Update stacked: 3 packages

[gominimal-pkgmgr-mgr]

Update base-soup (3 packages)

Note

These packages declare replace_on_cycle in their build.ncl, so
they participate in the toolchain rebuild graph and one hash change
cascades through the set. Bundling ensures the cascading rebuild
lands as a single unit, even when only one package is bumping —
avoids back-to-back full rebuilds from singleton PRs.

Warning

1 requested member did NOT ship — each needs separate follow-up.
A member is dropped when it fails to update, has its gs:// mirror
withheld by the scan gate, or is peeled to keep the shipped set a
closed dependency closure. Reasons are abbreviated — the full
diagnostics ride the Slack thread and the run's logs.

Package	Old	Target	Why
sqlite	3.53.3	3.53.4	update failed: update refused: sqlite's source URL is keyed on a non-version binding (commit/revision/snapshot), so bumping the version leaves the URL — and therefore the downloaded bytes — unchanged.

Pkgscan: 2 below-threshold signals across bundle members (all Info severity, risk score 0.2). Demoted in benign contexts (test fixtures, CI workflow setup); expand for details.

Package	Severity	File	Line	Capability (MBC)	Pattern
fontconfig	INFO	fontconfig (upstream release)	0	metadata/recent-bump	recency NOT evaluated — no release date from the version source
pango	INFO	pango (upstream release)	0	metadata/recent-bump	recency NOT evaluated — no release date from the version source

Note

Build risk — 10 dependents across the tree. Package(s) that
build- or runtime-depend on a member of this bundle may need a rebuild,
or could FTBFS on an API/ABI change. Informational (not blocking) — a
heads-up for the reviewer on what this bump can ripple into.

Bundle member	Dependents
fontconfig	7 — cairo, chromium-bin, chromium-headless-shell-bin, ffmpeg, graphviz, libass, libgd
pango	3 — chromium-bin, chromium-headless-shell-bin, graphviz

Summary

Package	Old	New	Source
fontconfig	2.18.2	2.18.3	override:fontconfig:operator-pinned
pango	1.58.0	1.58.2	override:pango:operator-pinned
gradle	9.6.1	9.7.0	github:gradle/gradle:operator-pinned

Per-package details

fontconfig 2.18.2 → 2.18.3

• SHA256: cf8e6576ef0484c1... → 4f7b554a38cdf78c...
• Size: 1.3 MB → 1.2 MB
• Source: gs://minimal-staging-archives/fontconfig-2.18.2.tar.xz → gs://minimal-staging-archives/fontconfig-2.18.3.tar.xz
• Released: unknown (non-GitHub source or tag-only fallback)

pango 1.58.0 → 1.58.2

• SHA256: bc5bad6213ad4886... → 342385b6ca3b7c73...
• Size: 2.6 MB → 1.9 MB
• Source: gs://minimal-staging-archives/pango-1.58.0.tar.xz → gs://minimal-staging-archives/pango-1.58.2.tar.xz
• Released: unknown (non-GitHub source or tag-only fallback)
• License: LGPL-2.0-only (source: tarball)

gradle 9.6.1 → 9.7.0

• SHA256: 9c0f7faeeb306cb1... → 84fbba45c7f4c64a...
• Size: 150.3 MB
• Source: https://services.gradle.org/distributions/gradle-9.6.1-bin.zip → https://services.gradle.org/distributions/gradle-9.7.0-bin.zip
• Released: 4 days ago (2026-08-06)
• License: Apache-2.0 (source: GitHub + tarball)

---

Created by pkgmgr