chore(deps): update ⬆️ mise-packages

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending	Age	Adoption	Passing	Confidence
aqua:astral-sh/uv	tools	patch	0.12.10 → 0.12.11	0.12.13 (+1)
aqua:mvdan/gofumpt	tools	minor	0.11.0 → 0.12.0
aqua:snyk/cli	tools	patch	1.1307.0 → 1.1307.1	1.1307.2
aqua:sst/opencode	tools	patch	1.18.29 → 1.18.30
aqua:vercel-labs/agent-browser	tools	minor	0.36.0 → 0.37.1
aqua:walles/moor	tools	minor	2.18.0 → 2.19.0
droid (source)		minor	0.213.0 → 0.216.0	0.218.1 (+2)
github:anthropics/claude-code	tools	patch	v2.1.263 → v2.1.266	v2.1.270 (+3)
github:janosmiko/lfk	tools	patch	v0.18.8 → v0.18.9	v0.18.13 (+3)
github:max-sixty/worktrunk	tools	minor	v0.76.0 → v0.77.0
github:nolabs-ai/nono	tools	minor	v0.75.0 → v0.76.0	v0.77.0
node (source)	tools	minor	24.20.0 → 24.21.0
npm:cspell (source)	tools	minor	10.2.2 → 10.3.0
npm:ctx7 (source)	tools	patch	0.5.10 → 0.5.11
npm:pyright (source)	tools	patch	1.1.413 → 1.1.414
npm:socket	tools	patch	1.1.169 → 1.1.170	1.1.171
usage	tools	minor	6.7.1 → 6.8.0	6.9.0

Release notes are maintained in a PR comment by the renovate-release-notes-comment workflow.

---

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

• Branch creation
  • Between 03:00 AM and 05:59 AM (* 3-5 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[scottames-github-bot]

Renovate Release Notes

Generated from Renovate's update table by the renovate-release-notes-comment workflow.

Packages that cannot be summarized from GitHub releases are listed explicitly below.

astral-sh/uv (aqua:astral-sh/uv)

0.12.11: 0.12.11

Compare Source

Release Notes

Released on 2026-09-08.

Preview features

• Generate missing artifact hashes when exporting pylock.toml files to ensure they conform to PEP 751 (#20146)
• Warn when pylock.toml artifact hash tables are empty, which will be rejected in a future uv release (#21462)

Performance

• Speed up installs that overwrite existing files by eliminating per-file temporary directories for atomic hard-link, symlink, and reflink replacements (#21478)
• Speed up installs that merge copied wheels into existing environments by replacing per-file temporary directories with adjacent temporary files (#21468)
• Speed up local wheel installs by replacing the shared ZIP cursor lock with positioned reads (#21500)
• Speed up local wheel installs by reusing ZIP readers and buffers across extracted files (#21499)
• Avoid transitive dependency checks and unnecessary resolution when uv pip install --no-deps finds the requested packages already installed (#21523)

Bug fixes

• Verify source archives against hashes recorded in uv.lock before reading their metadata or running their build backends (#21223)
• Verify supplied hashes for registry requirements pinned with === under both --verify-hashes and --require-hashes (#21543)
• Apply hashes from public-version pins to matching local versions when no exact local-version hash is provided (#21544)
• Support PowerShell virtual environment activation from UNC paths, including WSL paths (#19159)
• Trim surrounding whitespace from entries in .python-version and .python-versions files (#21529)
• Suppress VIRTUAL_ENV mismatch warnings for uv add --no-sync, uv remove --no-sync, and uv add --frozen (#21496)
• Warn and continue when uv python list cannot query an interpreter (#21498)

Documentation

• Restore TOML syntax highlighting for exclude-newer examples (#21534)

Install uv 0.12.11

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.11/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.11/uv-installer.ps1 | iex"

Download uv 0.12.11

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
uv-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
uv-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz	PPC64LE Linux	checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz	RISCV Linux	checksum
uv-s390x-unknown-linux-gnu.tar.gz	S390x Linux	checksum
uv-x86_64-unknown-linux-gnu.tar.gz	x64 Linux	checksum
uv-armv7-unknown-linux-gnueabihf.tar.gz	ARMv7 Linux	checksum
uv-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
uv-i686-unknown-linux-musl.tar.gz	x86 MUSL Linux	checksum
uv-riscv64gc-unknown-linux-musl.tar.gz	RISCV MUSL Linux	checksum
uv-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum
uv-arm-unknown-linux-musleabihf.tar.gz	ARMv6 MUSL Linux (Hardfloat)	checksum
uv-armv7-unknown-linux-musleabihf.tar.gz	ARMv7 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

mvdan/gofumpt (aqua:mvdan/gofumpt)

v0.12.0

Compare Source

This release is based on Go 1.27's gofmt, and requires Go 1.26 or later.

A standard library import carrying a doc or inline comment is no longer moved into the top import group, as the comment stayed behind and ended up detached at the bottom of the group. See #289.

Moving a standard library import up no longer leaves an empty line where it used to be, which split the remaining imports into extra groups. See #225.

A copyright header or package doc no longer makes gofumpt treat a single-line first declaration as multi-line, adding an empty line after it.

An assignment whose right-hand side is separated by a comment is now left alone, as merging the lines produced output which gofmt would change back.

Consider becoming a sponsor if you benefit from the work that went into this release!

Binaries built on go version go1.27.1 linux/amd64 with:

CGO_ENABLED=0 go build -trimpath -ldflags="-w -s"

snyk/cli (aqua:snyk/cli)

v1.1307.1: v1.1307.1

Compare Source

1.1307.1 (2026-09-07)

The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see this documentation

Bug Fixes

• test: snyk test on a repository with no supported manifest files again reports SNYK-CLI-0008 and exits 3, instead of a generic SNYK-CLI-0000 with exit 2. snyk test --json writes the error document to stdout as expected. (50cad38)
• test: Restores moduleName, insights.triageAdvice, and functions_new fields in snyk test --json output. (4ec3d18)
• test: .snyk policy files are now handled correctly in the unified test flow -- empty, whitespace-only and comment-only policies, date-only timestamps, and other edge cases that previously caused incorrect results or failures. (a22a563)
• general: Fixes a case where CLI commands that complete with findings (exit 1) could produce duplicate or corrupt JSON output when an unrelated network error occurred during the run. (836ee0d)
• general: Fixes debug-log scrubber so that secrets are consistently masked and scrubbing no longer corrupts the surrounding JSON structure. (d89333a)
• container: Container scans now surface source repository information for locally built images using BuildKit metadata. (dd6ff36)
• deps: Updates dependencies to fix vulnerabilities:
  • CVE-2022-25883 (465d5f3)
  • CVE-2026-84304 (27f00a1)
  • CVE-2026-84375 (5ceea33)
  • SNYK-GOLANG-GOLANGORGXCRYPTOSSH-19504090 (4ec3d18)

sst/opencode (aqua:sst/opencode)

v1.18.30: v1.18.30

Compare Source

Core

Improvements

• Added the Astra system prompt for GPT-6 models.

Bugfixes

• Preserved Bedrock DeepSeek model IDs, including ARN-based IDs, so they resolve correctly. (@​YeEmrick)
• Updated the Azure provider SDK to pick up compatibility fixes.
• Updated the OpenAI provider SDK to pick up compatibility fixes.
• Added reasoning effort variants for supported GitLab GPT and Claude models. (@​far-ouq)

Thank you to 3 community contributors:

• @​heimoshuiyu:
  • fix(console): openai usage normalization and tier threshold config (#47342)
• @​far-ouq:
  • fix(opencode): add GitLab reasoning variants (#47306)
• @​YeEmrick:
  • fix: preserve Bedrock DeepSeek model ids (#34441)

vercel-labs/agent-browser (aqua:vercel-labs/agent-browser)

v0.37.1: v0.37.1

Compare Source

Bug Fixes

• Fixed Windows headless Chrome desktop artifacts by isolating owned headless Chrome on a private desktop and ensuring its process tree is cleaned up when the daemon exits or is forcibly terminated. Headed and externally connected browsers retain their existing desktop behavior (#1498, #1820)

Contributors

• @​ctate

v0.37.0: v0.37.0

Compare Source

New Features

• Added higher-quality video recording: record start and record restart now capture the current active page at 30 fps by default, support --fps 1-60, use Page.startScreencast for smoother motion, and preserve wall-clock timing. WebM and MP4 output are documented, and doctor reports the ffmpeg recording dependencies (#1763, #1776, #1778)
• Added WebMCP availability output so navigation responses advertise when a page exposes allowed WebMCP tools, including availability metadata for CLI, JSON, and MCP clients (#1760)
• Added session setup inheritance for new tabs. Tabs opened with tab new or through page clicks now inherit the active session's headers, credentials, user agent, locale, timezone, geolocation, offline mode, routes, color scheme, and init scripts before their first navigation (#1777)

Bug Fixes

• Fixed recording startup validation so missing ffmpeg, extensionless output paths, and invalid recording options fail before browser or recording state changes. Failed replacements preserve the active take, and ffmpeg errors now include useful diagnostics (#1778)
• Fixed recording navigation state so URL navigation during recording clears stale element refs, frame scope, and page WebMCP state like normal navigation (#1776)

Contributors

• @​jamesvclements
• @​ctate
• @​Railly

walles/moor (aqua:walles/moor)

v2.19.0: v2.19.0: Go back to Go 1.25 for RHEL10 compatibility

Compare Source

With this release, moor drops back to requiring Go 1.25 instead of 1.27,
so it can still be built from source on distros like RHEL10 that haven't
caught up with the latest Go toolchain yet. Going forward, moor's Go
version requirement will never be newer than the most recently
end-of-lifed Go release.

Also in this release:

• twin, moor's terminal library, is now an external project
  (github.com/walles/twin) instead of living in this repository
• Fixed potential screen tearing on quick window resizes (twin v0.9.3)

anthropics/claude-code (github:anthropics/claude-code)

v2.1.266: v2.1.266

Compare Source

What's changed

• Fixed a 2.1.265 regression affecting LLM-gateway and proxy setups: the undocumented CLAUDE_CODE_USE_GATEWAY environment variable, previously ignored unless ANTHROPIC_BASE_URL and ANTHROPIC_AUTH_TOKEN were both set, began forcing Cloud-gateway sign-in on its own in 2.1.265, so configurations that set it alongside an API key, apiKeyHelper, or custom auth headers failed every request with "Not signed in to the Cloud gateway". The variable on its own is ignored again; no configuration change is needed

v2.1.265: v2.1.265

Compare Source

What's changed

• Added user.email and user.groups to the telemetry Claude Desktop and Cowork send through a Claude apps gateway, matching terminal sessions
• Added support for pointing --plugin-dir at a folder of plugins: each child folder with a manifest loads, and children added or removed while running are picked up
• Added a 1 GB cap on tool results saved to disk; the in-conversation preview says when a saved file was truncated
• Fixed resuming a foreground-spawned subagent changing its tool list and system prompt prefix, which broke prompt-cache reuse for that agent
• Fixed agent teammates and resumed subagents moving SubagentStart hook context and preloaded skills out of the prompt prefix on later turns, which broke prompt-cache reuse
• Fixed resume after the previous process died while a tool was running: the last prompt is no longer rewritten, and the interrupted tool call is kept and marked interrupted
• Fixed /model opusplan[1m] being rejected with "Model not found"
• Fixed syntax-highlighted code in permission prompts and messages sometimes omitting a character after a Ruby ?, Erlang $, or Perl $ sigil
• Fixed the fullscreen transcript jumping by one row whenever the slash-command or @​-file suggestion list opened or closed
• Fixed a plugin path containing a backslash bypassing the symlink containment check on macOS and Linux
• Fixed plugin directories whose names begin with two dots being wrongly refused as outside the plugin root
• Fixed VS Code and SDK sessions occasionally requiring re-login when a session was closed while refreshing its token
• Fixed Remote Control sessions sending the end-of-turn signal before the reply's last message, which could show a reply as finished in the Claude app before its last part arrived
• Fixed background (--bg) sessions occasionally being retired mid-turn when a message arrived just before the idle timeout
• Fixed Claude Code's own git status and diff probes running clean filters configured by a nested repository inside the working tree
• Fixed the advisor tool and its instructions being re-decided per request from the request's model; the decision is now made once and announced in the conversation when it changes
• Fixed artifact publish accepting connector tool names the connector doesn't expose; the publish is now refused when none of the declared tools exist, and warned when only some don't
• Fixed /add-dir <subdirectory> refusing to load a subdirectory's agents when managed settings lock only skills to plugins, and promising agents when only agents are locked
• Fixed two-key keyboard shortcuts cancelling silently when the second key arrived more than a second later, as happens inside tmux; they now wait 3 seconds and show a notice when they time out
• Fixed forked skills (context: fork) not streaming their kickoff prompt and, with --forward-subagent-text, their text turns as progress events in stream-json
• Fixed a plugin's default component folder that the OS cannot check, such as a symlink loop, being silently skipped; it is now reported in /plugin with the error code
• Fixed the Claude apps gateway's OTLP telemetry relay pausing all forwarding to a collector for 30 seconds after it rejected a few payloads as malformed or too large
• Fixed /plugin Discover/Browse and claude plugin list --json --available showing no description or display name for marketplace plugins whose metadata lives only in their plugin.json
• Fixed /login showing "no gateway URL is configured" when re-run in a session that signed in to a Claude apps gateway set by managed settings
• Fixed /model claiming a model was "saved as your default" when the settings file couldn't be written; it now says the save failed and why
• Fixed /clear from Remote Control waiting on SessionStart hooks and on open terminal dialogs before completing
• Fixed the /config dialog changing height when switching between its tabs
• Fixed resuming a workflow run after its container restarted; a resume whose run journal is missing now fails with a clear error instead of rerunning every agent
• Fixed the claude-api skill's error-code reference: model access failures return 404 and unavailable beta headers return 400, not 403
• Fixed non-interactive sessions (-p with stream-json input, Agent SDK, cloud sessions) resetting the shell working directory at each new user message; a cd now persists across turns
• Fixed MCP servers configured as http that only speak the legacy HTTP+SSE transport never connecting; Claude Code now falls back to SSE as the MCP spec describes
• Fixed some claude.ai connectors in cloud sessions showing as needing authentication even though they are connected in claude.ai (servers that answer an unsupported request with HTTP 401)
• Fixed remote sessions keeping their sandbox container alive while a connector approval or sign-in link waits for you
• Fixed resumed sessions showing long model-facing recovery instructions in "background task didn't finish" notices instead of a short status line
• Windows: Fixed Read, Write and Edit refusing every file ("symlink resolution changed after permission was checked") when running inside an AppContainer or restricted-token sandbox
• Improved --worktree startup on large repositories: the new worktree is now checked out in parallel (git 2.32+)
• Improved /workflows agent detail: tool calls are marked running, failed or done, the subagent's task list is shown when it has one, and Enter unfolds the listed calls with their inputs and results
• Improved slash commands typed mid-prompt: matches now show in a list (Tab opens it outside fullscreen) instead of a single suggestion, and a plugin skill is now found by its bare name
• Improved remote MCP servers that need sign-in: Claude Code no longer registers an OAuth client with them until you actually authenticate
• Improved the time to resume long sessions that read many files
• Improved the error shown when an image over the size limits cannot be decoded: it now names the cause and how to fix it instead of only citing the limit
• Improved the Artifact tool's read of an artifact someone else wrote: the summary now treats the page as untrusted content and flags embedded instructions rather than relaying them
• Updated the .claude folder permission option to say what it actually allows: editing files in the project's .claude folder (or ~/.claude) for the session
• Changed machines with forceLoginGatewayUrl in managed settings to be Claude apps gateway sessions from startup, like forceLoginMethod: "gateway"; a leftover claude.ai login or API key is not used
• Changed image processing to use the runtime's built-in image support; the CLI no longer extracts a native image module to the temp directory
• Changed plugin display metadata to prefer the marketplace entry over plugin.json on the Installed tab and claude plugin details, filling gaps from plugin.json
• Changed Claude apps gateway sessions to export OpenTelemetry directly to a collector the gateway's managed settings name in OTEL_EXPORTER_OTLP_ENDPOINT, instead of through the gateway's relay; sessions without a named collector still use the relay
• [VSCode] Added automatic archiving of sessions inactive for a set period (new "Archive inactive sessions" setting, default 14 days)
• [VSCode] Fixed the sidebar chat coming back blank after Reload Window or a restart when the conversation had been open for more than 10 minutes
• [VSCode] Fixed the timeline dot sitting below the text on the "Remote Control is active" message

janosmiko/lfk (github:janosmiko/lfk)

v0.18.9: v0.18.9

Compare Source

0.18.9 (2026-09-08)

Miscellaneous Chores

• release 0.18.9 (#730) (17553eb)

max-sixty/worktrunk (github:max-sixty/worktrunk)

v0.77.0: 0.77.0

Compare Source

Release Notes

Improved

• wt list sizes and aligns its columns to the terminal width: one long branch name no longer sizes the Branch column for every row — it caps at 32 characters and elides, so a narrow terminal keeps its other columns instead of degenerating into a branch list. Remote⇅ stops holding blank space open in a repo with no remote, and alignment now follows the value type. --format=json still carries the whole name. (#3998)

• wt list names what it hid and marks detached worktrees: the summary reads hidden: Path, Commit instead of counting columns, a detached worktree shows ⊘ rather than borrowing ⚑, and a prunable row leaves its cells blank instead of showing loading dots that never resolve. (#3998)

• wt list --format=json gains a marker field and stops reporting detached twice: the branch marker set by wt config state marker is now readable without parsing it out of symbols, and state no longer reports a detached worktree as branch_worktree_mismatch — the sibling detached boolean carries it. (#3998)

• wt list --format=json now defaults to schema 2: callers get the envelope with repository metadata and orthogonal per-item facts without configuring [list] json-schema. wt list statusline --format=json follows the same key. Set json-schema = 1 to retain the original bare-array format. (Breaking.) (#4038)

• wt config show fails on a broken config: it exits 1 on an unreadable or invalid config, an invalid [list] columns, or an invalid approvals.toml. Unknown keys and deprecations stay warnings and still exit 0. A new APPROVALS section counts project commands awaiting approval. (Breaking: it always exited 0 before.) (#3999)

• Config migration output names its destination: wt config update --output <path> writes the migration artifact to that file instead of applying it in place, and --output=- writes it to stdout. Output mode includes project config when run from a linked worktree. (Breaking: --print was removed.) (#4021)

• Pi joins the agent integrations: wt config plugins pi install writes an activity hook to ~/.omp/agent/hooks/pre/worktrunk.ts, so Pi sessions show 🤖/💬 markers in wt list like Claude Code, Codex, OpenCode, and Gemini. $PI_CONFIG_DIR, $PI_CODING_AGENT_DIR, and named $OMP_PROFILE/$PI_PROFILE profiles are honored. Docs (#3594, thanks @​adity982, and @​ortonomy for the request)

• wt config plugins codex install installs the plugin too: it previously registered the marketplace and left you to run /plugins in Codex yourself. Uninstall follows for both Codex and Claude Code, removing the plugin and then the marketplace, so the two commands are inverses. (Breaking: Codex uninstall previously left an installed plugin alone; Claude uninstall now also removes the marketplace.) (#4019)

• wt step copy-ignored says whether it reflinked or copied: the summary now reads (reflinked, no extra disk), (full copy), or a partial count, so the same 29.5 GB line distinguishes a free copy from one that actually wrote the bytes. --format=json gains reflinked and written. (#4025)

• wt config update removes keys its destination cannot hold: migrating [select] or [commit-generation] drops keys the new section has no field for, reporting each one. Otherwise the key landed at a path the user never typed and warned on every command, with no way to clear it. (#3994)

Fixed

• A failed wt switch pr:<n> against a fork no longer deletes a branch it didn't create: the rollback force-deleted the branch on any setup error, including the one case where the branch wasn't its own — a pre-switch hook or a concurrent session claiming the name in the window after the forge answered. Branch and worktree are now created in one git worktree add -b, which writes nothing when the name is taken. (#3984)

• Codex on Windows: the activity hooks no longer fail on every event: each hook led with a bare bash, which cmd.exe resolves to the WSL launcher rather than Git Bash, so every event raised a Hook failed banner. Hooks now run wt.sh through a shim that finds Git Bash by path. (#4008, fixes #4007, thanks @​McNultyyy for reporting and diagnosing)

• Templates leave branch unset in a detached worktree: aliases and hooks rendered {{ branch }} as the literal HEAD, which git resolves, so an unguarded template ran against the wrong ref — the reported case ended in git push origin --delete HEAD, which git refused. base and target follow. (Breaking: an unguarded {{ branch }} now errors.) (#4010, fixes #4009)

• The OpenCode plugin loads under OpenCode 2: OpenCode 2's loader dropped the old bare-function export silently, so activity markers stopped appearing. The plugin now exports one object carrying both the v2 setup and v1 server entry points, and spawns wt through node:child_process rather than the Bun shell. Re-run wt config plugins opencode install to pick it up; the one file covers OpenCode 2 and OpenCode 1.16 or later. (#4018, thanks @​pragmaticivan for the request)

• wt step commit --branch builds its prompt from the worktree being committed: prompt-building git plumbing ran in the invoking worktree, so with nothing staged there the generated message described none of the changes it committed. wt step relocate --commit had the same bug, and --dry-run/--show-prompt now preview the worktree --branch names. (#3996)

• LLM commit messages keep diffs for quoted paths: a file whose name git quotes in the diff --git header — any non-ASCII name under the default core.quotePath — had its whole diff section dropped from the prompt once the diff exceeded the 100 KB budget. (#4041)

• An unparsable user config is reported, not a panic: wt config show --format=json and --full, plus wt step prune, relocate, eval, and for-each, panicked on a debug build and printed a bare ✗ Command failed on a release one. They now report ✗ Failed to load config with the parser's caret diagram. (#4002)

• wt switch --execute names the directory the program actually starts in: the Executing (--execute) @​ … header rendered the worktree the background hooks run in, not the program's own directory — which differs under --no-cd or a switch from a subdirectory. The path is omitted when the shell already stands there. (#4043, fixes #4042, thanks @​yajo for reporting)

• wt config plugins claude|codex uninstall is safe to re-run: removing an already-absent marketplace reported a failure, and a Claude uninstall that removed the plugin and then failed left the marketplace with no way to clear it. Both now finish a half-done uninstall and succeed when there is nothing left to remove. (#4033, #4034)

• wt config state marker set and clear no-op outside a git repository: they exited 1 with a git error, so an agent plugin running outside a repository printed one every turn (the hook's || true kept the session going). (#3981, thanks @​mahirhir)

• wt list produces output in a bare repo with no worktrees: it printed nothing at all and exited 0. It now reports ○ No worktrees with a hint, --branches lists the branches, and --format json emits the envelope with an empty items. (#3992)

• wt list warns when it can't parse the project config rather than ignoring it silently; the listing still succeeds. (#3993)

• Relayed command output no longer prints ahead of the delayed-stream progress line, and delayed-stream output routes through anstream so color is stripped consistently when redirected. (#4037, #3995)

• A hook filter that matches nothing names the unconfigured source, rather than reporting no match without saying which source was empty. (#3997)

Documentation

• wt hook says that post-* hooks from the two sources run concurrently, so dependent commands belong in one source; wt merge records that post-commit can't run when the merge removes the worktree it anchors on. (#4020, #4026)

• wt step help pages describe what the commands actually do: wt step prune says it removes branches as well as worktrees, wt step copy-ignored documents --from/--to, wt step commit documents --branch, and both it and squash document their hooks and no-LLM fallback messages. (#3997)

• The FAQ lists the files Worktrunk writes outside its own config: OpenCode's plugin, Pi's hook, and the Claude Code settings.json statusline entry, alongside the existing inventory of what Worktrunk creates and deletes. The Claude and Codex plugin installs write nothing themselves. (#4036)

• wt step copy-ignored documents its disk-space benefit per filesystem, and the bare-repo worktree-path example names the bare repo's own location. (#4022, #4006)

• Terminal examples on the docs site fit a desktop window rather than overflowing. (#4039)

nolabs-ai/nono (github:nolabs-ai/nono)

v0.76.0: v0.76.0

Compare Source

What's Changed

• fix(proxy): disable audit buffer for standalone nono proxy by @​panga in fix(proxy): disable audit buffer for standalone nono proxy nolabs-ai/nono#1766
• fix(policy): remove blanket /Volumes read grant from system_read_macos by @​SequeI in fix(policy): remove blanket /Volumes read grant from system_read_macos nolabs-ai/nono#1769
• fix: allow fire-and-forget child processes by @​kurtisc in fix: allow fire-and-forget child processes nolabs-ai/nono#1737
• fix(sandbox): resolve multi-hop symlinks in fs grants by @​kipz in fix(sandbox): resolve multi-hop symlinks in fs grants nolabs-ai/nono#1776
• feat(tool-sandbox): support Git fsmonitor socket via unix_socket_bind by @​kipz in feat(tool-sandbox): support Git fsmonitor socket via unix_socket_bind nolabs-ai/nono#1780
• fix(proxy): load declarative credentials from profiles by @​Haoxincode in fix(proxy): load declarative credentials from profiles nolabs-ai/nono#1789
• feat: add Nix flake support by @​levonk in feat: add Nix flake support nolabs-ai/nono#1784
• chore(github): remove triage label from issue templates by @​lukehinds in chore(github): remove triage label from issue templates nolabs-ai/nono#1798
• fix(proxy): read chunked HTTP request bodies on L7 forward path by @​Frankie-Xu in fix(proxy): read chunked HTTP request bodies on L7 forward path nolabs-ai/nono#1687
• fix(cli): route tracing warnings to stderr, not stdout by @​SequeI in fix(cli): route tracing warnings to stderr, not stdout nolabs-ai/nono#1801
• fix(cgroup): skip control files when sweeping stale lineage sessions by @​SequeI in fix(cgroup): skip control files when sweeping stale lineage sessions nolabs-ai/nono#1802
• chore(deps): bump softprops/action-gh-release from 3.0.2 to 3.0.3 by @​dependabot[bot] in chore(deps): bump softprops/action-gh-release from 3.0.2 to 3.0.3 nolabs-ai/nono#1810
• chore(deps): bump docker/setup-qemu-action from 4.2.0 to 4.3.0 by @​dependabot[bot] in chore(deps): bump docker/setup-qemu-action from 4.2.0 to 4.3.0 nolabs-ai/nono#1815
• chore(deps): bump tokio-rustls from 0.26.4 to 0.26.5 by @​dependabot[bot] in chore(deps): bump tokio-rustls from 0.26.4 to 0.26.5 nolabs-ai/nono#1809
• chore(deps): bump regress from 0.11.1 to 0.12.0 by @​dependabot[bot] in chore(deps): bump regress from 0.11.1 to 0.12.0 nolabs-ai/nono#1811
• chore(deps): bump clap from 4.6.4 to 4.6.6 by @​dependabot[bot] in chore(deps): bump clap from 4.6.4 to 4.6.6 nolabs-ai/nono#1812
• chore(deps): bump serde from 1.0.228 to 1.0.229 by @​dependabot[bot] in chore(deps): bump serde from 1.0.228 to 1.0.229 nolabs-ai/nono#1813
• chore(deps): bump h2 from 0.4.16 to 0.4.19 by @​dependabot[bot] in chore(deps): bump h2 from 0.4.16 to 0.4.19 nolabs-ai/nono#1814
• fix(policy): resolve nss module error by @​YewFence in fix(policy): resolve nss module error nolabs-ai/nono#1806
• ci(spire): scope SPIRE workflow to code changes by @​SequeI in ci(spire): scope SPIRE workflow to code changes nolabs-ai/nono#1800
• fix(cli): use CLAUDE_CONFIG_DIR instead of ~/.claude.json symlink redirects by @​SequeI in fix(cli): use CLAUDE_CONFIG_DIR instead of ~/.claude.json symlink redirects nolabs-ai/nono#1820
• fix(cli): preserve file permissions on write_file wiring copy by @​SequeI in fix(cli): preserve file permissions on write_file wiring copy nolabs-ai/nono#1807
• fix(proxy): make * stop at / in endpoint path patterns by @​MateSaary in fix(proxy): make * stop at / in endpoint path patterns nolabs-ai/nono#1828
• feat(cli): add --max-total-size flag to audit cleanup by @​christine-at-datadog in feat(cli): add --max-total-size flag to audit cleanup nolabs-ai/nono#1819
• docs(neps): add NEP-0001, pre-1.0.0 tech debt and API-freeze cleanup by @​SequeI in docs(neps): add NEP-0001, pre-1.0.0 tech debt and API-freeze cleanup nolabs-ai/nono#1758
• fix(cli): gate diagnostic remedies on observed evidence by @​roli-lpci in fix(cli): gate diagnostic remedies on observed evidence nolabs-ai/nono#1816
• chore: release v0.76.0 by @​SequeI in chore: release v0.76.0 nolabs-ai/nono#1832

New Contributors

• @​Haoxincode made their first contribution in fix(proxy): load declarative credentials from profiles nolabs-ai/nono#1789
• @​levonk made their first contribution in feat: add Nix flake support nolabs-ai/nono#1784
• @​MateSaary made their first contribution in fix(proxy): make * stop at / in endpoint path patterns nolabs-ai/nono#1828
• @​roli-lpci made their first contribution in fix(cli): gate diagnostic remedies on observed evidence nolabs-ai/nono#1816

Full Changelog: nolabs-ai/nono@v0.75.0...v0.76.0

Microsoft/pyright (npm:pyright)

1.1.414: Published 1.1.414

Compare Source

Changes:

• a28cce4077d87b80bead12de809f79845e39c8ba Bump version to 1.1.414 (#11724)

• 10f9e773c012d3ae15fd3232915a86ffda64d371 Bump the github-actions group across 1 directory with 5 updates (#11720)

• d72e2fe89e4ad4227d6c5be9bb6e57b082768e23 Fix pnpm setup in benchmark workflow (#11719)

• 854df36c470a636ca44fbf222ea7d4f328f5f471 Allow assigning signature metadata to functions (#11714)

• c77393240247e017db6538d35876e723c518e06c Publish pyright-typeserver to npm (#11713)

• fa9b200906fadc093e862ce62ec1afa985c7233d Pull Pylance with Pyright 1.1.413 (#11697)

• e690634a94ab05cf7dd003b63b1ac67cd6d6878e Fix printExpression output for slice expressions and set displays (#11598)

• 685de39b5d3f32092fb576c9de54e5472a28447d Report a specific diagnostic for walrus in a comprehension iterable (#11606) [ #11514 ]

• 5a958ca8f5119affaca3c6cfe2157cdc87480f0a Add regression tests for sentinel conditional type guards (#11686)

• 6a7d491300be1fe1c2328fb64b511f7e2a4b356a Preserve benchmark result comments (#11682)
  See More

• 8575d8332f73f96721987e373f9844a666446b94 Fix Sentinel base type assignability (#11676)

• 37c03866d7929e4745e802c37e7e9bcabeda080b Optimize type equality fast paths (#11420)

• b8dd159d12ff7e99ad8e8854737ce21e9ecb7042 Fix keyword-form assignability for standard dest parameters (#11670)

• bf6ec03650710f7dc34fcf42442e6590d960f5cb Fix benchmark comparison and reporting (#11680)

• 390f0aaa54fb0d6f17725a7f999e2457079b3bcb Fix TypeGuard and TypeIs narrowing for functions with union return types (#11608)

• fabb9f9f9005c1180a108cac1bb7daf9d1bb0721 Fix type narrowing for equality comparisons with IntEnum and StrEnum values (#11622)

• 20380f21f4afe7db79dd4dd7d3e31ab7a6ca4c24 Push Pylance changes to Pyright (#11678)

• 3a1e14df628d4e7454be3bc46ce0f8be672c08fd Benchmark pull request merge commits (#11677)

• d5162f944f9a565549939eb4dc87934c2f170689 Cover two remaining dataclass field() override branches (#11679) [ #11665 ]

• 0b8c227baf95bae353ce9268336ea09d912cd728 Fix crashes after clearing analyzer caches (#11675)

• b89505828a17ce2a75df68419eaf10ab9707104d Do not inherit dataclass defaults when a subclass uses field() without one. (#11665) [ #11660 ]

• 99854b716017afd28e79e61e3904834e0fcbe854 Dispatch typecheck benchmark workflow directly (#11674)

• 1be1899ebec8591346b64a388ec195298e78f44e Do not treat objects with explicit iter as iterable via getitem. (#11645)

• beaac8f2f965a4b27bfb1f958392254fcf86b11e Fix functools.partial type evaluation for callable class instances (#11672)

• 5b448bb99ddee5084ad51e1f7c4eb48455cc492c Do not eliminate a TypedDict with extra items on a negative key check (#11663)

• bacb8141b4e93fe2583db032a5318f42aa3a75e9 Fix benchmark comment trigger (#11673)

• 93a6550b2acc61d930edf54ad4621638cdc70777 Add cross-type-checker benchmark regression tracking (#11574)

• 85837efea752fbb1cd04c261a51cded566e21e57 Add non-publishing registry validation mode (#11667)

• 3f870712c2a2076ccfbfe685c3dbda7a453a590a Install pinned pnpm on Azure DevOps build agents (#11661) [ #11652 ]

• d5e77a7f4856f8e7caee1fa788b25bf67901a3c9 Fix protocol cache for specialized self overloads (#11649)

• 7ddd3b121bf3421fd3e98ec4f3b38209e24c08d0 Push Pylance changes to Pyright (#11658)

• 5cf4afa88b491795af0a2bfd1683ec24c60dcf03 Migrate CI package installation to pnpm (#11652)

• 334e3fb792f7b912a44715e74528fab22b73bf1e Pin GitHub Actions to full-length commit SHAs (#11628)

This list of changes was auto generated.

SocketDev/socket-cli (npm:socket)

v1.1.170: v1.1.170

Compare Source

What's Changed

• upgrading coana to version 15.10.39 by @​socket-pr-bot[bot] in upgrading coana to version 15.10.39 SocketDev/socket-cli#1535

Full Changelog: SocketDev/socket-cli@v1.1.169...v1.1.170

jdx/usage (usage)

v6.8.0: v6.8.0: Native completions and sharper docs output

Compare Source

This release gives the usage CLI native shell completions (including PowerShell), adds a configurable link extension for Markdown docs, and fixes a batch of synopsis and Markdown rendering issues across docs and man pages.

Added

• (cli) Native shell completions (#1388, @​jdx). usage --completions <shell> now emits native scripts that call the installed binary's compiled completion handler instead of caching a spec and relying on the bash-completion helpers. Bash, Zsh, Fish, and a new PowerShell script are all supported, and scripts use command usage so a shell function or alias can no longer shadow the executable. All four scripts are published alongside the CLI spec as signed Packslip resources. General usage generate completion behavior is unchanged.

• (docs) Configurable Markdown link extension (#1394, @​jdx). Generated Markdown links previously always ended in .md, forcing consumers who serve HTML or extensionless pages to rewrite links after generation. A new --link-extension flag (and MarkdownRenderer::with_link_extension, default .md) controls the suffix on command and configuration links without changing output filenames:

  usage generate markdown --file mycli.usage.kdl --link-extension .html
  

  Custom templates now also receive link_extension and config_link in their context.

Fixed

• (docs) Render optional subcommands and mount synopses (#1393, @​jdx). Generated synopses showed <SUBCOMMAND> even when a command could run without one; the shared usage string now honors subcommand_required (using [SUBCOMMAND] when optional) and custom placeholder names, keeping terminal help, Markdown, man pages, JSON, and SDK docs consistent. Unresolved mounts can also declare a display-only synopsis (for example mount run="mycli tasks --usage" synopsis="[TASK] [ARGS]…") to document dynamic arguments without running discovery; parsing and completion are unchanged.
• (docs) Preserve Markdown code blocks and headings (#1392, @​jdx). Indented help text was converted to code fences by stripping four spaces from every matching line, which could corrupt nested lists and existing fenced examples. Markdown code-block boundaries are now parsed so only real indented code blocks are converted, fences are chosen longer than any embedded backtick runs, and HTML escaping recognizes longer fences. Hidden subcommands are now filtered out before the Subcommands heading, and the duplicate synopsis line was removed from the multipage index.
• (manpage) Render mount synopses and custom command names (#1395, @​jdx). Completes the man-page side of the synopsis fixes above. The man-page renderer now carries declarative mount synopses and custom subcommand names into its own synopsis (instead of hard-coded <COMMAND>/[COMMAND]), includes mount fragments in root and subcommand synopses without running discovery, and emits a detail section for a command whose only documentation is a mount synopsis.

Changed

• (docs) Refreshed guides, navigation, and landing page (#1391, @​jdx). A new getting-started guide walks from install through KDL, lint/explain, docs/man, completions, and diff. Navigation is reorganized into guides, framework docs, and references with route-specific sidebars; the landing page is simplified with clearer starting points for Rust apps, existing CLIs, and scripts. Installation commands, Rust and SDK examples, and completion setup were corrected, Go is now labeled a development preview, and broken links across all 171 Markdown files were fixed.

Full Changelog: jdx/usage@v6.7.1...v6.8.0

💚 Sponsor usage

usage is built and maintained by @​jdx, an open source developer at entire.io, the title sponsor of his open source work.

If usage powers CLI specs, docs, or completions for a tool you maintain or use, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep usage fast, free, and independent.

Skipped Packages

Non-GitHub Sources

• node (https://nodejs.org)

• npm:cspell (https://cspell.org/)

• npm:ctx7 (https://context7.com)

GitHub Release Notes Unavailable

• droid: No GitHub release was found for 0.216.0