Sandbox::https://github.com/scottames/dots/pull/870

renovate · 2026-05-03T12:30:18Z

This PR contains the following updates:

Package	Update	Change	Pending
aqua:cli/cli	minor	`2.91.0` → `2.92.0`
aqua:securego/gosec	minor	`2.25.0` → `2.26.1`
aqua:sst/opencode	patch	`1.14.22` → `1.14.29`	`1.14.33` (+3)
github:always-further/nono	minor	`0.40.1` → `0.43.1`	`v0.46.0` (+2)
npm:@commitlint/cli (source)	patch	`20.5.2` → `20.5.3`
npm:@google/gemini-cli	minor	`0.39.1` → `0.40.0`	`0.40.1`
npm:socket	patch	`1.1.86` → `1.1.89`	`1.1.91` (+1)
npm:stylelint (source)	patch	`17.9.0` → `17.9.1`	`17.10.0`
npm:textlint	minor	`15.5.4` → `15.6.0`

Release Notes

cli/cli (aqua:cli/cli)

`v2.92.0`: GitHub CLI 2.92.0

Compare Source

Support GitHub Enterprise Cloud (GHEC) in `skill` commandset

Now gh skill subcommands (install, preview, publish, search, update) are able to work with GHEC hosts with data residency.

Add `--allow-hidden-dirs` flag to `skill preview`

Following the addition of --allow-hidden-dirs to skill install in the previous release, now the flag is also supported in skill preview, allowing users to preview skills located in hidden (dot-prefixed) directories such as .claude/skills/, .agents/skills/, and .github/skills/.

What's Changed

✨ Features

feat(skills): add --allow-hidden-dirs flag to preview command by @SamMorrowDrums in #13265
feat(skills): support GHEC with data residency hosts by @SamMorrowDrums in #13264

🐛 Fixes

Fix SetSampleRate not updating sample_rate dimension by @williammartin in #13259
Fix log terminal injection by @williammartin in #13272
Add "Resource not accessible" to ProjectsV2IgnorableError by @maxbeizer in #13281

📚 Docs & Chores

fix: using variable interpolation `${{ in deployment.yml... by @orbisai0security in #13258
docs: correct typo in Linux Homebrew copy by @cassidyjames in #13273
Install skills flat by Name, not namespaced InstallName by @SamMorrowDrums in #13266
chore: fix zsh completion on debian by @babakks in #13274
Add trust disclaimer to extension help text by @travellertales in #13296
Bump Go to 1.26.2 by @github-actions[bot] in #13301

Dependencies

chore(deps): bump github.com/mattn/go-isatty from 0.0.20 to 0.0.21 by @dependabot[bot] in #13161
chore(deps): bump github.com/google/go-containerregistry from 0.21.4 to 0.21.5 by @dependabot[bot] in #13162
chore(deps): bump charm.land/lipgloss/v2 from 2.0.2 to 2.0.3 by @dependabot[bot] in #13163
chore(deps): bump charm.land/bubbletea/v2 from 2.0.2 to 2.0.6 by @dependabot[bot] in #13206
chore(deps): bump github.com/gdamore/tcell/v2 from 2.13.8 to 2.13.9 by @dependabot[bot] in #13241
chore(deps): bump github.com/mattn/go-isatty from 0.0.21 to 0.0.22 by @dependabot[bot] in #13298

New Contributors

@orbisai0security made their first contribution in #13258
@cassidyjames made their first contribution in #13273
@travellertales made their first contribution in #13296

Full Changelog: cli/cli@v2.91.0...v2.92.0

securego/gosec (aqua:securego/gosec)

`v2.26.1`

Compare Source

Changelog

4a3bd8a Update cosign to v3.0.6 (#1659)

`v2.26.0`

Compare Source

sst/opencode (aqua:sst/opencode)

`v1.14.29`

Compare Source

Core

Sessions now keep a relative workspace path.
Moonshot and Kimi tool schemas are sanitized to avoid rejected tool calls.
MCP OAuth errors now match the native API more closely.
Provider OAuth authorize errors now match the native API more closely.
Shell cancellations now finish cleanly instead of leaving aborted commands in a bad state.
Creating a session over HTTP now works with an empty request body.
Workspace HTTP API routes are now mounted through the bridge.
Tool streaming now defaults off for non-Anthropic models when using the Anthropic SDK.
DeepSeek OpenAI-compatible setups now keep reasoning_content interleaved by default.
The experimental LSP tool now forwards the workspace symbol query.
Google Vertex now defaults tool call streaming off.

TUI

Zed context polling stays responsive.
Pressing Enter in dialogs now triggers the dialog instead of leaking through. (@CasualDeveloper)
File context is clearer, can be turned off, and clears after sending.
opencode agent create now writes a valid permissions.deny config. (@21pounder)

Desktop

Per-workspace icon overrides now stay applied for subdirectories in the same repo.
Sync state loading is more reliable for MCP, LSP, and workspace refreshes.

Thank you to 3 community contributors:

@21pounder:
- fix(opencode): agent create generates permissions field with deny ins… (#24482)
@SeashoreShi:
- docs: fix duplicated word in CLI env var table (#24614)
@CasualDeveloper:
- fix(tui): consume Enter in dialog useKeyboard handlers (#23390)

`v1.14.28`

Compare Source

Core

Fixed issue with opencode upgrade failing for bun installs unless in a directory with package.json

`v1.14.27`

Compare Source

Core

Added a configurable default shell for terminals and agent shell commands, with a Desktop setting to manage it.
Reduced extra terminal noise while creating TUI workspaces.

TUI

Hid provider connection checks until onboarding is complete.
Restored the default toast timeout when no custom duration is provided. (@OpeOginni)

Thank you to 1 community contributor:

@OpeOginni:
- fix(tui): update toast duration handling to use default value (#23395)

`v1.14.26`

Compare Source

Core

Fixed config parsing to preserve permission rule order.
Fixed OpenRouter DeepSeek reasoning output handling.
Sent an opencode/<version> User-Agent header with HTTP requests.

TUI

Added Zed editor selection support for editor context.
Show a /connect tip when no models are configured.
Fixed editor lock detection to ignore locks from unrelated workspaces. (@jjjermiah)

Thank you to 2 community contributors:

@ariane-emory:
- fix: correct typo in comment (#24420)
@jjjermiah:
- fix(editor): reject lock files with no workspace match for cwd (#24323)

`v1.14.25`

Compare Source

Core

Fixed permission config preserving rule order and exposes full IntelliSense for tool permission keys
LSP permission prompts now include request details like the operation, file, and cursor position
Shell commands keep the correct working directory after login shell startup files run
Added Roslyn LSP support for Razor, .cshtml, and C# script files
GPT-5.5 with OpenAI OAuth now uses the correct context limits to avoid compaction issues

Thank you to 2 community contributors:

@altendky:
- fix(opencode): clarify git amend condition to require verifying commit landed (#19937)
@b0o:
- fix(build): add prettier to devDependencies (#23255)

`v1.14.24`

Compare Source

Core

Fixed DeepSeek assistant messages so reasoning is always included, avoiding provider formatting failures.
Fixed inherited model configs so interleaved-capability models keep working when that field falls back to an existing model. (@07akioni)
Added an experimental HTTP API endpoint for MCP server status.
Added experimental HTTP API endpoints to list files, read file contents, and check project file status.

Thank you to 1 community contributor:

@07akioni:
- fix: use existingModel as fallback for interleaved field (#24172)

`v1.14.23`

Compare Source

Core

Respect custom .npmrc registry settings when checking package versions and updates.

TUI

Render all non-synthetic text in a user message instead of showing only the first text block.

always-further/nono (github:always-further/nono)

`v0.43.1`

Compare Source

What's Changed

fix(cli): shell-quote command args in display output (#660) by @scp7 in #761

Full Changelog: nolabs-ai/nono@v0.43.0...v0.43.1

`v0.43.0`

Compare Source

What's Changed

chore(deps): bump hyper from 1.8.1 to 1.9.0 by @dependabot[bot] in #775
feat: make system keyring optional for headless/container builds by @sahuguet in #742
feat(cli): add --allow-connect-port for outbound TCP port allowlisting by @sahuguet in #744
chore(deps): bump aws-lc-rs from 1.16.2 to 1.16.3 by @dependabot[bot] in #776

New Contributors

@sahuguet made their first contribution in #742

Full Changelog: nolabs-ai/nono@v0.42.0...v0.43.0

`v0.42.0`

Compare Source

What's Changed

feat(cli): --allow-unix-socket flag family + AF_UNIX fixes for Linux V2 and macOS by @scp7 in #703
fix(proxy): stop adding allow_domain hosts to NO_PROXY without direct TCP grants by @4x0v7 in #762

Full Changelog: nolabs-ai/nono@v0.41.0...v0.42.0

`v0.41.0`

Compare Source

What's Changed

feat(cli): enhance prompts and denial diagnostics by @lukehinds in #751
feat(cli): consolidate 'nono policy' under 'nono profile' with deprecation alias (#594) by @ranguard in #753
feat(pty): preserve outer terminal scrollback on attach by @lukehinds in #754

New Contributors

@ranguard made their first contribution in #753

Full Changelog: nolabs-ai/nono@v0.40.1...v0.41.0

conventional-changelog/commitlint (npm:@commitlint/cli)

`v20.5.3`

Compare Source

Note: Version bump only for package @commitlint/cli

google-gemini/gemini-cli (npm:@google/gemini-cli)

`v0.40.0`

Compare Source

What's Changed

chore(release): bump version to 0.40.0-nightly.20260414.g5b1f7375a by @gemini-cli-robot in #25420
Fix(core): retry additional OpenSSL 3.x SSL errors during streaming (#16075) by @rcleveng in #25187
fix(core): prevent YOLO mode from being downgraded by @galz10 in #25341
feat: bundle ripgrep binaries into SEA for offline support by @scidomino in #25342
Changelog for v0.39.0-preview.0 by @gemini-cli-robot in #25417
feat(test): add large conversation scenario for performance test by @cynthialong0-0 in #25331
improve(core): require recurrence evidence before extracting skills by @SandyTao520 in #25147
test(evals): add subagent delegation evaluation tests by @anj-s in #24619
feat: add github colorblind themes by @Z1xus in #15504
fix(core): honor GOOGLE_GEMINI_BASE_URL and GOOGLE_VERTEX_BASE_URL by @chrisjcthomas in #25357
fix(cli): clean up slash command IDE listeners by @jasonmatthewsuhari in #24397
Changelog for v0.38.0 by @gemini-cli-robot in #25470
fix(evals): update eval tests for invoke_agent telemetry and project-scoped memory by @SandyTao520 in #25502
Changelog for v0.38.1 by @gemini-cli-robot in #25476
feat(core): integrate skill-creator into skill extraction agent by @SandyTao520 in #25421
feat(cli): provide default post-submit prompt for skill command by @ruomengz in #25327
feat(core): add tools to list and read MCP resources by @ruomengz in #25395
fix(evals): add typecheck coverage for evals, integration-tests, and memory-tests by @SandyTao520 in #25480
Use OSC 777 for terminal notifications by @jackyliuxx in #25300
fix(extensions): fix bundling for examples by @abhipatel12 in #25542
fix(cli): reset plan session state on /clear by @jasonmatthewsuhari in #25515
feat(core): add .mdx support to get-internal-docs tool by @g-samroberts in #25090
docs(policy): mention that workspace policies are broken by @6112 in #24367
fix(core): allow explicit write permissions to override governance file protections in sandboxes by @galz10 in #25338
feat(sandbox): resolve custom seatbelt profiles from $HOME/.gemini first by @mvanhorn in #25427
Reduce blank lines. by @gundermanc in #25563
fix(ui): revert preview theme on dialog unmount by @JayadityaGit in #22542
fix(core): fix ShellExecutionConfig spread and add ProjectRegistry save backoff by @mahimashanware in #25382
feat(core): Disable topic updates for subagents by @gundermanc in #25567
feat(core): enable topic update narration by default and promote to general by @gundermanc in #25586
docs: migrate installation and authentication to mdx with tabbed layouts by @g-samroberts in #25155
feat(config): split memoryManager flag into autoMemory by @SandyTao520 in #25601
fix(core): allow Cloud Shell users to use PRO_MODEL_NO_ACCESS experiment by @sehoon38 in #25702
fix(cli): round slow render latency to avoid opentelemetry float warning by @scidomino in #25709
docs(tracker): introduce experimental task tracker feature by @anj-s in #24556
docs(cli): fix inconsistent system.md casing in system prompt docs by @Bodlux in #25414
feat(cli): add streamlined gemini gemma local model setup by @Samee24 in #25498
Changelog for v0.38.2 by @gemini-cli-robot in #25593
Fix: Disallow overriding IDE stdio via workspace .env (RCE) by @M0nd0R in #25022
feat(test): refactor the memory usage test to use metrics from CLI process instead of test runner by @cynthialong0-0 in #25708
feat(vertex): add settings for Vertex AI request routing by @gordonhwc in #25513
Fix/allow for session persistence by @ahsanfarooq210 in #25176
Allow dots on GEMINI_API_KEY by @DKbyo in #25497
feat(telemetry): add flag for enabling traces specifically by @spencer426 in #25343
fix(core): resolve nested plan directory duplication and relative path policies by @mahimashanware in #25138
feat: detect new files in @ recommendations with watcher based updates by @prassamin in #25256
fix(cli): use newline in shell command wrapping to avoid breaking heredocs by @cocosheng-g in #25537
fix(cli): ensure theme dialog labels are rendered for all themes by @JayadityaGit in #24599
fix(core): disable detached mode in Bun to prevent immediate SIGHUP of child processes by @euxaristia in #22620
feat: add /new as alias for /clear and refine command description by @ved015 in #17865
fix(cli): start auto memory in ACP sessions by @jasonmatthewsuhari in #25626
fix(core): remove duplicate initialize call on agents refreshed by @adamfweidman in #25670
test(e2e): default integration tests to Flash Preview by @SandyTao520 in #25753
refactor(memory): replace MemoryManagerAgent with prompt-driven memory editing across four tiers by @SandyTao520 in #25716
fix(cli): fix "/clear (new)" command by @mini2s in #25801
fix(core): use dynamic CLI version for IDE client instead of hardcoded '1.0.0' by @thekishandev in #24414
fix(core): handle line endings in ignore file parsing by @xoma-zver in #23895
Fix/command injection shell by @Famous077 in #24170
fix(ui): removed background color for input by @devr0306 in #25339
fix(devtools): reduce memory usage and defer connection by @SandyTao520 in #24496
fix(core): support jsonl session logs in memory and summary services by @SandyTao520 in #25816
fix(release): exclude ripgrep binaries from npm tarballs by @SandyTao520 in #25841
fix(patch): cherry-pick 048bf6e to release/v0.40.0-preview.3-pr-25941 to patch version v0.40.0-preview.3 and create version 0.40.0-preview.4 by @gemini-cli-robot in #25942
fix(patch): cherry-pick 54b7586 to release/v0.40.0-preview.4-pr-26066 [CONFLICTS] by @gemini-cli-robot in #26124

New Contributors

@rcleveng made their first contribution in #25187
@Z1xus made their first contribution in #15504
@jackyliuxx made their first contribution in #25300
@6112 made their first contribution in #24367
@mvanhorn made their first contribution in #25427
@Bodlux made their first contribution in #25414
@M0nd0R made their first contribution in #25022
@gordonhwc made their first contribution in #25513
@ahsanfarooq210 made their first contribution in #25176
@DKbyo made their first contribution in #25497
@prassamin made their first contribution in #25256
@mini2s made their first contribution in #25801
@thekishandev made their first contribution in #24414
@xoma-zver made their first contribution in #23895

Full Changelog: google-gemini/gemini-cli@v0.39.1...v0.40.0

SocketDev/socket-cli (npm:socket)

stylelint/stylelint (npm:stylelint)

`v17.9.1`

Compare Source

It fixes 4 bugs. We also documented the messageArgs each rule provides to the message configuration property.

Fixed: ConfigurationError regression for custom syntaxes (#9245) (@jeddy3).
Fixed: MD5 hash algorithm to SHA256 for caching (#9241) (@rkdfx).
Fixed: property-no-deprecated autofix for page-break-*: always (#9214) (@rkdfx).
Fixed: selector-no-deprecated false positives for ::part() (#9227) (@SaekiTominaga).

textlint/textlint (npm:textlint)

`v15.6.0`

Compare Source

What's Changed

Features

feat(markdown-to-ast): add support for TOML and JSON frontmatter by @3w36zj6 in #2012

CI

fix(ci): remove CNAME from website PR preview build by @azu in #1999
chore(deps): update github/codeql-action action to v3.35.2 by @renovate[bot] in #2010
Update merge-gatekeeper action and add actions permission by @azu in #2014

Dependency Updates

chore(deps): update docusaurus monorepo to ^3.10.0 (minor) by @renovate[bot] in #2000
chore(deps): update dependency oxlint to ^1.59.0 by @renovate[bot] in #2002
chore(deps): update patch updates (patch) by @renovate[bot] in #2001
chore(deps): update dependency oxlint-tsgolint to ^0.20.0 by @renovate[bot] in #2004
chore(deps): update dependency json5 to ^2.2.3 by @renovate[bot] in #2003
chore(deps): update react monorepo to ^19.2.5 (patch) by @renovate[bot] in #2005
chore(deps): update dependency oxlint-tsgolint to ^0.21.0 by @renovate[bot] in #2007
chore(deps): update dependency oxlint-tsgolint to ^0.21.1 by @renovate[bot] in #2009
chore(deps): update pnpm to v10.33.1 by @renovate[bot] in #2011
chore(deps): update pnpm to v10.33.2 by @renovate[bot] in #2013

Other Changes

fix(website): move onBrokenMarkdownLinks into markdown.hooks by @azu in #1998

Full Changelog: textlint/textlint@v15.5.4...v15.6.0

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

Branch creation
- Between 03:00 AM and 05:59 AM (* 3-5 * * *)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

🤖 I have created a release *beep* *boop* --- ## [0.45.0](v0.44.0...v0.45.0) (2026-05-11) ### Updates & Misc Chores * **aqua/mise:** move 'alltuner/mise-completions-sync' to mise ([b155789](b155789)) * **deps:** lock file maintenance ([#872](#872)) ([b4cd81d](b4cd81d)) * **deps:** update ⬆️ aqua-packages ([#869](#869)) ([28ee891](28ee891)) * **deps:** update ⬆️ aqua-packages ([#871](#871)) ([7665c93](7665c93)) * **deps:** update ⬆️ aqua-packages ([#873](#873)) ([12beaed](12beaed)) * **deps:** update ⬆️ aqua-packages ([#875](#875)) ([f23f469](f23f469)) * **deps:** update ⬆️ aqua-packages ([#878](#878)) ([397d75a](397d75a)) * **deps:** update ⬆️ mise-packages ([#870](#870)) ([e14bc98](e14bc98)) * **deps:** update ⬆️ mise-packages ([#874](#874)) ([a026c77](a026c77)) * **deps:** update ⬆️ mise-packages ([#882](#882)) ([0885dee](0885dee)) * **deps:** update ⬆️ mise-packages (major) ([#883](#883)) ([2ec6fa4](2ec6fa4)) * **deps:** update ⬆️ mise-packages to v1.14.33 ([#879](#879)) ([4d78982](4d78982)) * **deps:** update ⬆️ mise-packages to v17.10.0 ([#877](#877)) ([4af370e](4af370e)) * **opencode:** add permissions ([ece47f0](ece47f0)) * **release-please:** move to manifest/config driven ([dbbb3e4](dbbb3e4)) * upgrade trunk ([#880](#880)) ([ce2107a](ce2107a)) * **zen:** update keybinds based on version upgrade ([984c215](984c215)) ### Features * **mise:** add ghui ([17fc02a](17fc02a)) * **mise:** add lfk ([c5cb06d](c5cb06d)) * **opencode:** add /tree plugin ([f2de1cb](f2de1cb)) * **worktrunk:** add step copy-ignored to post-start ([580cb23](580cb23)) ### Bug Fixes * **aqua:** disable ecr-cred-helper for mac ([f837a7c](f837a7c)) * **mac:** nix / fix updates ([cf7fa3e](cf7fa3e)) * **opencode:** tmpl/init fixes ([149aa59](149aa59)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: scottames-github-bot[bot] <162828115+scottames-github-bot[bot]@users.noreply.github.com>

chore(deps): update ⬆️ mise-packages

24d7f77

renovate Bot added the dependencies label May 3, 2026

renovate Bot requested a review from scottames as a code owner May 3, 2026 12:30

renovate Bot added the dependencies label May 3, 2026

renovate Bot enabled auto-merge (squash) May 3, 2026 12:30

renovate-approve Bot approved these changes May 3, 2026

View reviewed changes

chore(mise): lock

7ce1032

renovate Bot merged commit e14bc98 into main May 3, 2026
5 checks passed

renovate Bot deleted the renovate/mise-packages branch May 3, 2026 12:34

scottames-github-bot Bot mentioned this pull request May 11, 2026

chore(main): release 0.45.0 #884

Merged

Navigation Menu

Repository navigation

chore(deps): update ⬆️ mise-packages - #870

chore(deps): update ⬆️ mise-packages#870
renovate[bot] merged 2 commits into
mainfrom
renovate/mise-packages

renovate Bot commented May 3, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented May 3, 2026

Release Notes

v2.92.0: GitHub CLI 2.92.0

Support GitHub Enterprise Cloud (GHEC) in skill commandset

Add --allow-hidden-dirs flag to skill preview

What's Changed

✨ Features

🐛 Fixes

📚 Docs & Chores

Dependencies

New Contributors

Changelog

Core

TUI

Desktop

Core

Core

TUI

Core

TUI

Core

Core

Core

TUI

What's Changed

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

Features

CI

Dependency Updates

Other Changes

Configuration

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`v2.92.0`: GitHub CLI 2.92.0

Support GitHub Enterprise Cloud (GHEC) in `skill` commandset

Add `--allow-hidden-dirs` flag to `skill preview`