Skip to content

Update stacked: 8 packages - #724

Closed
gominimal-pkgmgr-mgr[bot] wants to merge 8 commits into
mainfrom
update-stacked-2026-09-18-4bb008fa
Closed

Update stacked: 8 packages#724
gominimal-pkgmgr-mgr[bot] wants to merge 8 commits into
mainfrom
update-stacked-2026-09-18-4bb008fa

Conversation

@gominimal-pkgmgr-mgr

@gominimal-pkgmgr-mgr gominimal-pkgmgr-mgr Bot commented Sep 18, 2026

Copy link
Copy Markdown
Contributor

Update base-soup (8 packages)

Note

These packages declare replace_on_cycle in their build.ncl, so
they participate in the toolchain rebuild graph and one hash change
cascades through the set. Bundling ensures the cascading rebuild
lands as a single unit, even when only one package is bumping —
avoids back-to-back full rebuilds from singleton PRs.

Warning

2 requested members did NOT ship — each needs separate follow-up.
A member is dropped when it fails to update, has its gs:// mirror
withheld by the scan gate, or is peeled to keep the shipped set a
closed dependency closure. Reasons are abbreviated — the full
diagnostics ride the Slack thread and the run's logs.

Package Old Target Why
uv 0.12.7 0.12.17 held for dwell — the release is too fresh (anti-xz recency gate) and the gs:// mirror write was withheld.
zola 0.23.3 0.23.6 update failed: new tarball size (7495490 bytes) differs more than 2x from the previous artifact at gs://minimal-staging-archives/getzola/zola/v0.

Pkgscan: clean across all bundle members — diffs against prior versions surfaced no newly-introduced suspicious patterns.

Summary

Package Old New Source
varlock 1.19.0 1.20.0 github:dmno-dev/varlock:release-asset:operator-pinned
vhs 0.11.0 0.12.0 github:charmbracelet/vhs:operator-pinned
vim 9.2.1116 9.2.1119 github:vim/vim:tag:operator-pinned
vlt 1.0.5 1.1.0 custom:https://registry.npmjs.org/vlt:operator-pinned
wrangler 4.125.0 4.135.0 github:cloudflare/workers-sdk:operator-pinned
yazi 26.8.15 26.9.1 github:sxyazi/yazi:operator-pinned
zellij 0.45.0 0.45.1 github:zellij-org/zellij:operator-pinned
zizmor 1.29.0 1.30.1 github:zizmorcore/zizmor:operator-pinned

Per-package details

varlock 1.19.0 → 1.20.0
  • SHA256: a47efbb732325c65... → a61e72cbf75d6269...
  • Size: 41.1 MB
  • Source: https://github.com/dmno-dev/varlock/releases/download/varlock%401.19.0/varlock-linux-x64.tar.gz → https://github.com/dmno-dev/varlock/releases/download/varlock%401.20.0/varlock-linux-x64.tar.gz
  • Released: 4 hours ago (2026-09-18)
  • License: MIT (source: GitHub)
vhs 0.11.0 → 0.12.0
  • SHA256: c08b8502989fe7e9... → 2e4a3b940f66ffbe...
  • Size: 144 KB
  • Source: https://github.com/charmbracelet/vhs/archive/refs/tags/v0.11.0.tar.gz → https://github.com/charmbracelet/vhs/archive/refs/tags/v0.12.0.tar.gz
  • Released: 9 days ago (2026-09-09)
  • License: MIT (source: GitHub + tarball)
vim 9.2.1116 → 9.2.1119
  • SHA256: b4ad5a0d7cce404a... → b304b06aafe3e263...
  • Size: 20.2 MB → 20.2 MB
  • Source: gs://minimal-staging-archives/vim-9.2.1116.tar.gz → gs://minimal-staging-archives/vim-9.2.1119.tar.gz
  • Released: 1 days ago (2026-09-17)
  • License: Vim (source: GitHub + tarball)
vlt 1.0.5 → 1.1.0
  • SHA256: →
  • Size: 0 B
  • Source: npm:vlt@1.0.5 (lockfile) → npm:vlt@1.1.0 (lockfile)
  • Released: unknown (non-GitHub source or tag-only fallback)
  • Auto-applied:
    • Regenerated package-lock.json for vlt@1.1.0 (version, resolved URL and integrity hash move together; npm ci installs exactly this tree).
wrangler 4.125.0 → 4.135.0
  • SHA256: →
  • Size: 0 B
  • Source: npm:wrangler@4.125.0 → npm:wrangler@4.135.0
  • Released: unknown (non-GitHub source or tag-only fallback)
yazi 26.8.15 → 26.9.1
  • SHA256: 60bd4ca56398f0f6... → 66857f1b670469da...
  • Size: 1.2 MB → 1.2 MB
  • Source: gs://minimal-staging-archives/sxyazi/yazi/v26.8.15.tar.gz → gs://minimal-staging-archives/sxyazi/yazi/v26.9.1.tar.gz
  • Released: 17 days ago (2026-09-01)
  • License: MIT (source: GitHub + tarball)
zellij 0.45.0 → 0.45.1
  • SHA256: fba81ade9d3fd938... → 5cbe711437d2a61a...
  • Size: 13.0 MB → 13.1 MB
  • Source: gs://minimal-staging-archives/zellij-org/zellij/v0.45.0.tar.gz → gs://minimal-staging-archives/zellij-org/zellij/v0.45.1.tar.gz
  • Released: 21 days ago (2026-08-28)
  • License: MIT (source: GitHub + tarball)
zizmor 1.29.0 → 1.30.1
  • SHA256: de3da74599a1e080... → 3224fd5b49b77b2e...
  • Size: 779 KB
  • Source: https://github.com/zizmorcore/zizmor/archive/refs/tags/v1.29.0.tar.gz → https://github.com/zizmorcore/zizmor/archive/refs/tags/v1.30.1.tar.gz
  • Released: 9 days ago (2026-09-09)
  • License: MIT (source: GitHub + tarball)

Created by pkgmgr

@gominimal-pkgmgr-mgr
gominimal-pkgmgr-mgr Bot requested a review from a team as a code owner September 18, 2026 23:46
@coderabbitai

coderabbitai Bot commented Sep 18, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: gominimal/pkgs/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 8f46b206-ded7-41d8-a91a-4aef4074db67

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Comment @coderabbitai help to get the list of available commands.

@bryan-minimal bryan-minimal mentioned this pull request Sep 19, 2026
Merged
@bryan-minimal

bryan-minimal commented Sep 21, 2026

Copy link
Copy Markdown
Member

Closing this as superseded rather than rebasing it.

The branch was cut on 2026-09-18 and main has moved a long way since
(#725, #728 rust 1.98.1, #736). Rebasing it onto current main needs a
force-push to the bot's branch; replaying it as-is would revert ~221 lines
that landed in the meantime.

To be explicit about what is being dropped: this is not an empty PR. It
carries eight genuine bumps that main does not have —

package main here
varlock 1.19.0 1.20.0
vhs 0.11.0 0.12.0
vim 9.2.1116 9.2.1119
vlt 1.0.5 1.1.0
wrangler 4.125.0 4.135.0
yazi 26.8.15 26.9.1
zellij 0.45.0 0.45.1
zizmor 1.29.0 1.30.1

None of these were covered by #725/#728/#736, which touched a disjoint set of
packages. They are dropped here only because the updater re-cuts stacked PRs
every 1–3 days and will re-offer all eight against current main, correctly
based and with a clean build — which is strictly better than force-pushing a
stale branch.

If the next stacked PR does not include these eight, that is a real signal
worth chasing, not a quiet omission.

@bryan-minimal bryan-minimal mentioned this pull request Sep 21, 2026
Merged
@bryan-minimal

bryan-minimal commented Sep 21, 2026

Copy link
Copy Markdown
Member

Replayed onto current main as #737 — same eight bumps, files taken verbatim from this branch's head so the updater-verified sha256s carry over. Nothing is lost by this PR staying closed.

cvince pushed a commit to capysc/pkgs that referenced this pull request Oct 2, 2026
@bryan-minimal @claude
Update stacked: 8 packages (gominimal#737)
e2d6ca9 
Replays gominimal#724 onto current main. gominimal#724 was cut on 2026-09-18 and its branch
had gone stale enough that replaying it as-is would have reverted ~221
lines landed since by gominimal#725, gominimal#728 (rust 1.98.1) and gominimal#736; rebasing it
needed a force-push to the bot's branch. The eight bumps themselves are
unchanged and none were covered by those merges.

  varlock   1.19.0    -> 1.20.0
  vhs       0.11.0    -> 0.12.0
  vim       9.2.1116  -> 9.2.1119
  vlt       1.0.5     -> 1.1.0
  wrangler  4.125.0   -> 4.135.0
  yazi      26.8.15   -> 26.9.1
  zellij    0.45.0    -> 0.45.1
  zizmor    1.29.0    -> 1.30.1

Each file is taken verbatim from gominimal#724's head, so the source URLs and
sha256s are the ones the updater verified at cut time. All ten files were
untouched on main since gominimal#724's branch point, so the replay is a clean
apply rather than a merge resolution.

Verified: `mip dump --packages --arch amd64` evaluates the full catalog
(531 packages, exit 0) and each of the eight resolves to the version
above.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@bryan-minimal