chore(deps): update ⬆️ mise-packages - #1065
Merged
Merged
Conversation
![renovate-approve[bot]](https://avatars.githubusercontent.com/in/7394?s=60&v=4){kind=small}
Contributor
Renovate Release NotesGenerated from Renovate's update table by the Packages that cannot be summarized from GitHub releases are listed explicitly below. astral-sh/ruff (aqua:astral-sh/ruff)0.16.7: 0.16.7Release NotesReleased on 2026-09-10. Preview features
Bug fixes
Rule changes
Performance
DocumentationOther changes
Contributors
Install ruff 0.16.7Install prebuilt binaries via shell scriptcurl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.7/ruff-installer.sh | shInstall prebuilt binaries via powershell scriptpowershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.16.7/ruff-installer.ps1 | iex"Download ruff 0.16.7Verifying GitHub Artifact AttestationsThe artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI: gh attestation verify <file-path of downloaded artifact> --repo astral-sh/ruffYou can also download the attestation from GitHub and verify against that directly: gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>astral-sh/uv (aqua:astral-sh/uv)0.12.13: 0.12.13Release NotesReleased on 2026-09-10. Python
Enhancements
Preview features
Performance
Bug fixes
Install uv 0.12.13Install prebuilt binaries via shell scriptcurl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-installer.sh | shInstall prebuilt binaries via powershell scriptpowershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-installer.ps1 | iex"Download uv 0.12.13Verifying GitHub Artifact AttestationsThe artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI: gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uvYou can also download the attestation from GitHub and verify against that directly: gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>0.12.12: 0.12.12Release NotesReleased on 2026-09-09. The executables in our macOS and Windows release archives and Bug fixes
Install uv 0.12.12Install prebuilt binaries via shell scriptcurl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.12/uv-installer.sh | shInstall prebuilt binaries via powershell scriptpowershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.12/uv-installer.ps1 | iex"Download uv 0.12.12Verifying GitHub Artifact AttestationsThe artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI: gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uvYou can also download the attestation from GitHub and verify against that directly: gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>atuinsh/atuin (aqua:atuinsh/atuin)v18.22.0: 18.22.0Release NotesBug Fixes
Features
Miscellaneous Tasks
Refactor
Testing
atuin-server 18.22.0Install atuin-server 18.22.0Install prebuilt binaries via shell scriptcurl --proto '=https' --tlsv1.2 -LsSf https://github.com/atuinsh/atuin/releases/download/v18.22.0/atuin-server-installer.sh | shInstall prebuilt binaries via powershell scriptpowershell -ExecutionPolicy Bypass -c "irm https://github.com/atuinsh/atuin/releases/download/v18.22.0/atuin-server-installer.ps1 | iex"Download atuin-server 18.22.0
Verifying GitHub Artifact AttestationsThe artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI: gh attestation verify <file-path of downloaded artifact> --repo atuinsh/atuinYou can also download the attestation from GitHub and verify against that directly: gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>atuin 18.22.0Install atuin 18.22.0Install prebuilt binaries via shell scriptcurl --proto '=https' --tlsv1.2 -LsSf https://github.com/atuinsh/atuin/releases/download/v18.22.0/atuin-installer.sh | shInstall prebuilt binaries via powershell scriptpowershell -ExecutionPolicy Bypass -c "irm https://github.com/atuinsh/atuin/releases/download/v18.22.0/atuin-installer.ps1 | iex"Download atuin 18.22.0
Verifying GitHub Artifact AttestationsThe artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI: gh attestation verify <file-path of downloaded artifact> --repo atuinsh/atuinYou can also download the attestation from GitHub and verify against that directly: gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>charmbracelet/gum (aqua:charmbracelet/gum)v2.0.1: v2.0.1No more gibberish
This is a small Friday fix bumping Bubble Tea to fix these symbols leaking from keyboard protocol Happy Friday and weekend, Charm ☀️ ChangelogOther stuff
Verifying the artifacts First, download the wget 'https://github.com/charmbracelet/gum/releases/download/v2.0.1/checksums.txt'
wget 'https://github.com/charmbracelet/gum/releases/download/v2.0.1/checksums.txt.sigstore.json'Then, verify it using cosign verify-blob \
--certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@​refs/heads/main' \
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
--bundle 'checksums.txt.sigstore.json' \
./checksums.txtIf the output is sha256sum --ignore-missing -c checksums.txtDone! You artifacts are now verified! Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky. |
Contributor
helm/helm (aqua:helm/helm)v4.3.0: Helm v4.3.0Helm v4.3.0 is a feature release. Users are encouraged to upgrade for the best experience. The community keeps growing, and we'd love to see you there!
Notable Changes
Installation and UpgradingDownload Helm v4.3.0. The common platform binaries are here:
This release was signed with The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with What's Next
Changelog
junegunn/fzf (aqua:junegunn/fzf)v0.74.4: 0.74.4Demo: Non-blocking fzf vim plugin on tmux floating panefzf-vim-show.mp4
|
Contributor
openai/codex (aqua:openai/codex)rust-v0.154.0: 0.154.0New Features
Bug Fixes
Documentation
Chores
ChangelogFull Changelog: openai/codex@rust-v0.153.0...rust-v0.154.0
snyk/cli (aqua:snyk/cli)v1.1307.2: v1.1307.21.1307.2 (2026-09-09)The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see this documentation Bug Fixes
|
Contributor
anthropics/claude-code (github:anthropics/claude-code)v2.1.270: v2.1.270What's changed
v2.1.269: v2.1.269What's changed
v2.1.268: v2.1.268What's changed
v2.1.267: v2.1.267What's changed
|
Contributor
backnotprop/plannotator (github:backnotprop/plannotator)v0.27.14: v0.27.14Follow @plannotator on X for updates Missed recent releases?
What's New in v0.27.14A community release. Eleven pull requests, nine of them from contributors, and one first-time contributor who arrived with two Pi fixes. Six of the changes close issues people filed. The theme is the long tail: Pi plans that lose their progress, Codex threads split across files, a browser setting that silently did nothing under WSL, a toolbar that grew off the bottom of the screen. Each one was reported by someone who hit it, and each one is fixed. Pi: plan progress survives compaction and session forksOn Pi, the approved plan's progress widget tracked Completion state is now persisted into the approved plan's markdown itself. A new #1496 by @a4180p, closing #1376 reported by @huangxinsteam-oss, with @michaelmior confirming the same failure. Pi: Ask AI renders completed messages and reports errorsAsk AI on Pi built its response from streamed The provider now maps text blocks from Pi's #1495 by @a4180p. Codex: annotate-last works when a thread spans several rollout filesOne Codex thread can be written across several rollout JSONL files. Every rollout for the thread is now considered, newest first, and annotate-last uses the first one that actually contains a rendered assistant message. The Stop hook's plan detection takes the newest existing rollout for the current session and deliberately does not fall back across segments, so an older segment can never resurrect a stale plan. Single-file threads behave exactly as before. The fix was verified against the Codex CLI with a synthetic multi-segment session home. #1493 by @FNDEVVE, closing #1367 reported by @arklanq-patronus.
|
| Release | Highlights |
|---|---|
| v0.27.12 | Unified decision control, token hover cards, local-vs-remote diff, approval notes |
| v0.27.11 | OpenCode server leak fix, durable local feedback archive, unknown-subcommand fix |
| v0.27.10 | Auto-viewed files on scroll, annotation undo/redo, OpenCode 2 slash commands restored, npm 12 agent terminal fix |
| v0.27.9 | WebMCP browser-agent tools, HTML refresh from disk, host seams, lazy renderers, Windows uninstall fix |
| v0.27.8 | Pi keeps its prompt cache across plan transitions, thumbs-up returns to HTML annotation, embed picker seam |
| v0.27.7 | Pi host crash fix on Windows, Call Flow tree cap, jj fork-point base, plannotator knowledge skill + llms.txt |
| v0.27.6 | Live app annotation lands on Pi, one interaction model for HTML pages |
| v0.27.5 | Annotate your running app, Agent TUI placement, collapsed lockfiles, VS Code theme fix |
| v0.27.4 | Portable Guided Review exports, guides.show share links, guide CLI, jj Call Flow |
| v0.27.3 | Folder watcher freeze fix on large repos, first SBOM-attested release pipeline |
| v0.27.2 | Mobile plan and code review, Codex CLI 0.147 fix, configurable markdown extensions |
| v0.27.1 | Open-in-editor launch fix, file headers respect Viewed/Git-add visibility toggles |
What's New in v0.27.13
Six pull requests, four of them from community contributors, two from first-time contributors. The headline answers a request straight from X: open a code review against the base you actually mean, not always the trunk. Alongside it: a security hardening of the document endpoint, the end of our longest-standing CI flake, and a Amp delivery fix.
Open a review on a specific base
plannotator review always opened against the detected trunk, even when you were reviewing one layer of a stacked branch. A user on X put it plainly: "it always opens vs. main even if it explicitly understands that I'm reviewing a stack."
Now the review can open exactly where you point it:
# stack: main → feature/part-1 → feature/part-2 (you are here)
plannotator review --base feature/part-1
# opens on "All changes since feature/part-1": just what this layer adds
plannotator review --base feature/part-1 --diff-type merge-base
# the committed-only view of the same layer--base takes anything git resolves: a branch, origin/branch, a tag, a commit, HEAD~3. --diff-type picks the opening view from the same nine modes the dropdown offers. Both are a starting state, nothing more: the session opens there, everything stays changeable in the UI, and neither flag ever touches your saved defaults. A base that does not exist fails at launch with a clear message and a "did you mean" suggestion instead of silently producing a wrong diff.
This matters most when an agent opens the review for you. The agent knows which layer it just built, so it can hand you a review already looking at the right thing instead of telling you which dropdown to click. The installed skills teach exactly that: reviewing a stack layer, pass --base <the branch below yours>.
The flags work across every host that launches reviews through the CLI, and error honestly on surfaces where a base has no meaning (jj, GitButler, Perforce, multi-repo workspaces, and PR URLs, whose base comes from the platform). #1484
One behavior change shipped with this. The review command used to silently ignore flags it did not recognize; a typo like --bse main opened a review as if you had typed nothing, and in the worst case an unknown flag could swallow the PR URL next to it. Unknown dash-prefixed flags now fail loudly with a usage hint, matching how annotate has always behaved. Plain words stay tolerated, so slash-command hosts that forward your raw sentence keep working. OpenCode and Pi slash commands also now reject CLI-only transport flags such as --tailscale that they previously accepted and ignored. #1483
Symlinks can no longer read outside the project
A symlink committed into a repository you are reviewing could point anywhere on your disk, and the endpoint that serves linked documents would follow it: the requested path looked like it was inside the project, but the content came from outside it. Document reads are now gated on real-path containment in both server runtimes: a path must land inside the project both as written and after resolving symlinks, or the request is refused.
Legitimate symlink setups keep working, including symlinked project roots (macOS temp directories) and links that resolve within the project. Three edge behaviors changed on purpose: a symlink escaping the project returns 403 on every path through the endpoint, HTML files over the 2MB annotate cap now return 413 where one path previously served them in full, and a file that exists but cannot be opened returns 500 instead of 404.
Contributed by @bendrucker in a first contribution that went well beyond its own scope: along the way he reproduced our longest-standing CI flake, disproved our working theory with actual experiments, and traced it to the real root cause below. #1437
The CI flake is dead, and tests stay out of your data
Four annotate-server tests had been failing intermittently on CI for weeks (#1464), passing on rerun, resisting diagnosis. The root cause turned out to be a single line: shared storage captured the data directory once at module import, so a test that imported it under a temporary override poisoned every later test in the process, and test-file discovery order decided who got hit. The same freeze meant a full test run could write into a contributor's real ~/.plannotator.
Storage now resolves its directory per call, and the test suite sandboxes PLANNOTATOR_DATA_DIR for every run, with regression tests locking both halves down. Two contributors converged on the same root cause independently within a day, from different starting points: @FNDEVVE working from our test-isolation issue, and @bendrucker debugging his own PR's CI failures. Closes #1455 and #1464. #1473
Amp: feedback is routed by decision, never guessed from prose
The Amp plugin classified review outcomes by searching the rendered feedback text for phrases, so a genuine comment like "this path has no feedback loop, add one" pattern-matched as no-action and was silently dropped. The CLI now offers plannotator review --json, emitting one structured { decision, message } record from the same builder as the plaintext output, and Amp routes purely on the decision field. The prose classifier is gone. An outdated CLI produces a recoverable update notice with the captured output, never a guessed decision.
Contributed by @FNDEVVE, closing #1456. #1476
Additional Changes
- Selection toolbar stays on screen on phones: selecting short text near a screen edge in compact touch layouts overflowed the floating toolbar past the viewport, clipping its buttons. It now clamps inside the screen (respecting notch safe areas) and keeps its centered position whenever that fits. Desktop placement is untouched. Contributed by @katya4oyu in their first contribution. #1471
- The view dropdown follows the live base: the "All changes since " option label was baked at session start from the detected trunk and never updated, so it could contradict the base picker sitting next to it. It now renders from the active base.
Install / Update
macOS / Linux:
curl -fsSL https://plannotator.ai/install.sh | bashWindows:
irm https://plannotator.ai/install.ps1 | iexClaude Code Plugin: Run /plugin in Claude Code, find plannotator, and click "Update now".
Pi: Update @​plannotator/pi-extension to 0.27.13 and restart Pi.
OpenCode: Clear cache and restart:
rm -rf ~/.bun/install/cache/@​plannotatorWhat's Changed
- feat(review): open a review on a specific base and diff type in #1484
- fix(review): strict argument parsing for unknown review flags in #1483
- fix(doc): deny symlink escapes on /api/doc reads by @bendrucker in #1437
- fix(test): isolate test-run data from contributor history by @FNDEVVE in #1473
- fix(amp): relay structured decisions without prose classification by @FNDEVVE in #1476
- fix(ui): keep selection toolbar within compact touch viewport by @katya4oyu in #1471
New Contributors
- @bendrucker made their first contribution in #1437
- @katya4oyu made their first contribution in #1471
Community
This release is mostly the community's. @bendrucker shipped the symlink containment work through two rebases we caused, and when CI failed on his branch he did the diagnosis himself: reproduced it deterministically, tested and disproved our working theory, and root-caused a flake that had dogged this project for weeks, then filed the follow-up (#1477) for the remaining cases. @FNDEVVE swept our own issue tracker and closed two filed issues in as many days, with fixes careful enough that one of them independently matched bendrucker's root cause line for line. @katya4oyu fixed a real phone papercut with a minimal, well-tested change that read the repo's conventions closely enough to regenerate a build manifest most first PRs miss. And the headline feature exists because a user on X told us the review always opened against the wrong base when reviewing a stack. They were right.
Thank you. Plannotator gets better because you tell us where it falls short.
Full Changelog: backnotprop/plannotator@v0.27.12...v0.27.13
janosmiko/lfk (github:janosmiko/lfk)
v0.18.12: v0.18.12
0.18.12 (2026-09-11)
Features
Bug Fixes
- reap browser opener process and close probe handle (#761) (ae84899)
- reset the explorer layout to normal on config reload (#764) (7368824)
v0.18.11: v0.18.11
0.18.11 (2026-09-10)
Features
- quarantine a pod out of its Service selectors (#751) (24bfdb1)
- show what constrains the selected object (#755) (b985970)
Bug Fixes
- land owner jumps on the visible sidebar row (#759) (623d313), closes #748
- open the constraints view for workloads only and size its columns (#758) (cd1cdcc)
- scope the instant metrics throttle by namespace (#749) (eb50b95)
v0.18.10: v0.18.10
0.18.10 (2026-09-09)
Features
- add KYAML output to copy, export, and the YAML viewer (#732) (3f204ac)
- browse Dynamic Resource Allocation objects (#737) (1424a37)
- browse MutatingAdmissionPolicy and binding objects (#734) (78e075c)
- browse PodCertificateRequest and ClusterTrustBundle objects (#738) (f02f204)
- jump from a pod to its ResourceClaim with c (#746) (97ece1e)
- resize pod container resources in place (#747) (72575dd)
- show the right-sizing data span when it is shorter than the window (#740) (cef699d)
Bug Fixes
- drop kubeconfig files that declare no clusters, users or contexts (#741) (ba3eacf)
- drop kubeconfig files whose only cluster has no server (#745) (73c5117)
- keep user-supplied values out of config warnings (#744) (a38904c)
- log the kubeconfig_dir shape instead of its raw value (#739) (c9106b4)
- show a real Changed age on container rows (#736) (eaf73e1)
- show the resources a Helm release manages in its resource map (#743) (b275a9e), closes #742
- treat HPA minReplicas 0 as scaled to zero (#735) (38e10d7)
modem-dev/hunk (github:modem-dev/hunk)
v0.22.0: v0.22.0
What's Changed
- test(website): cover stable changelog promotion by @benvinegar in test(website): cover stable changelog promotion modem-dev/hunk#973
- feat(website): add VCS landing pages and sitemap alias by @benvinegar in feat(website): add VCS landing pages and sitemap alias modem-dev/hunk#970
- Add hunk-gh, hunk-viewed to hunk-extension marketplace by @benvinegar in Add hunk-gh, hunk-viewed to hunk-extension marketplace modem-dev/hunk#981
- fix(pager): stop CPU pegging and truncation on large piped documents by @benvinegar in fix(pager): stop CPU pegging and truncation on large piped documents modem-dev/hunk#978
- feat(extensions): show delegated review metadata by @benvinegar in feat(extensions): show delegated review metadata modem-dev/hunk#986
- feat(extensions): add review reload requests by @benvinegar in feat(extensions): add review reload requests modem-dev/hunk#988
- build: upgrade Bun to 1.4.2 by @benvinegar in build: upgrade Bun to 1.4.2 modem-dev/hunk#990
- feat: add static-first history browsing by @benvinegar in feat: add static-first history browsing modem-dev/hunk#979
- refactor(ui): share desktop chrome with history by @benvinegar in refactor(ui): share desktop chrome with history modem-dev/hunk#983
- feat(ui): make history automatically responsive by @benvinegar in feat(ui): make history automatically responsive modem-dev/hunk#987
- fix(ui): prepare history reviews before terminal handoff by @benvinegar in fix(ui): prepare history reviews before terminal handoff modem-dev/hunk#989
- refactor(ui): keep history reviews in one renderer by @benvinegar in refactor(ui): keep history reviews in one renderer modem-dev/hunk#992
- refactor: move hunkdiff into packages/hunk by @benvinegar in refactor: move hunkdiff into packages/hunk modem-dev/hunk#997
- docs(website): list hunk-history in the extension directory by @any-victor in docs(website): list hunk-history in the extension directory modem-dev/hunk#995
- refactor(ui): route surfaces through one session runtime by @benvinegar in refactor(ui): route surfaces through one session runtime modem-dev/hunk#998
- refactor(extensions): centralize session ownership by @benvinegar in refactor(extensions): centralize session ownership modem-dev/hunk#999
- fix(ui): keep suspended jobs alive upon fg by @HackAttack in fix(ui): keep suspended jobs alive upon fg modem-dev/hunk#996
- feat(ui): collapse sidebar tree folders by @benvinegar in feat(ui): collapse sidebar tree folders modem-dev/hunk#1009
- test(ui): harden job control resume coverage by @benvinegar in test(ui): harden job control resume coverage modem-dev/hunk#1010
- refactor: extract bundled Git provider by @benvinegar in refactor: extract bundled Git provider modem-dev/hunk#1001
- refactor: extract shared VCS infrastructure by @benvinegar in refactor: extract shared VCS infrastructure modem-dev/hunk#1005
- refactor: extract bundled Jujutsu provider by @benvinegar in refactor: extract bundled Jujutsu provider modem-dev/hunk#1002
- refactor: extract bundled Sapling provider by @benvinegar in refactor: extract bundled Sapling provider modem-dev/hunk#1003
- feat(cli): support replies to review comments by @benvinegar in feat(cli): support replies to review comments modem-dev/hunk#1012
- feat(ui): group history by day by @benvinegar in feat(ui): group history by day modem-dev/hunk#1011
- docs(architecture): refresh maintainer guidance by @benvinegar in docs(architecture): refresh maintainer guidance modem-dev/hunk#1013
- chore: organize repository scripts by @benvinegar in chore: organize repository scripts modem-dev/hunk#1014
- fix(ui): save log view preferences by @benvinegar in fix(ui): save log view preferences modem-dev/hunk#1015
- refactor(ui): use default diff row memo comparison by @benvinegar in refactor(ui): use default diff row memo comparison modem-dev/hunk#1017
- refactor(ui): inline diff row dispatch by @benvinegar in refactor(ui): inline diff row dispatch modem-dev/hunk#1018
- refactor(ui): require planned diff rows by @benvinegar in refactor(ui): require planned diff rows modem-dev/hunk#1019
- feat(ui): show history commit metadata in reviews by @benvinegar in feat(ui): show history commit metadata in reviews modem-dev/hunk#1016
- refactor(ui): make diff row dispatch exhaustive by @benvinegar in refactor(ui): make diff row dispatch exhaustive modem-dev/hunk#1025
- refactor(ui): share diff row note targets by @benvinegar in refactor(ui): share diff row note targets modem-dev/hunk#1026
- refactor(ui): clarify raw diff row planning by @benvinegar in refactor(ui): clarify raw diff row planning modem-dev/hunk#1027
- chore(deps): bump the github-actions group with 2 updates by @dependabot[bot] in chore(deps): bump the github-actions group with 2 updates modem-dev/hunk#966
- feat(dev): add disposable Firecracker shell by @benvinegar in feat(dev): add disposable Firecracker shell modem-dev/hunk#1030
- fix(cli): print static reviews without a tty by @benvinegar in fix(cli): print static reviews without a tty modem-dev/hunk#1029
- docs(video): require readable terminal commands by @benvinegar in docs(video): require readable terminal commands modem-dev/hunk#976
- fix(git): shorten SHAs in comparison titles by @benvinegar in fix(git): shorten SHAs in comparison titles modem-dev/hunk#1035
- fix(keys): match alt across terminal protocols by @benvinegar in fix(keys): match alt across terminal protocols modem-dev/hunk#991
- docs(website): list hunk-compact-filenav in the extension directory by @rschoch in docs(website): list hunk-compact-filenav in the extension directory modem-dev/hunk#1034
- feat(ui): animate docked pane transitions by @benvinegar in feat(ui): animate docked pane transitions modem-dev/hunk#941
- fix(session): report daemon health probe failures by @samuela in fix(session): report daemon health probe failures modem-dev/hunk#927
- feat(review): add multiline comment selections by @benvinegar in feat(review): add multiline comment selections modem-dev/hunk#931
- feat(log): review contiguous commit ranges by @benvinegar in feat(log): review contiguous commit ranges modem-dev/hunk#1031
- fix(ui): show info for comparison reviews by @benvinegar in fix(ui): show info for comparison reviews modem-dev/hunk#1032
- refactor(ui): extract diff selection controller by @benvinegar in refactor(ui): extract diff selection controller modem-dev/hunk#1037
- fix(ui): persist themes across routed surfaces by @benvinegar in fix(ui): persist themes across routed surfaces modem-dev/hunk#1040
- feat: rename the stack diff layout to unified by @saadjs in feat: rename the stack diff layout to unified modem-dev/hunk#945
- feat(history): add configurable command ids by @benvinegar in feat(history): add configurable command ids modem-dev/hunk#1039
- perf(ui): cap pane animations at 30 fps by @benvinegar in perf(ui): cap pane animations at 30 fps modem-dev/hunk#1036
- feat(log): add visual range selection by @benvinegar in feat(log): add visual range selection modem-dev/hunk#1038
- refactor(ui): normalize session theme startup by @benvinegar in refactor(ui): normalize session theme startup modem-dev/hunk#1041
- perf(ui): restore fast wrapped line rendering by @benvinegar in perf(ui): restore fast wrapped line rendering modem-dev/hunk#1043
- feat(dev): preload fixtures in disposable VM shell by @benvinegar in feat(dev): preload fixtures in disposable VM shell modem-dev/hunk#1042
- feat(install): add observable release proxy by @benvinegar in feat(install): add observable release proxy modem-dev/hunk#969
- fix(ui): retain view preferences across history reviews by @benvinegar in fix(ui): retain view preferences across history reviews modem-dev/hunk#1045
- feat(review): make inline notes keyboard selectable by @benvinegar in feat(review): make inline notes keyboard selectable modem-dev/hunk#1044
- fix(ui): remove duplicate reply range connectors by @benvinegar in fix(ui): remove duplicate reply range connectors modem-dev/hunk#1046
- fix(ui): save note drafts without stale input races by @benvinegar in fix(ui): save note drafts without stale input races modem-dev/hunk#1050
- chore(git): internalize tree ref resolver by @benvinegar in chore(git): internalize tree ref resolver modem-dev/hunk#1052
- fix(watch): reload direct files outside repositories by @benvinegar in fix(watch): reload direct files outside repositories modem-dev/hunk#1054
- fix(ui): keep wrapped diff interactions responsive by @benvinegar in fix(ui): keep wrapped diff interactions responsive modem-dev/hunk#1051
- fix(release): support current prerelease metadata by @benvinegar in fix(release): support current prerelease metadata modem-dev/hunk#1056
- chore(release): prepare v0.22.0-beta.0 by @benvinegar in chore(release): prepare v0.22.0-beta.0 modem-dev/hunk#1061
- feat(cli): show metadata for direct revision reviews by @benvinegar in feat(cli): show metadata for direct revision reviews modem-dev/hunk#1064
- perf(test): make suite sharding configurable by @benvinegar in perf(test): make suite sharding configurable modem-dev/hunk#1057
- perf(ci): parallelize validation lanes by @benvinegar in perf(ci): parallelize validation lanes modem-dev/hunk#1058
- perf(nix): skip unchanged lock generation by @benvinegar in perf(nix): skip unchanged lock generation modem-dev/hunk#1059
- fix(update): avoid GitHub release rate limits by @benvinegar in fix(update): avoid GitHub release rate limits modem-dev/hunk#1069
- fix(ui): swap unified and split layout keys by @benvinegar in fix(ui): swap unified and split layout keys modem-dev/hunk#1068
- chore(release): prepare v0.22.0-beta.1 by @benvinegar in chore(release): prepare v0.22.0-beta.1 modem-dev/hunk#1070
- chore(release): include latest main in v0.22.0-beta.1 by @benvinegar in chore(release): include latest main in v0.22.0-beta.1 modem-dev/hunk#1071
- docs(release): publish v0.22.0-beta.1 notes by @benvinegar in docs(release): publish v0.22.0-beta.1 notes modem-dev/hunk#1072
- perf(ci): focus Windows compatibility tests by @benvinegar in perf(ci): focus Windows compatibility tests modem-dev/hunk#1074
- feat(video): add camera pans and callouts by @benvinegar in feat(video): add camera pans and callouts modem-dev/hunk#1055
- fix(watch): check Git signatures asynchronously by @elucid in fix(watch): check Git signatures asynchronously modem-dev/hunk#1075
- fix(watch): register directory watchers in yielding batches on Linux by @elucid in fix(watch): register directory watchers in yielding batches on Linux modem-dev/hunk#1076
- chore(release): prepare v0.22.0 by @benvinegar in chore(release): prepare v0.22.0 modem-dev/hunk#1081
New Contributors
- @any-victor made their first contribution in docs(website): list hunk-history in the extension directory modem-dev/hunk#995
- @rschoch made their first contribution in docs(website): list hunk-compact-filenav in the extension directory modem-dev/hunk#1034
- @saadjs made their first contribution in feat: rename the stack diff layout to unified modem-dev/hunk#945
Full Changelog: modem-dev/hunk@v0.21.0...v0.22.0
nolabs-ai/nono (github:nolabs-ai/nono)
v0.77.0: v0.77.0
What's Changed
- docs(cli): update built-in profiles and groups list by @lukehinds in docs(cli): update built-in profiles and groups list nolabs-ai/nono#1840
- feat(profile)!: remove all legacy aliases and deprecation shims for v1.0.0 prep by @SequeI in feat(profile)!: remove all legacy aliases and deprecation shims for v1.0.0 prep nolabs-ai/nono#1826
- docs(cli): link built-in groups to their policy.json source by @SequeI in docs(cli): link built-in groups to their policy.json source nolabs-ai/nono#1850
- fix(cli): ignore unhandled keys in the denied-path review selector by @MateSaary in fix(cli): ignore unhandled keys in the denied-path review selector nolabs-ai/nono#1852
- fix(cli): always re-invoke the credential source for ambient captures by @kipz in fix(cli): always re-invoke the credential source for ambient captures nolabs-ai/nono#1849
- fix(lib): validate localhost port ranges for zero end and inverted ranges by @Ayush7614 in fix(lib): validate localhost port ranges for zero end and inverted ranges nolabs-ai/nono#1860
- fix(cli): guard denied-path selector against type-ahead by @MateSaary in fix(cli): guard denied-path selector against type-ahead nolabs-ai/nono#1863
- fix(cli): keep legacy ~/.claude.json in sync with CLAUDE_CONFIG_DIR redirects by @SequeI in fix(cli): keep legacy ~/.claude.json in sync with CLAUDE_CONFIG_DIR redirects nolabs-ai/nono#1837
- ci: run full integration suite on PRs by @SequeI in ci: run full integration suite on PRs nolabs-ai/nono#1872
- feat(cli): use CLONE_FILES bootstrap for network-notification sessions by @lukehinds in feat(cli): use CLONE_FILES bootstrap for network-notification sessions nolabs-ai/nono#1825
New Contributors
- @Ayush7614 made their first contribution in fix(lib): validate localhost port ranges for zero end and inverted ranges nolabs-ai/nono#1860
Full Changelog: nolabs-ai/nono@v0.76.0...v0.77.0
SocketDev/socket-cli (npm:socket)
v1.1.171: v1.1.171
What's Changed
- upgrading coana to version 15.10.40 by @socket-pr-bot[bot] in upgrading coana to version 15.10.40 SocketDev/socket-cli#1536
Full Changelog: SocketDev/socket-cli@v1.1.170...v1.1.171
semgrep/semgrep (pipx:semgrep)
v1.177.0: Release v1.177.0
1.177.0 - 2026-09-10
### Added
- Added native Supply Chain support for Bazel workspaces using
rules_jvm_external. Semgrep now recognizes amaven_install.jsonpinned lockfile (versions0.1.0and3, as emitted by rules_jvm_external 3.x through current) paired with aMODULE.bazel(or legacyWORKSPACE/WORKSPACE.bazel) marker as a Maven-ecosystem subproject, and attributes findings to the workspace root rather than the lockfile's directory. Workspace-declared root artifacts are identified via__INPUT_ARTIFACTS_HASHfor accurate direct-vs-transitive classification; dependencies are emitted withUnknowntransitivity when that field is not available. This is the first milestone of native Bazel coverage; broader ecosystem support (rules_python,rules_go,rules_js) and Bazel-aware reachability attribution follow. (SC-2008) - Several performance improvements for regex-only rules where the underlying
regex are inefficient to run on our default regex engine (currently PCRE2). For
example, a rule matchingFOOBAR(a+)\1will skip any file that does not
containFOOBARwithout running the regex. (scrt-979)
### Changed
- Prefilter conditions now evaluate their cheap string predicates before their
expensive regex predicates. Since evaluation short-circuits, a file that a
string check already rules in or out no longer pays for regex predicates
(which is what a pattern's prefilter falls back to when no literal substring
can be extracted from it, and which can be slow on files with very long
lines). (prefilter-rank-conjuncts) - Supply Chain scans can report dependencies from their Gradle module build files instead of the root manifest. This behavior is disabled by default during rollout and can be tested with
--x-gradle-module-attribution. Enabling it can change finding IDs because finding paths change; the ID calculation is unchanged. (SC-2560)
### Fixed
-
Speed up
semgrep cifiltering when a deployment has many triage-ignored findings. (triage-ignored-performance) -
Semgrep no longer crashes with an OCaml stack trace when a proxy environment
variable holds an unusable value.HTTP_PROXY,HTTPS_PROXY, orALL_PROXY
set to an empty value is now ignored with a warning, and the scan
proceeds without a proxy. A non-empty value that is not a usable proxy URL
now exits with an error message, with any credentials in the URL
redacted, instead of failing inside the HTTP client.Semgrep also now adds the missing scheme to a proxy URL supplied
without one;httpsforHTTPS_PROXY andhttp` otherwise. (ENGINE-2208) -
Supply Chain: lockfileless Gradle scans now report a "Resource Inaccessible"
resolution error when a repository refuses a request (for example a 401 from a
private registry), instead of exiting successfully with a silently incomplete
dependency list. (sc-3358)
### Infra/Release Changes
- Improves shutdown time during scans with --trace. (otel-shutdown-flush)
jdx/usage (usage)
v6.9.0: v6.9.0: Default-subcommand flag routing, standalone Args parsing, and smaller help builds
Flags belonging to a default subcommand can now select it without typing its name, a derived Args type can be parsed on its own, help colours can be remapped, and a series of help-rendering changes trims binary size for usage-rs adopters. Bash completion also stops mangling colon-separated candidates.
Added
-
(parse) Opt-in default-subcommand flag routing (#1413, @jdx). With
default_subcommand_flags, leading flags that belong only to the configured default subcommand route to it, soem -ua @​worldparses asem install -ua @​world. Explicit command names and aliases still win, parent-only flags and bare invocations stay on the parent, a mixed short bundle such as-puakeeps the parent's-p, and--or an unknown flag stops the lookahead. Completion also offers the default command's flags at the root. Supported in KDL specs, the Rust derive, and the Go runtime; existing routing is unchanged without the opt-in.usage lintreportsdefault_subcommand_flagsdeclared without adefault_subcommand.default_subcommand "install" default_subcommand_flags #true
#[usage(default_subcommand = "install", default_subcommand_flags)] -
(parse) Parse a derived
Argstype without an enclosing CLI (#1419, @jdx).usage::parse_args_from::<T>treats the slice as that command's words;usage::parse_args_from_argv::<T>strips argv0 first. Both reuse the command's compiled flags, positionals, defaults, validation, and nested subcommands, and return the ordinary parse errors, including help and version requests. Available behind thespecfeature.let install = usage::parse_args_from::<Install>(&args)?;
-
(help) Remap semantic help colours with a
Palette(#1414, @lu-zero). Theheading,option,metavar, andcommandroles were previously fixed SGR colours.help::Paletteremaps any of them using the existing{$…}tag vocabulary (for example"cyan+bold"), andStyle::paletteapplies it; role names expand once, so mappingmetavarto"heading"uses the built-in heading colour. Hosts that own the exit path getembedded_outcome_paletted/embedded_outcome_into_paletted(andembedded::outcome_paletted);parse()and plain rendering are unchanged.let palette = usage::help::Palette::DEFAULT.metavar("cyan+bold"); match Ex::embedded_outcome_paletted(&argv, palette) { /* … */ }
Changed
-
(cli) Smaller binaries and faster help rendering (#1396, #1399, #1400, #1401, @jdx). Help sorting and rendering do less work and share more code, plain (uncoloured) help skips colour-span analysis, and the flag diagnostics share one formatter. Help output is byte-identical; on the oxc binaries used for measurement this removed roughly 360 KiB combined, and plain
--helprendered about 18% faster locally. Two new opt-ins let CLIs trim further:-
Flattened subcommand pages,
HelpAll, and recursiverender_allnow live behind ahelp-advancedfeature (enabled by default inusage-rsandusage-argv). A CLI that uses none of them can disable defaults and omit it:usage = { package = "usage-rs", version = "6", default-features = false, features = ["help", "diagnostics", "completions"] }
-
#[usage(spec_endpoint_file = "cli.usage.kdl")]answers__usage_spec__from a KDL file included at compile time, keeping the endpoint without linking the runtime serializer.to_kdl()still generates from live metadata, so regenerate the file after CLI changes and test the two for drift.
Compatibility note: dependents that already set
default-features = falseand declareflatten_helpor aHelpAllflag must addhelp-advanced; the derive now rejects those declarations at compile time, and hand-written metadata requesting advanced help panics when rendered instead of being silently ignored. -
Fixed
- (bash) Preserve colon-prefixed completion words (#1405, @jdx). When
:is inCOMP_WORDBREAKS, Readline replaces only the fragment after the last colon, so candidates such asupdate:deps:no-cooldownwere inserted with a duplicatedupdate:deps:prefix. The generated Bash script now forwards the current Readline word andCOMP_WORDBREAKSto the__complete_word__request, and the binary reports the prefix Readline keeps so the script can trim it; escaped colons, consecutive colons, and a cursor on a colon are handled. Path candidates are unaffected. Regenerate Bash completion scripts to pick up the fix (reported in Bash completion duplicates colon-prefixed task names on second Tab jdx/mise#12970).
New Contributors
- @lu-zero made their first contribution in #1414
Full Changelog: jdx/usage@v6.8.0...v6.9.0
💚 Sponsor usage
usage is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.
If usage powers CLI specs, docs, or completions for a tool you maintain or use, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep usage fast, free, and independent.
Skipped Packages
Non-GitHub Sources
- npm:cspell (https://cspell.org/)
GitHub Release Notes Unavailable
- droid: No GitHub release was found for
0.218.1
renovate
Bot
force-pushed
the
renovate/mise-packages
branch
2 times, most recently
from
September 16, 2026 20:35
b093da9 to
d03a912
Compare
scottames
approved these changes
Sep 16, 2026
renovate
Bot
force-pushed
the
renovate/mise-packages
branch
from
September 16, 2026 21:56
1eabd11 to
59ce169
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
0.16.6→0.16.70.16.80.12.11→0.12.130.12.15(+1)18.21.0→18.22.02.0.0→2.0.14.2.4→4.3.00.74.3→0.74.4rust-v0.153.4→rust-v0.154.01.1307.1→1.1307.20.216.0→0.218.10.220.0(+2)v2.1.266→v2.1.270v2.1.273(+2)v0.27.12→v0.27.14v0.27.15v0.18.9→v0.18.12v0.18.14(+1)v0.21.1→v0.22.0v0.76.0→v0.77.0v0.78.010.3.0→10.3.110.3.3(+1)1.1.170→1.1.1711.1.173(+1)1.176.1→1.177.06.8.0→6.9.06.9.1Release notes are maintained in a PR comment by the
renovate-release-notes-commentworkflow.Configuration
📅 Schedule: (in timezone America/Los_Angeles)
* 3-5 * * *)🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.