW42g.js} +1 -1
- package/web-app/dist/assets/{rotate-ccw-DM3IP9x7.js → rotate-ccw-BdSjUAk-.js} +1 -1
- package/web-app/dist/assets/{scroll-text-lH2uW7rB.js → scroll-text-BjFqxpw3.js} +1 -1
- package/web-app/dist/assets/{server-BkerZcdR.js → server-C7UEKdol.js} +1 -1
- package/web-app/dist/assets/{shield-alert-B8ohcUfu.js → shield-alert-DY8fpEs7.js} +1 -1
- package/web-app/dist/assets/{thumbs-up-CTIxLzPD.js → thumbs-up-Cz1san1g.js} +1 -1
- package/web-app/dist/assets/{trash-2-C3zIpsH5.js → trash-2-D2MvGYeP.js} +1 -1
- package/web-app/dist/assets/{trending-down-BTT7wV4Y.js → trending-down-CxO3OYOB.js} +1 -1
- package/web-app/dist/assets/{trending-up-BzHdCDvF.js → trending-up-DCHKPJLe.js} +1 -1
- package/web-app/dist/assets/{upload-HxR34-A8.js → upload-CdPJpSHC.js} +1 -1
- package/web-app/dist/assets/{usePolling-DDj6Fupy.js → usePolling-DAH6K3ST.js} +1 -1
- package/web-app/dist/assets/{user-qH5y9yNy.js → user-Byyt01W4.js} +1 -1
- package/web-app/dist/index.html +1 -1
- package/docs/BRANCH-LIFECYCLE-PLAN.md +0 -354
- package/docs/EXECUTION-COCKPIT-PLAN.md +0 -289
- package/packages/control-plane/ui/dist/assets/index-BQbFv65M.css +0 -1
- package/packages/control-plane/ui/dist/assets/index-Dbhu244h.js +0 -155
package/docs/v10/DEPS.md
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
# Dependency Inventory (D35 DEP-01)
|
|
2
2
|
|
|
3
|
-
Generated by `scripts/dep-inventory.py`. Lookup date: 2026-
|
|
3
|
+
Generated by `scripts/dep-inventory.py`. Lookup date: 2026-10-03.
|
|
4
4
|
|
|
5
5
|
Inventory only. No dependency, lockfile, workflow or image was changed to produce this report. Manifests are discovered with `git ls-files`, never a filesystem walk. Network lookups are cached under the `--cache` directory so re-running against the same cache is byte-identical.
|
|
6
6
|
|
|
@@ -8,118 +8,118 @@ Inventory only. No dependency, lockfile, workflow or image was changed to produc
|
|
|
8
8
|
|
|
9
9
|
| File | Name | Current | Latest stable | Bump | Note |
|
|
10
10
|
|---|---|---|---|---|---|
|
|
11
|
-
| `
|
|
12
|
-
| `
|
|
13
|
-
| `legacy-ui/package.json` | `jest` | `^29.7.0` | `30.5.2` | MAJOR | |
|
|
14
|
-
| `legacy-ui/package.json` | `jest-environment-jsdom` | `^29.7.0` | `30.5.2` | MAJOR | |
|
|
15
|
-
| `legacy-ui/package.json` | `jsdom` | `^24.0.0` | `30.1.1` | MAJOR | |
|
|
16
|
-
| `loki-ts/package.json` | `@anthropic-ai/claude-agent-sdk` | `0.3.283` | `0.3.283` | up-to-date | |
|
|
17
|
-
| `loki-ts/package.json` | `@anthropic-ai/sdk` | `^0.124.0` | `0.128.0` | 0.x breaking | |
|
|
11
|
+
| `loki-ts/package.json` | `@anthropic-ai/claude-agent-sdk` | `0.3.288` | `0.3.288` | up-to-date | |
|
|
12
|
+
| `loki-ts/package.json` | `@anthropic-ai/sdk` | `^0.124.0` | `0.131.0` | 0.x breaking | |
|
|
18
13
|
| `loki-ts/package.json` | `@resvg/resvg-wasm` | `^2.6.2` | `2.6.2` | up-to-date | |
|
|
19
14
|
| `loki-ts/package.json` | `@types/bun` | `latest` | `1.4.2` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
|
|
20
15
|
| `loki-ts/package.json` | `typescript` | `^5.6.0` | `7.0.2` | MAJOR | |
|
|
21
|
-
| `loki-ts/tests/engine10/fixtures/testmap/package.json` | `vitest` | `^2.0.0` | `5.0.
|
|
16
|
+
| `loki-ts/tests/engine10/fixtures/testmap/package.json` | `vitest` | `^2.0.0` | `5.0.3` | MAJOR | test fixture, not a real dependency |
|
|
17
|
+
| `loki-ts/tests/fixtures/project-model/firelater-17/backend/package.json` | `vitest` | `^1.0.0` | `5.0.3` | MAJOR | test fixture, not a real dependency |
|
|
22
18
|
| `package.json` | `@resvg/resvg-wasm` | `^2.6.2` | `2.6.2` | up-to-date | |
|
|
23
|
-
| `package.json` | `@types/node` | `^25.2.0` | `26.6.
|
|
19
|
+
| `package.json` | `@types/node` | `^25.2.0` | `26.6.4` | MAJOR | |
|
|
24
20
|
| `package.json` | `jest` | `^29.7.0` | `30.5.2` | MAJOR | |
|
|
25
21
|
| `package.json` | `jsdom` | `^24.0.0` | `30.1.1` | MAJOR | |
|
|
26
22
|
| `package.json` | `typescript` | `^5.9.3` | `7.0.2` | MAJOR | |
|
|
27
|
-
| `packages/control-plane/package.json` | `drizzle-kit` | `^0.31.11` | `0.31.11` | up-to-date | |
|
|
28
23
|
| `packages/control-plane/package.json` | `drizzle-orm` | `^0.45.3` | `0.45.3` | up-to-date | |
|
|
29
24
|
| `packages/control-plane/package.json` | `hono` | `^4.13.12` | `4.13.12` | up-to-date | |
|
|
25
|
+
| `packages/control-plane/package.json` | `yaml` | `^2.9.1` | `2.9.1` | up-to-date | |
|
|
26
|
+
| `packages/control-plane/package.json` | `@playwright/test` | `1.58.1` | `1.63.0` | minor | |
|
|
27
|
+
| `packages/control-plane/package.json` | `axe-core` | `4.13.0` | `4.13.0` | up-to-date | |
|
|
28
|
+
| `packages/control-plane/package.json` | `drizzle-kit` | `^0.31.11` | `0.31.11` | up-to-date | |
|
|
29
|
+
| `packages/control-plane/ui/package.json` | `lucide-react` | `^0.577.0` | `1.51.0` | MAJOR | |
|
|
30
|
+
| `packages/control-plane/ui/package.json` | `react` | `^19.3.0` | `19.3.0` | up-to-date | |
|
|
31
|
+
| `packages/control-plane/ui/package.json` | `react-dom` | `^19.3.0` | `19.3.0` | up-to-date | |
|
|
30
32
|
| `packages/control-plane/ui/package.json` | `@happy-dom/global-registrator` | `^18.0.1` | `20.14.5` | MAJOR | |
|
|
31
33
|
| `packages/control-plane/ui/package.json` | `@testing-library/react` | `^16.3.0` | `16.3.3` | patch | |
|
|
32
34
|
| `packages/control-plane/ui/package.json` | `@types/react` | `^19.0.0` | `19.3.0` | minor | |
|
|
33
|
-
| `packages/control-plane/ui/package.json` | `@types/react-dom` | `^19.0.0` | `
|
|
35
|
+
| `packages/control-plane/ui/package.json` | `@types/react-dom` | `^19.0.0` | `19.3.0` | minor | |
|
|
34
36
|
| `packages/control-plane/ui/package.json` | `@vitejs/plugin-react` | `^4.3.4` | `6.1.1` | MAJOR | |
|
|
35
37
|
| `packages/control-plane/ui/package.json` | `autoprefixer` | `^10.6.1` | `10.6.1` | up-to-date | |
|
|
36
|
-
| `packages/control-plane/ui/package.json` | `lucide-react` | `^0.577.0` | `1.49.0` | MAJOR | |
|
|
37
38
|
| `packages/control-plane/ui/package.json` | `postcss` | `^8.5.28` | `8.5.28` | up-to-date | |
|
|
38
|
-
| `packages/control-plane/ui/package.json` | `react` | `^19.3.0` | `19.3.0` | up-to-date | |
|
|
39
|
-
| `packages/control-plane/ui/package.json` | `react-dom` | `^19.3.0` | `19.3.0` | up-to-date | |
|
|
40
39
|
| `packages/control-plane/ui/package.json` | `tailwindcss` | `^3.4.17` | `4.3.3` | MAJOR | |
|
|
41
40
|
| `packages/control-plane/ui/package.json` | `typescript` | `~5.7.2` | `7.0.2` | MAJOR | |
|
|
42
41
|
| `packages/control-plane/ui/package.json` | `vite` | `^6.2.0` | `8.3.2` | MAJOR | |
|
|
43
42
|
| `sdk/typescript/package.json` | `typescript` | `^5.9.3` | `7.0.2` | MAJOR | |
|
|
44
|
-
| `vscode-extension/package.json` | `@types/node` | `^20.10.0` | `26.6.
|
|
45
|
-
| `vscode-extension/package.json` | `@types/vscode` | `^1.85.0` | `1.
|
|
46
|
-
| `vscode-extension/package.json` | `@typescript-eslint/eslint-plugin` | `^6.13.0` | `8.
|
|
47
|
-
| `vscode-extension/package.json` | `@typescript-eslint/parser` | `^6.13.0` | `8.
|
|
43
|
+
| `vscode-extension/package.json` | `@types/node` | `^20.10.0` | `26.6.4` | MAJOR | |
|
|
44
|
+
| `vscode-extension/package.json` | `@types/vscode` | `^1.85.0` | `1.140.0` | minor | |
|
|
45
|
+
| `vscode-extension/package.json` | `@typescript-eslint/eslint-plugin` | `^6.13.0` | `8.71.0` | MAJOR | |
|
|
46
|
+
| `vscode-extension/package.json` | `@typescript-eslint/parser` | `^6.13.0` | `8.71.0` | MAJOR | |
|
|
48
47
|
| `vscode-extension/package.json` | `@vscode/vsce` | `^2.22.0` | `4.0.0` | MAJOR | |
|
|
49
48
|
| `vscode-extension/package.json` | `esbuild` | `^0.19.8` | `0.28.2` | 0.x breaking | |
|
|
50
|
-
| `vscode-extension/package.json` | `eslint` | `^8.55.0` | `10.
|
|
49
|
+
| `vscode-extension/package.json` | `eslint` | `^8.55.0` | `10.12.0` | MAJOR | |
|
|
51
50
|
| `vscode-extension/package.json` | `typescript` | `^5.3.2` | `7.0.2` | MAJOR | |
|
|
52
51
|
| `web-app/package.json` | `@monaco-editor/react` | `^4.7.0` | `4.7.0` | up-to-date | |
|
|
53
52
|
| `web-app/package.json` | `@xterm/addon-fit` | `^0.11.0` | `0.11.0` | up-to-date | |
|
|
54
53
|
| `web-app/package.json` | `@xterm/addon-web-links` | `^0.12.0` | `0.12.0` | up-to-date | |
|
|
55
54
|
| `web-app/package.json` | `@xterm/xterm` | `^6.0.0` | `6.0.0` | up-to-date | |
|
|
56
|
-
| `web-app/package.json` | `lucide-react` | `^0.577.0` | `1.
|
|
57
|
-
| `web-app/package.json` | `react` | `^19.
|
|
58
|
-
| `web-app/package.json` | `react-dom` | `^19.
|
|
59
|
-
| `web-app/package.json` | `react-resizable-panels` | `^4.
|
|
60
|
-
| `web-app/package.json` | `react-router-dom` | `^7.
|
|
55
|
+
| `web-app/package.json` | `lucide-react` | `^0.577.0` | `1.51.0` | MAJOR | |
|
|
56
|
+
| `web-app/package.json` | `react` | `^19.3.0` | `19.3.0` | up-to-date | |
|
|
57
|
+
| `web-app/package.json` | `react-dom` | `^19.3.0` | `19.3.0` | up-to-date | |
|
|
58
|
+
| `web-app/package.json` | `react-resizable-panels` | `^4.14.1` | `4.14.2` | patch | |
|
|
59
|
+
| `web-app/package.json` | `react-router-dom` | `^7.18.4` | `7.18.4` | up-to-date | |
|
|
61
60
|
| `web-app/package.json` | `@eslint/js` | `^9.21.0` | `10.0.1` | MAJOR | |
|
|
62
|
-
| `web-app/package.json` | `@playwright/test` | `^1.
|
|
63
|
-
| `web-app/package.json` | `@types/react` | `^19.0
|
|
64
|
-
| `web-app/package.json` | `@types/react-dom` | `^19.0
|
|
61
|
+
| `web-app/package.json` | `@playwright/test` | `^1.63.0` | `1.63.0` | up-to-date | |
|
|
62
|
+
| `web-app/package.json` | `@types/react` | `^19.3.0` | `19.3.0` | up-to-date | |
|
|
63
|
+
| `web-app/package.json` | `@types/react-dom` | `^19.3.0` | `19.3.0` | up-to-date | |
|
|
65
64
|
| `web-app/package.json` | `@vitejs/plugin-react` | `^4.3.4` | `6.1.1` | MAJOR | |
|
|
66
|
-
| `web-app/package.json` | `autoprefixer` | `^10.
|
|
67
|
-
| `web-app/package.json` | `eslint` | `^9.21.0` | `10.
|
|
65
|
+
| `web-app/package.json` | `autoprefixer` | `^10.6.1` | `10.6.1` | up-to-date | |
|
|
66
|
+
| `web-app/package.json` | `eslint` | `^9.21.0` | `10.12.0` | MAJOR | |
|
|
68
67
|
| `web-app/package.json` | `eslint-plugin-react-hooks` | `^5.1.0` | `7.1.1` | MAJOR | |
|
|
69
68
|
| `web-app/package.json` | `eslint-plugin-react-refresh` | `^0.4.19` | `0.5.7` | 0.x breaking | |
|
|
70
|
-
| `web-app/package.json` | `globals` | `^15.15.0` | `17.
|
|
71
|
-
| `web-app/package.json` | `postcss` | `^8.5.
|
|
69
|
+
| `web-app/package.json` | `globals` | `^15.15.0` | `17.13.0` | MAJOR | |
|
|
70
|
+
| `web-app/package.json` | `postcss` | `^8.5.28` | `8.5.28` | up-to-date | |
|
|
72
71
|
| `web-app/package.json` | `tailwindcss` | `^3.4.17` | `4.3.3` | MAJOR | |
|
|
73
72
|
| `web-app/package.json` | `typescript` | `~5.7.2` | `7.0.2` | MAJOR | |
|
|
74
|
-
| `web-app/package.json` | `typescript-eslint` | `^8.
|
|
75
|
-
| `web-app/package.json` | `vite` | `^6.2.0` | `8.3.
|
|
73
|
+
| `web-app/package.json` | `typescript-eslint` | `^8.70.1` | `8.71.0` | minor | |
|
|
74
|
+
| `web-app/package.json` | `vite` | `^6.2.0` | `8.3.2` | MAJOR | |
|
|
75
|
+
| `loki-ts/tests/fixtures/project-model/firelater-17/frontend/package.json` | `(none found)` | `` | `-` | n/a | test fixture; no dependencies or devDependencies declared |
|
|
76
76
|
|
|
77
77
|
## Python (requirements*.txt)
|
|
78
78
|
|
|
79
79
|
| File | Name | Current | Latest stable | Bump | Note |
|
|
80
80
|
|---|---|---|---|---|---|
|
|
81
|
-
| `dashboard/requirements.txt` | `fastapi` | `>=0.100.0,<1.0.0` | `0.
|
|
81
|
+
| `dashboard/requirements.txt` | `fastapi` | `>=0.100.0,<1.0.0` | `0.142.2` | 0.x breaking | |
|
|
82
82
|
| `dashboard/requirements.txt` | `uvicorn` | `>=0.20.0,<1.0.0` | `0.54.0` | 0.x breaking | |
|
|
83
|
-
| `dashboard/requirements.txt` | `sqlalchemy` | `>=2.
|
|
83
|
+
| `dashboard/requirements.txt` | `sqlalchemy` | `>=2.1.1,<3.0.0` | `2.1.3` | patch | |
|
|
84
84
|
| `dashboard/requirements.txt` | `aiosqlite` | `>=0.19.0,<1.0.0` | `0.22.1` | 0.x breaking | |
|
|
85
|
-
| `dashboard/requirements.txt` | `greenlet` | `>=3.
|
|
86
|
-
| `dashboard/requirements.txt` | `pydantic` | `>=2.
|
|
87
|
-
| `dashboard/requirements.txt` | `websockets` | `>=12.0,<16.0` | `17.
|
|
88
|
-
| `mcp/requirements.txt` | `mcp` | `>=1.0.0,<2.0.0` | `2.
|
|
89
|
-
| `mcp/requirements.txt` | `chromadb` | `>=1.
|
|
90
|
-
| `mcp/requirements.txt` | `anthropic` | `>=0.40,<1.0.0` | `1.
|
|
85
|
+
| `dashboard/requirements.txt` | `greenlet` | `>=3.5.6,<4.0.0` | `3.5.6` | up-to-date | |
|
|
86
|
+
| `dashboard/requirements.txt` | `pydantic` | `>=2.13.5,<3.0.0` | `2.13.5` | up-to-date | |
|
|
87
|
+
| `dashboard/requirements.txt` | `websockets` | `>=12.0,<16.0` | `17.2` | MAJOR | |
|
|
88
|
+
| `mcp/requirements.txt` | `mcp` | `>=1.0.0,<2.0.0` | `2.3.0` | MAJOR | |
|
|
89
|
+
| `mcp/requirements.txt` | `chromadb` | `>=1.5.9,<2.0.0` | `1.5.9` | up-to-date | |
|
|
90
|
+
| `mcp/requirements.txt` | `anthropic` | `>=0.40,<1.0.0` | `1.11.0` | MAJOR | |
|
|
91
91
|
| `requirements-test.txt` | `pytest` | `(unpinned)` | `9.1.1` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
|
|
92
92
|
| `requirements-test.txt` | `pytest-asyncio` | `(unpinned)` | `1.4.0` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
|
|
93
93
|
| `requirements-test.txt` | `pytest-xdist` | `(unpinned)` | `3.8.0` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
|
|
94
|
-
| `requirements-test.txt` | `mcp` | `>=1.0.0,<2.0.0` | `2.
|
|
94
|
+
| `requirements-test.txt` | `mcp` | `>=1.0.0,<2.0.0` | `2.3.0` | MAJOR | |
|
|
95
95
|
| `requirements-test.txt` | `pydantic` | `(unpinned)` | `2.13.5` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
|
|
96
|
-
| `requirements-test.txt` | `fastapi` | `(unpinned)` | `0.
|
|
96
|
+
| `requirements-test.txt` | `fastapi` | `(unpinned)` | `0.142.2` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
|
|
97
97
|
| `requirements-test.txt` | `uvicorn` | `(unpinned)` | `0.54.0` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
|
|
98
98
|
| `requirements-test.txt` | `httpx` | `(unpinned)` | `0.28.1` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
|
|
99
|
-
| `requirements-test.txt` | `sqlalchemy` | `(unpinned)` | `2.1.
|
|
99
|
+
| `requirements-test.txt` | `sqlalchemy` | `(unpinned)` | `2.1.3` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
|
|
100
100
|
| `requirements-test.txt` | `aiosqlite` | `(unpinned)` | `0.22.1` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
|
|
101
|
-
| `requirements-test.txt` | `cryptography` | `>=41.0.0` | `50.0.
|
|
101
|
+
| `requirements-test.txt` | `cryptography` | `>=41.0.0` | `50.0.2` | MAJOR | |
|
|
102
102
|
| `requirements-test.txt` | `pyyaml` | `(unpinned)` | `6.0.3` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
|
|
103
103
|
| `tests/fixtures/legacy-checkout-app/requirements.txt` | `flask` | `==3.0.0` | `3.1.3` | minor | test fixture, not a real dependency |
|
|
104
|
-
| `tests/fixtures/legacy-checkout-app/requirements.txt` | `stripe` | `==7.0.0` | `
|
|
104
|
+
| `tests/fixtures/legacy-checkout-app/requirements.txt` | `stripe` | `==7.0.0` | `16.0.0` | MAJOR | test fixture, not a real dependency |
|
|
105
105
|
| `web-app/requirements-test.txt` | `pytest` | `>=7.4.0` | `9.1.1` | MAJOR | |
|
|
106
106
|
| `web-app/requirements-test.txt` | `pytest-asyncio` | `>=0.21.0` | `1.4.0` | MAJOR | |
|
|
107
107
|
| `web-app/requirements-test.txt` | `httpx` | `>=0.24.0` | `0.28.1` | 0.x breaking | |
|
|
108
|
-
| `web-app/requirements.txt` | `fastapi` | `>=0.100.0` | `0.
|
|
108
|
+
| `web-app/requirements.txt` | `fastapi` | `>=0.100.0` | `0.142.2` | 0.x breaking | |
|
|
109
109
|
| `web-app/requirements.txt` | `uvicorn` | `>=0.20.0` | `0.54.0` | 0.x breaking | |
|
|
110
|
-
| `web-app/requirements.txt` | `pydantic` | `>=2.
|
|
110
|
+
| `web-app/requirements.txt` | `pydantic` | `>=2.13.5` | `2.13.5` | up-to-date | |
|
|
111
111
|
| `web-app/requirements.txt` | `httpx` | `>=0.24.0` | `0.28.1` | 0.x breaking | |
|
|
112
112
|
| `web-app/requirements.txt` | `python-multipart` | `>=0.0.9` | `0.0.32` | 0.x breaking | |
|
|
113
|
-
| `web-app/requirements.txt` | `pexpect` | `>=4.
|
|
113
|
+
| `web-app/requirements.txt` | `pexpect` | `>=4.9.0` | `4.9.0` | up-to-date | |
|
|
114
114
|
| `web-app/requirements.txt` | `watchdog` | `>=3.0.0` | `6.0.0` | MAJOR | |
|
|
115
|
-
| `web-app/requirements.txt` | `sqlalchemy` | `>=2.
|
|
115
|
+
| `web-app/requirements.txt` | `sqlalchemy` | `>=2.1.1` | `2.1.3` | patch | |
|
|
116
116
|
| `web-app/requirements.txt` | `asyncpg` | `>=0.28.0` | `0.31.0` | 0.x breaking | |
|
|
117
117
|
| `web-app/requirements.txt` | `aiosqlite` | `>=0.19.0` | `0.22.1` | 0.x breaking | |
|
|
118
|
-
| `web-app/requirements.txt` | `alembic` | `>=1.
|
|
119
|
-
| `web-app/requirements.txt` | `python-jose` | `>=3.
|
|
118
|
+
| `web-app/requirements.txt` | `alembic` | `>=1.20.0` | `1.20.0` | up-to-date | |
|
|
119
|
+
| `web-app/requirements.txt` | `python-jose` | `>=3.5.0` | `3.5.0` | up-to-date | |
|
|
120
120
|
| `web-app/requirements.txt` | `passlib` | `>=1.7.4` | `1.7.4` | up-to-date | |
|
|
121
|
-
| `web-app/requirements.txt` | `cryptography` | `>=41.0.0` | `50.0.
|
|
122
|
-
| `web-app/requirements.txt` | `pyyaml` | `>=6.0` | `6.0.3` |
|
|
121
|
+
| `web-app/requirements.txt` | `cryptography` | `>=41.0.0` | `50.0.2` | MAJOR | |
|
|
122
|
+
| `web-app/requirements.txt` | `pyyaml` | `>=6.0.3` | `6.0.3` | up-to-date | |
|
|
123
123
|
|
|
124
124
|
## Python (pyproject.toml)
|
|
125
125
|
|
|
@@ -128,7 +128,7 @@ Inventory only. No dependency, lockfile, workflow or image was changed to produc
|
|
|
128
128
|
| `loki-ts/tests/engine10/fixtures/testmap/pyproject.toml` | `(none declared)` | `` | `-` | n/a | test fixture, not a real dependency |
|
|
129
129
|
| `loki-ts/tests/engine10/modernize/fixtures/inv/sample-repo/pyproject.toml` | `(none declared)` | `` | `-` | n/a | test fixture, not a real dependency |
|
|
130
130
|
| `sdk/python/pyproject.toml` | `httpx` | `>=0.24.0` | `0.28.1` | 0.x breaking | |
|
|
131
|
-
| `sdk/python/pyproject.toml` | `pydantic` | `>=2.
|
|
131
|
+
| `sdk/python/pyproject.toml` | `pydantic` | `>=2.13.5` | `2.13.5` | up-to-date | |
|
|
132
132
|
| `sdk/python/pyproject.toml` | `setuptools` | `>=68.0` | `84.0.0` | MAJOR | |
|
|
133
133
|
| `sdk/python/pyproject.toml` | `wheel` | `(unpinned)` | `0.48.0` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
|
|
134
134
|
|
|
@@ -136,49 +136,31 @@ Inventory only. No dependency, lockfile, workflow or image was changed to produc
|
|
|
136
136
|
|
|
137
137
|
| File | Name | Current | Latest stable | Bump | Note |
|
|
138
138
|
|---|---|---|---|---|---|
|
|
139
|
-
| `.github/workflows/arm64-runtime.yml` | `docker/setup-qemu-action@v3` | `v3 (resolves to v3.7.0)` | `v4.4.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v3 resolves to v3.7.0 (commit c7c53464625b), behind latest release v4.4.0 (commit 990126619549); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
140
139
|
| `.github/workflows/bun-parity.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
141
|
-
| `.github/workflows/bun-parity.yml` | `oven-sh/setup-bun@
|
|
140
|
+
| `.github/workflows/bun-parity.yml` | `oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6` | `0c5077e51419868618aeaa5fe8019c62421857d6 # v2` | `v2.2.0` | minor | SHA-pinned |
|
|
142
141
|
| `.github/workflows/bun-parity.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
143
|
-
| `.github/workflows/
|
|
144
|
-
| `.github/workflows/check-phase6-ready.yml` | `oven-sh/setup-bun@v2` | `v2 (resolves to v2.2.0)` | `v2.2.0` | up-to-date | tag-pinned (not SHA-pinned); floating tag v2 resolves to v2.2.0, which IS the latest release -- tracks latest within that major |
|
|
145
|
-
| `.github/workflows/check-phase6-ready.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
146
|
-
| `.github/workflows/cla.yml` | `contributor-assistant/github-action@v2.6.1` | `v2.6.1` | `v2.6.1` | up-to-date | tag-pinned (not SHA-pinned); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
142
|
+
| `.github/workflows/cla.yml` | `contributor-assistant/github-action@ca4a40a7d1004f18d9960b404b97e5f30a505a08` | `ca4a40a7d1004f18d9960b404b97e5f30a505a08 # v2.6.1` | `v2.6.1` | up-to-date | SHA-pinned; action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
147
143
|
| `.github/workflows/claude-code-review.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
148
|
-
| `.github/workflows/claude-code-review.yml` | `anthropics/claude-code-action@
|
|
144
|
+
| `.github/workflows/claude-code-review.yml` | `anthropics/claude-code-action@8ce9314fa9a404564fa7e954cd84f25bcba2b829` | `8ce9314fa9a404564fa7e954cd84f25bcba2b829 # v1` | `v1` | up-to-date | SHA-pinned |
|
|
149
145
|
| `.github/workflows/coverage.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
150
|
-
| `.github/workflows/coverage.yml` | `oven-sh/setup-bun@
|
|
146
|
+
| `.github/workflows/coverage.yml` | `oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6` | `0c5077e51419868618aeaa5fe8019c62421857d6 # v2` | `v2.2.0` | minor | SHA-pinned |
|
|
147
|
+
| `.github/workflows/coverage.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
151
148
|
| `.github/workflows/coverage.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
152
149
|
| `.github/workflows/first-run-gate.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
153
|
-
| `.github/workflows/first-run-gate.yml` | `oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6` | `0c5077e51419868618aeaa5fe8019c62421857d6 # v2` | `v2.2.0` |
|
|
150
|
+
| `.github/workflows/first-run-gate.yml` | `oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6` | `0c5077e51419868618aeaa5fe8019c62421857d6 # v2` | `v2.2.0` | minor | SHA-pinned |
|
|
154
151
|
| `.github/workflows/first-run-gate.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
155
152
|
| `.github/workflows/integrity-audit.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
156
153
|
| `.github/workflows/integrity-audit.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
157
154
|
| `.github/workflows/integrity-audit.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
158
155
|
| `.github/workflows/integrity-audit.yml` | `azure/setup-helm@v4` | `v4 (resolves to v4.3.1)` | `v5.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.3.1 (commit 1a275c3b6953), behind latest release v5.0.1 (commit 9bc31f4ebc9c); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
159
|
-
| `.github/workflows/loki-ci-example.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
160
|
-
| `.github/workflows/loki-ci-example.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
161
|
-
| `.github/workflows/loki-ci-example.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
162
|
-
| `.github/workflows/loki-enterprise.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
163
|
-
| `.github/workflows/loki-enterprise.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
164
|
-
| `.github/workflows/loki-enterprise.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
165
|
-
| `.github/workflows/loki-enterprise.yml` | `actions/download-artifact@v4` | `v4 (resolves to v4.3.0)` | `v8.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.3.0 (commit d3f86a106a0b), behind latest release v8.0.1 (commit 3e5f45b2cfb9); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
166
|
-
| `.github/workflows/loki-issue-to-pr.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
167
|
-
| `.github/workflows/loki-issue-to-pr.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
168
|
-
| `.github/workflows/loki-issue-to-pr.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
169
|
-
| `.github/workflows/loki-issue-to-pr.yml` | `actions/download-artifact@v4` | `v4 (resolves to v4.3.0)` | `v8.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.3.0 (commit d3f86a106a0b), behind latest release v8.0.1 (commit 3e5f45b2cfb9); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
170
156
|
| `.github/workflows/model-catalog-probe.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
171
157
|
| `.github/workflows/model-catalog-probe.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
172
|
-
| `.github/workflows/mutation-testing.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
173
|
-
| `.github/workflows/mutation-testing.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
174
|
-
| `.github/workflows/mutation-testing.yml` | `oven-sh/setup-bun@v2` | `v2 (resolves to v2.2.0)` | `v2.2.0` | up-to-date | tag-pinned (not SHA-pinned); floating tag v2 resolves to v2.2.0, which IS the latest release -- tracks latest within that major |
|
|
175
|
-
| `.github/workflows/mutation-testing.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
176
158
|
| `.github/workflows/nightly.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
177
|
-
| `.github/workflows/nightly.yml` | `oven-sh/setup-bun@
|
|
159
|
+
| `.github/workflows/nightly.yml` | `oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6` | `0c5077e51419868618aeaa5fe8019c62421857d6 # v2` | `v2.2.0` | minor | SHA-pinned |
|
|
178
160
|
| `.github/workflows/nightly.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
179
161
|
| `.github/workflows/nightly.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
180
162
|
| `.github/workflows/parity-drift.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
181
|
-
| `.github/workflows/parity-drift.yml` | `oven-sh/setup-bun@
|
|
163
|
+
| `.github/workflows/parity-drift.yml` | `oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6` | `0c5077e51419868618aeaa5fe8019c62421857d6 # v2` | `v2.2.0` | minor | SHA-pinned |
|
|
182
164
|
| `.github/workflows/parity-drift.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
183
165
|
| `.github/workflows/parity-drift.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
184
166
|
| `.github/workflows/post-release-smoke.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
@@ -186,24 +168,19 @@ Inventory only. No dependency, lockfile, workflow or image was changed to produc
|
|
|
186
168
|
| `.github/workflows/post-release-smoke.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
187
169
|
| `.github/workflows/promote.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
188
170
|
| `.github/workflows/promote.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
171
|
+
| `.github/workflows/promote.yml` | `oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6` | `0c5077e51419868618aeaa5fe8019c62421857d6 # v2` | `v2.2.0` | minor | SHA-pinned |
|
|
189
172
|
| `.github/workflows/promote.yml` | `docker/login-action@v3` | `v3 (resolves to v3.7.0)` | `v4.6.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v3 resolves to v3.7.0 (commit c94ce9fb4685), behind latest release v4.6.0 (commit dbcb813823bd); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
190
|
-
| `.github/workflows/provenance.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
191
|
-
| `.github/workflows/provenance.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
192
|
-
| `.github/workflows/provenance.yml` | `oven-sh/setup-bun@v2` | `v2 (resolves to v2.2.0)` | `v2.2.0` | up-to-date | tag-pinned (not SHA-pinned); floating tag v2 resolves to v2.2.0, which IS the latest release -- tracks latest within that major |
|
|
193
|
-
| `.github/workflows/provenance.yml` | `sigstore/cosign-installer@v3` | `v3 (resolves to v3.9.1)` | `v4.1.2` | MAJOR | tag-pinned (not SHA-pinned); floating tag v3 resolves to v3.9.1 (commit 398d4b0eeef1), behind latest release v4.1.2 (commit 6f9f17788090) |
|
|
194
|
-
| `.github/workflows/provenance.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
195
|
-
| `.github/workflows/provenance.yml` | `docker/login-action@v3` | `v3 (resolves to v3.7.0)` | `v4.6.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v3 resolves to v3.7.0 (commit c94ce9fb4685), behind latest release v4.6.0 (commit dbcb813823bd); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
196
173
|
| `.github/workflows/release.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
197
|
-
| `.github/workflows/release.yml` | `oven-sh/setup-bun@
|
|
198
|
-
| `.github/workflows/release.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
174
|
+
| `.github/workflows/release.yml` | `oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6` | `0c5077e51419868618aeaa5fe8019c62421857d6 # v2` | `v2.2.0` | minor | SHA-pinned |
|
|
199
175
|
| `.github/workflows/release.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
176
|
+
| `.github/workflows/release.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
200
177
|
| `.github/workflows/release.yml` | `docker/setup-buildx-action@v3` | `v3 (resolves to v3.12.0)` | `v4.4.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v3 resolves to v3.12.0 (commit 8d2750c68a42), behind latest release v4.4.1 (commit f87e5991a6d7); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
201
178
|
| `.github/workflows/release.yml` | `docker/login-action@v3` | `v3 (resolves to v3.7.0)` | `v4.6.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v3 resolves to v3.7.0 (commit c94ce9fb4685), behind latest release v4.6.0 (commit dbcb813823bd); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
202
179
|
| `.github/workflows/release.yml` | `docker/build-push-action@v5` | `v5 (resolves to v5.4.0)` | `v7.4.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.4.0 (commit ca052bb54ab0), behind latest release v7.4.0 (commit c3c9e263c25d); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
203
180
|
| `.github/workflows/release.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
204
181
|
| `.github/workflows/release.yml` | `actions/download-artifact@v4` | `v4 (resolves to v4.3.0)` | `v8.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.3.0 (commit d3f86a106a0b), behind latest release v8.0.1 (commit 3e5f45b2cfb9); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
205
182
|
| `.github/workflows/release.yml` | `sigstore/cosign-installer@v3` | `v3 (resolves to v3.9.1)` | `v4.1.2` | MAJOR | tag-pinned (not SHA-pinned); floating tag v3 resolves to v3.9.1 (commit 398d4b0eeef1), behind latest release v4.1.2 (commit 6f9f17788090) |
|
|
206
|
-
| `.github/workflows/release.yml` | `anchore/sbom-action@
|
|
183
|
+
| `.github/workflows/release.yml` | `anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610` | `e22c389904149dbc22b58101806040fa8d37a610 # v0` | `v0.24.3` | minor | SHA-pinned |
|
|
207
184
|
| `.github/workflows/release.yml` | `peter-evans/dockerhub-description@v4` | `v4 (resolves to v4.0.2)` | `v5.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.0.2 (commit 432a30c9e074), behind latest release v5.0.0 (commit 1b9a80c056b6); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
208
185
|
| `.github/workflows/sbom.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
209
186
|
| `.github/workflows/sbom.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
@@ -216,7 +193,7 @@ Inventory only. No dependency, lockfile, workflow or image was changed to produc
|
|
|
216
193
|
| `.github/workflows/security-audit.yml` | `actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02` | `ea165f8d65b6e75b540449e92b4886f43607fa02 # v4` | `v7.0.1` | MAJOR | SHA-pinned; action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
217
194
|
| `.github/workflows/security-audit.yml` | `github/codeql-action/init@f3712979fa5f215279b101dd0a2e3bdfb4353324` | `f3712979fa5f215279b101dd0a2e3bdfb4353324` | `codeql-bundle-v2.27.1` | unknown | SHA-pinned, no version comment; latest release is codeql-bundle-v2.27.1; action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
218
195
|
| `.github/workflows/security-audit.yml` | `github/codeql-action/analyze@f3712979fa5f215279b101dd0a2e3bdfb4353324` | `f3712979fa5f215279b101dd0a2e3bdfb4353324` | `codeql-bundle-v2.27.1` | unknown | SHA-pinned, no version comment; latest release is codeql-bundle-v2.27.1; action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
219
|
-
| `.github/workflows/security-audit.yml` | `oven-sh/setup-bun@
|
|
196
|
+
| `.github/workflows/security-audit.yml` | `oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6` | `0c5077e51419868618aeaa5fe8019c62421857d6 # v2` | `v2.2.0` | minor | SHA-pinned |
|
|
220
197
|
| `.github/workflows/sentrux-real.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
221
198
|
| `.github/workflows/sentrux-real.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
222
199
|
| `.github/workflows/sentrux-real.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
@@ -225,52 +202,53 @@ Inventory only. No dependency, lockfile, workflow or image was changed to produc
|
|
|
225
202
|
| `.github/workflows/test.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
226
203
|
| `.github/workflows/test.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
227
204
|
| `.github/workflows/test.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
228
|
-
| `.github/workflows/test.yml` | `oven-sh/setup-bun@
|
|
205
|
+
| `.github/workflows/test.yml` | `oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6` | `0c5077e51419868618aeaa5fe8019c62421857d6 # v2` | `v2.2.0` | minor | SHA-pinned |
|
|
229
206
|
| `.github/workflows/test.yml` | `actions/cache@v4` | `v4 (resolves to v4.3.0)` | `v6.1.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.3.0 (commit 0057852bfaa8), behind latest release v6.1.0 (commit 55cc8345863c); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
230
207
|
| `.github/workflows/test.yml` | `azure/setup-helm@v4` | `v4 (resolves to v4.3.1)` | `v5.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.3.1 (commit 1a275c3b6953), behind latest release v5.0.1 (commit 9bc31f4ebc9c); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
231
208
|
| `.github/workflows/tier-a.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
232
209
|
| `.github/workflows/tier-a.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
233
|
-
| `.github/workflows/tier-a.yml` | `oven-sh/setup-bun@
|
|
210
|
+
| `.github/workflows/tier-a.yml` | `oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6` | `0c5077e51419868618aeaa5fe8019c62421857d6 # v2` | `v2.2.0` | minor | SHA-pinned |
|
|
234
211
|
| `.github/workflows/tier-a.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
235
212
|
| `action.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
|
|
236
213
|
| `.github/actions/issue-to-pr/action.yml` | `(none found)` | `` | `-` | n/a | no `uses:` step found in this workflow/action file |
|
|
237
214
|
| `.github/actions/review/action.yml` | `(none found)` | `` | `-` | n/a | no `uses:` step found in this workflow/action file |
|
|
238
215
|
|
|
239
|
-
**Node 20 runtime deprecation:** GitHub's own Node 20 deprecation covers two distinct things and they must not be conflated. First, matrix jobs still targeting `node-version: 20` (files: .github/workflows/test.yml). Second, and separately: an action whose OWN `action.yml` declares `using: node20` IS the deprecated runtime itself, regardless of what version tag or SHA it is pinned to -- pinning to the latest release of such an action does not fix this until that action's maintainers migrate its action.yml to node22 or later. Every `uses:` target in this repo's workflows was checked at its pinned ref via the GitHub Contents API; action.yml itself declares node20 for: actions/cache, actions/checkout, actions/download-artifact, actions/setup-node, actions/setup-python, actions/upload-artifact, azure/setup-helm, contributor-assistant/github-action, docker/build-push-action, docker/login-action, docker/setup-buildx-action,
|
|
216
|
+
**Node 20 runtime deprecation:** GitHub's own Node 20 deprecation covers two distinct things and they must not be conflated. First, matrix jobs still targeting `node-version: 20` (files: .github/workflows/test.yml). Second, and separately: an action whose OWN `action.yml` declares `using: node20` IS the deprecated runtime itself, regardless of what version tag or SHA it is pinned to -- pinning to the latest release of such an action does not fix this until that action's maintainers migrate its action.yml to node22 or later. Every `uses:` target in this repo's workflows was checked at its pinned ref via the GitHub Contents API; action.yml itself declares node20 for: actions/cache, actions/checkout, actions/download-artifact, actions/setup-node, actions/setup-python, actions/upload-artifact, azure/setup-helm, contributor-assistant/github-action, docker/build-push-action, docker/login-action, docker/setup-buildx-action, github/codeql-action/analyze, github/codeql-action/init, peter-evans/dockerhub-description.
|
|
240
217
|
|
|
241
218
|
## Runtime matrices
|
|
242
219
|
|
|
243
|
-
Node.js current stable: 26.10.0 (cycle 26); Python current stable: 3.14.
|
|
220
|
+
Node.js current stable: 26.10.0 (cycle 26); Python current stable: 3.14.8 (cycle 3.14); Bun current stable: bun-v1.4.2.
|
|
244
221
|
|
|
245
222
|
(The File column lists every workflow file pinning that version.)
|
|
246
223
|
|
|
247
224
|
| File | Name | Current | Latest stable | Bump | Note |
|
|
248
225
|
|---|---|---|---|---|---|
|
|
249
226
|
| `.github/workflows/test.yml` | `Node.js` | `20` | `20.20.2 (newest line 26.10.0)` | EOL | EOL 2026-04-30 (past); EOL in current line; newest line is 26.10.0 |
|
|
250
|
-
| `.github/workflows/integrity-audit.yml, .github/workflows/
|
|
227
|
+
| `.github/workflows/integrity-audit.yml, .github/workflows/nightly.yml, .github/workflows/sentrux-real.yml, .github/workflows/test.yml, .github/workflows/tier-a.yml` | `Node.js` | `22` | `22.23.3 (newest line 26.10.0)` | MAJOR | EOL 2027-04-30 (not yet); minor in line; MAJOR to newest line |
|
|
251
228
|
| `.github/workflows/test.yml` | `Node.js` | `24` | `24.21.0 (newest line 26.10.0)` | MAJOR | EOL 2028-04-30 (not yet); minor in line; MAJOR to newest line |
|
|
252
|
-
| `.github/workflows/test.yml` | `Python` | `3.10` | `3.10.
|
|
253
|
-
| `.github/workflows/test.yml` | `Python` | `3.11` | `3.11.
|
|
254
|
-
| `.github/workflows/bun-parity.yml, .github/workflows/model-catalog-probe.yml, .github/workflows/nightly.yml, .github/workflows/parity-drift.yml,
|
|
255
|
-
| `.github/workflows/test.yml` | `Python` | `3.13` | `3.13.
|
|
256
|
-
| `.github/workflows/bun-parity.yml, .github/workflows/
|
|
229
|
+
| `.github/workflows/test.yml` | `Python` | `3.10` | `3.10.22 (newest line 3.14.8)` | EOL | EOL 2026-10-01 (past); EOL in current line; newest line is 3.14.8 |
|
|
230
|
+
| `.github/workflows/test.yml` | `Python` | `3.11` | `3.11.17 (newest line 3.14.8)` | minor | EOL 2027-10-31 (not yet); patch in line; minor to newest line |
|
|
231
|
+
| `.github/workflows/bun-parity.yml, .github/workflows/coverage.yml, .github/workflows/model-catalog-probe.yml, .github/workflows/nightly.yml, .github/workflows/parity-drift.yml, +3 more` | `Python` | `3.12` | `3.12.15 (newest line 3.14.8)` | minor | EOL 2028-10-31 (not yet); patch in line; minor to newest line |
|
|
232
|
+
| `.github/workflows/test.yml` | `Python` | `3.13` | `3.13.16 (newest line 3.14.8)` | minor | EOL 2029-10-31 (not yet); patch in line; minor to newest line |
|
|
233
|
+
| `.github/workflows/bun-parity.yml, .github/workflows/coverage.yml, .github/workflows/first-run-gate.yml, .github/workflows/nightly.yml, .github/workflows/parity-drift.yml, +4 more` | `Bun` | `1.3.13` | `bun-v1.4.2` | minor | |
|
|
257
234
|
| `.github/workflows/nightly.yml, .github/workflows/test.yml` | `Bun` | `latest` | `-` | unknown | not a numeric version, skipped |
|
|
258
235
|
|
|
259
236
|
## Docker / Compose images
|
|
260
237
|
|
|
261
238
|
| File | Name | Current | Latest stable | Bump | Note |
|
|
262
239
|
|---|---|---|---|---|---|
|
|
240
|
+
| `Dockerfile` | `oven/bun:${BUN_VERSION}` | `oven/bun:${BUN_VERSION}` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
|
|
263
241
|
| `Dockerfile` | `ubuntu:24.04` | `ubuntu:24.04` | `24.04.5 (newest line 26.04.1)` | MAJOR | EOL 2029-05-31 (not yet); patch in line; MAJOR to newest line |
|
|
264
|
-
| `Dockerfile.control-plane` | `oven/bun
|
|
265
|
-
| `Dockerfile.control-plane` | `oven/bun
|
|
242
|
+
| `Dockerfile.control-plane` | `oven/bun:${BUN_VERSION}` | `oven/bun:${BUN_VERSION}` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
|
|
243
|
+
| `Dockerfile.control-plane` | `oven/bun:${BUN_VERSION}-slim` | `oven/bun:${BUN_VERSION}-slim` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
|
|
266
244
|
| `Dockerfile.purplelab-test` | `node:22-slim` | `node:22-slim` | `22.23.3 (newest line 26.10.0)` | MAJOR | EOL 2027-04-30 (not yet); minor in line; MAJOR to newest line |
|
|
267
245
|
| `Dockerfile.sandbox` | `debian:bookworm-slim` | `debian:bookworm-slim` | `12.15 (newest line 13.7)` | MAJOR | EOL 2028-06-30 (not yet); minor in line; MAJOR to newest line |
|
|
268
246
|
| `Dockerfile.sandbox` | `debian:bookworm-slim` | `debian:bookworm-slim` | `12.15 (newest line 13.7)` | MAJOR | EOL 2028-06-30 (not yet); minor in line; MAJOR to newest line |
|
|
269
|
-
| `Dockerfile.test-runner` | `python:3.12-slim` | `python:3.12-slim` | `3.12.
|
|
247
|
+
| `Dockerfile.test-runner` | `python:3.12-slim` | `python:3.12-slim` | `3.12.15 (newest line 3.14.8)` | minor | EOL 2028-10-31 (not yet); patch in line; minor to newest line |
|
|
270
248
|
| `artifacts/observability/Dockerfile` | `nginx:1.27-alpine` | `nginx:1.27-alpine` | `1.27.5 (newest line 1.31.6)` | EOL | EOL 2025-06-24 (past); EOL in current line; newest line is 1.31.6 |
|
|
271
|
-
| `dashboard/Dockerfile` | `python:3.11-slim-bookworm` | `python:3.11-slim-bookworm` | `3.11.
|
|
249
|
+
| `dashboard/Dockerfile` | `python:3.11-slim-bookworm` | `python:3.11-slim-bookworm` | `3.11.17 (newest line 3.14.8)` | minor | EOL 2027-10-31 (not yet); patch in line; minor to newest line |
|
|
272
250
|
| `web-app/Dockerfile` | `node:22-alpine` | `node:22-alpine` | `22.23.3 (newest line 26.10.0)` | MAJOR | EOL 2027-04-30 (not yet); minor in line; MAJOR to newest line |
|
|
273
|
-
| `web-app/Dockerfile` | `python:3.12-slim` | `python:3.12-slim` | `3.12.
|
|
251
|
+
| `web-app/Dockerfile` | `python:3.12-slim` | `python:3.12-slim` | `3.12.15 (newest line 3.14.8)` | minor | EOL 2028-10-31 (not yet); patch in line; minor to newest line |
|
|
274
252
|
| `dashboard/docker-compose.yml` | `loki-dashboard:latest` | `loki-dashboard:latest` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
|
|
275
253
|
| `deploy/docker-compose/docker-compose.yml` | `asklokesh/loki-mode:latest` | `asklokesh/loki-mode:latest` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
|
|
276
254
|
| `deploy/docker-compose/docker-compose.yml` | `otel/opentelemetry-collector-contrib:0.96.0` | `otel/opentelemetry-collector-contrib:0.96.0` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
|
|
@@ -288,20 +266,26 @@ Node.js current stable: 26.10.0 (cycle 26); Python current stable: 3.14.7 (cycle
|
|
|
288
266
|
|
|
289
267
|
| File | Name | Current | Latest stable | Bump | Note |
|
|
290
268
|
|---|---|---|---|---|---|
|
|
291
|
-
| `deploy/helm/autonomi/Chart.yaml` | `appVersion` | `7.93.0` | `10.
|
|
269
|
+
| `deploy/helm/autonomi/Chart.yaml` | `appVersion` | `7.93.0` | `10.9.1` | drifted | DRIFTED: chart appVersion does not track the product VERSION file (10.9.1) |
|
|
292
270
|
| `deploy/helm/autonomi/Chart.yaml` | `chart dependencies` | `(none declared)` | `-` | n/a | |
|
|
293
271
|
| `deploy/helm/autonomi/templates/tests/test-controlplane-health.yaml` | `curlimages/curl:8.11.1` | `curlimages/curl:8.11.1` | `-` | unknown | floating/arbitrary registry tag, see Docker section for endoflife-mapped images |
|
|
294
272
|
| `deploy/helm/autonomi/tests/test-connection.yaml` | `curlimages/curl:8.5.0` | `curlimages/curl:8.5.0` | `-` | unknown | floating/arbitrary registry tag, see Docker section for endoflife-mapped images |
|
|
295
273
|
| `deploy/helm/autonomi/tests/test-health.yaml` | `curlimages/curl:8.5.0` | `curlimages/curl:8.5.0` | `-` | unknown | floating/arbitrary registry tag, see Docker section for endoflife-mapped images |
|
|
296
274
|
| `deploy/helm/autonomi/values.yaml` | `alpine/git:latest` | `alpine/git:latest` | `-` | unknown | floating/arbitrary registry tag, see Docker section for endoflife-mapped images |
|
|
297
275
|
| `deploy/helm/autonomi/values.yaml` | `image.repository` | `asklokesh/loki-mode:(defaults to appVersion)` | `-` | n/a | own product image, tracked via VERSION not a third-party dep |
|
|
298
|
-
| `deploy/helm/control-plane/Chart.yaml` | `appVersion` | `10.6.7` | `10.
|
|
276
|
+
| `deploy/helm/control-plane/Chart.yaml` | `appVersion` | `10.6.7` | `10.9.1` | drifted | DRIFTED: chart appVersion does not track the product VERSION file (10.9.1) |
|
|
299
277
|
| `deploy/helm/control-plane/Chart.yaml` | `chart dependencies` | `(none declared)` | `-` | n/a | |
|
|
300
|
-
| `helm/
|
|
278
|
+
| `deploy/helm/control-plane/values.yaml` | `image.repository` | `asklokesh/loki-control-plane:(defaults to appVersion)` | `-` | n/a | own product image, tracked via VERSION not a third-party dep |
|
|
279
|
+
| `helm/loki-mode/Chart.yaml` | `appVersion` | `9.19.1` | `10.9.1` | drifted | DRIFTED: chart appVersion does not track the product VERSION file (10.9.1) |
|
|
301
280
|
| `helm/loki-mode/Chart.yaml` | `chart dependencies` | `(none declared)` | `-` | n/a | |
|
|
302
281
|
| `helm/loki-mode/values.yaml` | `redis:7-alpine` | `redis:7-alpine` | `-` | unknown | floating/arbitrary registry tag, see Docker section for endoflife-mapped images |
|
|
303
282
|
| `helm/loki-mode/values.yaml` | `image.repository` | `asklokesh/loki-mode:(defaults to appVersion)` | `-` | n/a | own product image, tracked via VERSION not a third-party dep |
|
|
283
|
+
| `deploy/helm/control-plane/templates/deployment.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
|
|
284
|
+
| `deploy/helm/control-plane/templates/ingress.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
|
|
285
|
+
| `deploy/helm/control-plane/templates/pvc.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
|
|
286
|
+
| `deploy/helm/control-plane/templates/service.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
|
|
304
287
|
| `deploy/helm/autonomi/templates/configmap.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
|
|
288
|
+
| `deploy/helm/autonomi/templates/control-token-secret.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
|
|
305
289
|
| `deploy/helm/autonomi/templates/deployment-controlplane.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
|
|
306
290
|
| `deploy/helm/autonomi/templates/deployment-worker.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
|
|
307
291
|
| `deploy/helm/autonomi/templates/hpa-worker.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
|
|
@@ -314,6 +298,7 @@ Node.js current stable: 26.10.0 (cycle 26); Python current stable: 3.14.7 (cycle
|
|
|
314
298
|
| `deploy/helm/autonomi/templates/pdb.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
|
|
315
299
|
| `deploy/helm/autonomi/templates/pvc-audit.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
|
|
316
300
|
| `deploy/helm/autonomi/templates/pvc-checkpoints.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
|
|
301
|
+
| `deploy/helm/autonomi/templates/pvc-control-db.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
|
|
317
302
|
| `deploy/helm/autonomi/templates/rbac.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
|
|
318
303
|
| `deploy/helm/autonomi/templates/secret.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
|
|
319
304
|
| `deploy/helm/autonomi/templates/service-controlplane.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
|
|
@@ -337,10 +322,10 @@ Node.js current stable: 26.10.0 (cycle 26); Python current stable: 3.14.7 (cycle
|
|
|
337
322
|
|
|
338
323
|
| File | Name | Current | Latest stable | Bump | Note |
|
|
339
324
|
|---|---|---|---|---|---|
|
|
340
|
-
| `deploy/terraform/modules/aws-ecs/versions.tf` | `aws (hashicorp/aws)` | `>= 5.0` | `6.
|
|
341
|
-
| `deploy/terraform/modules/aws/versions.tf` | `aws (hashicorp/aws)` | `>= 5.0` | `6.
|
|
342
|
-
| `deploy/terraform/modules/azure/versions.tf` | `azurerm (hashicorp/azurerm)` | `>= 3.0` | `5.
|
|
343
|
-
| `deploy/terraform/modules/gcp/versions.tf` | `google (hashicorp/google)` | `>= 5.0` | `8.
|
|
325
|
+
| `deploy/terraform/modules/aws-ecs/versions.tf` | `aws (hashicorp/aws)` | `>= 5.0` | `6.67.0` | MAJOR | |
|
|
326
|
+
| `deploy/terraform/modules/aws/versions.tf` | `aws (hashicorp/aws)` | `>= 5.0` | `6.67.0` | MAJOR | |
|
|
327
|
+
| `deploy/terraform/modules/azure/versions.tf` | `azurerm (hashicorp/azurerm)` | `>= 3.0` | `5.8.0` | MAJOR | |
|
|
328
|
+
| `deploy/terraform/modules/gcp/versions.tf` | `google (hashicorp/google)` | `>= 5.0` | `8.5.0` | MAJOR | |
|
|
344
329
|
| `deploy/terraform/examples/aws-eks/main.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
|
|
345
330
|
| `deploy/terraform/examples/azure-aks/main.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
|
|
346
331
|
| `deploy/terraform/examples/gcp-gke/main.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
|
|
@@ -363,7 +348,7 @@ Formula lives in a separate repo: `asklokesh/homebrew-tap`, `Formula/loki-mode.r
|
|
|
363
348
|
|
|
364
349
|
| File | Name | Current | Latest stable | Bump | Note |
|
|
365
350
|
|---|---|---|---|---|---|
|
|
366
|
-
| `asklokesh/homebrew-tap:Formula/loki-mode.rb` | `loki-mode` | `10.
|
|
351
|
+
| `asklokesh/homebrew-tap:Formula/loki-mode.rb` | `loki-mode` | `10.7.1` | `10.7.1` | up-to-date | repo VERSION file is 10.9.1 |
|
|
367
352
|
|
|
368
353
|
## Summary
|
|
369
354
|
|
|
@@ -371,92 +356,86 @@ Counts are all from the single `Bump` column (current line vs newest line in the
|
|
|
371
356
|
|
|
372
357
|
| Ecosystem | patch | minor | 0.x breaking | MAJOR | EOL | drifted | unknown | up-to-date | other |
|
|
373
358
|
|---|---|---|---|---|---|---|---|---|---|
|
|
374
|
-
| npm/bun |
|
|
375
|
-
| Python (requirements) |
|
|
376
|
-
| Python (pyproject) | 0 |
|
|
377
|
-
| GitHub Actions |
|
|
378
|
-
| Runtimes | 0 |
|
|
379
|
-
| Docker/Compose | 0 | 3 | 0 | 8 | 1 | 0 |
|
|
380
|
-
| Helm | 0 | 0 | 0 | 0 | 0 |
|
|
359
|
+
| npm/bun | 2 | 5 | 3 | 27 | 0 | 0 | 1 | 24 | 0 |
|
|
360
|
+
| Python (requirements) | 2 | 0 | 10 | 9 | 0 | 0 | 10 | 9 | 0 |
|
|
361
|
+
| Python (pyproject) | 0 | 0 | 1 | 1 | 0 | 0 | 1 | 1 | 0 |
|
|
362
|
+
| GitHub Actions | 0 | 11 | 0 | 59 | 0 | 0 | 2 | 2 | 2 |
|
|
363
|
+
| Runtimes | 0 | 4 | 0 | 2 | 2 | 0 | 1 | 0 | 0 |
|
|
364
|
+
| Docker/Compose | 0 | 3 | 0 | 8 | 1 | 0 | 11 | 0 | 1 |
|
|
365
|
+
| Helm | 0 | 0 | 0 | 0 | 0 | 3 | 5 | 0 | 42 |
|
|
381
366
|
| Terraform | 0 | 0 | 0 | 4 | 0 | 0 | 0 | 0 | 15 |
|
|
382
367
|
| Homebrew | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 1 | 0 |
|
|
383
368
|
|
|
384
369
|
## Proposed slice list (D35)
|
|
385
370
|
|
|
386
371
|
- **LOW - npm/bun patch+minor batch** (one slice for the whole ecosystem, touching every file below; lockfiles regenerated and committed):
|
|
387
|
-
- `
|
|
388
|
-
- `
|
|
389
|
-
- `
|
|
372
|
+
- `packages/control-plane/package.json`: @playwright/test 1.58.1->1.63.0
|
|
373
|
+
- `packages/control-plane/ui/package.json`: @testing-library/react ^16.3.0->16.3.3, @types/react ^19.0.0->19.3.0, @types/react-dom ^19.0.0->19.3.0
|
|
374
|
+
- `vscode-extension/package.json`: @types/vscode ^1.85.0->1.140.0
|
|
375
|
+
- `web-app/package.json`: react-resizable-panels ^4.14.1->4.14.2, typescript-eslint ^8.70.1->8.71.0
|
|
390
376
|
- **LOW - Python patch+minor batch** (one slice for the whole ecosystem, touching every file below; lockfiles regenerated and committed):
|
|
391
|
-
- `dashboard/requirements.txt`:
|
|
392
|
-
- `
|
|
393
|
-
- `web-app/requirements.txt`: alembic >=1.12.0->1.20.0, pexpect >=4.8.0->4.9.0, pydantic >=2.0.0->2.13.5, python-jose >=3.3.0->3.5.0, pyyaml >=6.0->6.0.3, sqlalchemy >=2.0.0->2.1.1
|
|
394
|
-
- **LOW - Python (pyproject) patch+minor batch** (one slice for the whole ecosystem, touching every file below; lockfiles regenerated and committed):
|
|
395
|
-
- `sdk/python/pyproject.toml`: pydantic >=2.0.0->2.13.5
|
|
377
|
+
- `dashboard/requirements.txt`: sqlalchemy >=2.1.1,<3.0.0->2.1.3
|
|
378
|
+
- `web-app/requirements.txt`: sqlalchemy >=2.1.1->2.1.3
|
|
396
379
|
- **MEDIUM - one slice per MAJOR (or 0.x-breaking) package**, deduped across manifests:
|
|
397
380
|
- `@eslint/js` -> `10.0.1` (MAJOR): web-app/package.json
|
|
398
|
-
- `@
|
|
399
|
-
- `@
|
|
400
|
-
- `@typescript-eslint/
|
|
401
|
-
- `@
|
|
381
|
+
- `@happy-dom/global-registrator` -> `20.14.5` (MAJOR): packages/control-plane/ui/package.json
|
|
382
|
+
- `@types/node` -> `26.6.4` (MAJOR): package.json, vscode-extension/package.json
|
|
383
|
+
- `@typescript-eslint/eslint-plugin` -> `8.71.0` (MAJOR): vscode-extension/package.json
|
|
384
|
+
- `@typescript-eslint/parser` -> `8.71.0` (MAJOR): vscode-extension/package.json
|
|
385
|
+
- `@vitejs/plugin-react` -> `6.1.1` (MAJOR): packages/control-plane/ui/package.json, web-app/package.json
|
|
402
386
|
- `@vscode/vsce` -> `4.0.0` (MAJOR): vscode-extension/package.json
|
|
403
387
|
- `aiosqlite` -> `0.22.1` (0.x breaking): dashboard/requirements.txt, web-app/requirements.txt
|
|
404
|
-
- `anthropic` -> `1.
|
|
388
|
+
- `anthropic` -> `1.11.0` (MAJOR): mcp/requirements.txt
|
|
405
389
|
- `asyncpg` -> `0.31.0` (0.x breaking): web-app/requirements.txt
|
|
406
|
-
- `cryptography` -> `50.0.
|
|
407
|
-
- `esbuild` -> `0.28.2` (0.x breaking):
|
|
408
|
-
- `eslint` -> `10.
|
|
390
|
+
- `cryptography` -> `50.0.2` (MAJOR): requirements-test.txt, web-app/requirements.txt
|
|
391
|
+
- `esbuild` -> `0.28.2` (0.x breaking): vscode-extension/package.json
|
|
392
|
+
- `eslint` -> `10.12.0` (MAJOR): vscode-extension/package.json, web-app/package.json
|
|
409
393
|
- `eslint-plugin-react-hooks` -> `7.1.1` (MAJOR): web-app/package.json
|
|
410
394
|
- `eslint-plugin-react-refresh` -> `0.5.7` (0.x breaking): web-app/package.json
|
|
411
|
-
- `fastapi` -> `0.
|
|
412
|
-
- `globals` -> `17.
|
|
395
|
+
- `fastapi` -> `0.142.2` (0.x breaking): dashboard/requirements.txt, web-app/requirements.txt
|
|
396
|
+
- `globals` -> `17.13.0` (MAJOR): web-app/package.json
|
|
413
397
|
- `httpx` -> `0.28.1` (0.x breaking): sdk/python/pyproject.toml, web-app/requirements-test.txt, web-app/requirements.txt
|
|
414
|
-
- `jest` -> `30.5.2` (MAJOR):
|
|
415
|
-
- `
|
|
416
|
-
- `
|
|
417
|
-
- `
|
|
418
|
-
- `mcp` -> `2.2.0` (MAJOR): mcp/requirements.txt, requirements-test.txt
|
|
398
|
+
- `jest` -> `30.5.2` (MAJOR): package.json
|
|
399
|
+
- `jsdom` -> `30.1.1` (MAJOR): package.json
|
|
400
|
+
- `lucide-react` -> `1.51.0` (MAJOR): packages/control-plane/ui/package.json, web-app/package.json
|
|
401
|
+
- `mcp` -> `2.3.0` (MAJOR): mcp/requirements.txt, requirements-test.txt
|
|
419
402
|
- `pytest` -> `9.1.1` (MAJOR): web-app/requirements-test.txt
|
|
420
403
|
- `pytest-asyncio` -> `1.4.0` (MAJOR): web-app/requirements-test.txt
|
|
421
404
|
- `python-multipart` -> `0.0.32` (0.x breaking): web-app/requirements.txt
|
|
422
405
|
- `setuptools` -> `84.0.0` (MAJOR): sdk/python/pyproject.toml
|
|
423
|
-
- `tailwindcss` -> `4.3.3` (MAJOR): web-app/package.json
|
|
424
|
-
- `typescript` -> `7.0.2` (MAJOR): loki-ts/package.json, package.json, sdk/typescript/package.json, vscode-extension/package.json,
|
|
406
|
+
- `tailwindcss` -> `4.3.3` (MAJOR): packages/control-plane/ui/package.json, web-app/package.json
|
|
407
|
+
- `typescript` -> `7.0.2` (MAJOR): loki-ts/package.json, package.json, packages/control-plane/ui/package.json, sdk/typescript/package.json, vscode-extension/package.json, +1 more
|
|
425
408
|
- `uvicorn` -> `0.54.0` (0.x breaking): dashboard/requirements.txt, web-app/requirements.txt
|
|
426
|
-
- `vite` -> `8.3.
|
|
409
|
+
- `vite` -> `8.3.2` (MAJOR): packages/control-plane/ui/package.json, web-app/package.json
|
|
427
410
|
- `watchdog` -> `6.0.0` (MAJOR): web-app/requirements.txt
|
|
428
|
-
- `websockets` -> `17.
|
|
411
|
+
- `websockets` -> `17.2` (MAJOR): dashboard/requirements.txt
|
|
429
412
|
- **MEDIUM - one slice per Actions MAJOR**, deduped by action across workflows (bump to latest major AND SHA-pin with a `# vN` comment in the same slice, per D35):
|
|
430
413
|
- `actions/cache` v4 (resolves to v4.3.0) -> `v6.1.0`: .github/workflows/test.yml
|
|
431
|
-
- `actions/checkout` 11d5960a326750d5838078e36cf38b85af677262, v4 (resolves to v4.4.0) -> `v7.0.1`: .github/workflows/bun-parity.yml, .github/workflows/
|
|
432
|
-
- `actions/download-artifact` v4 (resolves to v4.3.0) -> `v8.0.1`: .github/workflows/
|
|
433
|
-
- `actions/setup-node` v4 (resolves to v4.4.0) -> `v7.0.0`: .github/workflows/integrity-audit.yml, .github/workflows/
|
|
434
|
-
- `actions/setup-python` v5 (resolves to v5.6.0) -> `v7.0.0`: .github/workflows/bun-parity.yml, .github/workflows/
|
|
435
|
-
- `actions/upload-artifact` ea165f8d65b6e75b540449e92b4886f43607fa02, v4 (resolves to v4.6.2) -> `v7.0.1`: .github/workflows/
|
|
414
|
+
- `actions/checkout` 11d5960a326750d5838078e36cf38b85af677262, v4 (resolves to v4.4.0) -> `v7.0.1`: .github/workflows/bun-parity.yml, .github/workflows/claude-code-review.yml, .github/workflows/coverage.yml, .github/workflows/first-run-gate.yml, .github/workflows/integrity-audit.yml, +12 more
|
|
415
|
+
- `actions/download-artifact` v4 (resolves to v4.3.0) -> `v8.0.1`: .github/workflows/release.yml
|
|
416
|
+
- `actions/setup-node` v4 (resolves to v4.4.0) -> `v7.0.0`: .github/workflows/integrity-audit.yml, .github/workflows/nightly.yml, .github/workflows/post-release-smoke.yml, .github/workflows/promote.yml, .github/workflows/release.yml, +6 more
|
|
417
|
+
- `actions/setup-python` v5 (resolves to v5.6.0) -> `v7.0.0`: .github/workflows/bun-parity.yml, .github/workflows/coverage.yml, .github/workflows/integrity-audit.yml, .github/workflows/model-catalog-probe.yml, .github/workflows/nightly.yml, +6 more
|
|
418
|
+
- `actions/upload-artifact` ea165f8d65b6e75b540449e92b4886f43607fa02, v4 (resolves to v4.6.2) -> `v7.0.1`: .github/workflows/coverage.yml, .github/workflows/first-run-gate.yml, .github/workflows/parity-drift.yml, .github/workflows/release.yml, .github/workflows/sbom.yml, +3 more
|
|
436
419
|
- `azure/setup-helm` v4 (resolves to v4.3.1) -> `v5.0.1`: .github/workflows/integrity-audit.yml, .github/workflows/test.yml
|
|
437
420
|
- `docker/build-push-action` v5 (resolves to v5.4.0) -> `v7.4.0`: .github/workflows/release.yml
|
|
438
|
-
- `docker/login-action` v3 (resolves to v3.7.0) -> `v4.6.0`: .github/workflows/promote.yml, .github/workflows/
|
|
421
|
+
- `docker/login-action` v3 (resolves to v3.7.0) -> `v4.6.0`: .github/workflows/promote.yml, .github/workflows/release.yml
|
|
439
422
|
- `docker/setup-buildx-action` v3 (resolves to v3.12.0) -> `v4.4.1`: .github/workflows/release.yml
|
|
440
|
-
- `docker/setup-qemu-action` v3 (resolves to v3.7.0) -> `v4.4.0`: .github/workflows/arm64-runtime.yml
|
|
441
423
|
- `peter-evans/dockerhub-description` v4 (resolves to v4.0.2) -> `v5.0.0`: .github/workflows/release.yml
|
|
442
|
-
- `sigstore/cosign-installer` v3 (resolves to v3.9.1) -> `v4.1.2`: .github/workflows/
|
|
443
|
-
- **LOW - Actions SHA-pinning** (already on latest major, just needs pinning): convert every tag-pinned `uses:` to a SHA pin with a trailing `# vN` comment (the pattern already used for `actions/checkout` and `actions/upload-artifact` in security-audit.yml):
|
|
444
|
-
- `anchore/sbom-action`: .github/workflows/release.yml
|
|
445
|
-
- `anthropics/claude-code-action`: .github/workflows/claude-code-review.yml
|
|
446
|
-
- `contributor-assistant/github-action`: .github/workflows/cla.yml
|
|
447
|
-
- `oven-sh/setup-bun`: .github/workflows/bun-parity.yml, .github/workflows/check-phase6-ready.yml, .github/workflows/coverage.yml, .github/workflows/mutation-testing.yml, .github/workflows/nightly.yml, +6 more
|
|
424
|
+
- `sigstore/cosign-installer` v3 (resolves to v3.9.1) -> `v4.1.2`: .github/workflows/release.yml
|
|
448
425
|
- **MEDIUM - one slice per Terraform provider MAJOR**:
|
|
449
|
-
- `deploy/terraform/modules/aws-ecs/versions.tf`: `aws (hashicorp/aws)` >= 5.0 -> 6.
|
|
450
|
-
- `deploy/terraform/modules/aws/versions.tf`: `aws (hashicorp/aws)` >= 5.0 -> 6.
|
|
451
|
-
- `deploy/terraform/modules/azure/versions.tf`: `azurerm (hashicorp/azurerm)` >= 3.0 -> 5.
|
|
452
|
-
- `deploy/terraform/modules/gcp/versions.tf`: `google (hashicorp/google)` >= 5.0 -> 8.
|
|
426
|
+
- `deploy/terraform/modules/aws-ecs/versions.tf`: `aws (hashicorp/aws)` >= 5.0 -> 6.67.0
|
|
427
|
+
- `deploy/terraform/modules/aws/versions.tf`: `aws (hashicorp/aws)` >= 5.0 -> 6.67.0
|
|
428
|
+
- `deploy/terraform/modules/azure/versions.tf`: `azurerm (hashicorp/azurerm)` >= 3.0 -> 5.8.0
|
|
429
|
+
- `deploy/terraform/modules/gcp/versions.tf`: `google (hashicorp/google)` >= 5.0 -> 8.5.0
|
|
453
430
|
- **MEDIUM - runtime matrix refresh**:
|
|
454
431
|
- `Node.js` 20 is EOL (EOL 2026-04-30 (past); EOL in current line; newest line is 26.10.0), pinned by: .github/workflows/test.yml
|
|
432
|
+
- `Python` 3.10 is EOL (EOL 2026-10-01 (past); EOL in current line; newest line is 3.14.8), pinned by: .github/workflows/test.yml
|
|
455
433
|
- Node 20 is named in the upstream Actions runtime deprecation warnings even where not yet past its endoflife.date EOL; pinned by: .github/workflows/test.yml
|
|
456
|
-
- **MEDIUM - SDKs with the 5-task eval**: `@anthropic-ai/claude-agent-sdk` 0.3.
|
|
434
|
+
- **MEDIUM - SDKs with the 5-task eval**: `@anthropic-ai/claude-agent-sdk` 0.3.288 -> 0.3.288 (up-to-date, `loki-ts/package.json`); `@anthropic-ai/sdk` ^0.124.0 -> 0.131.0 (0.x breaking, `loki-ts/package.json`). Gated on the 5-task eval per D35, not the plain patch/minor batch.
|
|
457
435
|
- **LOW - Docker/Helm digest pass**: pin every `FROM` / `image:` tag by digest instead of a mutable tag (own-product images and `:latest` floating tags are out of scope for a version bump and tracked via VERSION instead).
|
|
458
436
|
- EOL now: `nginx:1.27-alpine` in `artifacts/observability/Dockerfile` (EOL 2025-06-24 (past); EOL in current line; newest line is 1.31.6)
|
|
459
437
|
- **FINDING - Helm chart appVersion has drifted from the product VERSION**:
|
|
460
|
-
- `deploy/helm/autonomi/Chart.yaml`: appVersion `7.93.0` vs VERSION `10.
|
|
461
|
-
- `helm/
|
|
438
|
+
- `deploy/helm/autonomi/Chart.yaml`: appVersion `7.93.0` vs VERSION `10.9.1`
|
|
439
|
+
- `deploy/helm/control-plane/Chart.yaml`: appVersion `10.6.7` vs VERSION `10.9.1`
|
|
440
|
+
- `helm/loki-mode/Chart.yaml`: appVersion `9.19.1` vs VERSION `10.9.1`
|
|
462
441
|
|