check_stack
Compare running component versions against known release changes to identify security fixes, breaking changes, and required upgrade actions per component.
Instructions
Check the user's running component versions against known changes. Versions are compared INSIDE THIS SERVER PROCESS — only project slugs are sent upstream, and this tool never calls the server-side /v1/upgrade endpoint. Run the server yourself and running versions never leave your infrastructure; on the hosted endpoint they transit server memory only and are not logged. Returns, per component, the changes from releases NEWER than the running version (the upgrade path). Default is a briefing: summary (new_changes, distinct_matters, by_severity, by_family, by_bucket), then the items split by what the caller must do — action_required applies to everyone, check_config applies only if its applies_if holds against the running configuration (resolve it before recommending; an unmet condition is not a reason to upgrade, it is a precondition for later — the entry's version is the minimum to be on before enabling that feature). The split comes from the server's bucket field, the SAME rule the website and the weekly email use. Repeat appearances of one matter_key (the same issue fixed on several release branches) collapse into one entry, and same_matter_also_addressed_in names every other release on record that carried it. Branch-aware: a matter already fixed at or below the running version ON THE RUNNING BRANCH is excluded (the install has it), counted in note — so a backport visible on a newer branch is not reported as outstanding work. Line-aware: a repository can publish separate products or channels (containerd api/, Flatcar lts vs stable, openfeature flagd vs core) and there is NO version order between lines, so only the line your version belongs to is compared — pass the tag as published, prefix included ("flagd/v0.16.1", "lts-4081.3.9"), or the wrong line is compared. Pass version_source per component (where you read the version — e.g. a daemonset image tag, or that the user stated it): it is echoed back as an audit trail. This server cannot see your environment, so it cannot verify a version or its source; a running version older than every release on record is flagged in note, which is the only cross-check available here. Use detail:"full" for every change verbatim in relevant_changes (capped at 50 per component with relevant_changes_omitted — narrow with severity_min or target_version), target_version to limit to one upgrade hop, severity_min to filter. Components with zero changes carry tracked:true|false — tracked:false means the project is NOT covered by ratatosk, so the absence of changes is no-coverage, not safety. Drill down with get_release or changes_by_entity.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| detail | No | brief (default): summary + the items to act on, split by bucket; full: every change verbatim | |
| components | Yes | the running stack to check | |
| severity_min | No | only changes at or above this severity: info|low|medium|high|critical |