[dependabot]

Bumps WireCatLabs/cli-base/.github/workflows/node-ci.yml from 0.31.0 to 0.47.5.

Release notes

Sourced from WireCatLabs/cli-base/.github/workflows/node-ci.yml's releases.

0.35.0

Added

• Bounded batches share parsing, correlation and sequential execution. prepareBatch, readBatchInput and runBatch accept explicit registered handlers, cap input/count/read reservations and retained output, and keep a result for every input on budget refusal. Failed reads never refund their reserved ceiling; it is not a byte consumption measurement. Hosts retain account authorization, cancellation, final rendering and resource cleanup. projectBatchAnswers selects nested answer fields while retaining ids, errors and completeness.

Full changelog

0.31.1

Fixed

• Nested field selection traverses arrays and retains report coverage. Item/list envelopes, continuation, missing data and operation identifiers are handled by one shared projector; consumers no longer need to unwrap item answers.

Full changelog

Changelog

Sourced from WireCatLabs/cli-base/.github/workflows/node-ci.yml's changelog.

Changelog

Notable changes to @wirecat/cli-base (published as @wirecat/cli-core up to 0.20.0), one section per version, newest first. Versions follow semantic versioning; before 1.0.0 a minor release may change the API. Versions before 0.8.0 are in the git tags.

Every entry says what changed as a caller sees it, why, and what to watch for — the rules are docs/dev/CONVENTIONS.md.

0.50.3 — 23.10.2026

Added

• The vocabulary has press and app for a messenger's bot buttons. Verb press (press a button under a bot's message; the bot sees who pressed it), the owner's word for it (2026-10-23), and view app (a bot's mini app: the address that opens it). tg and max mount messages press and chats app, so unknown-verb stops reporting them; a CLI whose baseline lists them sees "stale baseline entry" and removes the lines.

0.50.2 — 23.10.2026

Added

• The vocabulary has the words a messenger's bot commands use. Verbs answer, action and watch; views me and between; resources callbacks, webhooks, templates, media and the singular auth; flags --secret (which secret beside a bot token to keep) and --store-token. The owner approved them for the shared bot commands tg, max and wa mount, so unknown-verb, unknown-resource and option-role stop reporting those commands. A CLI whose baseline lists them sees "stale baseline entry" and removes the lines.

• The messenger vocabulary names sign-in sessions, cached metadata, conversations, analysis work and statistics views precisely. Decryption and retry keep distinct meanings; model categories and alternate spellings still use existing words in command migrations.

• The flag vocabulary distinguishes analysis and embedding providers, recorded-consent identities, tag ownership claims, stored-answer models and saved reply-template policies. It also declares the disappearing-message duration, admin-only chat settings, photo removal and sticker-file input with explicit roles.

0.50.1 — 23.10.2026

Fixed

• Joined-path hints can retain a profile. refuseJoinedPath accepts an optional display prefix so hosts can preserve the caller's profile in the corrected invocation. Existing two-argument calls stay valid.

• Skill commands have concise summaries. Detailed installation paths remain in their descriptions, while help and discovery show short task names.

• Secret checks follow the checked revision. Shared CI, security and release checks scan its complete reachable history. An unrelated fetched branch can no longer fail a clean pull request.

0.50.0 — 22.10.2026

Changed — may break callers

• The shared scripts TypeScript configuration checks vitest.config.ts. Consumers extending it now catch type errors in their test-runner configuration alongside scripts; fix newly reported errors before upgrading.

• The handbook clarifies JSON previews and local release validation. A dry-run preview uses the item

... (truncated)

Commits

• 46d9970 fix(keyring): require the Secret Service on Linux instead of the kernel keyri...
• f6f5222 chore(release): 0.47.4 (#272)
• 68decf7 feat(standards): register selected annotation transfer vocabulary (#270)
• 555903c chore(release): 0.47.3 (#271)
• 08a90b9 fix(query): read a chat id with @ as one term, unquoted (#269)
• b8c56ea chore(release): 0.47.2 (#267)
• 7810058 refactor(standards): drop --qr-file from the flag vocabulary (#266)
• f9435c4 docs(standards): WC-REL-9 counts only changes that make a CLI change its code...
• 611505b chore(release): 0.47.1 (#264)
• 265b053 feat(standards): --alias vocabulary flag (#263)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[leemour]

Superseded by #235, which moves every action pin in this repository to its latest release (pinned by commit SHA with a version comment).