[3alpha]

Deprecates github-action bump-upstream and makes its file edits match DAppNode's org bump engine (bump-runner update in docker.io/dappnode/tropibot), so packages get the same result from either until they migrate to the shared workflow.

Deprecation

• The command prints a deprecation notice and a ::warning annotation that point to dappnode/workflows/.github/workflows/bump-upstream.yml@master for DAppNode org packages, and to dappnode/workflows/actions/bump-upstream@master for others.
• The README section is marked deprecated and gives a drop-in replacement for auto_check.yml.
• The command keeps its PR lifecycle, APM package version and build until it is removed.

Engine parity (src/bump/)

• Upstream metadata: reads the optional upstream[].provider (docker by default, github or docker_tags) and tagPattern added to the manifest schema in feat(schemas): add upstream bump metadata (provider, tagPattern) DNP_DAPPMANAGER#2504. Legacy manifests use upstreamProvider.
• Latest release: uses GitHub's Latest release if it qualifies, otherwise the first qualifying release in releases?per_page=30.
  • A release qualifies when it isn't a draft or flagged as a prerelease, has no nightly, and matches tagPattern.
  • It also must not be a semver pre-release whose pre part starts with alpha, beta, rc, pre, preview, dev, canary, nightly, snapshot or unstable. Other suffixes are stable: gnosischain/go-ethereum's v1.17.10-gc is a stable release.
• Docker tags: docker maps the release tag to the form the FROM image tag uses, checking the registry. docker_tags takes the highest stable image tag.
• No downgrades: a resolved version that is older than the current one is never applied.
• Digest pins: kept and refreshed from the registry; SPEC-M05 now accepts lowercase digests only.
• Format-preserving edits: Compose and manifest edits keep comments, quoting and key order. A reparse check rejects any change other than the intended values.
• Variants: package_variants/ is detected automatically, so --use_variants is accepted but ignored. --upstream_version requests an explicit tag for a single upstream.
• PR body: shows the Compose value and carries the explorer-dashboard bump marker, so bump PRs from both engines are classified the same way.

Spec

New warning rule SPEC-M12: Upstream bump metadata is valid. It reports an unknown provider, and a tagPattern that doesn't compile or uses constructs outside the common JavaScript/Rust regex subset (lookaround, backreferences).

Behaviour changes

• Some releases are now treated as stable that the previous rule rejected, for example -gc and other suffixes that aren't pre-release words.
• Some releases are now skipped when GitHub's Latest release qualifies, if they appear above it in the release list.
• A failed APM lookup for the next package version now stops the bump instead of leaving the version unchanged.

Testing

• yarn build, yarn lint and yarn test pass (219 passing).
• The SDK's latest-release lookup was run against real upstreams. It gives the expected release for gnosischain/go-ethereum (v1.17.10-gc), n8n (n8n@2.47.5), NousResearch/hermes-agent, prysm, openclaw with ^v(.+)$ (2026.11.3), optimism with ^op-node/v(.+)$ (1.20.1), HOPR and lighthouse.
• test/bump/compareEngines.ts --workspace <package clone> compares this command's file edits byte for byte with bump-runner update from the public image. It needs Docker and was not part of this run. The published image picks up the Latest-first release rule in its next release.

[github-actions]

Dappnode bot has built and pinned the built packages to an IPFS node, for commit: a41223e

This is a development version and should only be installed for testing purposes.

1. Package dappnodesdk.public.dappnode.eth

Install link

Hash: /ipfs/QmbU51LDFx5LKmJKqi7g6nJD7rhVtipP2yENSyNAysiWDG

(by dappnodebot/build-action)