Release 2.1.259 (2026-10-23)

Bug fixes

• bump the runtime pin from the per-series vergil-python package (#3468)
• fix(update-deps): bump the runtime pin from the per-series vergil-python package

The vergil updater looked up the legacy per-patch vergil-python package names, so it could not keep an exact [package.python] runtime pin current once vergil-python moved to one package per series, and would fail once the legacy packages leave the index. It now reads the newest version of vergil-python on every build and install-test index, takes its CPython patch (the part before +) and bumps the pin to it within its series. A missing series package, indexes that disagree on the patch, a malformed version, a patch on another series or older than the pin all fail loudly. The legacy-name lookup is removed; the missing-package error explains the retirement. A newer series is still only reported as held back. Ref #3456

• fix(update-deps): hold the runtime bump back while the package indexes disagree

The deb and rpm indexes publish separately, so right after a vergil-python release they briefly serve different patches. That was a hard failure, which made the next vrg-update-deps run file a fix task for a normal, transient state. The updater now leaves the pin unchanged and records a held-back entry naming each served patch and the indexes serving it until they agree. Every other loud failure is unchanged, and a served patch on another series still fails even while the indexes disagree. Ref #3456

CI Evidence: All gates passed — full audit bundle available. Download →