Skip to content

chore(deps): update every language's dependencies and release them together at 0.16.0 - #294

Merged
konard merged 10 commits into
mainfrom
issue-292-a602b59a2375
Aug 28, 2026
Merged

chore(deps): update every language's dependencies and release them together at 0.16.0#294
konard merged 10 commits into
mainfrom
issue-292-a602b59a2375

Conversation

@konard

@konard konard commented Aug 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Closes #292.

Updates every dependency in every language, takes the major bumps the issue calls for, releases all
seven implementations together at 0.16.0, and adds the CI that makes a version disagreement fail
instead of going unnoticed.

Dependencies

Every version below was read from the registry rather than from the tables in the issue — several of
those were already stale (xunit.runner.visualstudio was listed as needing 2.x→3.x when NuGet
already served 4.0.0; java and php were listed at 0.3.0/0.2.0 when both were already 0.15.0 on
main). After this pull request, every declared dependency equals its registry's current release;
the snapshot is reproducible with node experiments/issue-292/registry-latest.mjs.

Language Bumps
js bun-types 1.4.0, eslint 10.9.1; peggy 5.1.0, typescript 7.0.2 and prettier 3.9.6 were already current. Lockfiles refreshed
python pytest 9.1, pytest-timeout 2.4, black 26.5, isort 9.0, flake8 7.3
rust none needed — cargo update locked 0 packages; nom 8.0.0, syn 3.0.4, quote 1.0.47, proc-macro2 1.0.107 are current
csharp net8.0 → net10.0, xunit 2 → xunit.v3 4.0.0; Microsoft.CSharp dropped (NU1510: it is in the framework on net10)
java JUnit 5 → 6.1.3, maven.compiler.release 11 → 21, spotless 3.10.1, google-java-format 1.36.1
php PHPUnit 10 → 13.3, PHP_CodeSniffer 3 → 4.0, php >=8.1 → >=8.4
go go 1.21 → 1.24 (CI on 1.26); the module has no external dependencies
pre-commit six hook pins realigned with the tool versions the manifests ask for

Four Maven plugins were deliberately left where they are: the newest maven-compiler-plugin,
maven-jar-plugin and maven-source-plugin artefacts are 4.0.0 betas and the newest
maven-surefire-plugin is a 3.6.0 milestone, so the pom stays on the newest stable releases.

CI images moved with the language requirements: Java ['11','17','21'] → ['21','25'], PHP
['8.1','8.2','8.3','8.4'] → ['8.4','8.5'], .NET 8.0.x → 10.0.x, Go 1.21 → 1.26. The
READMEs that advertise a minimum version were updated to match.

The one bump that needed more than a version number

The .NET 10 SDK removed the VSTest path xunit v2 used, so dotnet test failed with "Testing with
VSTest target is no longer supported by Microsoft.Testing.Platform on .NET 10 SDK and later".
Neither <TestingPlatformDotnetTestSupport> nor a dotnet.config [dotnet.test.runner] section
fixes it; the documented opt-in is csharp/global.json:

{ "test": { "runner": "Microsoft.Testing.Platform" } }

with the test project built as <OutputType>Exe</OutputType>, because an xunit v3 project is its own
test host. Microsoft.NET.Test.Sdk, xunit.runner.visualstudio and coverlet.collector are VSTest
components and are gone.

Peggy and Pegasus

Both were already at their current release (peggy 5.1.0, Pegasus 4.1.0). Regenerating
js/src/parser-generated.js from src/grammar.pegjs produces a byte-identical file, and all 204
JS tests pass, so the generated parsers are unchanged.

Releasing the languages together

All seven declarations move to 0.16.0 in one commit. Two new pieces of CI keep them there:

  • scripts/version-consistency.mjs — a new job on release-audit.yml, now also triggered on
    pull_request, that fails when the implementations declare different versions. It reads only
    the working tree, so a disagreement is always a defect and never a transient registry answer.
  • scripts/release-audit.mjs — unchanged in behaviour, refactored to share the declaration
    readers via the new scripts/declared-versions.mjs. It keeps warning on registry drift, because
    a declared version being ahead of a published one is the normal state between a bump and the
    release that publishes it — this very pull request is in it.

Five languages (js, python, rust, csharp, go) already match their registries. java and php have
never published anything — Maven Central holds nothing under io.github.link-foundation:links-notation
and Packagist holds nothing under link-foundation/links-notation. That needs credentials this pull
request cannot supply and is tracked in #192; what it can do, and does, is make the divergence
impossible to reintroduce silently.

Automated dependency updates

.github/dependabot.yml watched cargo, npm, pip and github-actions, so Java, PHP and Go were
never offered updates. It now also watches maven (/java), composer (/php) and gomod (/go),
matching the existing blocks' weekly schedule, limits and labels.

Verification

Each major bump was kept only after its suite was run against it:

Language Result
js 204 tests, lint clean, peggy output byte-identical
python 193 passed, 1 skipped; black/isort/flake8 clean
rust cargo test passes
csharp 196 tests on net10.0 under xunit.v3; dotnet format --verify-no-changes and dotnet pack clean
java 133 tests on JDK 21 with JUnit 6; spotless:check and package clean
php 183 tests / 497 assertions under PHPUnit 13 in both the php:8.4 and php:8.5 containers; PSR-12 clean
go build, vet, gofmt and tests clean on go1.26.4

actionlint is clean on every changed workflow.

The new check was also tested negatively — editing one declaration and nothing else:

$ sed -i 's|<version>0.16.0</version>|<version>0.3.0</version>|' java/pom.xml
$ node scripts/version-consistency.mjs; echo "exit=$?"
::error::the implementations declare different versions: 0.16.0 (js, python, rust, csharp, go, php); 0.3.0 (java)
exit=1

The full evidence — registry snapshots, the Maven beta/milestone survey, the audit output after the
bump, and what each suite reported — is in
dev/log/issues/292/pulls/294/.

@konard
Initial commit with task details
ee241a8 
Adding .gitkeep for PR creation (default mode).
This file will be removed when the task is complete.

Issue: #292
@konard konard self-assigned this Aug 28, 2026
konard added 8 commits August 28, 2026 11:18
@konard
chore(deps): update js, python and go toolchain dependencies
e59efea 
js: eslint 10.8.1 -> 10.9.1, bun-types 1.3.14 -> 1.4.0 (both lockfiles refreshed).
python: pytest >=9.1, black >=26.5, isort >=9.0 (isort 8 -> 9 is a major bump;
  the suite and black/isort/flake8 checks pass unchanged).
go: go directive 1.21 -> 1.24 and CI go-version 1.21 -> 1.26; the module has no
  external dependencies.
rust: nom 8.0.0, syn 3.0.4, quote 1.0.47, proc-macro2 1.0.107 already resolve to
  the latest published versions, so Cargo.lock is unchanged.

Refs #292
@konard
chore(deps): move java to the Java 21 baseline and JUnit 6
c44e6e4 
junit-jupiter 5.14.4 -> 6.1.3 (major; JUnit 6 requires Java 17+),
spotless-maven-plugin 2.46.1 -> 3.10.1 (major), google-java-format 1.19.2 ->
1.36.1, and maven.compiler.release 11 -> 21. The other Maven plugins already
pin the latest stable releases (compiler 3.15.0, surefire 3.5.6, jar 3.5.1,
source 3.4.0, javadoc 3.12.0, gpg 3.2.8, central-publishing 0.11.0); the 4.x
lines of compiler/jar/source are still beta and surefire 3.6.0-M1 a milestone,
so those stay where they are.

CI now sets up JDK 21 and the test matrix runs 21 and 25, the two current LTS
releases, instead of 11/17/21. All 133 tests and spotless:check pass locally on
JDK 21 with Maven 3.9.11.

Refs #292
@konard
chore(deps): take phpunit 13 and php_codesniffer 4, on a PHP 8.4 base…
b1d2b5a 
…line

phpunit/phpunit ^10.5 -> ^13.3 (three majors) and squizlabs/php_codesniffer
^3.10 -> ^4.0 (one major). phpunit 13.3.2 declares "php": ">=8.4.1", so the
package baseline moves with it: "php": ">=8.1" -> ">=8.4". That is a real
restriction on consumers, taken deliberately per the issue - 8.1/8.2 are
end-of-life and 8.3 is security-fixes only.

No phpunit.xml or phpcs.xml change was needed: the existing <source>/<testsuites>
schema is still what phpunit 13 reads, and PSR12 plus Generic.Files.LineLength
still resolve under PHPCS 4.

CI lints on 8.4 and the test matrix is 8.4 and 8.5 instead of 8.1-8.4.
Verified in php:8.4-cli and php:8.5-cli containers: 183 tests / 497 assertions
pass on both, phpcs reports no violations across the 21 files.

Refs #292
@konard
chore(deps): move csharp to net10.0 and xunit v3
a6a66f6 
TargetFramework net8 -> net10.0 for both projects and xunit 2.9.3 -> xunit.v3
4.0.0. The v3 test project is self-executing, so it needs <OutputType>Exe.

The .NET 10 SDK dropped the VSTest path that used to run Microsoft.Testing.
Platform projects, so csharp/global.json opts `dotnet test` into MTP mode.
Under MTP, Microsoft.NET.Test.Sdk, xunit.runner.visualstudio and
coverlet.collector are unused VSTest components (CI collects no coverage) and
are dropped; xunit.v3 hosts the runner itself. Microsoft.CSharp is also dropped:
on net10.0 it is part of the shared framework and NU1510 flags the reference.

Pegasus 4.1.0, Platform.Collections 0.4.0 and Microsoft.SourceLink.GitHub
10.0.400 are already the latest published versions.

CI, docfx and the Gitpod task move to the .NET 10 SDK; `dotnet test -f net8`
becomes plain `dotnet test`, since MTP mode does not take -f.

Verified with the 10.0.400 SDK: restore, build, `dotnet format
--verify-no-changes`, 196/196 tests, and `dotnet pack` all succeed.

Refs #292
@konard
ci: cover every ecosystem with dependabot and fail on version disagre…
c49f7ce 
…ement

Dependabot only watched cargo, npm, pip and github-actions, so the maven,
composer and gomod manifests were never offered updates. Add the three
missing ecosystems with the same weekly schedule and labelling the other
blocks use.

The release audit compares each declared version against its registry and
only warns, because a bump legitimately lands before the release that
publishes it. Disagreement *between* the implementations has no such
excuse: it reads only the working tree, so it is always a defect. Split the
declaration readers into scripts/declared-versions.mjs, share them with the
audit, and add scripts/version-consistency.mjs as a hard-failing check that
runs on every pull request.
@konard
chore(release): bump every implementation to 0.16.0
6f18805 
The dependency updates change what each package is built and tested
against, so they need a release to reach anyone. Bump all seven
declarations together — the point of the repository is that the
implementations ship the same grammar at the same version — and record the
work in the changelog.

Part of #292
@konard
docs(dev/log): record the dependency sweep and version checks for #292
3eb8b21 
Keep the evidence the bumps were judged against: what each registry
actually serves (the issue's own tables were already stale), which Maven
artefacts were skipped because the newest one is a beta, what each suite
reported, what the .NET 10 test-runner change forced, and the negative test
proving the new consistency check fails on disagreement.

Part of #292
@konard
chore(deps): align the pre-commit hooks with the pinned tool versions
2e9784b 
The hooks are pinned by git tag, and had drifted from what the language
manifests actually ask for: eslint 8 against js/package.json's 10, black
24.1 against pyproject's 26.5, isort 5.13 against 9.0. Bump all six to
their current tags; doublify/pre-commit-rust has no newer one.

pre-commit does not pass on this repository and did not before — the
findings are in docs/, experiments/ and csharp/scripts/, never in a shipped
implementation — so no reformatting is folded into this update.

Part of #292
@konard konard changed the title [WIP] Update all dependencies in all eight languages, and publish them at one version (js 0.15.0 in-tree vs 0.13.0 on npm; java 0.3.0; php 0.2.0) chore(deps): update every language's dependencies and release them together at 0.16.0 Aug 28, 2026
@konard
konard marked this pull request as ready for review August 28, 2026 11:42
@konard
fix(python): stop tracking the generated egg-info directory
ba45ce2 
`pip install -e python/` writes python/links_notation.egg-info/, which
nothing ignored, so a local editable install leaked five generated files
into the previous commit. Untrack them and ignore *.egg-info/.

Part of #292
@konard

konard commented Aug 28, 2026

Copy link
Copy Markdown
Member Author

Working session summary

All 13 workflows are green on the final commit ba45ce2, the working tree is clean, and PR #294 is out of draft.

#294 — chore(deps): update every language's dependencies and release them together at 0.16.0

What landed against the six things #292 asked for:

  1. Every dependency in every language — js (bun-types 1.4.0, eslint 10.9.1 + lockfiles), python (pytest 9.1, black 26.5, isort 9.0, flake8 7.3, pytest-timeout 2.4), java (JUnit 6.1.3, spotless 3.10.1, google-java-format 1.36.1), php (PHPUnit 13.3, PHP_CodeSniffer 4.0), csharp (xunit.v3 4.0.0), go 1.24, plus six stale .pre-commit-config.yaml pins. Rust needed nothing — cargo update locked 0 packages. Every version was read from the registry (experiments/issue-292/registry-latest.mjs), not from the issue's tables, several of which were already stale.
  2. Major bumps — phpunit 10→13, php_codesniffer 3→4, xunit 2→3(v3 4.0.0), maven.compiler.release 11→21, go 1.21→1.24, net8→net10, php 8.1→8.4, each with the CI matrix and README minimums moved to match. Four Maven plugins were deliberately left on their newest stable release because the newest artefact is a 4.0.0 beta or a 3.6.0 milestone.
  3. peggy/Pegasus — both already current; regenerating js/src/parser-generated.js produced a byte-identical file and all 204 JS tests pass.
  4. Same version everywhere — all seven declarations moved to 0.16.0 in one commit.
  5. CI that fails on disagreement — new scripts/version-consistency.mjs job on release-audit.yml (now also pull_request-triggered), verified negatively: editing one declaration produces ::error::the implementations declare different versions: … and exit 1. release-audit.mjs was refactored onto the shared readers and still only warns on registry drift, deliberately — this PR itself declares 0.16.0 while every registry serves 0.15.0.
  6. Dependabot — maven, composer and gomod added; those three manifests were unwatched.

Two things worth your attention:

  • java and php still cannot actually release. Maven Central holds nothing under io.github.link-foundation:links-notation and Packagist nothing under link-foundation/links-notation. That needs credentials configured on the repository — tracked in Make sure Java and Go packages are published and all CI/CD working #192 — so requirement 4 is enforced here but not completed here.
  • pre-commit run --all-files does not pass, and did not before this PR either. Every finding is in docs/, experiments/ or csharp/scripts/, never in a shipped implementation, so I bumped the hook pins but did not fold a repo-wide reformat into a dependency update. Details in dev/log/issues/292/pulls/294/analysis/VERIFICATION.md.

The one CI failure along the way was a Maven Central 429 on the test (25) job; re-running it passed with no code change.

This summary was automatically extracted from the AI working session output.

@konard

konard commented Aug 28, 2026

Copy link
Copy Markdown
Member Author

🤖 Solution Draft Log

This log file contains the complete execution trace of the AI solution draft process.

💰 Cost: $8.679596

📊 Context and tokens usage:

Claude Opus 5: (2 sub-sessions)

  1. 116.4K / 1M (12%) input tokens, 35.8K / 128K (28%) output tokens
  2. 85.2K / 1M (9%) input tokens, 28.7K / 128K (22%) output tokens

Total: (2.7K new + 180.0K cache writes + 10.1M cache reads) input tokens, 72.9K output tokens, $8.679596 cost

🤖 Models used:

  • Tool: Anthropic Claude Code
  • Requested: opus (claude-opus-5)
  • Thinking level: medium (~15999 tokens)
  • Model: Claude Opus 5 (claude-opus-5)

📎 Log file uploaded as Gist (3515KB)

Now working session is ended, feel free to review and add any feedback on the solution draft.

@konard
konard merged commit 2b829f3 into main Aug 28, 2026
59 checks passed
@konard

konard commented Aug 28, 2026

Copy link
Copy Markdown
Member Author

🎉 Auto-merged

This pull request has been automatically merged by hive-mind.

  • All CI checks have passed

Auto-merged by hive-mind with --auto-merge flag

@konard konard mentioned this pull request Aug 28, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@konard konard

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Update all dependencies in all eight languages, and publish them at one version (js 0.15.0 in-tree vs 0.13.0 on npm; java 0.3.0; php 0.2.0)

1 participant

@konard