fix: Audit 06/26

[milesj]

No description provided.

[Copilot]

Pull request overview

This PR updates default toolchain plugin versions and adjusts moon docker scaffolding to produce deterministic manifests (supporting stable Docker layer caching), alongside corresponding changelog updates.

Changes:

• Bump default Go and JavaScript toolchain plugin locator versions.
• Make moon docker manifest project lists order-preserving by switching to IndexSet and deriving Default for DockerManifest.
• Add an Unreleased changelog entry describing the fixes.

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
crates/config-loader/src/toolchains_config_ext.rs	Bumps default plugin locator versions for Go and JavaScript toolchains.
crates/app/src/commands/docker/scaffold.rs	Simplifies manifest initialization to rely on DockerManifest::default().
crates/app/src/commands/docker/mod.rs	Switches manifest sets to IndexSet and derives Default to preserve deterministic ordering.
crates/app/Cargo.toml	Adds indexmap dependency needed for IndexSet.
CHANGELOG.md	Adds an Unreleased section noting fixes/toolchain updates.
Cargo.lock	Records the new dependency addition.

[codspeed-hq]

Merging this PR will not alter performance

⚠️ Unknown Walltime execution environment detected

Using the Walltime instrument on standard Hosted Runners will lead to inconsistent data.

For the most accurate results, we recommend using CodSpeed Macro Runners: bare-metal machines fine-tuned for performance measurement consistency.

⚠️ Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

⚡ 12 improved benchmarks
❌ 2 regressed benchmarks
✅ 9 untouched benchmarks

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Mode	Benchmark	BASE	HEAD	Efficiency
❌	WallTime	hash_files[1000]	9.7 ms	15.2 ms	-36.57%
❌	WallTime	build_graphs_sync[1000]	380.1 ms	546.2 ms	-30.42%
⚡	WallTime	track_tasks_sync[1000]	7.7 s	5.2 s	+47.71%
⚡	WallTime	track_tasks_sync[100]	768.2 ms	523.7 ms	+46.68%
⚡	WallTime	track_tasks_sync[10]	116 ms	80.1 ms	+44.82%
⚡	WallTime	track_projects_sync[100]	52.8 ms	37.3 ms	+41.81%
⚡	WallTime	track_projects_async[100]	53.4 ms	37.7 ms	+41.65%
⚡	WallTime	track_projects_async[10]	37.5 ms	26.6 ms	+41.01%
⚡	WallTime	track_projects_sync[10]	33.1 ms	23.5 ms	+40.98%
⚡	WallTime	track_tasks_async[100]	110.1 ms	79.4 ms	+38.67%
⚡	WallTime	track_tasks_async[1000]	1,075.8 ms	777.8 ms	+38.31%
⚡	WallTime	track_projects_sync[1000]	532.9 ms	386.9 ms	+37.75%
⚡	WallTime	track_projects_async[1000]	528.5 ms	384 ms	+37.61%
⚡	WallTime	track_tasks_async[10]	44.9 ms	33.2 ms	+35.42%

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing fixes-0626 (3e64c77) with master (3f13004)}