Maintenance

Before every course offering, verify the selected manager versions, install all fixtures with frozen/immutable lockfiles, run tests, and recapture live scans. Confirm target findings still teach the intended lesson. Update reports and provenance together, without manually changing findings.

Application source and tests intentionally match across every track and exercise. Validate those copies to avoid drift. Generate lockfiles with their actual package manager; never manufacture them by editing dependency entries. If a dependency version changes, retest both student and solution states and re-export student kits.

Record scan command, scanner/runtime/manager versions, date, completeness and counts. Distinguish advisory count from vulnerable-package count. Update the guide when a lower-impact fix differs from the reference major upgrade.

Verify GitHub Action commit pins and package-manager installation before publishing workflow templates. Do not state that templates passed GitHub CI unless an actual run establishes it. Keep the catalog's own verification separate from intentionally failing exercise gates.

Future exercises should follow the same README/worksheet/submission/instructor/examples layout and include all five tested manager tracks. Avoid publishing institutional names or endorsements without permission.