Skip to content

chore(deps): update all non-major dependencies - #38

Open
akua-renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

chore(deps): update all non-major dependencies#38
akua-renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@akua-renovate

@akua-renovate akua-renovate Bot commented Jul 24, 2026 •
edited
Loading

Copy link
Copy Markdown

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change
@earendil-works/pi-ai (source) peerDependencies minor 0.81.1 → 0.83.0
@earendil-works/pi-ai (source) dependencies minor 0.81.1 → 0.83.0
@earendil-works/pi-ai (source) devDependencies minor 0.81.1 → 0.83.0
@earendil-works/pi-coding-agent (source) peerDependencies minor 0.81.1 → 0.83.0
@earendil-works/pi-coding-agent (source) devDependencies minor 0.81.1 → 0.83.0
@earendil-works/pi-coding-agent (source) dependencies minor 0.81.1 → 0.83.0
@next/bundle-analyzer (source) devDependencies patch 16.2.11 → 16.2.12
@next/env (source) devDependencies patch 16.2.11 → 16.2.12
@​paper-design/shaders-react dependencies patch ^0.0.77 → ^0.0.78
@types/node (source) devDependencies patch 26.1.1 → 26.1.2
@types/pg (source) devDependencies patch 8.20.0 → 8.20.3
cnfast (source) dependencies minor ^0.0.8 → ^0.1.0
docker/login-action action minor v4.4.0 → v4.6.0
fumadocs-core dependencies minor 16.13.0 → 16.14.0
fumadocs-mdx dependencies patch 15.2.0 → 15.2.2
fumadocs-ui dependencies minor 16.13.0 → 16.14.0
gh tools minor 2.96.0 → 2.97.0
github:kunchenguid/no-mistakes tools minor 1.40.3 → v1.41.2
github:kunchenguid/treehouse tools minor 2.0.0 → v2.1.1
github:ogulcancelik/herdr tools patch 0.7.3 → v0.7.5
golang (source) stage minor 1.25.7-bookworm → 1.26.5-bookworm
jdx/mise-action action patch v4.2.1 → v4.2.4
kubectl tools minor 1.35.6 → 1.36.3
next (source) dependencies patch 16.2.11 → 16.2.12
node (source) tools minor 24.16.0 → v24.18.1
npm:@earendil-works/pi-coding-agent (source) tools minor 0.81.1 → 0.83.0
npm:@openai/codex (source) tools minor 0.144.5 → 0.146.0
npm:chrome-devtools-axi tools patch 0.1.26 → 0.1.28
npm:gh-axi tools patch 0.1.27 → 0.1.29
npm:lavish-axi tools patch 0.1.42 → 0.1.45
npm:quota-axi tools patch 0.1.5 → 0.1.17
oxc-parser (source) devDependencies minor 0.128.0 → 0.142.0
posthog-js (source) dependencies minor 1.408.2 → 1.409.5
ripgrep tools minor 15.1.0 → 15.2.0
sharp (source, changelog) devDependencies minor 0.34.5 → 0.35.3
vcluster tools minor 0.35.2 → 0.36.0
vite (source) devDependencies minor 8.1.5 → 8.2.0
wrangler (source) devDependencies minor 4.115.0 → 4.118.0

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

Release Notes

earendil-works/pi (@​earendil-works/pi-ai)

v0.83.0

Compare Source

Breaking Changes
  • Upgraded the exported TypeBox dependency to 1.3.7, removing deprecated APIs including Type.Base, Type.Awaited, Type.Promise, Type.AsyncIterator, Type.Iterator, Type.Options, and Value.Mutate, while fixing compiled validation of nullable array tool arguments. Consumers using removed APIs must migrate to supported TypeBox APIs (#​7243 by @​petrroll).
Added
  • Added per-request fetch injection for supported text and image provider transports; Google adapters reject non-global implementations rather than silently bypassing them.
  • Added Claude Opus 5 support for the GitHub Copilot provider, routing through the Anthropic Messages API with adaptive thinking, 1M context, and the Copilot minimal thinking-level override (#​7158 by @​jay-aye-see-kay).
  • Added the "pending" stop reason for partial streaming messages. See Stop Reasons (#​7151 by @​lucasmeijer).
  • Added AssistantMessage.rawStopReason and populated it across Google, Anthropic, Amazon Bedrock, Mistral, and OpenAI streams; unmapped terminal reasons now surface as provider errors instead of successful stops (#​7272).
  • Added manual redirect URL and authorization-code entry to OpenRouter OAuth login for remote and headless environments (#​7114 by @​rgarcia).
  • Added AuthResolutionOverrides.minOAuthValidityMs so callers can require and refresh OAuth credentials with a minimum remaining validity (#​7168).
Changed
  • Changed stored OAuth credentials to refresh when less than five minutes of validity remain instead of waiting until expiration (#​7168).
Fixed
  • Fixed Qwen Token Plan reasoning models to send their service-specific thinking controls and supported reasoning-effort levels (#​6951, #​6998).
  • Fixed Z.AI providers and compatible custom endpoints to send output limits through max_tokens, which those endpoints honor (#​7174 by @​HyeokjaeLee).
  • Fixed explicitly configured Amazon Bedrock profiles being overridden by ambient AWS access keys (#​7176 by @​christianbasch).
  • Fixed malformed OpenAI-compatible tool-call deltas with both a valid function payload and an empty custom object discarding the function arguments (#​7288 by @​sunnyyoung).

v0.82.1

Compare Source

Added
  • Added ModelsStoreEntry.etag so persisted provider catalogs can carry the remote ETag validator for conditional refreshes.
  • Added ANTHROPIC_AUTH_TOKEN bearer authentication for Anthropic-compatible gateways (#​5871)
  • Added Claude Opus 5 support for Anthropic and Amazon Bedrock with adaptive thinking, inference profiles, prompt caching, and preserved AWS validation messages (#​7081 by @​unexge, #​7083 by @​davidbrai).
Changed
  • Changed Radius OAuth device authorization, token exchange, and refresh requests to use the configured gateway directly.
  • Changed ModelsError messages to append the underlying cause, so auth failures such as OAuth refresh failed for openai-codex report the provider response instead of a bare wrapper message.

v0.82.0

Compare Source

Breaking Changes
  • Replaced getBuiltinModelDataUrl(provider) with getBuiltinModelDataGeneratedAt() so built-in catalog freshness uses its recorded generation time instead of installation-dependent file metadata (#​7016 by @​davidbrai).
Added
  • Added Kimi Code subscription OAuth login for the kimi-coding provider, with device authorization, token refresh, and OAuth host overrides (#​6935 by @​zaycruz).
  • Added OpenRouter OAuth PKCE login that mints a user-controlled API key for chat and image providers (#​6927 by @​rsaryev).
  • Added Tool.constrainedSampling with strict JSON Schema (prefer/require) and OpenAI Lark/regex grammar variants, enforcing provider-side constrained tool sampling across OpenAI, Anthropic, Amazon Bedrock, Google Gemini, and Mistral. See Constrained Sampling for Tools.
  • Added supportsGrammarTools and supportsStrictTools compatibility flags, expanded supportsStrictMode to Responses and Bedrock models, and generated model capability metadata to gate constrained sampling.
Changed
  • Changed generated model catalogs to expose only provider-verified reasoning effort levels from models.dev (#​6928 by @​davidbrai).
Fixed
  • Fixed OpenAI Codex cached WebSocket continuations after grammar tool calls to send only the real tool-result delta.
  • Fixed constrained tool sampling across Google, Amazon Bedrock, Mistral, and Azure OpenAI Responses adapters, including model-aware strict-tool capabilities, grammar configuration validation, and malformed grammar-call replay errors.
  • Fixed cacheRetention: "none" to disable implicit prompt-cache writes for supported OpenAI models and session-based caching for OpenAI Codex (#​6618 by @​tmustier).
  • Fixed DNS lookup failures such as getaddrinfo, ENOTFOUND, and EAI_AGAIN to trigger automatic assistant retries (#​6946 by @​christianklotz).
  • Fixed OpenAI Codex WebSocket sessions to retry once without a missing previous-response continuation after previous_response_not_found errors (#​6955 by @​davidbrai).
  • Fixed OpenAI and Anthropic provider retry waits to honor abort signals and configured delay limits (#​6980 by @​petrroll).
  • Fixed OpenRouter Anthropic cache breakpoints to advance through tool results and enabled cache control for ~anthropic/*-latest aliases (#​6941 by @​mteam88).
earendil-works/pi (@​earendil-works/pi-coding-agent)

v0.83.0

Compare Source

New Features
  • Credential export for external clients — pi auth print-api-key and pi auth print-bearer-token export configured credentials with automatic OAuth refresh and minimum-validity enforcement.
  • Headless OpenRouter sign-in — Complete /login over SSH by pasting the redirect URL or authorization code when the loopback callback is unavailable. See OpenRouter.
  • Claude Opus 5 on GitHub Copilot — Use Claude Opus 5 through GitHub Copilot with adaptive thinking and a 1M context window. See GitHub Copilot.
Breaking Changes
  • Upgraded bundled TypeBox aliases to 1.3.7, removing deprecated APIs including Type.Base, Type.Awaited, Type.Promise, Type.AsyncIterator, Type.Iterator, Type.Options, and Value.Mutate, while fixing compiled validation of nullable array tool arguments. Extensions using removed APIs must migrate to supported TypeBox APIs. See Package Dependencies (#​7243 by @​petrroll).
Added
  • Added pi auth print-api-key and pi auth print-bearer-token commands for exporting configured credentials to external clients, including automatic OAuth refresh and configurable minimum token validity (#​7168).
  • Exposed the session's resolved model scope as ctx.scopedModels to extensions. See Extension Context (#​7191 by @​pungggi, #​7215).
  • Added inherited per-request fetch injection for supported text and image provider transports.
  • Added the inherited "pending" stop reason for partial streaming messages. See Custom Provider Stream Pattern (#​7151 by @​lucasmeijer).
  • Added inherited raw provider stop reasons across Google, Anthropic, Amazon Bedrock, Mistral, and OpenAI streams; unmapped terminal reasons now surface as provider errors instead of successful stops (#​7272).
  • Added manual redirect URL and authorization-code entry to OpenRouter login for remote and headless environments. See OpenRouter (#​7114 by @​rgarcia).
  • Added inherited Claude Opus 5 support for GitHub Copilot with adaptive thinking and a 1M context window. See GitHub Copilot (#​7158 by @​jay-aye-see-kay).
Changed
  • Changed inherited OAuth credential resolution to refresh tokens with less than five minutes of validity remaining instead of waiting until expiration (#​7168).
Fixed
  • Added a status line when the tool output expansion is toggled (#​7180).
  • Fixed file-backed SYSTEM.md and APPEND_SYSTEM.md prompts being omitted from the interactive startup context listing. See System Prompt Files (#​7096).
  • Fixed context files loading twice when a linked Git worktree is nested under its main repository. See Context Files (#​7221 by @​arajkumar).
  • Fixed llama.cpp streamed responses reporting zero token usage and leaving session context accounting empty. See llama.cpp (#​7258 by @​SteveImmanuel).
  • Fixed session replacement and committed tree navigation during an active response to abort and persist the outgoing turn instead of leaving dangling tool calls. See Sessions (#​7022 by @​tmustier).
  • Fixed failed Git package installs leaving partial directories that blocked clean retries. See Install and Manage (#​7210 by @​haoqixu).
  • Fixed the /model selector retaining a stale selection while filtering instead of highlighting the top match (#​7211 by @​christianbasch).
  • Fixed direct RPC bash commands bypassing extension user_bash handlers. See User Bash Events (#​7214).
  • Fixed skills, prompts, and themes losing package source metadata after extensions reload resources. See Resource Events (#​6968).
  • Fixed cancellation of concurrently running user bash commands so every active command is aborted (#​7103 by @​yzhg1983).
  • Fixed duplicate messages appearing when extensions switch sessions during interactive startup (#​7110 by @​yzhg1983).
  • Fixed inherited Qwen Token Plan reasoning models to send their service-specific thinking controls and supported reasoning-effort levels (#​6951, #​6998).
  • Fixed inherited Z.AI output limits being sent through an unsupported parameter. See Providers (#​7174 by @​HyeokjaeLee).
  • Fixed explicitly configured Amazon Bedrock profiles being overridden by ambient AWS access keys. See Amazon Bedrock (#​7176 by @​christianbasch).
  • Fixed inherited image fallback paths overflowing narrow terminals, shortened home-directory paths, and made absolute paths clickable when terminal hyperlinks are available (#​7262).
  • Fixed inherited OpenAI-compatible tool calls losing their function arguments when malformed deltas also contain an empty custom object (#​7288 by @​sunnyyoung).

v0.82.1

Compare Source

New Features
  • Claude Opus 5 — Available on Anthropic and Amazon Bedrock with adaptive thinking (including xhigh), inference profiles, and prompt caching. See Providers.
  • Anthropic gateway bearer auth — ANTHROPIC_AUTH_TOKEN authenticates against Anthropic-compatible gateways that require Authorization: Bearer, including compaction and branch summaries. See Environment Variables or Auth File.
  • Faster, more resilient model catalogs — pi.dev catalogs revalidate with If-None-Match so unchanged providers answer with an empty 304, and llama.cpp models stay listed across restarts. See llama.cpp.
Added
  • Exposed the outputPad setting to custom message renderers. See Extensions (#​7045 by @​xl0).
  • Added inherited ANTHROPIC_AUTH_TOKEN bearer authentication for Anthropic-compatible gateways. See Providers (#​5871).
  • Added inherited Claude Opus 5 support for Anthropic and Amazon Bedrock with adaptive thinking, inference profiles, prompt caching, and preserved AWS validation messages (#​7081 by @​unexge, #​7083 by @​davidbrai).
Changed
  • Changed pi.dev model catalog refreshes to revalidate with If-None-Match, so unchanged provider catalogs answer with an empty 304 instead of a full download.
  • Changed inherited Radius OAuth device authorization, token exchange, and refresh requests to use the configured gateway directly.
  • Changed inherited model loading errors to append the underlying cause, so auth failures such as OAuth refresh failed for openai-codex report the provider response instead of a bare wrapper message.
Fixed
  • Fixed compaction and branch summaries for providers whose authentication resolves entirely to request headers (#​5871)
  • Fixed unavailable scoped models being hidden from /models, allowing them to be removed without editing settings manually (#​6949, #​7032 by @​christianklotz).
  • Fixed startup context file discovery to skip directories that match context file names such as AGENTS.md, which produced EISDIR warnings (#​7106 by @​mrexodia).
  • Fixed the llama.cpp extension to persist its model catalog, so llama.cpp models stay listed before the first successful refresh. See llama.cpp (#​7072 by @​davidbrai).

v0.82.0

Compare Source

New Features
  • Constrained tool sampling — Tools can prefer or require strict JSON Schema sampling or use OpenAI Lark/regex grammars, with model capability metadata preventing unsupported requests. See Constrained Sampling for Tools.
  • OpenRouter and Kimi Code sign-in — Use /login to authorize OpenRouter or a Kimi Code subscription without manually configuring API keys. See OpenRouter.
  • Session-aware, streaming bash integrations — Bash tools receive current session/model metadata, while direct RPC bash commands stream correlated output. See Bash Tool Session Environment and RPC bash events.
Added
  • Added inherited Tool.constrainedSampling with strict JSON Schema (prefer/require) and OpenAI Lark/regex grammar variants across OpenAI, Anthropic, Amazon Bedrock, Google Gemini, and Mistral. See Constrained Sampling for Tools.
  • Added inherited supportsGrammarTools and supportsStrictTools compatibility flags, expanded supportsStrictMode coverage, and generated model capability metadata to gate constrained sampling.
  • Added inherited Kimi Code subscription OAuth login for the Kimi For Coding provider, including device authorization and automatic token refresh (#​6935 by @​zaycruz).
  • Added inherited OpenRouter OAuth PKCE login through /login, minting a user-controlled API key. See OpenRouter (#​6927 by @​rsaryev).
  • Exposed PI_SESSION_ID, PI_SESSION_FILE, PI_PROVIDER, PI_MODEL, and PI_REASONING_LEVEL to commands run by built-in and factory-created bash tools. See Bash Tool Session Environment.
  • Added streaming bash_execution_update events for direct RPC bash commands, correlated with request IDs. See RPC bash events (#​6971 by @​ananthakumaran).
Changed
  • Changed inherited generated model catalogs to expose only provider-verified reasoning effort levels from models.dev (#​6928 by @​davidbrai).
Fixed
  • Fixed inherited DNS lookup failures such as getaddrinfo, ENOTFOUND, and EAI_AGAIN to trigger automatic assistant retries (#​6946 by @​christianklotz).
  • Fixed inherited OpenRouter Anthropic cache breakpoints to advance through tool results and enabled cache control for ~anthropic/*-latest aliases (#​6941 by @​mteam88).
  • Fixed inherited OpenAI Codex WebSocket sessions to retry once without a missing previous-response continuation after previous_response_not_found errors (#​6955 by @​davidbrai).
  • Fixed TUI debug and crash logs to respect custom agent directories instead of always writing under ~/.pi/agent (#​6958 by @​davidbrai).
  • Fixed slow Ctrl+G external-editor startup when the system temporary directory contains many entries (#​6903 by @​christianklotz).
  • Fixed startup resource display to preserve relative paths for sibling npm extensions loaded by a package (#​6964 by @​davidbrai).
  • Fixed compaction and branch-summary requests to use fresh routing session IDs with prompt caching disabled where supported (#​6618 by @​tmustier).
  • Fixed explicit self-updates when PI_SKIP_VERSION_CHECK is set (#​6977).
  • Fixed scoped model IDs containing brackets to resolve as literal exact matches before glob matching (#​6210).
  • Fixed inherited OpenAI and Anthropic provider retry waits to honor abort signals and configured delay limits (#​6980 by @​petrroll).
  • Fixed fresh installs from preferring bundled model catalogs over newer remote catalogs because package file mtimes were newer (#​7016 by @​davidbrai).
  • Fixed inherited editor scroll indicators overflowing narrow terminals (#​7015 by @​christianklotz).
  • Fixed llama.cpp models to use the loaded context window as their output token limit instead of capping it at 16K (#​7034 by @​christianklotz).
  • Fixed release source archives to include the generated provider model data used to build standalone binaries.
  • Updated the packaged protobufjs dependency to 7.6.5 to address GHSA-j3f2-48v5-ccww (#​7005).
  • Fixed /copy on Wayland to fall back to X11 or OSC 52 when wl-copy fails (#​7009 by @​rkfshakti).
  • Fixed /model to reload updated models.json configuration when opening the model picker (#​6999).
vercel/next.js (@​next/bundle-analyzer)

v16.2.12

Compare Source

What's Changed

Full Changelog: vercel/next.js@v16.2.11...v16.2.12

aidenybai/cnfast (cnfast)

v0.1.0

Minor Changes

  • 8643c3c: Add createCn for custom tailwind-merge configuration.

    createCn(config) builds a cn that honors a custom merge config, accepting the same { override, extend } shape as tailwind-merge's extendTailwindMerge (or a (defaultConfig) => config function). The default cn export is unchanged. Also re-exports createTailwindMerge, getDefaultConfig, and mergeConfigs. Fixes custom font-size/class-group configs being ignored (#​6).

Patch Changes
  • fix
docker/login-action (docker/login-action)

v4.6.0

Compare Source

Full Changelog: docker/login-action@v4.5.2...v4.6.0

v4.5.2

Compare Source

Full Changelog: docker/login-action@v4.5.1...v4.5.2

v4.5.1

Compare Source

Full Changelog: docker/login-action@v4.5.0...v4.5.1

v4.5.0

Compare Source

Full Changelog: docker/login-action@v4.4.0...v4.5.0

cli/cli (gh)

v2.97.0: GitHub CLI 2.97.0

Compare Source

Security

Four security vulnerabilities have been identified, and fixed, in this release. Users are advised to update gh to version v2.97.0 as soon as possible.

Several commands (including gh gist view, gh api, gh pr diff, gh release download --output -, gh codespace logs, gh skills preview, and gh agent-task view/create) printed externally controlled content without neutralizing terminal escape sequences, allowing escape sequence injection into a user's terminal.

See GHSA-3m3g-3wcr-px46 for more information.

Some request URLs were built without escaping their variable path components, so a value containing URL path metacharacters could alter the request path and cause gh to address a different resource than intended.

See GHSA-4fjg-2h4q-fwg3 for more information.

gh auth status (without --show-token) could print a portion of the authentication token in plaintext for token types whose format contains an underscore after the prefix, such as github_pat_*, ghs_*, and ghu_*.

See GHSA-cg6r-mpgc-h9mm for more information.

gh attestation verify built the certificate matcher from --signer-repo and --signer-workflow without escaping regex metacharacters, so a lookalike repository or workflow name could satisfy a matcher intended for a trusted signer and bypass attestation verification.

See GHSA-mm27-mwq9-fr5g for more information.

Address project fields and items by name in gh project

gh project item-edit and gh project item-list can now reference project fields and single-select options by name:

# Set an item's field by name
gh project item-edit 1 --owner monalisa --url <url> --field "Status" --value "In Progress"

# Show named fields as extra columns
gh project item-list 1 --owner "@&#8203;me" --field "Status" --field "Priority"

What's Changed

✨ Features
🐛 Fixes
📚 Docs & Chores
:dependabot: Dependencies

New Contributors

Full Changelog: cli/cli@v2.96.0...v2.97.0

kunchenguid/no-mistakes (github:kunchenguid/no-mistakes)

v1.41.2

Compare Source

Bug Fixes

v1.41.1

Compare Source

Bug Fixes

v1.41.0

Compare Source

Features

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

@akua-renovate
akua-renovate Bot force-pushed the renovate/all-minor-patch branch 18 times, most recently from a106b00 to 9430d43 Compare July 30, 2026 05:18
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Jul 30, 2026 •
edited
Loading

Copy link
Copy Markdown

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Updated (UTC)
❌ Deployment failed
View logs		 agentos-site b80bdf9 Aug 02 2026, 09:04 AM

@akua-renovate
akua-renovate Bot force-pushed the renovate/all-minor-patch branch 5 times, most recently from dd4215a to 8c310c3 Compare July 31, 2026 00:59
@akua-renovate akua-renovate Bot changed the title chore(deps): update all non-major dependencies Update all non-major dependencies Jul 31, 2026
@akua-renovate
akua-renovate Bot force-pushed the renovate/all-minor-patch branch from 8c310c3 to 1264bb5 Compare July 31, 2026 05:25
@akua-renovate akua-renovate Bot changed the title Update all non-major dependencies chore(deps): update all non-major dependencies Jul 31, 2026
@akua-renovate
akua-renovate Bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 0bbfcd5 to 75d656a Compare July 31, 2026 16:49
@akua-renovate
akua-renovate Bot force-pushed the renovate/all-minor-patch branch 9 times, most recently from 8366c5b to eee9fd1 Compare August 2, 2026 05:19
@akua-renovate
akua-renovate Bot force-pushed the renovate/all-minor-patch branch from eee9fd1 to b80bdf9 Compare August 2, 2026 09:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants