# Dependency Inventory (D35 DEP-01)

Generated by `scripts/dep-inventory.py`. Lookup date: 2026-10-03.

Inventory only. No dependency, lockfile, workflow or image was changed to produce this report. Manifests are discovered with `git ls-files`, never a filesystem walk. Network lookups are cached under the `--cache` directory so re-running against the same cache is byte-identical.

## npm / bun

| File | Name | Current | Latest stable | Bump | Note |
|---|---|---|---|---|---|
| `loki-ts/package.json` | `@anthropic-ai/claude-agent-sdk` | `0.3.288` | `0.3.288` | up-to-date |  |
| `loki-ts/package.json` | `@anthropic-ai/sdk` | `^0.124.0` | `0.131.0` | 0.x breaking |  |
| `loki-ts/package.json` | `@resvg/resvg-wasm` | `^2.6.2` | `2.6.2` | up-to-date |  |
| `loki-ts/package.json` | `@types/bun` | `latest` | `1.4.2` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
| `loki-ts/package.json` | `typescript` | `^5.6.0` | `7.0.2` | MAJOR |  |
| `loki-ts/tests/engine10/fixtures/testmap/package.json` | `vitest` | `^2.0.0` | `5.0.3` | MAJOR | test fixture, not a real dependency |
| `loki-ts/tests/fixtures/monorepo-fc01/backend/package.json` | `vitest` | `^1.0.0` | `5.0.3` | MAJOR | test fixture, not a real dependency |
| `loki-ts/tests/fixtures/project-model/firelater-17/backend/package.json` | `vitest` | `^1.0.0` | `5.0.3` | MAJOR | test fixture, not a real dependency |
| `loki-ts/tests/fixtures/monorepo-fc22/backend/package.json` | `vitest` | `^1.0.0` | `5.0.3` | MAJOR | test fixture, not a real dependency |
| `loki-ts/todo-app/package.json` | `@types/bun` | `latest` | `1.4.2` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
| `package.json` | `@resvg/resvg-wasm` | `^2.6.2` | `2.6.2` | up-to-date |  |
| `package.json` | `@types/node` | `^25.2.0` | `26.6.4` | MAJOR |  |
| `package.json` | `jest` | `^29.7.0` | `30.5.2` | MAJOR |  |
| `package.json` | `jsdom` | `^24.0.0` | `30.1.1` | MAJOR |  |
| `package.json` | `typescript` | `^5.9.3` | `7.0.2` | MAJOR |  |
| `packages/control-plane/package.json` | `drizzle-orm` | `^0.45.3` | `0.45.3` | up-to-date |  |
| `packages/control-plane/package.json` | `hono` | `^4.13.12` | `4.13.12` | up-to-date |  |
| `packages/control-plane/package.json` | `yaml` | `^2.9.1` | `2.9.1` | up-to-date |  |
| `packages/control-plane/package.json` | `@playwright/test` | `1.58.1` | `1.63.0` | minor |  |
| `packages/control-plane/package.json` | `axe-core` | `4.13.0` | `4.13.0` | up-to-date |  |
| `packages/control-plane/package.json` | `drizzle-kit` | `^0.31.11` | `0.31.11` | up-to-date |  |
| `packages/control-plane/ui/package.json` | `lucide-react` | `^0.577.0` | `1.51.0` | MAJOR |  |
| `packages/control-plane/ui/package.json` | `react` | `^19.3.0` | `19.3.0` | up-to-date |  |
| `packages/control-plane/ui/package.json` | `react-dom` | `^19.3.0` | `19.3.0` | up-to-date |  |
| `packages/control-plane/ui/package.json` | `@happy-dom/global-registrator` | `^18.0.1` | `20.14.5` | MAJOR |  |
| `packages/control-plane/ui/package.json` | `@testing-library/react` | `^16.3.0` | `16.3.3` | patch |  |
| `packages/control-plane/ui/package.json` | `@types/react` | `^19.0.0` | `19.3.0` | minor |  |
| `packages/control-plane/ui/package.json` | `@types/react-dom` | `^19.0.0` | `19.3.0` | minor |  |
| `packages/control-plane/ui/package.json` | `@vitejs/plugin-react` | `^4.3.4` | `6.1.1` | MAJOR |  |
| `packages/control-plane/ui/package.json` | `autoprefixer` | `^10.6.1` | `10.6.1` | up-to-date |  |
| `packages/control-plane/ui/package.json` | `postcss` | `^8.5.28` | `8.5.28` | up-to-date |  |
| `packages/control-plane/ui/package.json` | `tailwindcss` | `^3.4.17` | `4.3.3` | MAJOR |  |
| `packages/control-plane/ui/package.json` | `typescript` | `~5.7.2` | `7.0.2` | MAJOR |  |
| `packages/control-plane/ui/package.json` | `vite` | `^6.2.0` | `8.3.2` | MAJOR |  |
| `sdk/typescript/package.json` | `typescript` | `^5.9.3` | `7.0.2` | MAJOR |  |
| `vscode-extension/package.json` | `@types/node` | `^20.10.0` | `26.6.4` | MAJOR |  |
| `vscode-extension/package.json` | `@types/vscode` | `^1.85.0` | `1.140.0` | minor |  |
| `vscode-extension/package.json` | `@typescript-eslint/eslint-plugin` | `^6.13.0` | `8.71.0` | MAJOR |  |
| `vscode-extension/package.json` | `@typescript-eslint/parser` | `^6.13.0` | `8.71.0` | MAJOR |  |
| `vscode-extension/package.json` | `@vscode/vsce` | `^2.22.0` | `4.0.0` | MAJOR |  |
| `vscode-extension/package.json` | `esbuild` | `^0.19.8` | `0.28.2` | 0.x breaking |  |
| `vscode-extension/package.json` | `eslint` | `^8.55.0` | `10.12.0` | MAJOR |  |
| `vscode-extension/package.json` | `typescript` | `^5.3.2` | `7.0.2` | MAJOR |  |
| `web-app/package.json` | `@monaco-editor/react` | `^4.7.0` | `4.7.0` | up-to-date |  |
| `web-app/package.json` | `@xterm/addon-fit` | `^0.11.0` | `0.11.0` | up-to-date |  |
| `web-app/package.json` | `@xterm/addon-web-links` | `^0.12.0` | `0.12.0` | up-to-date |  |
| `web-app/package.json` | `@xterm/xterm` | `^6.0.0` | `6.0.0` | up-to-date |  |
| `web-app/package.json` | `lucide-react` | `^0.577.0` | `1.51.0` | MAJOR |  |
| `web-app/package.json` | `react` | `^19.3.0` | `19.3.0` | up-to-date |  |
| `web-app/package.json` | `react-dom` | `^19.3.0` | `19.3.0` | up-to-date |  |
| `web-app/package.json` | `react-resizable-panels` | `^4.14.1` | `4.14.2` | patch |  |
| `web-app/package.json` | `react-router-dom` | `^7.18.4` | `7.18.4` | up-to-date |  |
| `web-app/package.json` | `@eslint/js` | `^9.21.0` | `10.0.1` | MAJOR |  |
| `web-app/package.json` | `@playwright/test` | `^1.63.0` | `1.63.0` | up-to-date |  |
| `web-app/package.json` | `@types/react` | `^19.3.0` | `19.3.0` | up-to-date |  |
| `web-app/package.json` | `@types/react-dom` | `^19.3.0` | `19.3.0` | up-to-date |  |
| `web-app/package.json` | `@vitejs/plugin-react` | `^4.3.4` | `6.1.1` | MAJOR |  |
| `web-app/package.json` | `autoprefixer` | `^10.6.1` | `10.6.1` | up-to-date |  |
| `web-app/package.json` | `eslint` | `^9.21.0` | `10.12.0` | MAJOR |  |
| `web-app/package.json` | `eslint-plugin-react-hooks` | `^5.1.0` | `7.1.1` | MAJOR |  |
| `web-app/package.json` | `eslint-plugin-react-refresh` | `^0.4.19` | `0.5.7` | 0.x breaking |  |
| `web-app/package.json` | `globals` | `^15.15.0` | `17.13.0` | MAJOR |  |
| `web-app/package.json` | `postcss` | `^8.5.28` | `8.5.28` | up-to-date |  |
| `web-app/package.json` | `tailwindcss` | `^3.4.17` | `4.3.3` | MAJOR |  |
| `web-app/package.json` | `typescript` | `~5.7.2` | `7.0.2` | MAJOR |  |
| `web-app/package.json` | `typescript-eslint` | `^8.70.1` | `8.71.0` | minor |  |
| `web-app/package.json` | `vite` | `^6.2.0` | `8.3.2` | MAJOR |  |
| `loki-ts/tests/fixtures/monorepo-fc01/frontend/package.json` | `(none found)` | `` | `-` | n/a | test fixture; no dependencies or devDependencies declared |
| `loki-ts/tests/fixtures/project-model/firelater-17/frontend/package.json` | `(none found)` | `` | `-` | n/a | test fixture; no dependencies or devDependencies declared |
| `loki-ts/tests/fixtures/monorepo-fc22/package.json` | `(none found)` | `` | `-` | n/a | test fixture; no dependencies or devDependencies declared |
| `loki-ts/tests/fixtures/monorepo-fc22/frontend/package.json` | `(none found)` | `` | `-` | n/a | test fixture; no dependencies or devDependencies declared |

## Python (requirements*.txt)

| File | Name | Current | Latest stable | Bump | Note |
|---|---|---|---|---|---|
| `dashboard/requirements.txt` | `fastapi` | `>=0.100.0,<1.0.0` | `0.142.2` | 0.x breaking |  |
| `dashboard/requirements.txt` | `uvicorn` | `>=0.20.0,<1.0.0` | `0.54.0` | 0.x breaking |  |
| `dashboard/requirements.txt` | `sqlalchemy` | `>=2.1.1,<3.0.0` | `2.1.3` | patch |  |
| `dashboard/requirements.txt` | `aiosqlite` | `>=0.19.0,<1.0.0` | `0.22.1` | 0.x breaking |  |
| `dashboard/requirements.txt` | `greenlet` | `>=3.5.6,<4.0.0` | `3.5.6` | up-to-date |  |
| `dashboard/requirements.txt` | `pydantic` | `>=2.13.5,<3.0.0` | `2.13.5` | up-to-date |  |
| `dashboard/requirements.txt` | `websockets` | `>=12.0,<16.0` | `17.2` | MAJOR |  |
| `mcp/requirements.txt` | `mcp` | `>=1.0.0,<2.0.0` | `2.3.0` | MAJOR |  |
| `mcp/requirements.txt` | `chromadb` | `>=1.5.9,<2.0.0` | `1.5.9` | up-to-date |  |
| `mcp/requirements.txt` | `anthropic` | `>=0.40,<1.0.0` | `1.11.0` | MAJOR |  |
| `requirements-test.txt` | `pytest` | `(unpinned)` | `9.1.1` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
| `requirements-test.txt` | `pytest-asyncio` | `(unpinned)` | `1.4.0` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
| `requirements-test.txt` | `pytest-xdist` | `(unpinned)` | `3.8.0` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
| `requirements-test.txt` | `mcp` | `>=1.0.0,<2.0.0` | `2.3.0` | MAJOR |  |
| `requirements-test.txt` | `pydantic` | `(unpinned)` | `2.13.5` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
| `requirements-test.txt` | `fastapi` | `(unpinned)` | `0.142.2` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
| `requirements-test.txt` | `uvicorn` | `(unpinned)` | `0.54.0` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
| `requirements-test.txt` | `httpx` | `(unpinned)` | `0.28.1` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
| `requirements-test.txt` | `sqlalchemy` | `(unpinned)` | `2.1.3` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
| `requirements-test.txt` | `aiosqlite` | `(unpinned)` | `0.22.1` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
| `requirements-test.txt` | `cryptography` | `>=41.0.0` | `50.0.2` | MAJOR |  |
| `requirements-test.txt` | `pyyaml` | `(unpinned)` | `6.0.3` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |
| `tests/fixtures/legacy-checkout-app/requirements.txt` | `flask` | `==3.0.0` | `3.1.3` | minor | test fixture, not a real dependency |
| `tests/fixtures/legacy-checkout-app/requirements.txt` | `stripe` | `==7.0.0` | `16.0.0` | MAJOR | test fixture, not a real dependency |
| `web-app/requirements-test.txt` | `pytest` | `>=7.4.0` | `9.1.1` | MAJOR |  |
| `web-app/requirements-test.txt` | `pytest-asyncio` | `>=0.21.0` | `1.4.0` | MAJOR |  |
| `web-app/requirements-test.txt` | `httpx` | `>=0.24.0` | `0.28.1` | 0.x breaking |  |
| `web-app/requirements.txt` | `fastapi` | `>=0.100.0` | `0.142.2` | 0.x breaking |  |
| `web-app/requirements.txt` | `uvicorn` | `>=0.20.0` | `0.54.0` | 0.x breaking |  |
| `web-app/requirements.txt` | `pydantic` | `>=2.13.5` | `2.13.5` | up-to-date |  |
| `web-app/requirements.txt` | `httpx` | `>=0.24.0` | `0.28.1` | 0.x breaking |  |
| `web-app/requirements.txt` | `python-multipart` | `>=0.0.9` | `0.0.32` | 0.x breaking |  |
| `web-app/requirements.txt` | `pexpect` | `>=4.9.0` | `4.9.0` | up-to-date |  |
| `web-app/requirements.txt` | `watchdog` | `>=3.0.0` | `6.0.0` | MAJOR |  |
| `web-app/requirements.txt` | `sqlalchemy` | `>=2.1.1` | `2.1.3` | patch |  |
| `web-app/requirements.txt` | `asyncpg` | `>=0.28.0` | `0.31.0` | 0.x breaking |  |
| `web-app/requirements.txt` | `aiosqlite` | `>=0.19.0` | `0.22.1` | 0.x breaking |  |
| `web-app/requirements.txt` | `alembic` | `>=1.20.0` | `1.20.0` | up-to-date |  |
| `web-app/requirements.txt` | `python-jose` | `>=3.5.0` | `3.5.0` | up-to-date |  |
| `web-app/requirements.txt` | `passlib` | `>=1.7.4` | `1.7.4` | up-to-date |  |
| `web-app/requirements.txt` | `cryptography` | `>=41.0.0` | `50.0.2` | MAJOR |  |
| `web-app/requirements.txt` | `pyyaml` | `>=6.0.3` | `6.0.3` | up-to-date |  |

## Python (pyproject.toml)

| File | Name | Current | Latest stable | Bump | Note |
|---|---|---|---|---|---|
| `loki-ts/tests/engine10/fixtures/testmap/pyproject.toml` | `(none declared)` | `` | `-` | n/a | test fixture, not a real dependency |
| `loki-ts/tests/engine10/modernize/fixtures/inv/sample-repo/pyproject.toml` | `(none declared)` | `` | `-` | n/a | test fixture, not a real dependency |
| `sdk/python/pyproject.toml` | `httpx` | `>=0.24.0` | `0.28.1` | 0.x breaking |  |
| `sdk/python/pyproject.toml` | `pydantic` | `>=2.13.5` | `2.13.5` | up-to-date |  |
| `sdk/python/pyproject.toml` | `setuptools` | `>=68.0` | `84.0.0` | MAJOR |  |
| `sdk/python/pyproject.toml` | `wheel` | `(unpinned)` | `0.48.0` | unknown | no numeric version in spec (unpinned or a dist-tag like 'latest'); cannot compute a bump class |

## GitHub Actions (`uses:`)

| File | Name | Current | Latest stable | Bump | Note |
|---|---|---|---|---|---|
| `.github/workflows/bun-parity.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/bun-parity.yml` | `oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6` | `0c5077e51419868618aeaa5fe8019c62421857d6  # v2` | `v2.2.0` | minor | SHA-pinned |
| `.github/workflows/bun-parity.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/cla.yml` | `contributor-assistant/github-action@ca4a40a7d1004f18d9960b404b97e5f30a505a08` | `ca4a40a7d1004f18d9960b404b97e5f30a505a08  # v2.6.1` | `v2.6.1` | up-to-date | SHA-pinned; action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/claude-code-review.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/claude-code-review.yml` | `anthropics/claude-code-action@8ce9314fa9a404564fa7e954cd84f25bcba2b829` | `8ce9314fa9a404564fa7e954cd84f25bcba2b829  # v1` | `v1` | up-to-date | SHA-pinned |
| `.github/workflows/coverage.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/coverage.yml` | `oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6` | `0c5077e51419868618aeaa5fe8019c62421857d6  # v2` | `v2.2.0` | minor | SHA-pinned |
| `.github/workflows/coverage.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/coverage.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/docker-build-check.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/docker-build-check.yml` | `oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6` | `0c5077e51419868618aeaa5fe8019c62421857d6  # v2` | `v2.2.0` | minor | SHA-pinned |
| `.github/workflows/docker-build-check.yml` | `docker/setup-buildx-action@v3` | `v3 (resolves to v3.12.0)` | `v4.4.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v3 resolves to v3.12.0 (commit 8d2750c68a42), behind latest release v4.4.1 (commit f87e5991a6d7); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/docker-build-check.yml` | `docker/build-push-action@v5` | `v5 (resolves to v5.4.0)` | `v7.4.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.4.0 (commit ca052bb54ab0), behind latest release v7.4.0 (commit c3c9e263c25d); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/full-suite.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/full-suite.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/full-suite.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/full-suite.yml` | `oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6` | `0c5077e51419868618aeaa5fe8019c62421857d6  # v2` | `v2.2.0` | minor | SHA-pinned |
| `.github/workflows/full-suite.yml` | `actions/cache@v4` | `v4 (resolves to v4.3.0)` | `v6.1.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.3.0 (commit 0057852bfaa8), behind latest release v6.1.0 (commit 55cc8345863c); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/full-suite.yml` | `azure/setup-helm@v4` | `v4 (resolves to v4.3.1)` | `v5.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.3.1 (commit 1a275c3b6953), behind latest release v5.0.1 (commit 9bc31f4ebc9c); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/integrity-audit.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/integrity-audit.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/integrity-audit.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/integrity-audit.yml` | `azure/setup-helm@v4` | `v4 (resolves to v4.3.1)` | `v5.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.3.1 (commit 1a275c3b6953), behind latest release v5.0.1 (commit 9bc31f4ebc9c); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/model-catalog-probe.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/model-catalog-probe.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/nightly.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/nightly.yml` | `oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6` | `0c5077e51419868618aeaa5fe8019c62421857d6  # v2` | `v2.2.0` | minor | SHA-pinned |
| `.github/workflows/nightly.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/nightly.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/parity-drift.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/parity-drift.yml` | `oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6` | `0c5077e51419868618aeaa5fe8019c62421857d6  # v2` | `v2.2.0` | minor | SHA-pinned |
| `.github/workflows/parity-drift.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/parity-drift.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/post-release-smoke.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/post-release-smoke.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/post-release-smoke.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/release.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/release.yml` | `oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6` | `0c5077e51419868618aeaa5fe8019c62421857d6  # v2` | `v2.2.0` | minor | SHA-pinned |
| `.github/workflows/release.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/release.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/release.yml` | `docker/setup-buildx-action@v3` | `v3 (resolves to v3.12.0)` | `v4.4.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v3 resolves to v3.12.0 (commit 8d2750c68a42), behind latest release v4.4.1 (commit f87e5991a6d7); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/release.yml` | `docker/login-action@v3` | `v3 (resolves to v3.7.0)` | `v4.6.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v3 resolves to v3.7.0 (commit c94ce9fb4685), behind latest release v4.6.0 (commit dbcb813823bd); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/release.yml` | `docker/build-push-action@v5` | `v5 (resolves to v5.4.0)` | `v7.4.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.4.0 (commit ca052bb54ab0), behind latest release v7.4.0 (commit c3c9e263c25d); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/release.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/release.yml` | `actions/download-artifact@v4` | `v4 (resolves to v4.3.0)` | `v8.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.3.0 (commit d3f86a106a0b), behind latest release v8.0.1 (commit 3e5f45b2cfb9); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/release.yml` | `sigstore/cosign-installer@v3` | `v3 (resolves to v3.9.1)` | `v4.1.2` | MAJOR | tag-pinned (not SHA-pinned); floating tag v3 resolves to v3.9.1 (commit 398d4b0eeef1), behind latest release v4.1.2 (commit 6f9f17788090) |
| `.github/workflows/release.yml` | `anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610` | `e22c389904149dbc22b58101806040fa8d37a610  # v0` | `v0.24.3` | minor | SHA-pinned |
| `.github/workflows/release.yml` | `peter-evans/dockerhub-description@v4` | `v4 (resolves to v4.0.2)` | `v5.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.0.2 (commit 432a30c9e074), behind latest release v5.0.0 (commit 1b9a80c056b6); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/sdk-freshness.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/sbom.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/sbom.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/sbom.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/security-audit.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/security-audit.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/security-audit.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/security-audit.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/security-audit.yml` | `actions/checkout@11d5960a326750d5838078e36cf38b85af677262` | `11d5960a326750d5838078e36cf38b85af677262  # v4` | `v7.0.1` | MAJOR | SHA-pinned; action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/security-audit.yml` | `actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02` | `ea165f8d65b6e75b540449e92b4886f43607fa02  # v4` | `v7.0.1` | MAJOR | SHA-pinned; action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/security-audit.yml` | `github/codeql-action/init@f3712979fa5f215279b101dd0a2e3bdfb4353324` | `f3712979fa5f215279b101dd0a2e3bdfb4353324` | `codeql-bundle-v2.27.1` | unknown | SHA-pinned, no version comment; latest release is codeql-bundle-v2.27.1; action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/security-audit.yml` | `github/codeql-action/analyze@f3712979fa5f215279b101dd0a2e3bdfb4353324` | `f3712979fa5f215279b101dd0a2e3bdfb4353324` | `codeql-bundle-v2.27.1` | unknown | SHA-pinned, no version comment; latest release is codeql-bundle-v2.27.1; action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/security-audit.yml` | `oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6` | `0c5077e51419868618aeaa5fe8019c62421857d6  # v2` | `v2.2.0` | minor | SHA-pinned |
| `.github/workflows/sentrux-real.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/sentrux-real.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/sentrux-real.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/soak-monitor.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/soak-monitor.yml` | `actions/upload-artifact@v4` | `v4 (resolves to v4.6.2)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.6.2 (commit ea165f8d65b6), behind latest release v7.0.1 (commit 043fb46d1a93); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/test.yml` | `actions/checkout@v4` | `v4 (resolves to v4.4.0)` | `v7.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 11d5960a3267), behind latest release v7.0.1 (commit 3d3c42e5aac5); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/test.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/test.yml` | `actions/setup-python@v5` | `v5 (resolves to v5.6.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v5 resolves to v5.6.0 (commit a26af69be951), behind latest release v7.0.0 (commit 5fda3b95a4ea); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/test.yml` | `oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6` | `0c5077e51419868618aeaa5fe8019c62421857d6  # v2` | `v2.2.0` | minor | SHA-pinned |
| `.github/workflows/test.yml` | `actions/cache@v4` | `v4 (resolves to v4.3.0)` | `v6.1.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.3.0 (commit 0057852bfaa8), behind latest release v6.1.0 (commit 55cc8345863c); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/workflows/test.yml` | `azure/setup-helm@v4` | `v4 (resolves to v4.3.1)` | `v5.0.1` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.3.1 (commit 1a275c3b6953), behind latest release v5.0.1 (commit 9bc31f4ebc9c); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `action.yml` | `actions/setup-node@v4` | `v4 (resolves to v4.4.0)` | `v7.0.0` | MAJOR | tag-pinned (not SHA-pinned); floating tag v4 resolves to v4.4.0 (commit 49933ea5288c), behind latest release v7.0.0 (commit 820762786026); action.yml declares `using: node20` -- this action IS the deprecated Node 20 runtime |
| `.github/actions/issue-to-pr/action.yml` | `(none found)` | `` | `-` | n/a | no `uses:` step found in this workflow/action file |
| `.github/actions/receipt-check/action.yml` | `(none found)` | `` | `-` | n/a | no `uses:` step found in this workflow/action file |
| `.github/actions/review/action.yml` | `(none found)` | `` | `-` | n/a | no `uses:` step found in this workflow/action file |

**Node 20 runtime deprecation:** GitHub's own Node 20 deprecation covers two distinct things and they must not be conflated. First, matrix jobs still targeting `node-version: 20` (files: .github/workflows/test.yml). Second, and separately: an action whose OWN `action.yml` declares `using: node20` IS the deprecated runtime itself, regardless of what version tag or SHA it is pinned to -- pinning to the latest release of such an action does not fix this until that action's maintainers migrate its action.yml to node22 or later. Every `uses:` target in this repo's workflows was checked at its pinned ref via the GitHub Contents API; action.yml itself declares node20 for: actions/cache, actions/checkout, actions/download-artifact, actions/setup-node, actions/setup-python, actions/upload-artifact, azure/setup-helm, contributor-assistant/github-action, docker/build-push-action, docker/login-action, docker/setup-buildx-action, github/codeql-action/analyze, github/codeql-action/init, peter-evans/dockerhub-description.

## Runtime matrices

Node.js current stable: 26.10.0 (cycle 26); Python current stable: 3.14.8 (cycle 3.14); Bun current stable: bun-v1.4.2.

(The File column lists every workflow file pinning that version.)

| File | Name | Current | Latest stable | Bump | Note |
|---|---|---|---|---|---|
| `.github/workflows/test.yml` | `Node.js` | `20` | `20.20.2 (newest line 26.10.0)` | EOL | EOL 2026-04-30 (past); EOL in current line; newest line is 26.10.0 |
| `.github/workflows/integrity-audit.yml, .github/workflows/nightly.yml, .github/workflows/sentrux-real.yml, .github/workflows/test.yml, .github/workflows/tier-a.yml` | `Node.js` | `22` | `22.23.3 (newest line 26.10.0)` | MAJOR | EOL 2027-04-30 (not yet); minor in line; MAJOR to newest line |
| `.github/workflows/test.yml` | `Node.js` | `24` | `24.21.0 (newest line 26.10.0)` | MAJOR | EOL 2028-04-30 (not yet); minor in line; MAJOR to newest line |
| `.github/workflows/test.yml` | `Python` | `3.10` | `3.10.22 (newest line 3.14.8)` | EOL | EOL 2026-10-01 (past); EOL in current line; newest line is 3.14.8 |
| `.github/workflows/test.yml` | `Python` | `3.11` | `3.11.17 (newest line 3.14.8)` | minor | EOL 2027-10-31 (not yet); patch in line; minor to newest line |
| `.github/workflows/bun-parity.yml, .github/workflows/coverage.yml, .github/workflows/model-catalog-probe.yml, .github/workflows/nightly.yml, .github/workflows/parity-drift.yml, +3 more` | `Python` | `3.12` | `3.12.15 (newest line 3.14.8)` | minor | EOL 2028-10-31 (not yet); patch in line; minor to newest line |
| `.github/workflows/test.yml` | `Python` | `3.13` | `3.13.16 (newest line 3.14.8)` | minor | EOL 2029-10-31 (not yet); patch in line; minor to newest line |
| `.github/workflows/bun-parity.yml, .github/workflows/coverage.yml, .github/workflows/first-run-gate.yml, .github/workflows/nightly.yml, .github/workflows/parity-drift.yml, +4 more` | `Bun` | `1.3.13` | `bun-v1.4.2` | minor |  |
| `.github/workflows/nightly.yml, .github/workflows/test.yml` | `Bun` | `latest` | `-` | unknown | not a numeric version, skipped |

## Docker / Compose images

| File | Name | Current | Latest stable | Bump | Note |
|---|---|---|---|---|---|
| `docker/Dockerfile` | `oven/bun:${BUN_VERSION}` | `oven/bun:${BUN_VERSION}` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
| `docker/Dockerfile` | `ubuntu:24.04` | `ubuntu:24.04` | `24.04.5 (newest line 26.04.1)` | MAJOR | EOL 2029-05-31 (not yet); patch in line; MAJOR to newest line |
| `docker/Dockerfile.control-plane` | `oven/bun:${BUN_VERSION}` | `oven/bun:${BUN_VERSION}` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
| `docker/Dockerfile.control-plane` | `oven/bun:${BUN_VERSION}-slim` | `oven/bun:${BUN_VERSION}-slim` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
| `docker/Dockerfile.sandbox` | `debian:bookworm-slim` | `debian:bookworm-slim` | `12.15 (newest line 13.7)` | MAJOR | EOL 2028-06-30 (not yet); minor in line; MAJOR to newest line |
| `docker/Dockerfile.sandbox` | `debian:bookworm-slim` | `debian:bookworm-slim` | `12.15 (newest line 13.7)` | MAJOR | EOL 2028-06-30 (not yet); minor in line; MAJOR to newest line |
| `artifacts/observability/Dockerfile` | `nginx:1.27-alpine` | `nginx:1.27-alpine` | `1.27.5 (newest line 1.31.6)` | EOL | EOL 2025-06-24 (past); EOL in current line; newest line is 1.31.6 |
| `dashboard/Dockerfile` | `python:3.11-slim-bookworm` | `python:3.11-slim-bookworm` | `3.11.17 (newest line 3.14.8)` | minor | EOL 2027-10-31 (not yet); patch in line; minor to newest line |
| `web-app/Dockerfile` | `node:22-alpine` | `node:22-alpine` | `22.23.3 (newest line 26.10.0)` | MAJOR | EOL 2027-04-30 (not yet); minor in line; MAJOR to newest line |
| `web-app/Dockerfile` | `python:3.12-slim` | `python:3.12-slim` | `3.12.15 (newest line 3.14.8)` | minor | EOL 2028-10-31 (not yet); patch in line; minor to newest line |
| `dashboard/docker-compose.yml` | `loki-dashboard:latest` | `loki-dashboard:latest` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
| `deploy/docker-compose/docker-compose.yml` | `asklokesh/loki-mode:latest` | `asklokesh/loki-mode:latest` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
| `deploy/docker-compose/docker-compose.yml` | `otel/opentelemetry-collector-contrib:0.96.0` | `otel/opentelemetry-collector-contrib:0.96.0` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
| `deploy/docker-compose/docker-compose.yml` | `jaegertracing/all-in-one:1.54` | `jaegertracing/all-in-one:1.54` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
| `docker/docker-compose.yml` | `loki-mode:latest` | `loki-mode:latest` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
| `docker/docker-compose.yml` | `chromadb/chroma:latest` | `chromadb/chroma:latest` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
| `docker/docker-compose.yml` | `loki-mode:latest` | `loki-mode:latest` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
| `docker/docker-compose.yml` | `loki-mode:latest` | `loki-mode:latest` | `-` | unknown | floating tag or no endoflife.date product mapped for this image (own product image, or an unmapped base) |
| `docker/docker-compose.yml` | `redis:7-alpine` | `redis:7-alpine` | `7.4.11 (newest line 8.10.2)` | MAJOR | EOL 2029-12-01 (not yet); resolved floating tag '7' to cycle 7.4; minor in line; MAJOR to newest line |
| `web-app/docker-compose.purple-lab.yml` | `postgres:16-alpine` | `postgres:16-alpine` | `16.15 (newest line 18.6)` | MAJOR | EOL 2028-11-09 (not yet); minor in line; MAJOR to newest line |
| `web-app/docker-compose.purple-lab.yml` | `redis:7-alpine` | `redis:7-alpine` | `7.4.11 (newest line 8.10.2)` | MAJOR | EOL 2029-12-01 (not yet); resolved floating tag '7' to cycle 7.4; minor in line; MAJOR to newest line |

## Helm (every `Chart.yaml` found via `git ls-files`, any directory)

| File | Name | Current | Latest stable | Bump | Note |
|---|---|---|---|---|---|
| `deploy/helm/autonomi/Chart.yaml` | `appVersion` | `7.93.0` | `10.9.1` | drifted | DRIFTED: chart appVersion does not track the product VERSION file (10.9.1) |
| `deploy/helm/autonomi/Chart.yaml` | `chart dependencies` | `(none declared)` | `-` | n/a |  |
| `deploy/helm/autonomi/templates/tests/test-controlplane-health.yaml` | `curlimages/curl:8.11.1` | `curlimages/curl:8.11.1` | `-` | unknown | floating/arbitrary registry tag, see Docker section for endoflife-mapped images |
| `deploy/helm/autonomi/tests/test-connection.yaml` | `curlimages/curl:8.5.0` | `curlimages/curl:8.5.0` | `-` | unknown | floating/arbitrary registry tag, see Docker section for endoflife-mapped images |
| `deploy/helm/autonomi/tests/test-health.yaml` | `curlimages/curl:8.5.0` | `curlimages/curl:8.5.0` | `-` | unknown | floating/arbitrary registry tag, see Docker section for endoflife-mapped images |
| `deploy/helm/autonomi/values.yaml` | `alpine/git:latest` | `alpine/git:latest` | `-` | unknown | floating/arbitrary registry tag, see Docker section for endoflife-mapped images |
| `deploy/helm/autonomi/values.yaml` | `image.repository` | `asklokesh/loki-mode:(defaults to appVersion)` | `-` | n/a | own product image, tracked via VERSION not a third-party dep |
| `deploy/helm/control-plane/Chart.yaml` | `appVersion` | `10.6.7` | `10.9.1` | drifted | DRIFTED: chart appVersion does not track the product VERSION file (10.9.1) |
| `deploy/helm/control-plane/Chart.yaml` | `chart dependencies` | `(none declared)` | `-` | n/a |  |
| `deploy/helm/control-plane/values.yaml` | `image.repository` | `asklokesh/loki-control-plane:(defaults to appVersion)` | `-` | n/a | own product image, tracked via VERSION not a third-party dep |
| `helm/loki-mode/Chart.yaml` | `appVersion` | `9.19.1` | `10.9.1` | drifted | DRIFTED: chart appVersion does not track the product VERSION file (10.9.1) |
| `helm/loki-mode/Chart.yaml` | `chart dependencies` | `(none declared)` | `-` | n/a |  |
| `helm/loki-mode/values.yaml` | `redis:7-alpine` | `redis:7-alpine` | `-` | unknown | floating/arbitrary registry tag, see Docker section for endoflife-mapped images |
| `helm/loki-mode/values.yaml` | `image.repository` | `asklokesh/loki-mode:(defaults to appVersion)` | `-` | n/a | own product image, tracked via VERSION not a third-party dep |
| `deploy/helm/control-plane/templates/deployment.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
| `deploy/helm/control-plane/templates/ingress.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
| `deploy/helm/control-plane/templates/pvc.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
| `deploy/helm/control-plane/templates/service.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
| `deploy/helm/autonomi/templates/configmap.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
| `deploy/helm/autonomi/templates/control-token-secret.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
| `deploy/helm/autonomi/templates/deployment-controlplane.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
| `deploy/helm/autonomi/templates/deployment-worker.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
| `deploy/helm/autonomi/templates/hpa-worker.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
| `deploy/helm/autonomi/templates/ingress.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
| `deploy/helm/autonomi/templates/job-worker.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
| `deploy/helm/autonomi/templates/keda-scaledjob.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
| `deploy/helm/autonomi/templates/keda-scaledobject.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
| `deploy/helm/autonomi/templates/namespace.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
| `deploy/helm/autonomi/templates/networkpolicy.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
| `deploy/helm/autonomi/templates/pdb.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
| `deploy/helm/autonomi/templates/pvc-audit.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
| `deploy/helm/autonomi/templates/pvc-checkpoints.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
| `deploy/helm/autonomi/templates/pvc-control-db.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
| `deploy/helm/autonomi/templates/rbac.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
| `deploy/helm/autonomi/templates/secret.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
| `deploy/helm/autonomi/templates/service-controlplane.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
| `deploy/helm/autonomi/templates/service-worker.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
| `deploy/helm/autonomi/templates/serviceaccount.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
| `deploy/helm/autonomi/templates/servicemonitor.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
| `deploy/helm/autonomi/values-ha.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
| `deploy/helm/autonomi/values-production.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
| `helm/loki-mode/templates/networkpolicy.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
| `helm/loki-mode/templates/receiver-configmap.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
| `helm/loki-mode/templates/receiver-deployment.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
| `helm/loki-mode/templates/receiver-service.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
| `helm/loki-mode/templates/redis.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
| `helm/loki-mode/templates/secret.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
| `helm/loki-mode/templates/serviceaccount.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
| `helm/loki-mode/templates/tests/test-receiver-health.yaml` | `(none found)` | `` | `-` | n/a | test fixture; no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
| `helm/loki-mode/templates/worker-deployment.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |
| `helm/loki-mode/templates/worker-hpa.yaml` | `(none found)` | `` | `-` | n/a | no image reference or chart metadata found (a template, RBAC, or other non-image manifest) |

## Terraform providers

| File | Name | Current | Latest stable | Bump | Note |
|---|---|---|---|---|---|
| `deploy/terraform/modules/aws-ecs/versions.tf` | `aws (hashicorp/aws)` | `>= 5.0` | `6.67.0` | MAJOR |  |
| `deploy/terraform/modules/aws/versions.tf` | `aws (hashicorp/aws)` | `>= 5.0` | `6.67.0` | MAJOR |  |
| `deploy/terraform/modules/azure/versions.tf` | `azurerm (hashicorp/azurerm)` | `>= 3.0` | `5.8.0` | MAJOR |  |
| `deploy/terraform/modules/gcp/versions.tf` | `google (hashicorp/google)` | `>= 5.0` | `8.5.0` | MAJOR |  |
| `deploy/terraform/examples/aws-eks/main.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
| `deploy/terraform/examples/azure-aks/main.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
| `deploy/terraform/examples/gcp-gke/main.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
| `deploy/terraform/modules/aws-ecs/main.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
| `deploy/terraform/modules/aws-ecs/outputs.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
| `deploy/terraform/modules/aws-ecs/variables.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
| `deploy/terraform/modules/aws/main.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
| `deploy/terraform/modules/aws/outputs.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
| `deploy/terraform/modules/aws/variables.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
| `deploy/terraform/modules/azure/main.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
| `deploy/terraform/modules/azure/outputs.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
| `deploy/terraform/modules/azure/variables.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
| `deploy/terraform/modules/gcp/main.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
| `deploy/terraform/modules/gcp/outputs.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |
| `deploy/terraform/modules/gcp/variables.tf` | `(none found)` | `` | `-` | n/a | no `required_providers` block in this file (module wiring, not a version pin) |

## Homebrew

Formula lives in a separate repo: `asklokesh/homebrew-tap`, `Formula/loki-mode.rb` (updated by `.github/workflows/release.yml` job `update-homebrew` via the GitHub Contents API on every release).

| File | Name | Current | Latest stable | Bump | Note |
|---|---|---|---|---|---|
| `asklokesh/homebrew-tap:Formula/loki-mode.rb` | `loki-mode` | `10.7.1` | `10.7.1` | up-to-date | repo VERSION file is 10.9.1 |

## Summary

Counts are all from the single `Bump` column (current line vs newest line in the product; see the Latest column for the current-line patch when it differs from the newest line). `0.x breaking` and `drifted` are their own columns, not folded into MAJOR, since they are not the same computation.

| Ecosystem | patch | minor | 0.x breaking | MAJOR | EOL | drifted | unknown | up-to-date | other |
|---|---|---|---|---|---|---|---|---|---|
| npm/bun | 2 | 5 | 3 | 27 | 0 | 0 | 1 | 24 | 0 |
| Python (requirements) | 2 | 0 | 10 | 9 | 0 | 0 | 10 | 9 | 0 |
| Python (pyproject) | 0 | 0 | 1 | 1 | 0 | 0 | 1 | 1 | 0 |
| GitHub Actions | 0 | 11 | 0 | 59 | 0 | 0 | 2 | 2 | 2 |
| Runtimes | 0 | 4 | 0 | 2 | 2 | 0 | 1 | 0 | 0 |
| Docker/Compose | 0 | 2 | 0 | 7 | 1 | 0 | 11 | 0 | 0 |
| Helm | 0 | 0 | 0 | 0 | 0 | 3 | 5 | 0 | 42 |
| Terraform | 0 | 0 | 0 | 4 | 0 | 0 | 0 | 0 | 15 |
| Homebrew | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 1 | 0 |

## Proposed slice list (D35)

- **LOW - npm/bun patch+minor batch** (one slice for the whole ecosystem, touching every file below; lockfiles regenerated and committed):
  - `packages/control-plane/package.json`: @playwright/test 1.58.1->1.63.0
  - `packages/control-plane/ui/package.json`: @testing-library/react ^16.3.0->16.3.3, @types/react ^19.0.0->19.3.0, @types/react-dom ^19.0.0->19.3.0
  - `vscode-extension/package.json`: @types/vscode ^1.85.0->1.140.0
  - `web-app/package.json`: react-resizable-panels ^4.14.1->4.14.2, typescript-eslint ^8.70.1->8.71.0
- **LOW - Python patch+minor batch** (one slice for the whole ecosystem, touching every file below; lockfiles regenerated and committed):
  - `dashboard/requirements.txt`: sqlalchemy >=2.1.1,<3.0.0->2.1.3
  - `web-app/requirements.txt`: sqlalchemy >=2.1.1->2.1.3
- **MEDIUM - one slice per MAJOR (or 0.x-breaking) package**, deduped across manifests:
  - `@eslint/js` -> `10.0.1` (MAJOR): web-app/package.json
  - `@happy-dom/global-registrator` -> `20.14.5` (MAJOR): packages/control-plane/ui/package.json
  - `@types/node` -> `26.6.4` (MAJOR): package.json, vscode-extension/package.json
  - `@typescript-eslint/eslint-plugin` -> `8.71.0` (MAJOR): vscode-extension/package.json
  - `@typescript-eslint/parser` -> `8.71.0` (MAJOR): vscode-extension/package.json
  - `@vitejs/plugin-react` -> `6.1.1` (MAJOR): packages/control-plane/ui/package.json, web-app/package.json
  - `@vscode/vsce` -> `4.0.0` (MAJOR): vscode-extension/package.json
  - `aiosqlite` -> `0.22.1` (0.x breaking): dashboard/requirements.txt, web-app/requirements.txt
  - `anthropic` -> `1.11.0` (MAJOR): mcp/requirements.txt
  - `asyncpg` -> `0.31.0` (0.x breaking): web-app/requirements.txt
  - `cryptography` -> `50.0.2` (MAJOR): requirements-test.txt, web-app/requirements.txt
  - `esbuild` -> `0.28.2` (0.x breaking): vscode-extension/package.json
  - `eslint` -> `10.12.0` (MAJOR): vscode-extension/package.json, web-app/package.json
  - `eslint-plugin-react-hooks` -> `7.1.1` (MAJOR): web-app/package.json
  - `eslint-plugin-react-refresh` -> `0.5.7` (0.x breaking): web-app/package.json
  - `fastapi` -> `0.142.2` (0.x breaking): dashboard/requirements.txt, web-app/requirements.txt
  - `globals` -> `17.13.0` (MAJOR): web-app/package.json
  - `httpx` -> `0.28.1` (0.x breaking): sdk/python/pyproject.toml, web-app/requirements-test.txt, web-app/requirements.txt
  - `jest` -> `30.5.2` (MAJOR): package.json
  - `jsdom` -> `30.1.1` (MAJOR): package.json
  - `lucide-react` -> `1.51.0` (MAJOR): packages/control-plane/ui/package.json, web-app/package.json
  - `mcp` -> `2.3.0` (MAJOR): mcp/requirements.txt, requirements-test.txt
  - `pytest` -> `9.1.1` (MAJOR): web-app/requirements-test.txt
  - `pytest-asyncio` -> `1.4.0` (MAJOR): web-app/requirements-test.txt
  - `python-multipart` -> `0.0.32` (0.x breaking): web-app/requirements.txt
  - `setuptools` -> `84.0.0` (MAJOR): sdk/python/pyproject.toml
  - `tailwindcss` -> `4.3.3` (MAJOR): packages/control-plane/ui/package.json, web-app/package.json
  - `typescript` -> `7.0.2` (MAJOR): loki-ts/package.json, package.json, packages/control-plane/ui/package.json, sdk/typescript/package.json, vscode-extension/package.json, +1 more
  - `uvicorn` -> `0.54.0` (0.x breaking): dashboard/requirements.txt, web-app/requirements.txt
  - `vite` -> `8.3.2` (MAJOR): packages/control-plane/ui/package.json, web-app/package.json
  - `watchdog` -> `6.0.0` (MAJOR): web-app/requirements.txt
  - `websockets` -> `17.2` (MAJOR): dashboard/requirements.txt
- **MEDIUM - one slice per Actions MAJOR**, deduped by action across workflows (bump to latest major AND SHA-pin with a `# vN` comment in the same slice, per D35):
  - `actions/cache` v4 (resolves to v4.3.0) -> `v6.1.0`: .github/workflows/test.yml
  - `actions/checkout` 11d5960a326750d5838078e36cf38b85af677262, v4 (resolves to v4.4.0) -> `v7.0.1`: .github/workflows/bun-parity.yml, .github/workflows/claude-code-review.yml, .github/workflows/coverage.yml, .github/workflows/first-run-gate.yml, .github/workflows/integrity-audit.yml, +12 more
  - `actions/download-artifact` v4 (resolves to v4.3.0) -> `v8.0.1`: .github/workflows/release.yml
  - `actions/setup-node` v4 (resolves to v4.4.0) -> `v7.0.0`: .github/workflows/integrity-audit.yml, .github/workflows/nightly.yml, .github/workflows/post-release-smoke.yml, .github/workflows/release.yml, +6 more
  - `actions/setup-python` v5 (resolves to v5.6.0) -> `v7.0.0`: .github/workflows/bun-parity.yml, .github/workflows/coverage.yml, .github/workflows/integrity-audit.yml, .github/workflows/model-catalog-probe.yml, .github/workflows/nightly.yml, +6 more
  - `actions/upload-artifact` ea165f8d65b6e75b540449e92b4886f43607fa02, v4 (resolves to v4.6.2) -> `v7.0.1`: .github/workflows/coverage.yml, .github/workflows/first-run-gate.yml, .github/workflows/parity-drift.yml, .github/workflows/release.yml, .github/workflows/sbom.yml, +3 more
  - `azure/setup-helm` v4 (resolves to v4.3.1) -> `v5.0.1`: .github/workflows/integrity-audit.yml, .github/workflows/test.yml
  - `docker/build-push-action` v5 (resolves to v5.4.0) -> `v7.4.0`: .github/workflows/release.yml
  - `docker/login-action` v3 (resolves to v3.7.0) -> `v4.6.0`: .github/workflows/release.yml
  - `docker/setup-buildx-action` v3 (resolves to v3.12.0) -> `v4.4.1`: .github/workflows/release.yml
  - `peter-evans/dockerhub-description` v4 (resolves to v4.0.2) -> `v5.0.0`: .github/workflows/release.yml
  - `sigstore/cosign-installer` v3 (resolves to v3.9.1) -> `v4.1.2`: .github/workflows/release.yml
- **MEDIUM - one slice per Terraform provider MAJOR**:
  - `deploy/terraform/modules/aws-ecs/versions.tf`: `aws (hashicorp/aws)` >= 5.0 -> 6.67.0
  - `deploy/terraform/modules/aws/versions.tf`: `aws (hashicorp/aws)` >= 5.0 -> 6.67.0
  - `deploy/terraform/modules/azure/versions.tf`: `azurerm (hashicorp/azurerm)` >= 3.0 -> 5.8.0
  - `deploy/terraform/modules/gcp/versions.tf`: `google (hashicorp/google)` >= 5.0 -> 8.5.0
- **MEDIUM - runtime matrix refresh**:
  - `Node.js` 20 is EOL (EOL 2026-04-30 (past); EOL in current line; newest line is 26.10.0), pinned by: .github/workflows/test.yml
  - `Python` 3.10 is EOL (EOL 2026-10-01 (past); EOL in current line; newest line is 3.14.8), pinned by: .github/workflows/test.yml
  - Node 20 is named in the upstream Actions runtime deprecation warnings even where not yet past its endoflife.date EOL; pinned by: .github/workflows/test.yml
- **MEDIUM - SDKs with the 5-task eval**: `@anthropic-ai/claude-agent-sdk` 0.3.288 -> 0.3.288 (up-to-date, `loki-ts/package.json`); `@anthropic-ai/sdk` ^0.124.0 -> 0.131.0 (0.x breaking, `loki-ts/package.json`). Gated on the 5-task eval per D35, not the plain patch/minor batch.
- **LOW - Docker/Helm digest pass**: pin every `FROM` / `image:` tag by digest instead of a mutable tag (own-product images and `:latest` floating tags are out of scope for a version bump and tracked via VERSION instead).
  - EOL now: `nginx:1.27-alpine` in `artifacts/observability/Dockerfile` (EOL 2025-06-24 (past); EOL in current line; newest line is 1.31.6)
- **FINDING - Helm chart appVersion has drifted from the product VERSION**:
  - `deploy/helm/autonomi/Chart.yaml`: appVersion `7.93.0` vs VERSION `10.9.1`
  - `deploy/helm/control-plane/Chart.yaml`: appVersion `10.6.7` vs VERSION `10.9.1`
  - `helm/loki-mode/Chart.yaml`: appVersion `9.19.1` vs VERSION `10.9.1`