chore(deps): update ⬆️ aqua-packages

[renovate]

This PR contains the following updates:

Package	Update	Change	Pending
anthropics/claude-code	patch	v2.1.138 → v2.1.139	v2.1.143 (+3)
aquaproj/aqua-registry	minor	v4.510.0 → v4.511.1	v4.512.1 (+1)
github/copilot-cli	patch	v1.0.44 → v1.0.45	v1.0.48 (+2)
jdx/mise	patch	v2026.5.5 → v2026.5.6	v2026.5.10 (+3)
kubernetes/kubectl	patch	1.36.0 → 1.36.1

---

Release Notes

anthropics/claude-code (anthropics/claude-code)

v2.1.139

Compare Source

What's changed

• Added agent view (Research Preview): a single list of every Claude Code session — running, blocked on you, or done. Run claude agents to get started. See https://code.claude.com/docs/en/agent-view
• Added /goal command: set a completion condition and Claude keeps working across turns until it's met. Works in interactive, -p, and Remote Control. Shows live elapsed/turns/tokens as an overlay panel
• Added /scroll-speed command to tune mouse wheel scroll speed with a live preview
• Added claude plugin details <name> to show a plugin's component inventory and projected per-session token cost
• Added transcript view navigation: ? for keyboard shortcuts, {/} to jump between user prompts, v to toggle shortcut panel
• Added hook args: string[] field (exec form) that spawns the command directly without a shell, so path placeholders never need quoting
• Added hook continueOnBlock config option for PostToolUse — set to true to feed the hook's rejection reason back to Claude and continue the turn
• MCP stdio servers now receive CLAUDE_PROJECT_DIR in their environment, matching hooks. Plugin configs can reference ${CLAUDE_PROJECT_DIR} in commands
• Compaction prompt now asks the model to preserve sensitive user instructions
• /mcp Reconnect now picks up .mcp.json edits without a restart, and shows the HTTP status and URL when reconnecting fails
• /context all per-skill token estimates now account for the model's tokenizer and show rounded values
• claude plugin install <name>@&#8203;<marketplace> now auto-refreshes the marketplace and retries before reporting a plugin as not found
• /plugin installed-plugin details now show hook event names and MCP server names cleanly
• /context now shows the providing plugin's name for plugin-sourced skills
• Remote MCP server reconnect retry on transient failures is now enabled for all users
• API requests from subagents now carry x-claude-code-agent-id / x-claude-code-parent-agent-id headers, and claude_code.llm_request OTEL spans include agent_id / parent_agent_id attributes
• Remote Control, /schedule, claude.ai MCP connectors, and notification preferences are now disabled when ANTHROPIC_API_KEY / apiKeyHelper / ANTHROPIC_AUTH_TOKEN is set, even if a Claude.ai login also exists. Unset the API key to use these features
• Fixed a deadlock where expired credentials and the forceRemoteSettingsRefresh policy setting blocked claude auth login/logout/status with no way to recover
• Fixed autoAllowBashIfSandboxed not auto-approving commands with shell expansions like $VAR and $(cmd)
• Fixed a bug where a hook writing to the terminal could corrupt an on-screen interactive prompt; hooks now run without terminal access
• Fixed unbounded memory growth when an HTTP/SSE MCP server streams non-protocol data — response bodies now capped at 16 MB per SSE frame
• Fixed Skill(name *) permission rules — the wildcard form now works as a prefix match, matching Bash(ls *) behavior
• Fixed settings hot-reload not detecting edits to symlinked ~/.claude/settings.json
• Fixed plugin details failing to load when the marketplace key differs from the manifest name
• Fixed /model picker "Default" row not reflecting ANTHROPIC_DEFAULT_OPUS_MODEL/ANTHROPIC_DEFAULT_SONNET_MODEL overrides
• Fixed spurious "stream idle timeout" 5 minutes after a response completed, caused by the watchdog timer not being cleared on stream cancellation
• Fixed silent exit 1 when 10+ MCP servers are configured and the cache directory is unwritable — the error message now includes the underlying cause
• Fixed a typing cursor blinking on tab names, list pointers, and select rows in dialogs
• Fixed transcript view letter shortcuts not working after mouse click
• Fixed Bash-mode up-arrow history repeating the first entry and clobbering the in-progress draft
• Fixed pasting or dropping multiple images only inserting the last one
• Fixed hyperlinks using unreadable dark navy on dark themes — they now adapt to the active theme
• Fixed model picker showing a redundant "Current model" row for third-party users whose model is set to the opus alias
• Fixed legacy Opus picker entry on PAYG 3P providers resolving to the same model as the default entry
• Fixed mouse wheel scrolling speed in Cursor and VS Code 1.92–1.104; the trackpad now scrolls at a steady rate and the mouse wheel keeps ~3 lines per notch
• Fixed scroll behavior in Windows Terminal and VS Code when attached to background sessions
• Fixed MCP resources from disconnected servers lingering in @server: autocomplete
• Fixed two-file diff snippets over-reporting the number of truncated lines by one
• Fixed Grep results not relativizing Windows drive-letter paths and count mode reporting wrong totals for single-file paths
• Fixed border-embedded text overflowing on CJK/emoji due to visual cell width miscalculation
• Fixed fuzzy-match highlighting splitting emoji and astral-plane characters mid-pair
• Fixed skill argument names containing regex metacharacters breaking argument substitution
• Fixed ProgressBar rendering a full block for an almost-full fractional cell
• Fixed task polling and fs.watch being resurrected when the last subscriber leaves while a fetch is in flight
• Fixed plugin dependency resolution leaving a stale count when the manifest name differs from the source identifier
• Fixed Insights Time-of-Day chart skewing when a session has an unparseable timestamp
• Fixed keybindings using only the cmd/super/win modifier being flagged as unparseable
• Fixed claude_code.active_time.total OpenTelemetry metric not being emitted in --print mode
• Fixed claude plugin update not preserving cross-plugin symlinks inside a marketplace
• [VSCode] Press Cmd/Ctrl+Shift+T to reopen the most recently closed session tab, configurable via claudeCode.enableReopenClosedSessionShortcut

aquaproj/aqua-registry (aquaproj/aqua-registry)

v4.511.1

Compare Source

Issues | Pull Requests | aquaproj/aqua-registry@v4.511.0...v4.511.1

Fixes

#​53611 gruntwork-io/terragrunt: Support terragurnt v1.0.4 or later
#​53605 astral-sh/uv: GitHub artifact attestations missing for 0.11.9 @​scop
#​53597 Rename slack.com/slack-cli to slackapi/slack-cli and change the package type from http to github_release
#​53584 aquasecurity/trivy: Remove info for no longer existing releases @​scop
#​53580 racket-lang.org/racket-minimal: Rename to racket/racket/minimal

Security

#​53579 santosr2/TerraTidy: GitHub artifact attestations config @​scop
#​53578 gastownhall/beads: GitHub artifact attestations config @​scop
#​53577 cargo-bins/cargo-binstall: GitHub artifact attestations config @​scop
#​53576 foundry-rs/foundry: Cosign config @​scop

v4.511.0

Compare Source

Issues | Pull Requests | aquaproj/aqua-registry@v4.510.0...v4.511.0

🎉 New Packages

#​53554 SonarSource/sonarqube-cli - CLI tool to provide access to Sonar features @​3PeatVR
#​53535 earendil-works/pi - Interactive coding agent CLI @​garysassano
#​53534 jfernandez/bpftop - A dynamic real-time view of running eBPF programs @​2xdevv
#​53517 vectordotdev/vector - A high-performance observability data pipeline @​kquinsland
#​53515 modem-dev/hunk - Review-first terminal diff viewer for agentic coders @​naoki-mizuno
#​53511 hylo-lang/hylo-new - The Hylo programming language @​tothambrus11
#​53490 Code-Hex/Neo-cowsay - Cowsay reborn in Go @​TyceHerrman
#​50804 wasilibs/go-yamllint - A distribution of yamllint that can be used with go run @​WarrDoge
#​48803 npm/cli - the package manager for JavaScript @​risu729

Fixes

#​53550 DataDog/pup: Correct cosign certificate identity to DataDog/pup @​dragon3
#​53506 pnpm/pnpm: Expose v11 aliases (pnpm, pn, pnpx, and pnx) @​risu729
#​53549 Update link and add repo_owner and repo_name @​deiga

Security

#​53474 foundry-rs/foundry: GitHub artifact attestations config @​scop
#​53555 caarlos0/svu): v3.4.1 GitHub artifact attestations config @​scop

Documentation

#​53548 Update contribution link in README.md @​deiga

github/copilot-cli (github/copilot-cli)

v1.0.45: 1.0.45

Compare Source

2026-05-11

• Add /autopilot slash command to toggle between interactive and autopilot modes
• Fall back to Windows PowerShell (powershell.exe) when PowerShell 7+ (pwsh) is not available on Windows
• OpenTelemetry output aligns with GenAI semantic conventions: MCP tool calls now use standard tool_call spans, and a new gen_ai.client.operation.duration metric tracks tool execution time
• Sessions with extension permission prompts can be resumed without a "Session file is corrupted" error
• agentStop hook now fires correctly when the agent stops via task_complete
• CLI starts faster on terminals with limited OSC color query support, shaving up to ~1.5s off startup time.
• Add /fork command to fork the current session into a new independent session

jdx/mise (jdx/mise)

v2026.5.6: : Native GitHub OAuth, project-scoped OCI builds, faster registries

Compare Source

A mix of features and correctness work: a native GitHub OAuth token source (experimental) that drops the dependency on gh/ghtkn, mise oci commands scoped to the current project by default, and two registry-lookup performance wins — plus fixes across activate, exec, java, lock, pipx, and vfox.

Added

• (cli) Add --before <date> to mise ls-remote and mise lock for release-date-aware version discovery (#​9269) by @​risu729

• (config) Hooks can now be defined as a table — { run = "...", shell = "bash -c" } — to pick a shell inline, alongside the existing string form (#​9718) by @​risu729

• (github) Add native GitHub OAuth device-flow token source (experimental) — no dependency on gh/ghtkn (#​9654) by @​jdx. Create a GitHub App with device flow enabled, then authorize once:

  mise settings set experimental true
  mise settings set github.oauth_client_id Iv1.yourgithubappclientid
  mise token github --oauth

  mise caches and refreshes the token for its own GitHub API calls, and auto-exports it as GITHUB_TOKEN to shells started under mise activate/exec so gh, git, and other GitHub-aware tools pick it up too. See GitHub Tokens → Native GitHub OAuth for the full setup.

• (oci) mise oci build/run/push are now scoped to the current project's config by default; pass --include-global to opt back into the previous behavior of including global config (#​9766) by @​jdx

• (outdated) Prefixed-version requests now resolve to the latest within the prefix — e.g. temurin-17.0.19+10 for a temurin-17.x request, instead of jumping ahead to temurin-26.x (#​9767) by @​roele

Fixed

• (activate) Guard bash chpwd_functions expansion under set -u so activated shells no longer fail with chpwd_functions[@​]: unbound variable (#​9716) by @​risu729
• (backend) Date-check the latest_stable_version fast path when --before or minimum_release_age is active, instead of returning a too-new version (#​9650) by @​risu729
• (config) Parse core tool options consistently between table and bracket syntax, so [depends=...] and os= set the named core fields (#​9742) by @​risu729
• (exec) Nested mise -C <dir> exec correctly resolves the inner toolset's tools again — __MISE_DIFF is now propagated to children so the child no longer inherits a mutated PATH that hides its own tools (#​9765) by @​jdx
• (forgejo) Include prereleases when prerelease = true / MISE_PRERELEASES=1 is set (#​9717) by @​risu729
• (github) Avoid caching empty release-asset responses, refetching instead (#​9616) by @​risu729
• (java) Resolve core:java lockfile URLs/checksums from mise Java metadata, fixing mise install --locked for Java (#​9719) by @​risu729
• (lock) Cache github_attestations = "unavailable" so locked installs stop hitting the GitHub attestation API for artifacts known to have none (#​9741) by @​risu729
• (pipx) Preserve uvx_args/pipx_args/extras/uvx = false when pipx tools are reinstalled after a Python upgrade (#​9663) by @​risu729
• (python) Skip redundant GitHub attestation re-verification when the lockfile already has checksum + provenance = "github-attestations" (#​9739) by @​risu729
• (vfox) Run vfox plugin pre_uninstall hooks before removing install directories (#​9662) by @​risu729
• Quote program and args in cmd::cmd(..) debug output so logged commands are unambiguous (#​9777) by @​ktetzlaff

Performance

• (aqua) Bake aqua registry packages as rkyv blobs for much faster lookup (#​9535) by @​risu729
• (registry) Use phf for the mise registry lookup table, around 3.3x faster than the previous BTreeMap path (#​9769) by @​risu729

Registry

• Added vector (#​9761) by @​kquinsland
• Added openshift-install and an http: backend for oc (#​9669) by @​konono

New Contributors

• @​konono made their first contribution in #​9669
• @​kquinsland made their first contribution in #​9761
• @​ktetzlaff made their first contribution in #​9777

Full Changelog: jdx/mise@v2026.5.5...v2026.5.6

💚 Sponsor mise

mise is built by @​jdx under en.dev — an independent studio making developer tooling (mise, aube, and more). Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at en.dev. Individual and company sponsorships keep mise fast, free, and independent.

kubernetes/kubectl (kubernetes/kubectl)

v1.36.1

Compare Source

---

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

• Branch creation
  • Between 05:00 AM and 07:59 AM (* 5-7 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.