standardize upstream version-check comments; bump pinned versions

Reword the lookup comment above each upstream _version var to a single
greppable "# version-check: <url>" marker, always placed directly above
the version line, so a script can find every instance with one grep.

Bump bin 2.0.1 -> 2.0.2, pleroma 2.10.0 -> 2.11.0, relayer 2.2.8 -> 2.3.1,
ergo 2.18.0 -> 2.19.1, openhop_repeater 1.1.1 -> 1.1.4, keeping the
bin/server and pleroma/otp duplicate version vars in sync.

Add a TODO on openhop/repeater to review upstream's identity-validation
changes (1.1.2-1.1.4) against the stale-UID bug before deploying to the
live mesh node.

Document the version-check convention in the README.

13 files changed, 39 insertions, 18 deletions

diff --git a/README.md b/README.md
index 72fd055..86189fd 100644
--- a/README.md
+++ b/README.md
@@ -43,3 +43,20 @@ pleroma_db_passwd: "pleDbPass123"
 pleroma_db_superpass: "dbpass123"
 pleroma_secret_key: "secret123"
 ```
+
+## Dependency Version Checks
+
+Roles that pin an upstream dependency's version carry a comment directly above the `_version`
+variable in `defaults/main.yaml`, pointing at the page where the current upstream version can be
+confirmed:
+
+```yaml
+# version-check: https://github.com/fiatjaf/relayer/releases
+relayer_version: "2.3.1"
+```
+
+Find every instance across the repo with:
+
+```sh
+grep -rn "# version-check:" --include="*.yaml" .
+```
diff --git a/bin/build/defaults/main.yaml b/bin/build/defaults/main.yaml
index 4bea60c..d3c4dba 100644
--- a/bin/build/defaults/main.yaml
+++ b/bin/build/defaults/main.yaml
@@ -1,7 +1,7 @@
 ---
 
-bin_version: "2.0.1"
-# https://github.com/w4/bin/releases
+# version-check: https://github.com/w4/bin/releases
+bin_version: "2.0.2"
 bin_tar: "https://github.com/w4/bin/archive/refs/tags/v{{bin_version}}.tar.gz"
 bin_build_dir: "{{build_work_dir}}/bin-{{bin_version}}"
 bin_srv_dir: "{{build_srv_dir}}"
diff --git a/bin/server/defaults/main.yaml b/bin/server/defaults/main.yaml
index 7834ced..0d03a95 100644
--- a/bin/server/defaults/main.yaml
+++ b/bin/server/defaults/main.yaml
@@ -1,5 +1,5 @@
 ---
 
-bin_version: "2.0.1"
+bin_version: "2.0.2"
 bin_user: "pastebin"
 bin_port: 8820
diff --git a/dendrite/build/defaults/main.yaml b/dendrite/build/defaults/main.yaml
index 06e38e1..83110b4 100644
--- a/dendrite/build/defaults/main.yaml
+++ b/dendrite/build/defaults/main.yaml
@@ -1,7 +1,7 @@
 ---
 
+# version-check: https://github.com/element-hq/dendrite/releases
 dendrite_version: "0.15.2"
-# https://github.com/element-hq/dendrite/releases
 dendrite_tar: "https://github.com/element-hq/dendrite/archive/refs/tags/v{{dendrite_version}}.tar.gz"
 dendrite_build_dir: "{{build_work_dir}}/dendrite-{{dendrite_version}}"
 dendrite_srv_dir: "{{build_srv_dir}}"
diff --git a/ergo/defaults/main.yaml b/ergo/defaults/main.yaml
index dacd01c..192638d 100644
--- a/ergo/defaults/main.yaml
+++ b/ergo/defaults/main.yaml
@@ -1,8 +1,8 @@
 ---
 
 ergo_user: "ergo"
-# https://github.com/ergochat/ergo/releases/
-ergo_version: "2.18.0"
+# version-check: https://github.com/ergochat/ergo/releases/
+ergo_version: "2.19.1"
 ergo_arch: "arm64"
 ergo_tar_name: "ergo-{{ergo_version}}-linux-{{ergo_arch}}"
 ergo_tar: "{{ergo_tar_name}}.tar.gz"
diff --git a/mattertimectl/build/defaults/main.yaml b/mattertimectl/build/defaults/main.yaml
index ccd486a..2035674 100644
--- a/mattertimectl/build/defaults/main.yaml
+++ b/mattertimectl/build/defaults/main.yaml
@@ -1,7 +1,7 @@
 ---
 
+# version-check: https://github.com/lukehoersten/mattertimectl/tags
 mattertimectl_version: "0.1.0"
-# https://github.com/lukehoersten/mattertimectl/tags
 # Rust project: cargo build --release produces one self-contained binary
 # (all runtime deps are pure Rust), so the target only needs the binary to
 # run it. The source tarball must point at the Rust implementation.
diff --git a/mattertimectl/controller/defaults/main.yaml b/mattertimectl/controller/defaults/main.yaml
index 933a4bb..488c9dd 100644
--- a/mattertimectl/controller/defaults/main.yaml
+++ b/mattertimectl/controller/defaults/main.yaml
@@ -1,6 +1,6 @@
 ---
 
-# https://github.com/lukehoersten/mattertimectl/tags
+# version-check: https://github.com/lukehoersten/mattertimectl/tags
 mattertimectl_version: "0.1.0"
 
 mattertimectl_user: "mattertimectl"
diff --git a/nostr/build/defaults/main.yaml b/nostr/build/defaults/main.yaml
index 08dc1b5..67aebd6 100644
--- a/nostr/build/defaults/main.yaml
+++ b/nostr/build/defaults/main.yaml
@@ -1,7 +1,7 @@
 ---
 
-relayer_version: "2.2.8"
-# https://github.com/fiatjaf/relayer/releases
+# version-check: https://github.com/fiatjaf/relayer/releases
+relayer_version: "2.3.1"
 relayer_tar: "https://github.com/fiatjaf/relayer/archive/refs/tags/v{{relayer_version}}.tar.gz"
 relayer_build_dir: "{{build_work_dir}}/relayer-{{relayer_version}}"
 relayer_srv_dir: "{{build_srv_dir}}"
diff --git a/nostr/relayer/defaults/main.yaml b/nostr/relayer/defaults/main.yaml
index 5fd0f45..fe1435a 100644
--- a/nostr/relayer/defaults/main.yaml
+++ b/nostr/relayer/defaults/main.yaml
@@ -1,7 +1,7 @@
 ---
 
-# https://github.com/fiatjaf/relayer/releases
-relayer_version: "2.2.8"
+# version-check: https://github.com/fiatjaf/relayer/releases
+relayer_version: "2.3.1"
 relayer_user: "relayer"
 relayer_pubkey: ""
 relayer_port: "7447"
diff --git a/openhop/repeater/defaults/main.yaml b/openhop/repeater/defaults/main.yaml
index b72dcfb..cf37609 100644
--- a/openhop/repeater/defaults/main.yaml
+++ b/openhop/repeater/defaults/main.yaml
@@ -1,7 +1,11 @@
 ---
 
-repeater_version: "1.1.1"
-# https://github.com/openhop-dev/openhop_repeater/tags
+# version-check: https://github.com/openhop-dev/openhop_repeater/tags
+### TODO: before deploying this 1.1.4 bump to the live mesh node (lp1.chi.gdn),
+### review upstream PRs 1.1.2-1.1.4 titled "refactor identity validation" /
+### "relaxed identity guard" against the stale-UID identity bug fixed there
+### on 2026-08-10.
+repeater_version: "1.1.4"
 # openhop_repeater is NOT on PyPI, so it installs from this git tag.
 # Its dependency openhop_core[hardware] resolves from PyPI automatically.
 repeater_repo: "https://github.com/openhop-dev/openhop_repeater"
diff --git a/pleroma/build/defaults/main.yaml b/pleroma/build/defaults/main.yaml
index 4687c33..8889bea 100644
--- a/pleroma/build/defaults/main.yaml
+++ b/pleroma/build/defaults/main.yaml
@@ -1,7 +1,7 @@
 ---
 
-pleroma_version: "2.10.0"
-# https://git.pleroma.social/pleroma/pleroma/releases
+# version-check: https://git.pleroma.social/pleroma/pleroma/releases
+pleroma_version: "2.11.0"
 pleroma_tar: "https://git.pleroma.social/pleroma/pleroma/archive/v{{pleroma_version}}.tar.gz"
 pleroma_build_dir: "{{build_work_dir}}/pleroma"
 pleroma_srv_dir: "{{build_srv_dir}}"
diff --git a/pleroma/otp/defaults/main.yaml b/pleroma/otp/defaults/main.yaml
index c7047af..ea6c3a1 100644
--- a/pleroma/otp/defaults/main.yaml
+++ b/pleroma/otp/defaults/main.yaml
@@ -26,6 +26,6 @@ pleroma_db: "pleroma_{{pleroma_instance}}"
 pleroma_db_user: "pleroma_{{pleroma_instance}}"
 pleroma_data_dir: "/var/lib/pleroma/instance_data"
 
-pleroma_version: "2.10.0"
+pleroma_version: "2.11.0"
 pleroma_download_url: "http://{{build_server_host}}:{{build_server_port}}/pleroma-{{pleroma_version}}.tar.gz"
 
diff --git a/prometheus/rpi-client/defaults/main.yaml b/prometheus/rpi-client/defaults/main.yaml
index 49d19ca..4bedbe6 100644
--- a/prometheus/rpi-client/defaults/main.yaml
+++ b/prometheus/rpi-client/defaults/main.yaml
@@ -1,6 +1,6 @@
 ---
 
-# https://github.com/lukasmalkmus/rpi_exporter/releases
+# version-check: https://github.com/lukasmalkmus/rpi_exporter/releases
 prometheus_client_rpi_exporter_version: "0.9.0-rc.0"
 prometheus_client_arch: "{{ansible_facts['architecture']}}"