From ad094b389796a0f75116393e1c5233ec4e491214 Mon Sep 17 00:00:00 2001 From: Lilleman auf Larv Date: Sun, 6 Sep 2026 17:26:44 +0200 Subject: [PATCH] Record the two version-gate asks left open on the rewrite PR --- todo.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/todo.md b/todo.md index 99eef99..e616082 100644 --- a/todo.md +++ b/todo.md @@ -132,6 +132,21 @@ session message is a change to every call site. ## Worth doing, not blocking +- [ ] **A gate that refuses a floating version anywhere in the repo.** Maintainer's ask on + [#71](https://github.com/larvit/larvitsmpp/pull/71), 2026-09-06, on the `release.yaml` + pinning thread, which stays open until this lands. Pinning every action and runner by hand is + what the ask followed; the gate is what keeps them pinned. It has to cover workflow `uses:` + and `runs-on:`, compose `image:`, and Dockerfile `FROM`, and the conventions differ per kind — + actions take a semver tag, images the full patch version — so one grep for `latest` is not it. + +- [ ] **A gate that fails when the test matrix misses the current Node.** Maintainer's ask on + [#71](https://github.com/larvit/larvitsmpp/pull/71), 2026-09-06, on the Node 26 thread, which + stays open until this lands. Node 26 was added by hand; nothing notices when 27 ships. Needs a + source for what Current is — the Node release schedule is published as JSON — and a decision + on whether a new Current fails the build or opens a PR, which is what Renovate already does + for everything else here. + + - [ ] **Group the session's collaborators under `src/session/`.** `session.ts` imports `dlr-merger`, `incoming-requests`, `link-timers`, `outgoing-requests`, `pdu-transport`, `reconnect-loop` and `send-sms`, and nothing else does, so the directory would make that