Skip to content

fix(deps): bump OmniRoute, Ollama, Mnemon, uv and Tailscale pins - #79

Merged
gitricko merged 4 commits into
mainfrom
fix/deps-bump-3.8.52
Oct 21, 2026
Merged

gitricko merged 4 commits into
mainfrom
fix/deps-bump-3.8.52

Conversation

@intricko

Copy link
Copy Markdown
Collaborator

What

Five pins moved in etc/deps.yaml (the single source of truth), with the derived files regenerated from it rather than hand-edited:

Component From To
OmniRoute 3.8.51 3.8.52
Ollama v0.40.5 v0.40.6
Mnemon v0.2.10 v0.2.12
uv 0.13.1 0.13.4
Tailscale v1.104.1 1.104.2
  • etc/versions.env + .node-version → regenerated by scripts/sync-versions.sh
  • README version pills → regenerated by scripts/sync-readme-badges.sh

Why

The pins had drifted from what a fresh install actually pulls (OmniRoute 3.8.52 was already live locally while the repo still pinned 3.8.51). These are the current releases for all five at time of writing.

The Tailscale part is not just a version bump

lib/tailscale.sh verifies the tarball against the pinned sha256 before extracting, and aborts on mismatch. The bump moved the version to 1.104.2 but left the 1.104.1 digests behind, which would have failed every fresh --tailscale install with a checksum mismatch. Re-pinned by hashing the actual artifacts served from https://pkgs.tailscale.com/stable/:

Platform was (1.104.1) now (1.104.2)
linux_x64 108d1d96… 512f613e…
linux_arm64 f6029437… 5776aaa9…

The ${TAILSCALE_VERSION:-…} fallback in lib/tailscale.sh (still v1.104.1) and the comment next to the v-prefix strip were refreshed to match. Note the pin is now stored bare (1.104.2) — harmless, the installer strips a leading v anyway (lib/tailscale.sh:48).

Verification

  • Every version exists upstream: npm omniroute@3.8.52 (is latest), 9router@0.5.104, @earendil-works/pi-coding-agent@1.3.0; tags mnemon-dev/mnemon@v0.2.12, ollama/ollama@v0.40.6, astral-sh/uv@0.13.4; tailscale_1.104.2_{amd64,arm64}.tgz downloaded.
  • uv 0.13.4 shasums: 4/4 match GitHub release asset digests (linux-gnu, apple-darwin × x86_64/aarch64).
  • Ollama v0.40.6 shasums: 4/4 match release asset digests (ollama-linux-amd64, ollama-linux-arm64, and the universal ollama-darwin.tgz pinned for both macOS platforms).
  • Tailscale 1.104.2 shasums: re-pinned from the downloaded tarballs (see table).
  • Blocking CI gate (version-sync): scripts/sync-versions.sh --check → 0, scripts/sync-readme-badges.sh --check → 0.
  • Lint: shellcheck lib/tailscale.sh + sh -n → clean. Swept all of install.sh boot.sh stop.sh lib/*.sh (CI's shellcheck scope) → clean. (shellcheck findings in scripts/admin-update.sh / scripts/dts.sh are pre-existing on main and outside CI's scope.)

Notes

  • OmniRoute 3.8.52 is the release that drops the keyless oc / OpenCode Free provider upstream (migration 207_remove_opencode_free_provider, upstream PR fix(providers): remove OpenCode Free while preserving Zen and Go cheaper-inference/OmniRoute#16310, with a blocklist test guarding reintroduction). Any OmniRoute combo that targets oc/* without credentials will pre-filter every request out. That's upstream behavior this bump merely brings in — worth a follow-up for whoever owns the combo config.
  • The advisory dependency-drift job (continue-on-error: true) will still report NODE 26.12.0 → v26.12.1 and OLLAMA v0.40.6 → v0.40.7 as outdated — expected and non-blocking; left for a separate bump.

Hermes Agent and others added 4 commits October 21, 2026 15:01
- omniroute   3.8.51  -> 3.8.52
- ollama      v0.40.5 -> v0.40.6
- mnemon      v0.2.10 -> v0.2.12
- uv          0.13.1  -> 0.13.4
- tailscale   v1.104.1 -> 1.104.2

etc/versions.env and the README version pills are regenerated from
etc/deps.yaml with sync-versions.sh / sync-readme-badges.sh.

The Tailscale bump also needed its shasums re-pinned: the pins still
carried the 1.104.1 digests, and lib/tailscale.sh verifies the tarball
before extracting, so a fresh install would have failed with a checksum
mismatch. lib/tailscale.sh's version fallback/comment are refreshed to
match the new pin.
OmniRoute 3.8.52 honors XDG_CONFIG_HOME, so on runners where the legacy dir is
absent it relocates config+DB to $XDG_CONFIG_HOME/omniroute. install.sh then
found no storage.sqlite (login stayed on) and ~/.omniroute was never created,
failing the Real Install keep-config assertion. Pre-create ~/.omniroute, which
OmniRoute prefers over the XDG path, and stop swallowing setup output.
@gitricko

Copy link
Copy Markdown
Owner

Agent-Boss: LGTM

@gitricko
gitricko merged commit 0d09997 into main Oct 21, 2026
10 checks passed
@gitricko
gitricko deleted the fix/deps-bump-3.8.52 branch October 21, 2026 22:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants