golang.org/x/net deprecated http2.Server, staticcheck failed on
hscontrol/noise.go, and the whole batch of 50 direct requirements was
dropped for it. The bisect tries every atom together first, so one atom
per module costs nothing until something actually breaks.
nixpkgs decides which prettier and gofumpt format the tree. A lock bump to
prettier 3.9.6 reformatted CHANGELOG.md, which no area had touched, and the
formatting check failed on a file the bot never edited.
go env GOVERSION reports the toolchain the go command switched to, so a
go.mod that had outrun nixpkgs read back as a nixpkgs that had caught
up, and checkToolchain compared 1.27.1 against itself.
tailscale.com@main raised the go directive to 1.27.1 while nixpkgs was
still on 1.27.0. go build downloads the newer toolchain and looks fine;
the nix builders set GOTOOLCHAIN=local and fail, so the whole bump was
being thrown away one area at a time.
The oapi-codegen pin stays the single source of truth: the generate area
reads it back out of the Makefile, so the clients are regenerated with
whatever this lands on.
Debian is resolved from the numeric tags, which exist only for released
versions: forky-slim is published today and is testing. Distroless
follows that same release rather than its own repository names, since
gcr answers for base-debian99 as readily as for base-debian13.
Keeps the interlocked pins current and reports what it could not move.
Areas apply, gate and commit one at a time, so a dependency that breaks
the build costs one commit rather than the whole pull request.
Kristoffer Dalby