Skip to content

chore(deps): update ⬆️ mise-packages#980

Open
renovate[bot] wants to merge 3 commits into
mainfrom
renovate/mise-packages
Open

chore(deps): update ⬆️ mise-packages#980
renovate[bot] wants to merge 3 commits into
mainfrom
renovate/mise-packages

Conversation

@renovate

@renovate renovate Bot commented Jul 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Update Change Pending Age Adoption Passing Confidence
aqua:anthropics/claude-code patch 2.1.207 → 2.1.209 2.1.214 (+3) age adoption passing confidence
aqua:atuinsh/atuin patch 18.17.0 → 18.17.1 age adoption passing confidence
aqua:dprint/dprint patch 0.55.1 → 0.55.2 age adoption passing confidence
aqua:openai/codex patch rust-v0.144.1 → rust-v0.144.4 rust-v0.144.6 (+1) age adoption passing confidence
aqua:securego/gosec minor 2.27.1 → 2.28.0 age adoption passing confidence
aqua:sst/opencode minor 1.17.18 → 1.18.0 1.18.3 (+2) age adoption passing confidence
aqua:tree-sitter/tree-sitter patch 0.26.10 → 0.26.11 age adoption passing confidence
aqua:vercel-labs/agent-browser patch 0.31.1 → 0.31.2 0.32.2 (+2) age adoption passing confidence
github:agavra/tuicr patch v0.19.0 → v0.19.1 age adoption passing confidence
github:always-further/nono minor v0.67.1 → v0.68.0 age adoption passing confidence
github:janosmiko/lfk patch v0.15.6 → v0.15.7 v0.15.10 (+2) age adoption passing confidence
npm:markdownlint-cli patch 0.49.0 → 0.49.1 age adoption passing confidence
pipx:mypy (changelog) minor 2.2.0 → 2.3.0 age adoption passing confidence
usage patch 3.5.4 → 3.5.5 age adoption passing confidence

Release notes are maintained in a PR comment by the renovate-release-notes-comment workflow.

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

  • Branch creation
    • Between 03:00 AM and 05:59 AM (* 3-5 * * *)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from scottames as a code owner July 18, 2026 12:32
@renovate
renovate Bot enabled auto-merge (squash) July 18, 2026 12:32
@scottames-github-bot

scottames-github-bot Bot commented Jul 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Renovate Release Notes

Generated from Renovate's update table by the renovate-release-notes-comment workflow.

Packages that cannot be summarized from GitHub releases are listed explicitly below.

anthropics/claude-code (aqua:anthropics/claude-code)

v2.1.209: v2.1.209

Compare Source

What's changed

  • Fixed /model and other dialogs being blocked in claude agents background sessions (reverts an overly broad guard)

v2.1.208: v2.1.208

Compare Source

What's changed

  • Added screen reader mode: opt-in plain-text rendering for screen reader users. Run claude --ax-screen-reader, set CLAUDE_AX_SCREEN_READER=1, or add "axScreenReader": true to settings.
  • Added vimInsertModeRemaps setting: map two-key insert-mode sequences like jj to Escape in vim mode
  • Added CLAUDE_CODE_PROCESS_WRAPPER: agent view and the background service now honor a corporate launcher by running every Claude Code self-spawn through a required wrapper executable
  • Added mouse-click support for multi-select menus and "Other" input rows in fullscreen mode
  • Fixed fast mode staying off after switching back to a model that supports it — it now restores automatically when enabled in settings
  • Fixed replies typed to a background agent being lost when delivery fails — the text is now saved and delivered when the session restarts
  • Fixed background-session attach failing permanently ("Couldn't start the background daemon") after an update replaced the binary a running claude agents process was launched from
  • Fixed the context window (and auto-compact indicator) briefly resetting to 200k after the CLI auto-updates, causing a false "100% context used" when resuming long-context sessions
  • Fixed supervised and background sessions crashing when a server closed an HTTP/2 connection with a GOAWAY while requests were in flight
  • Fixed truncated stream-json/JSON output and missing result message when piping large responses from claude -p
  • Fixed CLAUDE_CODE_MAX_OUTPUT_TOKENS and similar env vars silently using the mantissa of scientific-notation values (1e6 became 1)
  • Fixed very large markdown tables stalling rendering or using excessive memory; tables over 200 rows show the first 200 with a "… N more rows" notice
  • Fixed the Edit tool failing on files modified after reading when the target text still matches uniquely
  • Fixed Read reporting empty files as "shorter than offset", Grep silently returning "No files found" for invalid regex patterns, Grep count mode under-reporting totals when paginated, and Glob crashing with an unclear error when the pattern, path, or working directory contained a null byte
  • Fixed apiKeyHelper script failures being hidden behind a generic 401 after ~10 silent retries; the script's own error is now shown within 3 attempts
  • Fixed Bedrock streaming requests failing with a misleading "Truncated event message received" when a gateway transforms the response — the error now names the content-type and points at the proxy
  • Fixed /upgrade showing a login flow instead of the upgrade URL when the browser fails to open
  • Fixed stream-json input killing the session on blank CRLF or whitespace-only lines from Windows-style SDK hosts
  • Fixed headless stream-json sessions hanging permanently when a control_request carried a non-string set_model payload; the CLI now answers with an error response
  • Fixed repeated "No completion record was found" notices on session resume — orphaned background tasks now collapse into a single summary
  • Fixed Remote Control clients attaching to a terminal-hosted session not seeing background agents and workflow progress until a task started or stopped
  • Fixed the Agent tool launching with no tools when a subagent's tools list resolves to nothing — it now returns a clear error naming the unrecognized entries
  • Fixed /usage showing stale cached bars over fresher data, and /mcp not reclassifying placeholder servers after config edits
  • Fixed "Change directory" in SDK hosts (e.g. Claude Desktop) failing with "A turn is in progress" on idle sessions that have a running background task
  • Fixed the workflow save dialog showing ~/.claude/workflows/ instead of the CLAUDE_CONFIG_DIR location for user-scope saves
  • Fixed /release-notes adding the viewed notes to the model's context — "Show all" previously injected the entire changelog into every subsequent request
  • Fixed a memory leak in the agent view where pasted images were retained for the screen's lifetime after sending peek replies
  • Fixed SDK sessions losing agents defined via the initialize request when a plugin refresh ran before the client attached
  • Fixed several memory leaks in long sessions: MCP stdio server stderr accumulating up to 64 MB per server, LSP documents staying open indefinitely (now LRU with 50-doc cap), async hook output retained after backgrounding, and unbounded growth in headless/SDK sessions from large tool-result payloads
  • Fixed a memory blowup when reading files with extremely long single lines using offset/limit — the read now returns a clean error instead of loading the whole line
  • Fixed multi-second per-turn slowdowns in sessions with many permission deny/ask rules — rule matchers are now compiled once and cached
  • Improved input responsiveness while agent task lists update — task updates no longer re-render the entire UI
  • Reduced per-tool-call CPU overhead in print/SDK sessions with many MCP tools by caching tool-pool assembly (up to 7x faster tool rounds at high tool counts)
  • Reduced memory usage by bounding the file edit read cache to 16 MB instead of pinning up to 1,000 full files
  • Reduced session transcript size (up to 79x in edit-heavy sessions) and bounded checkpoint disk usage by pruning superseded file-history backups
  • Reduced memory usage when resuming sessions with background agents or forks spawned from large conversations
  • Completed background agents now stay listed in /tasks until cleanup instead of vanishing the moment they finish
  • Attaching to a stopped background agent now shows its transcript immediately while the session warms up, instead of a blank "Session is starting" screen
  • Background sessions: an older daemon no longer silently restarts workers spawned by a newer version onto the older binary
  • Agent view: Ctrl+X now deletes renamed-branch worktrees, never destroys unpushed commits, keeps the session row when a worktree is kept, and reused worktree names reset to the current base
  • Catastrophic removals (e.g. rm -rf ~) in commands containing $(…)/backticks/<(…) now prompt in --dangerously-skip-permissions and auto mode, matching the plain form
  • /install-github-app and the /mcp settings menu no longer open in background sessions
  • MCP servers configured with an empty URL now show as "not configured" in /mcp instead of a config error
  • /usage now shows your last-known usage bars with an "as of" note when the usage endpoint is rate-limited, instead of an error screen
  • Fixed Bedrock auth failing with "Session token not found or invalid" for AWS SSO profiles whose sso_region differs from the Bedrock region (2.1.207 regression)
atuinsh/atuin (aqua:atuinsh/atuin)

v18.17.1: 18.17.1

Compare Source

Release Notes

Bug Fixes

  • (ai) Default to non-Hub mode for custom AI endpoints (#3620)
  • (import) Fix order of entries imported from zsh history (#3597)
  • (import) Fix import order of nushell history entries (#3598)
  • Various prefix mode bugs (#3616)

Documentation

  • Document output capture and mcp (#3595)

Features

  • (tui) Truncate long commands from middle to show start...end (#3602)

Miscellaneous Tasks

  • (logging) Remove the log crate in favor of tracing (#3608)
  • Update to rust 1.97 (#3617)

atuin 18.17.1

Install atuin 18.17.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/atuinsh/atuin/releases/download/v18.17.1/atuin-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/atuinsh/atuin/releases/download/v18.17.1/atuin-installer.ps1 | iex"

Download atuin 18.17.1

File Platform Checksum
atuin-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
atuin-x86_64-pc-windows-msvc.zip x64 Windows checksum
atuin-aarch64-unknown-linux-gnu.tar.gz ARM64 Linux checksum
atuin-x86_64-unknown-linux-gnu.tar.gz x64 Linux checksum
atuin-aarch64-unknown-linux-musl.tar.gz ARM64 MUSL Linux checksum
atuin-x86_64-unknown-linux-musl.tar.gz x64 MUSL Linux checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo atuinsh/atuin

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

atuin-server 18.17.1

Install atuin-server 18.17.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/atuinsh/atuin/releases/download/v18.17.1/atuin-server-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/atuinsh/atuin/releases/download/v18.17.1/atuin-server-installer.ps1 | iex"

Download atuin-server 18.17.1

File Platform Checksum
atuin-server-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
atuin-server-x86_64-pc-windows-msvc.zip x64 Windows checksum
atuin-server-aarch64-unknown-linux-gnu.tar.gz ARM64 Linux checksum
atuin-server-x86_64-unknown-linux-gnu.tar.gz x64 Linux checksum
atuin-server-aarch64-unknown-linux-musl.tar.gz ARM64 MUSL Linux checksum
atuin-server-x86_64-unknown-linux-musl.tar.gz x64 MUSL Linux checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo atuinsh/atuin

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>
dprint/dprint (aqua:dprint/dprint)

0.55.2: 0.55.2

Compare Source

Changes

Install

Run dprint upgrade or see https://dprint.dev/install/

Checksums

Artifact SHA-256 Checksum
dprint-x86_64-apple-darwin.zip b7074cf6c814f995b783b5baa7e516b34e783c42c9baf7af553dbad731adb3a7
dprint-aarch64-apple-darwin.zip e9ba8ed7988f3350501a8cf8af92da616cdec8d9d5c831c069293c587311b49d
dprint-x86_64-pc-windows-msvc.zip 12e8c26abc8c436223e70f5a30a2864001c92fa356a859eb93e06b97ab7dbd12
dprint-x86_64-pc-windows-msvc-installer.exe 60ecca3c071224d3097570dc07148457e86b97a85aba868cd0714377208825cd
dprint-aarch64-pc-windows-msvc.zip 65846975b2a8f4e36982ddff875147157c2c9b04c6eb17134d6655ed51e3a931
dprint-x86_64-unknown-linux-gnu.zip d7ccde62d789dfb048717252d259e21253e32feffe4cbf2dab9954eeab492219
dprint-x86_64-unknown-linux-musl.zip 45fc0eef3216af21c4c22c6e7e233aa45c3080fac07b6e94db7008a5c8e5c67a
dprint-aarch64-unknown-linux-gnu.zip 299923f2b56d66756ad2c7c220650c72f26437fd3f48b3fb6c0df664073eb1d1
dprint-aarch64-unknown-linux-musl.zip f0101217dd0abc94f1ac01b83d306d0288aeee8a501e8614a5e2bbe037500be0
dprint-riscv64gc-unknown-linux-gnu.zip ed70faf3ecfbb67786470c62fd3eee44172451fa91166f660c7a52a9d9c36979
dprint-loongarch64-unknown-linux-gnu.zip 9dccf17fd3d79885ece6b3442639cb62cc1ac3852d9a30467fb2f18b4c0997f4
dprint-loongarch64-unknown-linux-musl.zip 11eb0a855e862bc27c002b863125e96fa794b8d149f919759639fd76d6f31032
dprint-powerpc64le-unknown-linux-gnu.zip bb7b367b0ad41b413d4b0828cf96d5344e0686e14ab3bb1705a0705b340dd3ec
dprint-powerpc64le-unknown-linux-musl.zip 7973e0203bd5ca23fa50b75c45c61284080500fa50ec45b7ba422bd0f1dad0ed
dprint-aarch64-linux-android.zip 879a8de2c7e2b17dfd36fff855807803793fefdf8da9b1f69bc07c0a31f94ca3
dprint-x86_64-linux-android.zip 986c5f1926d9a1ae5049ac87c03f0d4cd7fdb823840d47af4fc6080725f3db32
openai/codex (aqua:openai/codex)

rust-v0.144.4: 0.144.4

Compare Source

Chores

  • No user-facing changes in this patch release.

Changelog

Full Changelog: openai/codex@rust-v0.144.3...rust-v0.144.4

securego/gosec (aqua:securego/gosec)

v2.28.0: v2.28.0

Compare Source

Changelog

  • 9e75c0576c9878035d4221392108d458abe10fc3 feat(G101): detect AWS temporary access keys (#1702)
  • 14f493ab92f212e1f3d69aeaa561989e5baf9d6f Update to go version 1.26.5 and 1.25.12 (#1704)
  • ffd5ba1d3354928fae89ac31912bd1d730798799 Update all dependencies (#1703)
  • 849570622f56a251c015c0e2417aebafc0216e17 Update all dependencies (#1699)
  • 11023e51e1f46c4ea63315bdb7670f073442168f Update all dependencies (#1698)
  • f88a0781159d73052ba792962e624749904783d6 fix: min+max G115 false positives (#1697)
  • 6a008f60b8f7f3d7fae8f126984a9df5d4b7e0cf Update all dependencies (#1696)
  • caf8857bbd3276599d0176b0528e9712bb0b5bec fix(G404): flag missing math/rand weak-random functions (#1694)
  • cbef395cb1e2e3a35f6223f5b97f1657f7144797 Update all dependencies (#1695)
  • f1c81de5fcdf7b466b229fb24ca02d1a8406dd09 Update all dependencies (#1693)
  • 9addc97cefc9460a114e3c36f536b935da3b98c9 Update to go version 1.26.4 and 1.25.11 (#1690)
  • 92ed8df32846e85d4e81b0b62012567afddfdc95 Update the gosec in the Github action to v2.27.1 (#1688)
sst/opencode (aqua:sst/opencode)

v1.18.0: v1.18.0

Compare Source

Desktop

Improvements

  • Completed the Desktop v2 migration, including upgrade handling for the new layout and first-launch onboarding.
  • Added a setting to switch between the new and old Desktop layouts during the transition period.

Bugfixes

  • Fixed file views using the wrong background in the v2 layout.
  • Fixed connected project picker positioning when its anchor is still loading.
  • Kept permission auto-accept state separate for each server.
  • Fixed a project picker positioning crash.
  • Kept terminal tab rename focused while editing.
  • Enabled remote sessions to auto-accept permissions correctly.
  • Fixed terminal tabs stealing focus when they mount.
  • Loaded more timeline history at once to reduce repeated backfill while scrolling.
  • Resynced the timeline correctly after reconnecting.
  • Preserved the composer caret after request updates.
  • Reduced Home cold-load time substantially.
  • Preserved timeline bottom anchoring more reliably.
  • Clarified status indicator severity.

v1.17.20: v1.17.20

Compare Source

Core

Bugfixes

  • Removed an obsolete Codex workaround that could interfere with OpenAI Luna Responses Lite requests.

Improvements

  • Updated Azure AI support for GPT-5.6.

v1.17.19: v1.17.19

Compare Source

Core

Bugfixes

  • Supported OpenAI pro reasoning mode.
  • Disabled response storage by default for xAI Responses. (@​geraint0923)
  • Added OAuth support for Luna Responses Lite.
  • Switched to another available org after logging out in the console.
  • Used Codex context limits for GPT-5.6 over OAuth. (@​nabilfreeman)

TUI

Bugfixes

  • Forwarded CLI environment variables to the TUI worker.

Desktop

Bugfixes

  • Removed interface transition changes that were accidentally shipped to dev.
  • Fixed clipped labels and branch tooltips.
  • Stopped the review panel width from jumping when opening or closing it.
  • Focused the prompt input when starting a new session.
  • Prevented some new-session updates from blocking the UI.
  • Fixed timeline outlines getting clipped.
  • Aligned context token counts with usage totals.
  • Kept the file tree visible while opening files.

Improvements

  • Redesigned attachment cards and file comment chips in the new interface.
  • Updated the review panel with persistent file browsing, better file tabs, and easier open-in-app actions.
  • Restyled the Edit Project modal to match the new interface.
  • Added middle-click to open sessions in a new tab.
  • Added a temporary setting to switch between the old and new interface.
  • Added per-prompt model selection in the composer.
  • Polished the new interface styling across the session view and terminal.

Thank you to 2 community contributors:

  • @​nabilfreeman:
    • fix(openai): use codex context limits for gpt-5.6 (#36248)
  • @​geraint0923:
    • fix(xai): default store to false for Responses (#36629)
tree-sitter/tree-sitter (aqua:tree-sitter/tree-sitter)

v0.26.11: v0.26.11

Compare Source

What's Changed

Full Changelog: tree-sitter/tree-sitter@v0.26.10...v0.26.11

vercel-labs/agent-browser (aqua:vercel-labs/agent-browser)

v0.31.2: v0.31.2

Compare Source

New Features

  • WebGPU launch preset - Added --webgpu across the CLI, config, environment, and MCP surfaces, with hardware backends on macOS and Windows, software Vulkan on Linux, automatic Xvfb for displayless headed sessions, and a doctor --webgpu render and screenshot probe (#1529)

Improvements

  • Added periodic restore-state autosaves while the browser remains open, preserving recent state after a browser window is closed by hand and capturing background page changes while honoring the restore save policy. The interval is configurable with AGENT_BROWSER_AUTOSAVE_INTERVAL_MS (#1509)

Contributors

  • @​ctate
agavra/tuicr (github:agavra/tuicr)

v0.19.1: v0.19.1

Compare Source

What's Changed

New Contributors

Full Changelog: agavra/tuicr@v0.19.0...v0.19.1

always-further/nono (github:always-further/nono)

v0.68.0: v0.68.0

Compare Source

What's Changed

New Contributors

Full Changelog: nolabs-ai/nono@v0.67.1...v0.68.0

janosmiko/lfk (github:janosmiko/lfk)

v0.15.7: v0.15.7

Compare Source

0.15.7 (2026-07-13)

Features

igorshubovych/markdownlint-cli (npm:markdownlint-cli)

v0.49.1: v0.49.1

Compare Source

  • Update markdownlint dependency to 0.41.1
    • Improve MD029
    • Fix module resolution under webpack
    • Update dependencies
  • Update all dependencies via Dependabot
jdx/usage (usage)

v3.5.5: v3.5.5: Hyphen-prefixed flag values

Compare Source

A small patch release that lets value-taking flags accept hyphen-prefixed values (such as passthrough args to a wrapped CLI), plus a redesigned logo.

Fixed

  • parse: allow hyphen-prefixed flag values (#715, fixes #713). Flags that carry passthrough values (e.g. forwarding args to terraform/terragrunt) previously lost values that started with - when the first letter collided with an existing short flag — ./repro -a -destroy would tokenize -destroy as -d estroy and silently drop the intended value of -a. Value flags can now opt in via allow_hyphen_values=#true, and the parser will consume the next -… token as that flag's value before short/long flag parsing kicks in:

    flag "-a --args <ARGS>" allow_hyphen_values=#true

    This works for -a -destroy, --args=-destroy, and repeated variadic values like -a -val1 -a -val2. Flags without the opt-in keep their existing behavior. The built-in usage complete-word --cword flag now sets this internally so negative cword indices parse correctly.

Documentation

  • Redesigned logo (#714). Replaces the previous raster logo with a clean flat vector flag mark — an ink flagpole with a green (#22c55e) swallowtail banner carrying the -- flag prefix. All derived favicons and app icons were regenerated from the new vector source, and an SVG favicon is now served for browsers that support it.

Full Changelog: jdx/usage@v3.5.4...v3.5.5

💚 Sponsor usage

usage is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise, aube, hk, and more. Work on usage is funded by sponsorships.

If usage powers CLI specs, docs, or completions for a tool you maintain or use, please consider sponsoring at jdx.dev. Every sponsorship helps the project stay independent and moving.

Skipped Packages

GitHub Release Notes Unavailable

  • pipx:mypy: No GitHub release was found for 2.3.0

@renovate
renovate Bot force-pushed the renovate/mise-packages branch from ac20cc7 to 5e39929 Compare July 18, 2026 17:52
@renovate
renovate Bot force-pushed the renovate/mise-packages branch from 1829207 to acc0e0d Compare July 18, 2026 20:51
@renovate

renovate Bot commented Jul 18, 2026

Copy link
Copy Markdown
Contributor Author

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@renovate-approve renovate-approve[bot] renovate-approve[bot] approved these changes
@scottames scottames Awaiting requested review from scottames scottames is a code owner

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@scottames