Skip to content

crossrepostatus: tool-version rows re-derived 2026-10-11, print-host-info.sh in the shared set #52

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bernardladenthin merged 1 commit into from
Oct 11, 2026
Merged

crossrepostatus: tool-version rows re-derived 2026-10-11, print-host-info.sh in the shared set #52

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions crossrepostatus.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@ Legend: ✅ done · 🚧 in progress · ❌ open · ➖ N/A · 📌 standing pol
|---|---|
| Error Prone `-Xep:<Name>:ERROR` promotions | Identical 13-pattern set in all 4 poms |
| NullAway `-XepOpt` options | Identical 6 standard options (`CheckOptionalEmptiness`, `AcknowledgeRestrictiveAnnotations`, `AcknowledgeAndroidRecent`, `AssertsEnabled`, `OnlyNullMarked`, strict JSpecify). Plugin additionally has `ExcludedFieldAnnotations=…@Parameter,@Component` — correct repo-local exception for Mojo POJOs. |
| Tool versions | Identical across all 4 (re-derived from every pom on `origin/main` 2026-10-06, not copied forward): Checker 4.3.0, fb-contrib 7.7.4, findsecbugs 1.14.0, spotbugs-maven-plugin 4.10.4.1, spotless 3.10.3, palantir 2.102.0, errorprone 2.50.0, nullaway 0.14.2, surefire 3.6.0, archunit 1.5.1, junit-jupiter 6.1.3, hamcrest 3.0, pitest-maven 1.30.0 (pitest-junit5-plugin 1.2.3). **All latest stable** — this row is the **canonical cross-repo tool-version matrix** (policy files point here rather than re-pinning). See "Dependency / plugin freshness" below for how this is kept current. **This row has now gone stale twice, the same way both times, and the note added after the first occurrence did not prevent the second — so treat the numbers here as evidence only when the audit date above is recent.** 2026-08-29: spotless 3.10.0, palantir 2.96.0, pitest-maven 1.25.9 and nullaway 0.13.8 were behind while the row claimed "all latest stable". 2026-09-05: Checker 4.2.2, spotbugs 4.10.4.0, spotless 3.10.1, nullaway 0.14.0 and surefire 3.5.6 were behind, again under the same claim. 2026-09-20: palantir 2.97.0 was behind (→ 2.98.0), a third time under the same claim. 2026-09-27: spotless 3.10.2, palantir 2.98.0, nullaway 0.14.1 and archunit 1.5.0 were behind — a fourth time; NullAway and palantir are exactly the two the versions plugin cannot see (annotation-processor path and a formatter version inside a plugin `<configuration>`), so only the direct `maven-metadata.xml` probe caught them. Every time the *identity* half held (all four repos really did carry the same values) and only the recorded numbers lagged. The mechanism is the same each time: a per-repo Dependabot bump lands in one repo, the other three are brought back in step by a follow-up commit, and nothing in that sequence touches this file. **What would actually fix it is a check that derives this row from the poms rather than a reminder to update it by hand** — the *identity* half exists now: every repository's `shared-files` job runs `check-versions.py`, which compares each `groupId:artifactId` the POMs use (incl. NullAway's processor path and the Spotless palantir version) with the siblings' default branches and warns per difference. Whether the shared value is the *latest* is still a manual question — re-derive before citing (the loop under "Dependency / plugin freshness" does it in one command). 2026-10-01: palantir 2.99.0 was behind (→ 2.100.0) — the formatter version again, the one Dependabot cannot see. 2026-10-06: palantir 2.100.0 was behind again (→ 2.102.0), and Checker 4.2.3 (→ 4.3.0) — the latter the usual one-repo-ahead shape: Dependabot had bumped streambuffer alone. Every value above was additionally cross-checked against Maven Central's own `maven-metadata.xml` on 2026-10-06 and is the latest **stable** release of its artifact. |
| Tool versions | Identical across all 4 (re-derived from every pom on `origin/main` 2026-10-11, not copied forward): Checker 4.3.1, fb-contrib 7.7.4, findsecbugs 1.14.0, spotbugs-maven-plugin 4.10.4.1, spotless 3.10.4, palantir 2.102.0, errorprone 2.50.0, nullaway 0.14.2, surefire 3.6.0, archunit 1.5.1, junit-jupiter 6.1.3, hamcrest 3.0, pitest-maven 1.30.0 (pitest-junit5-plugin 1.2.3). **All latest stable** — this row is the **canonical cross-repo tool-version matrix** (policy files point here rather than re-pinning). See "Dependency / plugin freshness" below for how this is kept current. **This row has now gone stale twice, the same way both times, and the note added after the first occurrence did not prevent the second — so treat the numbers here as evidence only when the audit date above is recent.** 2026-08-29: spotless 3.10.0, palantir 2.96.0, pitest-maven 1.25.9 and nullaway 0.13.8 were behind while the row claimed "all latest stable". 2026-09-05: Checker 4.2.2, spotbugs 4.10.4.0, spotless 3.10.1, nullaway 0.14.0 and surefire 3.5.6 were behind, again under the same claim. 2026-09-20: palantir 2.97.0 was behind (→ 2.98.0), a third time under the same claim. 2026-09-27: spotless 3.10.2, palantir 2.98.0, nullaway 0.14.1 and archunit 1.5.0 were behind — a fourth time; NullAway and palantir are exactly the two the versions plugin cannot see (annotation-processor path and a formatter version inside a plugin `<configuration>`), so only the direct `maven-metadata.xml` probe caught them. Every time the *identity* half held (all four repos really did carry the same values) and only the recorded numbers lagged. The mechanism is the same each time: a per-repo Dependabot bump lands in one repo, the other three are brought back in step by a follow-up commit, and nothing in that sequence touches this file. **What would actually fix it is a check that derives this row from the poms rather than a reminder to update it by hand** — the *identity* half exists now: every repository's `shared-files` job runs `check-versions.py`, which compares each `groupId:artifactId` the POMs use (incl. NullAway's processor path and the Spotless palantir version) with the siblings' default branches and warns per difference. Whether the shared value is the *latest* is still a manual question — re-derive before citing (the loop under "Dependency / plugin freshness" does it in one command). 2026-10-01: palantir 2.99.0 was behind (→ 2.100.0) — the formatter version again, the one Dependabot cannot see. 2026-10-06: palantir 2.100.0 was behind again (→ 2.102.0), and Checker 4.2.3 (→ 4.3.0) — the latter the usual one-repo-ahead shape: Dependabot had bumped streambuffer alone. Every value above was additionally cross-checked against Maven Central's own `maven-metadata.xml` on 2026-10-06 and is the latest **stable** release of its artifact. |
| Release hygiene (CHANGELOG footer + version sites) | Audited 2026-08-29 while preparing java-llama.cpp 5.1.0 and BAF 1.8.0. **jllama ✅ / streambuffer ✅** — released headings, footer compare-links and `v*` tags are the same set in both. **BAF ➖ → fixed**: `v1.7.0` shipped with no `[1.7.0]` compare-link at all and `[Unreleased]` still pointing at `v1.6.1`; both repaired in the 1.8.0 prep. **srcmorph ➖ → fixed**: `v1.1.0` was tagged and released with **no CHANGELOG section and no link** — the chain jumped `1.0.2 → 1.1.1`, so a shipped version was undocumented. Repaired in the 1.2.0 prep (`ff68cfc`): the section was reconstructed, the compare-link added, and `[1.1.1]` re-pointed to compare from `v1.1.0`. Re-verified 2026-08-31 on srcmorph `main` — release headings and footer links are now the same set (`1.0.0`…`1.2.0`), with `[Unreleased]` kept as the anchor for the next cycle. The footer is the most-missed step because nothing builds or renders it — the mechanical headings/links/tags check and the per-repo table of version sites now live in [`workflows/release-process.md`](workflows/release-process.md) under "What actually gets missed". Related: BAF enforces its 24 launcher-script jar names with `ExampleRunScriptJarVersionTest` (a pom bump reds the build until they follow) and srcmorph is structurally immune via a glob — a repo that hardcodes jar names with neither guard is the gap to close. |
| `dependencyConvergence` pinning convention | All 4 Maven repos (+ srcmorph's 3 reactor modules) enable maven-enforcer's `<dependencyConvergence/>`. Convention, the `excludedScopes=[test,provided]` default gotcha, and merge-discipline guidance are in [`policies/dependency-convergence-pinning.md`](policies/dependency-convergence-pinning.md). |
| Maven Enforcer `bannedDependencies` | Identical 7-entry list |
Expand Down Expand Up @@ -95,7 +95,7 @@ action would pin it by SHA (Scorecard's pinned-dependencies rule), it would need
of its own, and a checkout of a second repository in CI; copies keep each repository self-contained,
and the manifest makes the duplication explicit instead of accidental. The shared set: the build-check
library (`.github/buildcheck/{__init__,workflow,releasegate,sharedfiles,versions,runscripts}.py`, its
tests, and the `check-*.py` entry points), `print-crash-logs.sh`,
tests, and the `check-*.py` entry points), `print-crash-logs.sh`, `print-host-info.sh`,
`verify-signing-key.sh`, `verify-bytecode-version.sh`, the signing self-test (`.github/signing-selftest/`),
the issue/PR templates, `CODE_OF_CONDUCT.md`, `smoke-fatjar-cli.sh` (BAF + srcmorph; `sign-fatjars.sh`
was jllama + srcmorph until jllama dropped its fat jars with the modular natives, 5.2.0), `lombok.config` (jllama at `llama/lombok.config`; matched by file name there),
Expand Down Expand Up @@ -359,7 +359,7 @@ Differences below are intentional design decisions, not gaps to close.
All four repos are on the **newest stable** version of every dependency and build plugin,
checked with `versions:display-dependency-updates` + `display-plugin-updates` against Maven
Central plus direct `maven-metadata.xml` probes for paths the versions plugin doesn't scan
(Error Prone, NullAway, Checker, palantir-java-format). **Re-checked 2026-10-06** (palantir 2.102.0 in all 4 + `llama-atmosphere-agent`; Checker 4.3.0 in BAF/jllama/srcmorph, streambuffer having it from Dependabot; in jllama langchain4j 1.21.0, atmosphere-ai 4.0.72, Jetty 12.1.14, JLine 4.4.7 — none of the eight carried JLine fixes' files changed between 4.4.6 and 4.4.7 — and clang-format 23.1.3, zero-churn; jqwik stays at 1.9.3 by policy; OpenJML 21.0.28 now has binaries but is being evaluated separately; every Action on its newest release, Gradle 9.8.0, Kotlin 2.4.20, sccache 0.18.0, GoogleTest v1.18.0 current; AGP/androidx not re-checkable, Google's Maven being blocked from the session.) Previous re-check 2026-10-01 (palantir 2.100.0 in all 4 + `llama-atmosphere-agent`; logback 1.6.5 in BAF/jllama/srcmorph; guava 33.7.2-jre in BAF + BroomCabinet; OpenJML stays at 21.0.27 — the 21.0.28 tag (2026-10-01) has no binary assets yet; llama.cpp b11320 in jllama; BroomCabinet's h2/ojdbc8 deliberately left alone — that project is a bug reproducer pinned to the versions it reproduces against. Every Action already on its newest major, Gradle 9.8.0, AGP 9.4.0 and Compose BOM 2026.09.00 current; the androidx libraries outside the BOM could not be checked, dl.google.com being blocked from the session.) Previous re-check 2026-09-27 (sweep closed, all in one change set so the repos stay in step: spotless 3.10.3, palantir 2.99.0, nullaway 0.14.2, archunit 1.5.1 in all 4; slf4j 2.0.20 + logback 1.6.4 in BAF/jllama/srcmorph; jackson 2.22.3 in jllama + srcmorph (BAF had it from Dependabot the same morning — the usual one-repo-ahead shape); mockito 5.24.0 in BAF + BroomCabinet; langchain4j 1.20.1, atmosphere-ai 4.0.71, jline 4.4.6 and exec-maven-plugin 3.5.0 → 3.6.4 in jllama (the last in `llama-atmosphere-agent`, a standalone pom the 2026-09-20 sweep had missed while this paragraph claimed 3.6.4 for jllama); lz4-java 1.12.0 in BroomCabinet; and jllama's non-Maven pins Gradle 9.7.1 → 9.8.0, Compose BOM 2026.06.01 → 2026.09.00, appcompat 1.7.1 → 1.8.0, Compose compiler plugin 2.4.10 → 2.4.20. Earlier sweep, 2026-09-20: palantir 2.98.0 in all 4, exec-maven-plugin 3.6.4 in jllama + srcmorph, protobuf-javalite 4.36.2 in BAF, animal-sniffer 1.28 in jllama, plus jllama's non-Maven pins — GoogleTest v1.18.0, sccache 0.18.0, clang-format 23.1.1 (zero-churn: the tree was already clean under it), AGP 9.4.0, Gradle 9.7.1 — and BroomCabinet's 15 poms). The langchain4j lag this paragraph
(Error Prone, NullAway, Checker, palantir-java-format). **Re-checked 2026-10-11** (palantir 2.102.0 in all 4 + `llama-atmosphere-agent`; Checker 4.3.1 and spotless 3.10.4 in all 4; the ACP Java SDK 0.80.0 in the agent, a binary-incompatible release ported the same day; langchain4j 1.22.0; `commons-codec` 1.23.0 in BAF; Python 3.10 + 3.15 in BAF's measurement-tools matrix; in jllama langchain4j 1.21.0, atmosphere-ai 4.0.72, Jetty 12.1.14, JLine 4.4.7 — none of the eight carried JLine fixes' files changed between 4.4.6 and 4.4.7 — and clang-format 23.1.3, zero-churn; jqwik stays at 1.9.3 by policy; OpenJML 21.0.28 now has binaries but is being evaluated separately; every Action on its newest release, Gradle 9.8.1, Kotlin 2.4.21 in the POMs and the Compose compiler plugin alike -- `check-versions.py` now compares the two, since Dependabot bumps only the POMs -- ROCm TheRock 10.1.0 available but 10.0.0 kept while upstream llama.cpp builds with it, OpenVINO 2026.4.1, CUDA 13.4 (13.5 not out), sccache 0.18.0, GoogleTest v1.18.0 current; AGP/androidx not re-checkable, Google's Maven being blocked from the session.) Previous re-check 2026-10-01 (palantir 2.100.0 in all 4 + `llama-atmosphere-agent`; logback 1.6.5 in BAF/jllama/srcmorph; guava 33.7.2-jre in BAF + BroomCabinet; OpenJML stays at 21.0.27 — the 21.0.28 tag (2026-10-01) has no binary assets yet; llama.cpp b11320 in jllama; BroomCabinet's h2/ojdbc8 deliberately left alone — that project is a bug reproducer pinned to the versions it reproduces against. Every Action already on its newest major, Gradle 9.8.0, AGP 9.4.0 and Compose BOM 2026.09.00 current; the androidx libraries outside the BOM could not be checked, dl.google.com being blocked from the session.) Previous re-check 2026-09-27 (sweep closed, all in one change set so the repos stay in step: spotless 3.10.3, palantir 2.99.0, nullaway 0.14.2, archunit 1.5.1 in all 4; slf4j 2.0.20 + logback 1.6.4 in BAF/jllama/srcmorph; jackson 2.22.3 in jllama + srcmorph (BAF had it from Dependabot the same morning — the usual one-repo-ahead shape); mockito 5.24.0 in BAF + BroomCabinet; langchain4j 1.20.1, atmosphere-ai 4.0.71, jline 4.4.6 and exec-maven-plugin 3.5.0 → 3.6.4 in jllama (the last in `llama-atmosphere-agent`, a standalone pom the 2026-09-20 sweep had missed while this paragraph claimed 3.6.4 for jllama); lz4-java 1.12.0 in BroomCabinet; and jllama's non-Maven pins Gradle 9.7.1 → 9.8.0, Compose BOM 2026.06.01 → 2026.09.00, appcompat 1.7.1 → 1.8.0, Compose compiler plugin 2.4.10 → 2.4.20. Earlier sweep, 2026-09-20: palantir 2.98.0 in all 4, exec-maven-plugin 3.6.4 in jllama + srcmorph, protobuf-javalite 4.36.2 in BAF, animal-sniffer 1.28 in jllama, plus jllama's non-Maven pins — GoogleTest v1.18.0, sccache 0.18.0, clang-format 23.1.1 (zero-churn: the tree was already clean under it), AGP 9.4.0, Gradle 9.7.1 — and BroomCabinet's 15 poms). The langchain4j lag this paragraph
used to record is closed — jllama is on `1.20.0`, which is Central's release. The only version
updates still on offer are pre-releases (Maven 4 betas/RCs, `slf4j-api` 2.1.0-alpha1, `log4j`
3.0.0-beta2, `maven-plugin-tools`/`maven-plugin-plugin` 4.0.0-beta-2, `maven-surefire-plugin`
Expand Down
Loading