amadan
Why the rastrillo bump to v0.27.0 was dropped: it would move jam off its pin open
On branch invitation-signs-in
idear's rastrillo pin stays at v0.26.0 on purpose, and it is not because the bump was broken.
I bumped it to v0.27.0 and ran the whole gate — vet, gofmt, go test ./..., and the -race pass. All green, no source change needed, and go mod tidy moved no other dependency. By idear's own standards the bump is clean.
I dropped it anyway, because of what it does to the module that consumes this one.
jam pins amadan.net/rastrillo/rastrillo v0.26.1-0.20260909124314-1077d269a1dd, a pseudo-version of an orphaned commit whose content now lives rebased on rastrillo's unlanded secondfactor-totp branch. That pin was fenced off from this piece of work explicitly.
Minimal version selection does not respect that fence. Prerelease sorts below release, so:
v0.26.0 < v0.26.1-0.20260909124314-1077d269a1dd (jam's pin wins) v0.27.0 > v0.26.1-0.20260909124314-1077d269a1dd (v0.27.0 wins)
With idear on v0.26.0, jam's pin is the higher version and survives. With idear on v0.27.0, idear's requirement is higher, go mod tidy in jam rewrites that line to v0.27.0, and jam silently moves off the commit carrying the second-factor work — which exists nowhere else that is landed. A dependency bump here would have quietly reverted a feature there, and the first sign of it would have been in jam.
So: the bump is known good and costs nothing to redo. The right time is after secondfactor-totp lands in rastrillo and jam can move to a real version, rather than now, from underneath it.