This release fixes issues for SREs watching stability and regressions.
✓ No known CVEs patched in this version
Topics
+1 more
Affected surfaces
Summary
AI summaryFixed ExVer range operations to correctly compare downstream revisions, correcting manifest migration ranges.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Bugfix | Medium |
ExVer range operations no longer ignore the downstream revision. ExVer range operations no longer ignore the downstream revision. Source: llm_adapter@2026-07-14 Confidence: high |
— |
Full changelog
What's Changed
Fixed
-
ExVer range operations no longer ignore the downstream revision.
compareVersionRangePointsandadjacentVersionRangePointscompared the upstream version twice instead of comparing the downstream on the second pass, so two points that shared an upstream but differed in downstream (1.0.0:3vs1.0.0:15) collapsed into a single point. Everything built on the truth tables inherited the error —normalize()silently dropped the lower of the two, andintersects()/satisfiable()could answer on a merged point.=1.0.0:0 || =1.0.0:1normalized to=1.0.0:1.The visible consequence was in packed manifests:
canMigrateFrom/canMigrateToare derived from the version graph and normalized, so any package declaring anotherversion sharingcurrent's upstream advertised a range narrower than the truth (mempoolat3.3.1:15withother: [3.3.1:3]shippedcanMigrateFrom: <=3.3.1:3rather than<=3.3.1:15). No upgrade actually broke — StartOS resolves migrations through the version graph rather than gating on this field, and the registry index does not yet populatesourceVersionfrom it — but the manifests were wrong and would have become load-bearing the moment either changed. The Rust implementation derives its point ordering and was never affected.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About StartOS
Browser-based, graphical Operating System (OS) that makes running a personal server as easy as running a personal computer.
Related context
Related tools
Earlier breaking changes
- vstart-sdk/v2.0.4 'setupMain' callback now accepts any DaemonBuildable rather than requiring a Daemons.
- vstart-sdk/v2.0.4 `Daemons.dynamic` now takes `effects` and returns a `DaemonReconciler` instead of replacing `main`.
- v0.4.0-beta.9 Previous backups incompatible with v0.4.0; create fresh backup after updating.
Beta — feedback welcome: [email protected]