deps: update tree-sitter-language-pack requirement from <1.14,>=1.13.3 to >=1.13.3,<1.16

[dependabot]

Updates the requirements on tree-sitter-language-pack to permit the latest version.

Release notes

Sourced from tree-sitter-language-pack's releases.

v1.15.8

Fixed

• The plain-Java artifact reaches Maven Central again. It was the only registry still stuck at 1.14.3: every 1.15.x publish skipped Publish Maven package, because the E2E gate — Java it sits behind failed first on 8 assertions of the shape expected: <null> but was: <[]>.

  The cause was a disagreement inside each generated Java record. A component backed by a Rust Vec carrying #[serde(default, skip_serializing_if = "Vec::is_empty")] was emitted as @Nullable, and the canonical constructor stored whatever it was handed — null included — while the Jackson builder defaulted the same component to List.of(). A record built through the builder, or round-tripped through JSON, therefore never compared equal to the same record built through the constructor. Regenerating against alef 0.67.2 drops @Nullable on those components and adds a compact constructor normalizing null to an empty collection, so both construction paths agree. Affected records: DataNode, DocstringInfo, ImportInfo, ProcessResult, StructureItem.

• The hand-written Java unit tests asserted the old, wrong contract. They required such a component to arrive as null; the Rust fields behind them are plain Vec, never Option<Vec>, so empty is the truthful representation. They now assert assertEquals(List.of(), ...), which fails on null as well as on a non-empty list — the assertions were tightened, not relaxed to accept either shape. mvn test in packages/java reports 150 tests, 0 failures, 0 errors.

Added

• Prerelease mode for the registry-mode test apps. task test-apps:prerelease:run (and :verify, :status, :clean) stages a throwaway copy of each test_apps/ app under .prerelease/ and redirects its dependency resolution at the in-repo package source, so the suite is runnable between a version bump and the publish — the window in which the pinned version exists on no registry and alef test-apps run cannot resolve anything. Covers rust, go, python, ruby, dart, elixir and swift; status names the remaining targets and why each needs a built artifact rather than a source path.

• scripts/check_test_app_pins.py — a gate that fails when a test app is pinned to a release other than the one being built. It re-derives all 18 pins across every test_apps/ app plus the alef.toml registry pins from Cargo.toml, deliberately independent of alef, so a change in what alef sync-versions is willing to write surfaces as a failure instead of as silent drift. A pattern that matches nothing is an error, not a pass — that was the Dart failure mode. --fix repins everything; --release X checks against the version being published and also catches a Cargo.toml that disagrees with the tag.

  Wired in three places: task version:sync repins after alef sync-versions, the Check version sync CI step gates every push, and the publish workflow's validate-versions job gates the release itself against the tag. Also exposed as task test-apps:check-pins / :fix-pins.

• scripts/sync_zig_zon_hashes.py — regenerates and verifies the test_apps/zig/build.zig.zon package hashes from the tarballs their URLs name. A Zig package hash is a content digest, so it cannot be derived from a version string the way every other test-app pin can; the only reproducible source is zig fetch <url>, which prints the exact hash Zig will demand. --fix

... (truncated)

Changelog

Sourced from tree-sitter-language-pack's changelog.

[1.15.8] - 2026-08-23

Fixed

• The plain-Java artifact reaches Maven Central again. It was the only registry still stuck at 1.14.3: every 1.15.x publish skipped Publish Maven package, because the E2E gate — Java it sits behind failed first on 8 assertions of the shape expected: <null> but was: <[]>.

  The cause was a disagreement inside each generated Java record. A component backed by a Rust Vec carrying #[serde(default, skip_serializing_if = "Vec::is_empty")] was emitted as @Nullable, and the canonical constructor stored whatever it was handed — null included — while the Jackson builder defaulted the same component to List.of(). A record built through the builder, or round-tripped through JSON, therefore never compared equal to the same record built through the constructor. Regenerating against alef 0.67.2 drops @Nullable on those components and adds a compact constructor normalizing null to an empty collection, so both construction paths agree. Affected records: DataNode, DocstringInfo, ImportInfo, ProcessResult, StructureItem.

• The hand-written Java unit tests asserted the old, wrong contract. They required such a component to arrive as null; the Rust fields behind them are plain Vec, never Option<Vec>, so empty is the truthful representation. They now assert assertEquals(List.of(), ...), which fails on null as well as on a non-empty list — the assertions were tightened, not relaxed to accept either shape. mvn test in packages/java reports 150 tests, 0 failures, 0 errors.

Added

• Prerelease mode for the registry-mode test apps. task test-apps:prerelease:run (and :verify, :status, :clean) stages a throwaway copy of each test_apps/ app under .prerelease/ and redirects its dependency resolution at the in-repo package source, so the suite is runnable between a version bump and the publish — the window in which the pinned version exists on no registry and alef test-apps run cannot resolve anything. Covers rust, go, python, ruby, dart, elixir and swift; status names the remaining targets and why each needs a built artifact rather than a source path.

• scripts/check_test_app_pins.py — a gate that fails when a test app is pinned to a release other than the one being built. It re-derives all 18 pins across every test_apps/ app plus the alef.toml registry pins from Cargo.toml, deliberately independent of alef, so a change in what alef sync-versions is willing to write surfaces as a failure instead of as silent drift. A pattern that matches nothing is an error, not a pass — that was the Dart failure mode. --fix repins everything; --release X checks against the version being published and also catches a Cargo.toml that disagrees with the tag.

  Wired in three places: task version:sync repins after alef sync-versions, the Check version sync CI step gates every push, and the publish workflow's validate-versions job gates the release itself against the tag. Also exposed as task test-apps:check-pins / :fix-pins.

• scripts/sync_zig_zon_hashes.py — regenerates and verifies the test_apps/zig/build.zig.zon package hashes from the tarballs their URLs name. A Zig package hash is a content digest, so it cannot be derived from a version string the way every other test-app pin can; the only

... (truncated)

Commits

• 86fa5a8 chore(swift): update Package.swift with checksum for v1.15.8
• 7f3d1e6 docs(changelog): roll [Unreleased] into 1.15.8
• d9d1647 chore(release): bump version to 1.15.8
• 0f55a1e fix(java): assert the non-null empty-collection contract
• e85d7ee chore: regenerate bindings with alef 0.67.2
• eededd2 chore(deps): repin alef to 0.67.2
• 4da61e7 feat(ci): refresh zig test-app package hashes after publish
• 4d0b2b3 chore(deps): refresh Cargo.lock to latest compatible versions
• 19508d1 fix(ci): trigger CI Zig on the files its hash check reads
• 308fcb1 fix(test-apps): regenerate zig package hashes stale since 1.14.3
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

roam-code Analysis

Mode: incremental (changed-only) — base 264e2eb9d19a43cc8b9b0e5f26e1bcf246c727e2, 1 changed+dependent files

Health Score: 76/100 FAIR

health: Fair codebase (76/100) — 66 critical, 0 warnings, focus: god_components
pr-risk: Moderate risk (30/100) — review recommended (risk_level medium) (driver: test_coverage_low)

Health Metrics

Metric	Value
Health Score	76/100
Tangle Ratio	0.7%
Propagation Cost	0.0279
Total Issues	66

PR Risk

Metric	Value
Risk Score	30/100

Quality Gate: PASSED

Gate expression: health_score>=50

SARIF Upload

Metric	Value
Category	roam-code-self-analysis/self-analysis/py3.12
Results Uploaded	117

Full analysis output

health

{
  "_meta": {
    "cache_ttl_s": 300,
    "cacheable": true,
    "index_age_s": 5,
    "index_status": {
      "dirty_files": 0,
      "fresh": false,
      "head_commit": "7ae6b34c8764",
      "hint": "index latest commit 55c7dd35e89a != HEAD 7ae6b34c8764 — git-derived metrics (commits, churn, co-change, weather) may be stale. Run `roam index --force`.",
      "indexed_commit": "55c7dd35e89a"
    },
    "latency_ms": null,
    "response_tokens": 6995,
    "roam_version": "14.0.0",
    "timestamp": "2026-08-31T10:39:07Z"
  },
  "actionable_count": 18,
  "actionable_cycles": 1,
  "agent_contract": {
    "confidence": null,
    "facts": [
      "Fair codebase (76/100) — 66 critical, 0 warnings, focus: god_components",
      "health score 76",
      "tangle ratio 0.7",
      "0.0279 propagation cost findings",
      "issue count 66"
    ],
    "next_commands": [
      "roam debt",
      "roam trends --days 30"
    ],
    "risks": []
  },
  "algebraic_connectivity": null,
  "algebraic_connectivity_available": false,
  "bottleneck_thresholds": {
    "list_limit": 15,
    "p70": 36867.2,
    "p90": 174379.9,
    "population": 3449,
    "utility_multiplier": 1.5
  },
  "category_severity": {
    "bottlenecks": {
      "critical": 15,
      "info": 0,
      "warning": 0
    },
    "cycles": {
      "critical": 1,
      "info": 0,
      "warning": 0
    },
    "god_components": {
      "critical": 50,
      "info": 0,
      "warning": 0
    },
    "layer_violations": {
      "critical": 0,
      "info": 0,
      "warning": 0
    }
  },
  "command": "health",
  "cycles_actionable": 1,
  "cycles_total": 52,
  "framework_filtered": 0,
  "god_component_thresholds": {
    "list_limit": 50,
    "min_degree": 20,
    "population": 634
  },
  "health_score": 76,
  "ignored_cycles": 51,
  "imported_coverable_lines": 0,
  "imported_coverage_files": 0,
  "imported_coverage_pct": null,
  "imported_covered_lines": 0,
  "index_status": {
    "dirty_files": 0,
    "fresh": false,
    "head_commit": "7ae6b34c8764",
    "hint": "index latest commit 55c7dd35e89a != HEAD 7ae6b34c8764 — git-derived metrics (commits, churn, co-change, weather) may be stale. Run `roam index --force`.",
    "indexed_commit": "55c7dd35e89a"
  },
  "issue_count": 66,
  "list_counts": {
    "bottlenecks": 15,
    "cycle_break_suggestions": 1,
    "cycles": 52,
    "god_components": 50,
    "layer_violations": 0,
    "next_steps": 2,
    "score_breakdown": 5
  },
  "project": "roam-code",
  "propagation_cost": 0.0279,
  "schema": "roam-envelope-v1",
  "schema_version": "1.2.0",
  "severity": {
    "critical": 66,
    "info": 51,
    "warning": 0
  },
  "summary": {
    "actionable_cycles": 1,
    "algebraic_connectivity": null,
    "algebraic_connectivity_available": false,
    "category_severity": {
      "bottlenecks": {
        "critical": 15,
        "info": 0,
        "warning": 0
      },
      "cycles": {
        "critical": 1,
        "info": 0,
        "warning": 0
      },
      "god_components": {
        "critical": 50,
        "info": 0,
        "warning": 0
      },
      "layer_violations": {
        "critical": 0,
        "info": 0,
        "warning": 0
      }
    },
    "cycles_actionable": 1,
    "cycles_definition": "Cycle counts derived from `roam.graph.cycles.find_cycles(G, min_size=2)` on the symbol graph. `cycles_total` = all SCCs of size >= 2; `cycles_actionable` = SCCs spanning >=2 files AND no test files (same-file and test-only cycles are informational). Run `roam health` for the per-cycle breakdown.",
    "cycles_total": 52,
    "detail_available": true,
    "god_components": 50,
    "god_components_definition": "God components: symbols where `(in_degree + out_degree) > 20` from the `graph_metrics` table, with utility-aware severity bands (standard >50=CRITICAL >30=WARNING; utility >150=CRITICAL >90=WARNING). Run `roam health` for the per-symbol breakdown. Legacy aliases: `god_objects` (fingerprint), `god_classes` (rules).",
    "health_score": 76,
    "health_score_definition": "weighted geometric mean (0-100) of 5 sigmoid health factors: tangle_ratio, god_components, bottlenecks, layer_violations, file_health (+coverage if available); computed by roam.quality.health_score.compute_health_score, shared verbatim with the `snapshots` writer so `roam health --baseline` compares like with like.",
    "ignored_cycles": 51,
    "imported_coverage_files": 0,
    "imported_coverage_pct": null,
    "issue_count": 66,
    "partial_success": true,
    "preserved_list_truncations": {},
    "propagation_cost": 0.0279,
    "severity": {
      "critical": 66,
      "info": 51,
      "warning": 0
    },
    "tangle_ratio": 0.7,
    "tangle_ratio_definition": "percent of symbols inside non-trivial SCCs (size >= 2), counting ALL such SCCs, not just actionable ones; higher = more cyclic coupling. `roam fingerprint` reports the identical measurement as a fraction (percent / 100).",
    "total_cycles": 52,
    "truncated": true,
    "truncation_reason": "detail_mode",
    "verdict": "Fair codebase (76/100) — 66 critical, 0 warnings, focus: god_components",
    "warnings_out": [
      "health_algebraic_connectivity_warning:RuntimeWarning:algebraic_connectivity compute failed (ModuleNotFoundError): No module named 'numpy'; returning 0.0 sentinel — value is NOT a legitimate disconnected-graph reading",
      "health_god_components_list_capped:showing_top_50_of_634",
      "health_bottlenecks_list_capped:showing_top_15_of_3449"
    ]
  },
  "tangle_ratio": 0.7,
  "total_cycles": 52,
  "utility_count": 32,
  "version": "14.0.0",
  "warnings_out": [
    "health_algebraic_connectivity_warning:RuntimeWarning:algebraic_connectivity compute failed (ModuleNotFoundError): No module named 'numpy'; returning 0.0 sentinel — value is NOT a legitimate disconnected-graph reading",
    "health_god_components_list_capped:showing_top_50_of_634",
    "health_bottlenecks_list_capped:showing_top_15_of_3449"
  ]
}

pr-risk

{
  "_meta": {
    "cache_ttl_s": 60,
    "cacheable": true,
    "index_age_s": 7,
    "index_status": {
      "dirty_files": 0,
      "fresh": false,
      "head_commit": "7ae6b34c8764",
      "hint": "index latest commit 55c7dd35e89a != HEAD 7ae6b34c8764 — git-derived metrics (commits, churn, co-change, weather) may be stale. Run `roam index --force`.",
      "indexed_commit": "55c7dd35e89a"
    },
    "latency_ms": null,
    "response_tokens": 872,
    "roam_version": "14.0.0",
    "timestamp": "2026-08-31T10:39:09Z"
  },
  "actor": null,
  "agent_contract": {
    "confidence": null,
    "facts": [
      "Moderate risk (30/100) — review recommended (risk_level medium) (driver: test_coverage_low)",
      "risk score 30",
      "2 risk rank findings",
      "1 changed files",
      "1 lines added"
    ],
    "next_commands": [],
    "risks": [
      "pr-risk: moderate (30/100) on 264e2eb9d19a43cc8b9b0e5f26e1bcf246c727e2..HEAD — driver: test_coverage_low"
    ]
  },
  "author": null,
  "blast_radius_pct": 0,
  "bus_factor_risk": 0,
  "change_shape": "mixed",
  "changed_files": 1,
  "closest_historical_pattern": null,
  "closest_similarity": 0,
  "cluster_spread": 0,
  "clusters_touched": 0,
  "command": "pr-risk",
  "coupling_score": 0,
  "dead_code": [],
  "dead_exports": 0,
  "familiarity": {
    "avg_familiarity": 1,
    "files": [],
    "files_assessed": 0
  },
  "findings": [
    {
      "claim": "pr-risk: moderate (30/100) on 264e2eb9d19a43cc8b9b0e5f26e1bcf246c727e2..HEAD — driver: test_coverage_low",
      "confidence": "heuristic",
      "evidence": {
        "actor": null,
        "author": null,
        "blast_radius_pct": 0,
        "bus_factor_risk": 0,
        "changed_files_count": 1,
        "commit_range": "264e2eb9d19a43cc8b9b0e5f26e1bcf246c727e2..HEAD",
        "coupling_score": 0,
        "created_at_epoch": 1788172749,
        "diff_id": "299f82502ece",
        "familiarity_risk": 0,
        "file_list": [
          "pyproject.toml"
        ],
        "hotspot_score": 0,
        "label": "264e2eb9d19a43cc8b9b0e5f26e1bcf246c727e2..HEAD",
        "lines_added": 1,
        "lines_removed": 1,
        "minor_risk": 0,
        "novelty_score": 0,
        "reductive_change": false,
        "risk_level": "moderate",
        "risk_score": 30,
        "staged": false,
        "test_coverage_pct": 0,
        "top_driver": "test_coverage_low"
      },
      "finding_id_str": "pr-risk:composite-risk-score:299f82502ece",
      "kind": "pr-risk:composite-risk-score",
      "severity": "medium",
      "source_detector": "pr-risk",
      "source_version": "1.0.0",
      "subject_id": null,
      "subject_kind": "commit"
    }
  ],
  "hotspot_score": 0,
  "label": "264e2eb9d19a43cc8b9b0e5f26e1bcf246c727e2..HEAD",
  "layer_spread": 0,
  "layers_touched": 0,
  "lines_added": 1,
  "lines_removed": 1,
  "minor_risk": {
    "files": [],
    "files_assessed": 0,
    "minor_files": 0
  },
  "novelty_score": 0,
  "per_file": [
    {
      "blast": 0,
      "churn": 644,
      "is_test": false,
      "lines_added": 1,
      "lines_removed": 1,
      "path": "pyproject.toml",
      "symbols": 0
    }
  ],
  "project": "roam-code",
  "reductive_change": false,
  "reductive_discount_applied": false,
  "risk_level": "moderate",
  "risk_level_canonical": "medium",
  "risk_rank": 2,
  "risk_score": 30,
  "schema": "roam-envelope-v1",
  "schema_version": "1.2.0",
  "suggested_reviewers": [
    {
      "actor": "Cranot",
      "author": "Cranot",
      "lines": 449
    },
    {
      "actor": "t",
      "author": "t",
      "lines": 15
    },
    {
      "actor": "dependabot[bot]",
      "author": "dependabot[bot]",
      "lines": 1
    }
  ],
  "summary": {
    "change_shape": "mixed",
    "changed_files": 1,
    "findings_count": 1,
    "lines_added": 1,
    "lines_removed": 1,
    "partial_success": false,
    "risk_level": "moderate",
    "risk_level_canonical": "medium",
    "risk_rank": 2,
    "risk_score": 30,
    "score_classification": "classified",
    "verdict": "Moderate risk (30/100) — review recommended (risk_level medium) (driver: test_coverage_low)"
  },
  "test_coverage_pct": 0,
  "total_clusters": 11438,
  "total_layers": 45,
  "version": "14.0.0",
  "warnings_out": []
}

---

roam-code analysis | Commands: health pr-risk

[Cranot]

Thanks for keeping this up to date. We're keeping the current parser range for this release: it was chosen deliberately, and widening it means checking the new parser bundles against Roam's 28-language tests, not just checking that installation succeeds.

This PR also needs a matching lockfile update. Leaving it open for that dedicated compatibility pass; the current bounds aren't an accidental stale pin.