Four tools in hyperi_versions are behind upstream. We cannot just bump them here: tools/check_version_pins.py fails the test run on ANY disagreement with hyperi-ci, which is the whole point of that check. So this is a two-repo change, hyperi-ci first, then mirror it here.
Current vs upstream latest, checked 2026-08-26:
- osv-scanner
v2.4.0 -> v2.5.1
- golangci-lint
v2.12.2 -> v2.13.1
- govulncheck
v1.1.4 -> v1.7.0 -- five minors behind, and it is the vulnerability scanner itself, so this one matters most
- cargo-chef
v0.1.77 -> v0.1.78
None of them has a published CVE, so nothing is on fire. govulncheck being five minors stale just means a pinned box scans with an older database than it should.
Worth knowing while you are in there: until the pin-plumbing fix lands, several of these pins were not being consumed at all, so a --pinned box installed latest regardless of what the map said. Bumping the numbers only helps once the pin is actually read.
DONE WHEN hyperi-ci carries the four new versions and hyperi_versions mirrors them with the pin check green.
Four tools in
hyperi_versionsare behind upstream. We cannot just bump them here:tools/check_version_pins.pyfails the test run on ANY disagreement with hyperi-ci, which is the whole point of that check. So this is a two-repo change, hyperi-ci first, then mirror it here.Current vs upstream latest, checked 2026-08-26:
v2.4.0->v2.5.1v2.12.2->v2.13.1v1.1.4->v1.7.0-- five minors behind, and it is the vulnerability scanner itself, so this one matters mostv0.1.77->v0.1.78None of them has a published CVE, so nothing is on fire. govulncheck being five minors stale just means a pinned box scans with an older database than it should.
Worth knowing while you are in there: until the pin-plumbing fix lands, several of these pins were not being consumed at all, so a
--pinnedbox installed latest regardless of what the map said. Bumping the numbers only helps once the pin is actually read.DONE WHEN hyperi-ci carries the four new versions and
hyperi_versionsmirrors them with the pin check green.