gominimal · bryan-minimal · Jul 27, 2026 · Jul 24, 2026 · Jul 24, 2026 · Jul 24, 2026
diff --git a/packages/cython/build.ncl b/packages/cython/build.ncl
@@ -5,14 +5,14 @@ let setuptools = import "../setuptools/build.ncl" in
 let python = import "../python/build.ncl" in
 let toolchain = import "../toolchain/build.ncl" in
 
-let version = "3.2.8" in
+let version = "3.2.9" in
 {
   name = "cython",
   build_deps = [
     { file = "build.sh" } | Local,
     {
       url = "https://github.com/cython/cython/releases/download/%{version}/cython-%{version}.tar.gz",
-      sha256 = "f4f23a56b25221a06f91817fe8f3114ab8b48a4fac73187dbb64bc2c4a87961f",
+      sha256 = "d249c9022ab13286b17bd66f30609e800c5f95efeecb06168990c7a66cecde6c",
       extract = true,
       strip_prefix = "cython-%{version}",
     } | Source,

diff --git a/packages/hunk/build.ncl b/packages/hunk/build.ncl
@@ -5,14 +5,14 @@ let bun = import "../bun/build.ncl" in
 let git = import "../git/build.ncl" in
 let glibc = import "../glibc/build.ncl" in
 
-let version = "0.17.3" in
+let version = "0.17.4" in
 {
   name = "hunk",
   build_deps = [
     { file = "build.sh" } | Local,
     {
       url = "https://github.com/modem-dev/hunk/archive/refs/tags/v%{version}.tar.gz",
-      sha256 = "86c37686352fcc6925e4080ea2cc414fe84c1b2af10a07dccfbc0e0fc275dbc2",
+      sha256 = "f37c7e7c492a60f8b4a49cf99581de2dcb6e1c5ba120703790ae55bc596072d5",
       extract = true,
       strip_prefix = "hunk-%{version}",
     } | Source,

diff --git a/packages/otel-collector/build.ncl b/packages/otel-collector/build.ncl
@@ -4,17 +4,33 @@ let go = import "../go/build.ncl" in
 let toolchain = import "../toolchain/build.ncl" in
 let glibc = import "../glibc/build.ncl" in
 
-let version = "0.150.1" in
+let version = "0.157.0" in
+# OBI (OpenTelemetry eBPF Instrumentation) is compiled into otelcol-contrib as
+# of 0.157.0 — the contrib manifest declares it as a component and replaces it
+# with a vendored source tree at `internal/obi-src`. Upstream fetches that at
+# build time (scripts/prepare-obi.sh); we pin it here instead so every input
+# stays checksummed. MUST match the manifest's
+# `- gomod: go.opentelemetry.io/obi <ver>` line — if a version bump changes it,
+# this and the sha256 below move together, or the build fails loudly on the
+# replace path rather than silently building against the wrong OBI.
+let obi_version = "v0.10.0" in
 {
   name = "otel-collector",
   build_deps = [
     { file = "build.sh" } | Local,
     {
       url = "https://github.com/open-telemetry/opentelemetry-collector-releases/archive/refs/tags/v%{version}.tar.gz",
-      sha256 = "082a7d78167336765461d95edf71127423dcff0399ccbc0963eb33d6f67e121b",
+      sha256 = "b8058145292617c87b5acf7c316a801790a58899dfb88114ea71395795706c09",
       extract = true,
       strip_prefix = "opentelemetry-collector-releases-%{version}",
     } | Source,
+    # Fetched un-extracted: build.sh unpacks it into `internal/obi-src` (the
+    # path the manifest's `replaces:` points at). Extracting it here would merge
+    # its tree into the source root and collide with the collector checkout.
+    {
+      url = "https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/releases/download/%{obi_version}/obi-%{obi_version}-source-generated.tar.gz",
+      sha256 = "151ef5d04bff9660743148ff20d5c833222b0b45ab15245a2968a3f7f4366dec",
+    } | Source,
     base,
     go,
     toolchain,

diff --git a/packages/otel-collector/build.sh b/packages/otel-collector/build.sh
@@ -5,12 +5,38 @@ export GOROOT=/usr/go
 export GONOSUMCHECK=*
 export GONOSUMDB=*
 
-# Install the OpenTelemetry Collector Builder (ocb)
-go install -trimpath go.opentelemetry.io/collector/cmd/builder@v0.150.0
+# OBI (OpenTelemetry eBPF Instrumentation, the donated Grafana Beyla) is
+# compiled INTO otelcol-contrib as of 0.157.0: the contrib manifest declares
+# `go.opentelemetry.io/obi` as a component AND carries
+#   replaces: go.opentelemetry.io/obi => ../../../internal/obi-src
+# That directory is NOT in the upstream repo — upstream materializes it with
+# scripts/prepare-obi.sh, which curls the "source-generated" tarball (it ships
+# pre-generated BPF objects, so no clang/bpf2go/Docker toolchain is needed).
+# We declare that same tarball as a checksummed Source in build.ncl (repo
+# convention: every input pinned by sha256) and stage it here instead of
+# fetching at build time. Globbed so the version lives in ONE place (build.ncl).
+mkdir -p internal/obi-src
+tar -xof obi-*-source-generated.tar.gz -C internal/obi-src --strip-components=1
+
+# Install the OpenTelemetry Collector Builder (ocb). This pin MUST track the
+# distribution version: a mismatched builder resolves otelcol/service at its own
+# version while the manifest pulls the rest at %{version}, which fails to build.
+# Keeping it byte-equal to the package version is also what lets pkgmgr's
+# build.sh version rewrite carry it forward on the next bump (the old
+# `v0.150.0` pin never matched the `0.150.1` package version, so it silently
+# stayed behind).
+go install -trimpath go.opentelemetry.io/collector/cmd/builder@v0.157.0
 OCB=$(go env GOPATH)/bin/builder
 
-# Build the collector using the upstream contrib manifest
-$OCB --config=distributions/otelcol-contrib/manifest.yaml
+# Run ocb FROM the distribution directory. The manifest's `output_path: ./_build`
+# is CWD-relative, and the obi replace path (`../../../internal/obi-src`) is
+# resolved from that output dir — so ocb must run where upstream runs it
+# (distributions/otelcol-contrib), making _build/../../../ == the source root.
+# Running at the source root put _build at <root>/_build, so ../../../ escaped
+# above it and go reported:
+#   reading /internal/obi-src/go.mod: no such file or directory
+cd distributions/otelcol-contrib
+$OCB --config=manifest.yaml
 
 mkdir -p $OUTPUT_DIR/usr/bin
 install -m 755 _build/otelcol-contrib $OUTPUT_DIR/usr/bin/otelcol-contrib
diff --git a/packages/pulumi/build.ncl b/packages/pulumi/build.ncl
@@ -4,14 +4,14 @@ let go = import "../go/build.ncl" in
 let toolchain = import "../toolchain/build.ncl" in
 let glibc = import "../glibc/build.ncl" in
 
-let version = "3.253.0" in
+let version = "3.254.0" in
 {
   name = "pulumi",
   build_deps = [
     { file = "build.sh" } | Local,
     {
       url = "gs://minimal-staging-archives/pulumi/pulumi/v%{version}.tar.gz",
-      sha256 = "6bffd86f18ebeefbba91ca747822b1b8eb418f8c85e800fce0535d9e1b2310f0",
+      sha256 = "dfec607f9030b48a405ba847820a786ebbef615526ca646e27d44b33be2757df",
       extract = true,
       strip_prefix = "pulumi-%{version}",
     } | Source,

diff --git a/packages/redis/build.ncl b/packages/redis/build.ncl
@@ -10,14 +10,14 @@ let linux_headers = import "../linux_headers/build.ncl" in
 
 let glibc = import "../glibc/build.ncl" in
 
-let version = "8.8.0" in
+let version = "8.8.1" in
 {
   name = "redis",
   build_deps = [
     { file = "build.sh" } | Local,
     {
       url = "gs://minimal-staging-archives/redis/redis/%{version}.tar.gz",
-      sha256 = "19736ce6117d90b3df032504c6e5c1ce41667ae47f073281b40d2f274c200a74",
+      sha256 = "56008a7e9c87ed4ec5ce13032ff8a685ffff944276c2a993024ce805df8338e2",
       extract = true,
       strip_prefix = "redis-%{version}",
     } | Source,