Update stacked: 5 packages by gominimal-pkgmgr-mgr[bot] · Pull Request #522 · gominimal/pkgs

gominimal-pkgmgr-mgr · 2026-07-24T19:00:28Z

Update base-soup (5 packages)

Note

These packages declare replace_on_cycle in their build.ncl, so
they participate in the toolchain rebuild graph and one hash change
cascades through the set. Bundling ensures the cascading rebuild
lands as a single unit, even when only one package is bumping —
avoids back-to-back full rebuilds from singleton PRs.

Warning

3 requested members did NOT ship — each needs separate follow-up.
A member is dropped when it fails to update, has its gs:// mirror
withheld by the scan gate, or is peeled to keep the shipped set a
closed dependency closure (a survivor built against a dropped member's
old version would be a broken closure).

Package	Old	Target	Why
`charon`	`0.1.223`	`0.1.225`	update failed: no upstream tarball URL available
`prek`	`0.4.10`	`0.4.11`	gs:// mirror withheld (pkgscan-critical)
`cloud-sql-proxy`	`2.23.0`	`2.24.0`	held for dwell — upstream released ~1h ago (anti-xz recency gate, Critical <3h). Self-clears: re-ships automatically next run once it passes the recency window.

Pkgscan: clean across all bundle members — diffs against prior versions surfaced no newly-introduced suspicious patterns.

Note

Build risk — 1 dependent across the tree. Package(s) that
build- or runtime-depend on a member of this bundle may need a rebuild,
or could FTBFS on an API/ABI change. Informational (not blocking) — a
heads-up for the reviewer on what this bump can ripple into.

Bundle member	Dependents
`cython`	1 — `numpy`

Summary

Package	Old	New	Source
cython	`3.2.8`	`3.2.9`	`github:cython/cython:release-asset:operator-pinned`
hunk	`0.17.3`	`0.17.4`	`github:modem-dev/hunk:operator-pinned`
otel-collector	`0.150.1`	`0.157.0`	`github:open-telemetry/opentelemetry-collector-releases:operator-pinned`
pulumi	`3.253.0`	`3.254.0`	`github:pulumi/pulumi:operator-pinned`
redis	`8.8.0`	`8.8.1`	`github:redis/redis:operator-pinned`

Per-package details

cython 3.2.8 → 3.2.9

SHA256: f4f23a56b25221a0... → d249c9022ab13286...
Size: 3.3 MB
Source: https://github.com/cython/cython/releases/download/3.2.8/cython-3.2.8.tar.gz → https://github.com/cython/cython/releases/download/3.2.9/cython-3.2.9.tar.gz
Released: 13 hours ago (2026-07-24)
License: Apache-2.0 (source: GitHub + tarball)
Auto-applied:
- Rewrote the GitHub release-download tag to 3.2.9 (the upstream tag for 3.2.9); the previous tag did not track the version and would 404 at build time.

hunk 0.17.3 → 0.17.4

SHA256: 86c37686352fcc69... → f37c7e7c492a60f8...
Size: 799 KB
Source: https://github.com/modem-dev/hunk/archive/refs/tags/v0.17.3.tar.gz → https://github.com/modem-dev/hunk/archive/refs/tags/v0.17.4.tar.gz
Released: 22 hours ago (2026-07-23)
License: MIT (source: GitHub + tarball)

otel-collector 0.150.1 → 0.157.0

SHA256: 082a7d7816733676... → b8058145292617c8...
Size: 140 KB
Source: https://github.com/open-telemetry/opentelemetry-collector-releases/archive/refs/tags/v0.150.1.tar.gz → https://github.com/open-telemetry/opentelemetry-collector-releases/archive/refs/tags/v0.157.0.tar.gz
Released: 2 days ago (2026-07-22)
License: Apache-2.0 (source: GitHub + tarball)

pulumi 3.253.0 → 3.254.0

SHA256: 6bffd86f18ebeefb... → dfec607f9030b48a...
Size: 19.9 MB → 20.0 MB
Source: gs://minimal-staging-archives/pulumi/pulumi/v3.253.0.tar.gz → gs://minimal-staging-archives/pulumi/pulumi/v3.254.0.tar.gz
Released: 1 days ago (2026-07-23)
License: Apache-2.0 (source: GitHub + tarball)

redis 8.8.0 → 8.8.1

SHA256: 19736ce6117d90b3... → 56008a7e9c87ed4e...
Size: 4.5 MB → 4.5 MB
Source: gs://minimal-staging-archives/redis/redis/8.8.0.tar.gz → gs://minimal-staging-archives/redis/redis/8.8.1.tar.gz
Released: 23 hours ago (2026-07-23)

Created by pkgmgr

The 0.157.0 bump built clean at the version level but FTBFS on both arches: go: go.opentelemetry.io/obi@v0.10.0 (replaced by ../../../internal/obi-src): reading /internal/obi-src/go.mod: no such file or directory Three upstream build-topology changes between 0.150.1 and 0.157.0, none visible to a version check: 1. OBI is now compiled INTO otelcol-contrib. The contrib manifest gained `- gomod: go.opentelemetry.io/obi v0.10.0` plus `replaces: go.opentelemetry.io/obi => ../../../internal/obi-src`. That directory is not in the repo (internal/ holds only tools/) — upstream materializes it via scripts/prepare-obi.sh, which curls the "source-generated" tarball (pre-generated BPF objects, so no clang/bpf2go). Declare that tarball as a checksummed Source and stage it in build.sh, per repo convention that every input is pinned by sha256. 2. ocb must run FROM distributions/otelcol-contrib. `output_path: ./_build` is CWD-relative and the replace path is resolved from the output dir, so running at the source root put _build at <root>/_build and ../../../ escaped above the root — hence the absolute /internal/obi-src/go.mod in the error. 3. The builder pin was hardcoded at v0.150.0 while the package version was 0.150.1, so pkgmgr's build.sh version rewrite never matched it and it stayed behind — the failing log shows otelcol/service resolving at v0.150.0 while every other component came from 0.157.0. Pin it byte-equal to the package version so the rewrite carries it forward on the next bump. NOT yet build-verified — needs a clean-room build before it ships. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

bryan-minimal · 2026-07-24T19:43:39Z

Pushed a fix for the otel-collector FTBFS (f35ae44) — build-verified in a clean-room session: real 383 MB ELF at usr/bin/otelcol-contrib, built in 224.6s (not a cache restore).

The failure's real error was the last line under ~60 lines of go: downloading noise:

go: go.opentelemetry.io/obi@v0.10.0 (replaced by ../../../internal/obi-src):
    reading /internal/obi-src/go.mod: no such file or directory

Three upstream build-topology changes between 0.150.1 and 0.157.0, none of them visible to a version check:

OBI is now compiled into otelcol-contrib. The contrib manifest gained go.opentelemetry.io/obi v0.10.0 plus replaces: … => ../../../internal/obi-src. That directory isn't in the repo (internal/ holds only tools/) — upstream materializes it via scripts/prepare-obi.sh, which curls the "source-generated" tarball (pre-generated BPF objects, so no clang/bpf2go needed). Now declared as a checksummed Source and staged in build.sh, per the repo convention that every input is sha-pinned.
ocb must run from distributions/otelcol-contrib. output_path: ./_build is CWD-relative and the replace path resolves from the output dir, so running at the source root put _build at <root>/_build and ../../../ escaped above it — hence the absolute /internal/obi-src/go.mod in the error.
The builder pin was stale and invisible. build.sh hardcoded builder@v0.150.0 while the package version was 0.150.**1**, so pkgmgr's build.sh version rewrite never matched it — the failing log shows otelcol/service resolving at v0.150.0 while every other component came from 0.157.0. Now pinned byte-equal to the version so the existing rewrite carries it forward automatically.

Note the other 3 non-shipping members are unrelated and unchanged: cloud-sql-proxy and prek are both self-clearing dwell holds (each released ~17:05 UTC), and charon has no release tags so no tarball URL.

twitchyliquid64 · 2026-07-24T20:00:23Z

    {
-      url = "https://github.com/cython/cython/releases/download/%{version}/cython-%{version}.tar.gz",
-      sha256 = "f4f23a56b25221a06f91817fe8f3114ab8b48a4fac73187dbb64bc2c4a87961f",
+      url = "https://github.com/cython/cython/releases/download/3.2.9/cython-%{version}.tar.gz",


This seems like a regression?

twitchyliquid64

Aside from the version string thing, lgtm

Tom caught this: the URL came out half-templated — releases/download/3.2.9/cython-%{version}.tar.gz so the tag segment was pinned to a literal while the filename stayed %{version}. The next bump would move the filename and leave the tag behind, producing a 404. Cause is pkgmgr's rewrite_release_download_tag (pkgmgr-rs#578), added so ghostscript's non-version-derivable tag (gs10060 -> gs10071) gets rewritten on a bump. It replaces the /releases/download/<tag>/ segment unconditionally, so a tag that was ALREADY %{version} got clobbered with a literal. Correct for ghostscript, wrong wherever the tag is derivable — the tool fix follows separately so this cannot recur. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

gominimal-pkgmgr-mgr Bot and others added 6 commits July 24, 2026 19:00

Update cython to 3.2.9

2e9b094

Update hunk to 0.17.4

70c0a36

Update otel-collector to 0.157.0

f7fb798

Update pulumi to 3.254.0

de2da43

Update redis to 8.8.1

e473640

twitchyliquid64 reviewed Jul 24, 2026

View reviewed changes

twitchyliquid64 approved these changes Jul 24, 2026

View reviewed changes

bryan-minimal added this pull request to the merge queue Jul 27, 2026

Merged via the queue into main with commit b3f3c91 Jul 27, 2026
9 checks passed

bryan-minimal deleted the update-stacked-2026-07-24-46cde374 branch July 27, 2026 23:36

Navigation Menu

Uh oh!

Update stacked: 5 packages - #522

Update stacked: 5 packages#522
bryan-minimal merged 7 commits into
mainfrom
update-stacked-2026-07-24-46cde374

gominimal-pkgmgr-mgr Bot commented Jul 24, 2026

Uh oh!

bryan-minimal commented Jul 24, 2026

Uh oh!

twitchyliquid64 Jul 24, 2026

Uh oh!

twitchyliquid64 left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

gominimal-pkgmgr-mgr Bot commented Jul 24, 2026

Update base-soup (5 packages)

Summary

Per-package details

Uh oh!

bryan-minimal commented Jul 24, 2026

Uh oh!

twitchyliquid64 Jul 24, 2026

Choose a reason for hiding this comment

Uh oh!

twitchyliquid64 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants