chore(deps): update ⬆️ mise-packages - #1072
Conversation
![renovate-approve[bot]](https://avatars.githubusercontent.com/in/7394?s=60&v=4){kind=small}
Renovate Release NotesGenerated from Renovate's update table by the Packages that cannot be summarized from GitHub releases are listed explicitly below. astral-sh/uv (aqua:astral-sh/uv)0.12.15: 0.12.15Release NotesReleased on 2026-09-15. Performance
Bug fixes
Install uv 0.12.15Install prebuilt binaries via shell scriptcurl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.15/uv-installer.sh | shInstall prebuilt binaries via powershell scriptpowershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.15/uv-installer.ps1 | iex"Download uv 0.12.15Verifying GitHub Artifact AttestationsThe artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI: gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uvYou can also download the attestation from GitHub and verify against that directly: gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>0.12.14: 0.12.14Release NotesReleased on 2026-09-15. Enhancements
Preview features
Performance
Bug fixes
Install uv 0.12.14Install prebuilt binaries via shell scriptcurl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.14/uv-installer.sh | shInstall prebuilt binaries via powershell scriptpowershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.14/uv-installer.ps1 | iex"Download uv 0.12.14Verifying GitHub Artifact AttestationsThe artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI: gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uvYou can also download the attestation from GitHub and verify against that directly: gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>cli/cli (aqua:cli/cli)v2.101.0: GitHub CLI 2.101.0Linux package repository signing key rotationGitHub CLI's APT and RPM repositories, along with individual RPM packages, are now signed only with the new PGP key (fingerprint:
Copy authentication codes to the clipboard by default
To persistently opt out, run: gh config set clipboard disabledExplicit clipboard options still take precedence for an individual invocation. What's Changed✨ Features
🐛 Fixes
📚 Docs & Chores
|
Dependencies
anthropics/claude-code (github:anthropics/claude-code)v2.1.273: v2.1.273What's changed
v2.1.272: v2.1.272What's changed
v2.1.271: v2.1.271What's changed
aquaproj/aqua (github:aquaproj/aqua)v2.63.0aquaproj/aqua@v2.62.3...v2.63.0 SecurityFix a path traversal vulnerability GHSA-286g-rf2x-cv99. Features#5117 Create timestamp files as group writable and document read only $AQUA_ROOT_DIR Fixes#5237 Skip minisign verification if the host platform doesn't support minisign Others#5239 Fix Dockerfile build failure caused by a stale apt package index backnotprop/plannotator (github:backnotprop/plannotator)v0.27.15: v0.27.15Follow @plannotator on X for updates Missed recent releases?
What's New in v0.27.15Twenty-six pull requests, three of them from outside contributors and two of those first contributions. Most of the work is on the HTML annotate surface: pinpoint comments now carry a description of the element they point at, the page gets the whole viewport by default, links between local HTML files stay inside the session, and a folder review can finally see every comment it has collected. The rest is correctness work on annotation restore, on the Codex Stop hook, on the OpenCode 2 notice ordering, and on the x64 release binaries. Four behavior changes are worth reading before you update: HTML annotate sessions now open with the floating tools hidden, the plan diff opens in Classic view again, an emoji on a GitHub alert's first line becomes that alert's icon, and Codex 0.114 through 0.116 users now get plan review on Stop where they previously got nothing. Plannotator TUI and Herdr AnnotateA one-time panel now announces Plannotator's two terminal tools. Plannotator TUI is a standalone terminal client: annotate Markdown in the terminal (select, comment, looks good, delete), review a folder, or annotate one of your agent's recent replies, then hand the review to your agent as numbered feedback. Herdr Annotate is a Plannotator plugin for Herdr: comment on any terminal text, review Markdown documents and agent replies inside Herdr, and send the feedback straight back to the agent. Its document review runs Plannotator TUI. The panel shows a looping demo of the real client, one headline, one sentence, and a row of actions. It appears once per browser across plan review, annotate, and code review, then never again. There are no install commands or feature lists in it; the repo pages carry those. It is also suppressed in sessions that have no server behind them, so the public share portal never shows it. The repos are plannotator-tui and herdr-annotate. Pinpoint comments describe the element to the agentPinpointing an element in a raw HTML or live app session used to export either a placeholder quote ( Each pinpoint now captures a bounded description of the element at click time: tag, id, author-written classes, an ancestor path, ARIA role and accessible name, an allowlisted set of attributes, the rendered text, a collapsed HTML skeleton, the child count, the viewport box, the nearest landmark and heading, a component hint from The capture is deliberately narrow. Form values, inline HTML annotate: the page gets the viewport, and the chords are realThree changes to the raw HTML surface, all from owner feedback while using it. Tools are hidden on open. An annotated HTML page owns the full viewport now, with no floating chrome over it on a fresh session. The header eye shows them, and so does the new
The header controls explain themselves. Back, Refresh, the eye, and the pen now carry tooltips with a description line and their keyboard shortcut instead of a bare title string. Links between local HTML files open as linked documentsA srcdoc document has no URL of its own, so it inherits the parent page's. A plain Link clicks are now intercepted in the bridge and resolved in the parent. A relative or nested sibling opens as a linked document in place, with its annotations kept per document. An in-page fragment scrolls within the current document. A server-absolute path resolves against the directory the session opened from. A sibling markdown file opens as a markdown document. An off-origin link opens in a new tab with The way back is a new header control, leftmost of the group, named after the document it returns to. It claims no keyboard chord, because All files view in the annotations panelIn a folder session the annotations panel only ever showed the open file's comments. Reviewing across several documents, there was no way to see the whole review, and a file with nothing on it showed "No annotations yet" beside a small count of comments elsewhere that you could not read. The panel header now carries a The default rule is the frustration this exists for: your saved preference wins, except that a document with no feedback of its own, while other documents have some, opens on All files. Arriving by clicking a card in the All files list keeps you on All files. A plan review session with linked documents open contributes the plan's own comments as a group too, labelled GitHub alert titles, and the annotation restore work that followedA GitHub alert whose first body line is a bold-only line now renders that line as the alert's title on the icon row, in place of the type word. An emoji on that line becomes the alert's icon, which is the behavior change to know about: That change removed a paragraph from the rendered alert, and the annotation layer addresses blocks by position. A draft saved before the upgrade could resolve onto the wrong element, so restore verification was turned on for plan review and annotate: a restore whose painted text does not match the annotation's own quote is dropped and retried by text search, and only reported when the rescue also fails. That guard then turned out to be too strict, and the next two releases of work fixed what it broke and what it had been hiding. Restore verification compared the stored quote against the painted text with whitespace collapsed to a single space, but a selection string carries a blank line between blocks and the painted marks are concatenated with nothing between them. Every annotation spanning two paragraphs, a heading and its paragraph, or two list items came back from a reload with no highlight at all, under a misleading toast about edited text. Whitespace-only differences are now accepted, and content drift is still rejected. Two more shapes were failing closed for their own reasons: a drag starting inside excluded chrome, such as an alert's visually hidden type word, painted only its tail, so the start of a range is now snapped onto the first annotatable position it covers; and list markers are The other half of this is that an annotation that genuinely cannot be re-anchored is now visible on markdown surfaces the way it already was on HTML: the comment stays in the panel, still exports, and carries an Unanchored chip so you know its highlight is gone rather than wondering where it went.
Comment box caret alignment on Windows and LinuxThe comment composer paints its visible text with a mirror layer over a transparent textarea, and only the caret still comes from the textarea itself. When the textarea grew tall enough to sprout a classic vertical scrollbar, the kind Windows and Linux use, which consumes layout width, the textarea's lines wrapped earlier than the mirror's. From the first line whose wrap point differed, the caret was drawn away from the character it belonged to. macOS and iOS overlay scrollbars take no layout width, which is why nobody on a Mac ever saw it. The overlay's right padding now tracks the measured scrollbar width, re-measured when a resize adds or drops the scrollbar rather than only on keystrokes. Where the measured width is zero, the code writes no inline style at all, so macOS, iOS, and every touch surface render a byte-identical DOM to before. Classic is the plan diff default againThe plan diff opens in Classic view, the block-level view with old above new. The word-level Rendered view is still there next to Raw. This applies to every surface that renders the plan diff, including the annotate version diff, since they share one mode setting. OpenCode 2: feedback no longer lands behind the session noticeOn OpenCode v2, The notice and the feedback that follows it now share one promotion, so they enter the same turn. Two follow-ups hardened the tracking behind that. The first made the pending flag track reality instead of intent: it was set when the host accepted the notice and cleared only after our own prompt, so a reviewer who typed anything in the TUI while the review was open had the notice promoted out from under the flag, and feedback sent minutes later was steered into the middle of an unrelated turn. The flag is now cleared when the host reports the row left the inbox, read in both event vocabularies OpenCode 2 uses, after which feedback falls back to queued delivery. The second made the tracker's Codex: Stop plan review stays in the current turnThe Codex Stop hook could scrape the most recent That fix assumed every Codex sends a turn id with its Stop payload. It does not. The hooks engine shipped in Codex 0.114 and the The deny-and-resubmit de-duplication needed the same treatment. It anchored on a Pi: PLANNOTATOR_BROWSER script paths work on macOSOn macOS the Pi extension always ran x64 release binaries run on older CPUsThe v0.27.14 Linux x64 CLI exited with SIGILL on an Ivy Bridge Xeon E3-1220 V2, because the default Bun x64 target assumes instructions those CPUs do not have. The Linux and Windows x64 CLI and paste service binaries are now compiled with Bun's baseline x64 target, which Bun recommends for pre-2013 hardware. A bounded QEMU Nehalem gate was added to the existing Linux release smoke job, checking CLI
Additional Changes
Install / UpdatemacOS / Linux: curl -fsSL https://plannotator.ai/install.sh | bashWindows: irm https://plannotator.ai/install.ps1 | iexClaude Code Plugin: Run Pi: Update OpenCode: Clear cache and restart: rm -rf ~/.bun/install/cache/@​plannotatorWhat's Changed
New Contributors
Contributors@rNoz returns with the Codex Stop turn scoping in #1169, the fix that stops a decided plan from being re-opened by a later turn. It is his tenth merged pull request on the project, and the two follow-ups in this release both build directly on the machinery it introduced. He also helped diagnose the Pi browser failure on @punk-dev-robot's issue. @punk-dev-robot reported the silent @ybtam found that the official Linux x64 binary would not start on an Ivy Bridge Xeon, tracked it to the Bun compile target, and shipped the baseline build with a QEMU Nehalem gate in #1514 so the failure cannot ship again. First contribution. The reports and proposals that shaped this release:
Thank you. Plannotator gets better because you tell us where it falls short. Full Changelog: backnotprop/plannotator@v0.27.14...v0.27.15 janosmiko/lfk (github:janosmiko/lfk)v0.18.14: v0.18.140.18.14 (2026-09-14)Bug FixesPerformance Improvements
v0.18.13: v0.18.130.18.13 (2026-09-13)Bug Fixes |
SocketDev/socket-cli (npm:socket)v1.1.176: v1.1.176What's Changed
Full Changelog: SocketDev/socket-cli@v1.1.175...v1.1.176 v1.1.175: v1.1.175What's Changed
Full Changelog: SocketDev/socket-cli@v1.1.174...v1.1.175 v1.1.174: v1.1.174What's Changed
Full Changelog: SocketDev/socket-cli@v1.1.173...v1.1.174 v1.1.173: v1.1.173What's Changed
Full Changelog: SocketDev/socket-cli@v1.1.172...v1.1.173 v1.1.172: v1.1.172What's Changed
Full Changelog: SocketDev/socket-cli@v1.1.171...v1.1.172 jdx/usage (usage)v6.9.1: v6.9.1: Default-only flags commit to the default subcommand, and large KDL specs parse about 4x fasterA default-only flag now commits the rest of the line to the default subcommand even when a later word spells a sibling command, and the KDL parser scans strings in chunks so large generated specs load several times faster. The Go modules now require Go 1.26. Fixed
Changed
New Contributors
Full Changelog: jdx/usage@v6.9.0...v6.9.1 💚 Sponsor usageusage is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work. If Skipped PackagesNon-GitHub Sources
GitHub Release Notes Unavailable
|
17a355c to
6193d23
Compare
This PR contains the following updates:
0.12.13→0.12.150.12.17(+1)2.100.0→2.101.01.50.1→1.50.22.5.1→2.6.00.65.0→0.65.11.14.0→1.14.11.25.0→1.26.01.18.30→1.18.312.72.1→2.72.20.37.1→0.38.00.38.12.19.0→2.19.12.19.20.218.1→0.221.00.223.0(+1)v0.25.0→v0.26.0v2.1.270→v2.1.273v2.1.278(+4)v2.62.3→v2.63.0v0.27.14→v0.27.15v0.27.16v0.18.12→v0.18.14v0.18.155.6.0→5.8.05.8.13.9.6→3.9.73.9.81.1.171→1.1.1766.9.0→6.9.16.10.0Release notes are maintained in a PR comment by the
renovate-release-notes-commentworkflow.Configuration
📅 Schedule: (in timezone America/Los_Angeles)
* 3-5 * * *)🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.