setup-dev.sh pins stale dev-tool versions and downgrades newer local installs #590

New issue

Open

opened 2026-09-22 17:13:47 +00:00 by hexajon · 0 comments

hexajon commented

2026-09-22 17:13:47 +00:00

Owner

What

scripts/setup-dev.sh installs the dev tools at hardcoded version pins, and several pins are now behind the latest release. Running the script over a newer local install downgrades it:

govulncheck pins v1.6.0; latest is v1.8.0.
gosec pins v2.28.0; latest is v2.29.0.

Nothing flags a pin that has fallen behind, so the pins rot silently and the script quietly rolls a contributor's tools back over time. Downgrading a working toolchain is never the right fix.

Fix

Bump the pins to current, and add a drift check that flags a pinned dev tool that is behind its latest release, so the pins stay current and the script never installs a tool older than the one already present. Keep the pins for reproducibility; just keep them honest. This sits alongside the toolchain-currency theme in #526.

Acceptance

Every dev-tool pin in setup-dev.sh matches the current latest at the time of the change.
A check flags a pin behind latest, so this does not silently recur.
Running setup-dev.sh never installs a tool older than the one already present.

## What `scripts/setup-dev.sh` installs the dev tools at hardcoded version pins, and several pins are now behind the latest release. Running the script over a newer local install downgrades it: - govulncheck pins v1.6.0; latest is v1.8.0. - gosec pins v2.28.0; latest is v2.29.0. Nothing flags a pin that has fallen behind, so the pins rot silently and the script quietly rolls a contributor's tools back over time. Downgrading a working toolchain is never the right fix. ## Fix Bump the pins to current, and add a drift check that flags a pinned dev tool that is behind its latest release, so the pins stay current and the script never installs a tool older than the one already present. Keep the pins for reproducibility; just keep them honest. This sits alongside the toolchain-currency theme in #526. ## Acceptance - Every dev-tool pin in `setup-dev.sh` matches the current latest at the time of the change. - A check flags a pin behind latest, so this does not silently recur. - Running `setup-dev.sh` never installs a tool older than the one already present.

hexajon added the

testing

label

2026-09-22 17:13:47 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

sixfold-space/madtea#590

No description provided.

Rows
Columns