Fairy Fox

2026-08

2026-08-02 — v1.5.2 — full compliance sweep: gaps closed

Ran a full fairyfox compliance audit (report: notes/fairyfox-reports/2026-08-02-compliance-audit.md) — node compliant, Scorecard 7.9 (live) — and closed every gap it surfaced:

  • Dating fix. This session's artifacts were misdated 2026-07-25; corrected to 2026-08-02 (adopting report renamed, session log moved to sessions/2026-08/, changelog moved to this file, manifest dates fixed).
  • Dockerfile base image SHA-pinned — eclipse-temurin:21-jdk@sha256:da9d3a4f… (Scorecard Pinned-Dependencies 9 → 10; verified the digest against the local image + a clean docker build).
  • Dependabot backlog triaged (9 PRs). Merged the green bumps (#27 scorecard-action, #28 codeql-action, #29 attest-build-provenance, #30 deploy-pages, #31 upload-pages-artifact applied by hand, #35 kotest-property 6.2.3). Closed #33 (paper-api → 26.x — contradicts the deliberate 1.21.x target) and #32 (bundled Kotlin 2.4.0 → 2.4.10, which breaks the CodeQL pin). Closed #34 (ktlint 12 → 14 fails the build; needs a dedicated migration). Added dependabot.yml ignores for paper-api major/minor and org.jetbrains.kotlin* so neither recurs. The merged codeql-action/analyze bump (#28) skewed against codeql-action/init (still 4.36.3) and failed the required Analyze check on the release PR — aligned init to 4.37.3 and grouped all github-actions bumps so a monorepo action can't half-bump again. (The full-CI gate caught this pre-merge — exactly its job.)
  • main required checks now include Server smoke (Paper purpur-1.21.11) and Latest Paper smoke (stable + experimental) — the full-CI-gate mandate is now platform-enforced across all seven jobs.
  • Stale release/1.5.0 branch confirmed gone.

VERSION 1.5.1 → 1.5.2.

2026-08-02 — v1.5.1 — adopt hub 1.6.0: README structure & cross-linking standard

Ran the fairyfox check/adopt flow. Hub mirror fast-forwarded a6d7e68 → 8c6a50e (VERSION 1.5.1 → 1.6.0). The only project-facing change in the span is the new readme.md standard (worded README cross-links — the site chrome doesn't travel with the README to GitHub/registries, so it must carry its own mesh links); 1.5.2/1.5.3 are hub-side registry edits. Pre-authorized by the standing adopt-standards-by-default ledger grant → adopted by default. Applied to README.md:

  • a worded docs link near the top (fairyfox.io/papermc-despawned-items/), alongside the existing docs badge;
  • an organized "Get it" section (Documentation · Download/Releases · Source), with a note that Modrinth/Hangar/CurseForge rows land when those pages exist (not yet);
  • a mesh footer near the bottom linking back into the Fairy Fox mesh.

## Verify run and recorded in adoption-manifest.md (readme → implemented, baseline → 1.6.0). check-links green (40 files). Report: notes/fairyfox-reports/2026-08-02-adopting-updates.md. Shipped as PATCH v1.5.1 (docs-only) via PR into main, full CI, tag, back-merge. VERSION 1.5.0 → 1.5.1.