Update stacked: 2 packages

[gominimal-pkgmgr-mgr]

Update base-soup (2 packages)

Note

These packages declare replace_on_cycle in their build.ncl, so
they participate in the toolchain rebuild graph and one hash change
cascades through the set. Bundling ensures the cascading rebuild
lands as a single unit, even when only one package is bumping —
avoids back-to-back full rebuilds from singleton PRs.

Warning

5 requested members did NOT ship — each needs separate follow-up.
A member is dropped when it fails to update, has its gs:// mirror
withheld by the scan gate, or is peeled to keep the shipped set a
closed dependency closure. Reasons are abbreviated — the full
diagnostics ride the Slack thread and the run's logs.

Package	Old	Target	Why
expat	2.8.2	2.8.3	held for dwell — the release is too fresh (anti-xz recency gate) and the gs:// mirror write was withheld.
libpsl	0.23.1	0.23.2	held for dwell — the release is too fresh (anti-xz recency gate) and the gs:// mirror write was withheld.
libjpeg-turbo	3.1.4.1	3.2.0	update failed: download failed with status 404 Not Found
fontconfig	2.18.2	2.18.3	peeled — depends on dropped member 'expat'
pango	1.58.0	1.58.2	peeled — depends on dropped member 'fontconfig'

Caution

Pkgscan: 1 new signal introduced across bundle members.
Each member's diff was compared against its prior version. Review carefully — base-soup updates touch the toolchain core, so a malicious bump here has cascade-wide impact.

Package	Severity	File	Line	Capability (MBC)	Pattern
gtest	HIGH	gtest (upstream release)	0	metadata/recent-bump	upstream release <6h ago

Note

Build risk — 9 dependents across the tree. Package(s) that
build- or runtime-depend on a member of this bundle may need a rebuild,
or could FTBFS on an API/ABI change. Informational (not blocking) — a
heads-up for the reviewer on what this bump can ripple into.

Bundle member	Dependents
libffi	7 — ghc, glib, haskell-language-server, llvm, python, ruby, rust
gtest	2 — node, node-lts

Summary

Package	Old	New	Source
libffi	3.7.1	3.8.0	github:libffi/libffi:release-asset:operator-pinned
gtest	1.17.0	1.18.0	github:google/googletest:operator-pinned

Per-package details

libffi 3.7.1 → 3.8.0

• SHA256: d5e9a6638ddbd251... → 7da3e2d9a171eb0a...
• Size: 1.5 MB → 1.6 MB
• Source: gs://minimal-staging-archives/libffi-3.7.1.tar.gz → gs://minimal-staging-archives/libffi-3.8.0.tar.gz
• Released: 2 days ago (2026-08-08)
• License: (GPL-2.0-only AND MIT) (source: tarball)

gtest 1.17.0 → 1.18.0

• SHA256: 65fab701d9829d38... → 6e3191c1455468b3...
• Size: 895 KB
• Source: https://github.com/google/googletest/archive/refs/tags/v1.17.0.tar.gz → https://github.com/google/googletest/archive/refs/tags/v1.18.0.tar.gz
• Released: 5 hours ago (2026-08-10)
• License: BSD-3-Clause (source: GitHub + tarball)

---

Created by pkgmgr