Release 2.1.253 (2026-10-21)¶

Bug fixes¶

honour VRG_VERSION_WINDOW inside the dev container (#3402) When VRG_VERSION_WINDOW is set on the host, vrg-container-run resolves it to an absolute path, fails on the host (naming the path) if it is empty, not an existing file, or contains ':', bind-mounts the file read-only at /run/vergil/version-window.json and points VRG_VERSION_WINDOW in the container at that mount. The env-prefixes passthrough never forwards the raw host value. Unset leaves behaviour unchanged.
flush stdout and stderr before exec so the banner survives a pipe or file (#3403) When stdout is not a TTY, Python block-buffers it, and os.execvp replaces the process without flushing, so the run banner printed just before the exec was lost in CI logs and tee captures. Every os.execvp caller under src/ now goes through lib/process.exec_replace, which flushes both streams first. Regression tests model a block-buffered stdout for vrg-container-run and vrg-container-docs, and a subprocess test checks a real exec over a pipe. Ref #3396.

make vergil-tooling a library repository, keeping its CI version pin (#3404) vergil-tooling is installed into every consumer's image, so it is a library under the repository-type definitions (epic vergil-project/.github#407, spec section 3). As a tooling (app) repo, the resolver would narrow its packaged-Python matrix to a single version once derive.sh calls it, leaving its coverage gate on one interpreter. A library with a pin resolves to exactly the pin, so [ci].versions keeps 3.14/3.13/3.12 and the app multi-pin warning goes away. Pin removal stays with #3371.

add the Python resolver extension, toolchain-selection and floor checks (#3401) A packaged Python app resolves to the newest window version with a published vergil-python runtime, and fails loud when none has one; a packaged library keeps its whole matrix and only its deployed runtime needs a published package. [package.python].runtime becomes optional: unset, the builder derives the x.y runtime (vergil-python at /opt/vergil/python/); set, its x.y must be in the window. vrg-validate warns on a requires-python or go.mod floor below the window and an upper bound that excludes its newest version, and fails on .python-version or uv python-preference. vrg-container-run passes UV_PYTHON= into the container. Language rules live only in lib/versions/extensions/{python,go}.py; floors.py dispatches. Ref vergil-project/vergil-tooling#3368

CI Evidence: All gates passed — full audit bundle available. Download →