chore(deps): update ⬆️ aqua-packages - #871

v2.1.123

Compare Source

What's changed

• Fixed OAuth authentication failing with a 401 retry loop when CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS=1 is set

v2.1.122

Compare Source

What's changed

• Added ANTHROPIC_BEDROCK_SERVICE_TIER environment variable to select a Bedrock service tier (default, flex, or priority), sent as the X-Amzn-Bedrock-Service-Tier header
• Pasting a PR URL into the /resume search box now finds the session that created that PR (GitHub, GitHub Enterprise, GitLab, and Bitbucket)
• /mcp now shows claude.ai connectors hidden by a manually-added server with the same URL, with a hint to remove the duplicate
• Clarified the /mcp message shown when an MCP server is still unauthorized after the browser sign-in flow
• OpenTelemetry: numeric attributes on api_request/api_error log events are now emitted as numbers, not strings
• OpenTelemetry: added claude_code.at_mention log event for @-mention resolution
• Fixed /branch producing forks that fail with "tool_use ids were found without tool_result blocks" when the source session contained entries from rewound timelines
• Fixed /model not showing the Effort option for Bedrock application inference profile ARNs, and those ARNs not receiving output_config.effort
• Fixed Vertex AI / Bedrock returning invalid_request_error: output_config: Extra inputs are not permitted on session-title generation and other structured-output queries
• Fixed Vertex AI count_tokens endpoint returning 400 errors for users behind proxy gateways
• Fixed spinnerTipsOverride.excludeDefault not suppressing the time-based spinner tips
• Fixed ToolSearch missing MCP tools that connected after session start in nonblocking mode
• Fixed !exit / !quit in bash mode terminating the CLI instead of running as a shell command
• Fixed images sent to newer models being resized to 2576px per side instead of the correct 2000px maximum
• Fixed remote control session idle status redrawing twice per second, which could flood tmux -CC control pipes and pause the terminal
• Fixed assistant messages appearing blank in some sessions due to a stale view preference
• Fixed a malformed hooks entry in settings.json no longer invalidating the entire file
• Voice mode: keybindings bound to Caps Lock now show an error since terminals don't deliver Caps Lock as a key event

v4.501.0

Compare Source

Issues | Pull Requests | aquaproj/aqua-registry@v4.500.0...v4.501.0

🎉 New Packages

#​52722 IohannRabeson/tmignore-rs - Makes Time Machine respect .gitignore files @​TyceHerrman
#​52723 versity/versitygw - A simple to deploy but feature rich S3 object storage server for your filesystem @​TyceHerrman
#​52729 matthart1983/netwatch - Real-time network diagnostics in your terminal. One command, zero config, instant visibility @​TyceHerrman
#​52816 solarwinds/swo-cli - Standalone command line tool to retrieve and search recent app server logs from SolarWinds Observability @​nirojan

Fixes

#​52789 lycheeverse/lychee: Support lychee 0.24.0 or later @​gaato
#​52821 Fix pnpm v11 assets @​TyceHerrman
#​52858 Support WebAssembly/wabt 1.0.38 or later @​thedaneeffect
#​52737 jdx/pitchfork: Transfer the repository to endevco/pitchfork

v4.500.0

Compare Source

Issues | Pull Requests | aquaproj/aqua-registry@v4.499.0...v4.500.0

🎉 New Packages

#​52682 jonwiggins/xmloxide - A pure Rust reimplementation of libxml2 @​zeitlinger
#​52681 google/google-java-format - Reformats Java source code to comply with Google Java Style @​zeitlinger

Fixes

#​52663 #​52690 tstack/lnav: Support lnav v0.14.0 @​TyceHerrman

Security

#​52701 bmf-san/ggc: Cosign config @​scop

Documentation

#​52848 Replace deprecated cmdx references @​TyceHerrman

v18.16.0: 18.16.0

Compare Source

Release Notes

Features

• AI tool rendering overhaul + edit_file tool (#​3423)
• Implement write_file tool with overwrite safety (#​3432)
• Shell tool execution timeouts (#​3437)
• Send user-defined context with TERMINAL.md (#​3443)
• Add skill discovery, loading, and invocation (#​3444)

Bug Fixes

• Shell tool preview stuck as Running after completion (#​3436)
• Require all subcommands covered for shell allow rules (#​3440)
• Minor issues with fish's vim mode(s) (#​3362)

Documentation

• Document show_numeric_shortcuts (#​3433)
• Update for new server binary (#​3439)

Miscellaneous Tasks

• Update to rust 1.95 (#​3426)
• Clarified note about regular expressions matching in path. (#​3427)
• Use cat -n format for read_file tool (#​3435)
• Update to eye_declare 0.5.1 (#​3449)

Performance

• Reduce AI TUI rendering overhead for long conversations (#​3447)

Refactor

• Replace ad-hoc dispatch with FSM + driver architecture (#​3434)

atuin 18.16.0

Install atuin 18.16.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/atuinsh/atuin/releases/download/v18.16.0/atuin-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/atuinsh/atuin/releases/download/v18.16.0/atuin-installer.ps1 | iex"

Download atuin 18.16.0

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo atuinsh/atuin

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

atuin-server 18.16.0

Install atuin-server 18.16.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/atuinsh/atuin/releases/download/v18.16.0/atuin-server-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/atuinsh/atuin/releases/download/v18.16.0/atuin-server-installer.ps1 | iex"

Download atuin-server 18.16.0

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo atuinsh/atuin

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

v1.0.39: 1.0.39

Compare Source

2026-04-28

• Allow ACP clients to toggle allow-all permission mode via session configuration
• Add /compact, /context, /usage, and /env slash commands for ACP sessions
• Press ctrl+x → b to move the current running task or shell command to the background
• Transient pipe errors on child process stdio streams no longer cause crashes or trigger false crash reports
• /remote status output now shows actionable hints for each connection state
• Improve --resume session picker with better tab layout, status display, and progressive loading
• Slash command argument picker opens immediately at exact command boundaries without requiring a trailing space

v0.161.1

Compare Source

What's Changed

• resources: Honor Retry-After header in resources.GetRemote retries c4eba92 @​bep #​14828
• warpc: Move to parson.c in https://github.com/kgabis/parson 8b40a96 @​bep #​14823
• config/security: Add AllowChildProcess to security.node.permissions d65af84 @​bep #​14824
• config/security: Restrict default http.urls "@​" deny to userinfo 454450a @​bep #​14825

v0.161.0

Compare Source

This release contains two security hardening fixes:

• We now run the Node tools PostCSS, Babel and TailwindCSS, by default, with the --permission flag with the permissions defined in security.node.permissions. This means that you need Node >= 22 installed and that css.TailwindCSS now requires that the Tailwind CSS CLI must be installed as a Node.js package. The standalone executable is no longer supported
• We have made the defaults in security.http.urls more restrictive.

But there are some notable new features, as well:

Nested vars support in css.Build and css.Sass

A practical example in css.Build would be to have something like this in hugo.toml:

[params.style]
    primary    = "#​000000"
    background = "#ffffff"
    [params.style.dark]
        primary    = "#ffffff"
        background = "#​000000"

And in the stylesheet:

@​import "hugo:vars";
@​import "hugo:vars/dark" (prefers-color-scheme: dark);

:root {
  color-scheme: light dark;
}

Slice-based permalinks config

The permalinks configuration is now much more flexible (the old setup still works). It uses the same target matchers as in the cascade config, meaning you can now do:

permalinks:
  - target:
      kind: page
      path: "/books/**"
    pattern: /books/:year/:slug/
  - target:
      kind: section
      path: "/{books,books/**}"
    pattern: /libros/:sections[1:]
  - target:
      kind: page
    pattern: /other/:slug/

The above example isn't great, but it at least shows the gist of it.

A more flexible scheme for identifiers in filenames

What we had before was e.g. content/mypost.en.md which told Hugo that the content files was in English. With the new setup you could also name the file content/mypost._language_en_.md. This alone doesn't sound very useful, but this allows you to use more prefixes:

All Changes

• langs/i18n: Fix translation lookup when using language variants 72b85d5 @​jmooring #​7982
• create: Fix non-deterministic conflict detection in hugo new content 6436deb @​jmooring #​12602 #​12786 #​14112 #​14769
• commands: Fix environment isolation for configuration settings 1eea9fb @​jmooring #​14763
• Fix filename dimension identifiers (role_X, version_X) to replace mount config 8d6145f @​bep #​14756
• Fix it so we never auto-fallback to page resources in other roles/versions 9747724 @​bep #​14749 #​14752
• css: Support nested hugo:vars/ imports 7622dd8 @​bep #​14705
• github: Update GitHub actions versions 0814059 @​bep #​14810
• hugolib: Do not render aliases if the page is not rendered 8920d56 @​jmooring #​14807
• langs/i18n: Improve default content language fallback 633cc77 @​jmooring #​14243
• helpers: Remove unused code 4c40c6d @​bep
• common/constants: Remove unused consts d2594db @​bep
• common/paths: Remove unused code ab2de51 @​bep
• tests: Update Ruby setup action to v1.305.0 75f6183 @​jmooring
• langs: Use Language.Locale as primary localization key 1b7495b @​jmooring #​9109
• config/security: Add "! " negation to Whitelist, harden default http.urls 79f030b @​bep #​14792
• Harden Node tool execution with --permission flag a54c398 @​bep #​7287
• tpl/collections: Honor the Eqer interface in where comparisons f5fce93 @​bep #​14777
• modules: Ignore non-require blocks in go.mod rewrite 4169c1f @​bep #​14783
• Replace the concurrent map with an identical upstream version 7574e35 @​bep
• Add slice-based permalinks config with PageMatcher target 017a7cd @​bep #​14744
• commands: Add missing import e3413d9 @​bep
• Revert "common/hugo: Deprecate extended and extended_withdeploy editions" b01cc14 @​bep #​14771
• Adjust the SECURITY.md slightly 8ee19ff @​bep
• resources/page: Add passing test for Issue #​14325 0d58e42 @​jmooring
• Add a more flexible filename identifier scheme that also allows setting roles and versions (#​14754) ce2a156 @​bep #​14750
• common/hugo: Deprecate extended and extended_withdeploy editions a17bdbc @​jmooring #​14696
• parser/pageparser: Add a parser fuzz test 8f94d65 @​bep
• Replace deprecated .Site.Sites/.Page.Sites with hugo.Sites intests 90d8bf3 @​bep
• agents: Add a note about having the issue ID in test names bbb42b5 @​bep
• build(deps): bump github.com/getkin/kin-openapi from 0.135.0 to 0.137.0 d4ae662 @​dependabot[bot]
• build(deps): bump github.com/mattn/go-isatty from 0.0.21 to 0.0.22 9ede5fb @​dependabot[bot]
• build(deps): bump github.com/tdewolff/minify/v2 from 2.24.12 to 2.24.13 833a878 @​dependabot[bot]
• build(deps): bump github.com/magefile/mage from 1.17.1 to 1.17.2 4c03129 @​dependabot[bot]
• deps: Upgrade github.com/bep/imagemeta v0.17.1 => v0.17.2 080970b @​bep
• build(deps): bump github.com/aws/aws-sdk-go-v2/service/cloudfront (#​14789) 896bc89 @​dependabot[bot]
• build(deps): bump github.com/mattn/go-isatty from 0.0.20 to 0.0.21 (#​14788) 100dde5 @​dependabot[bot]
• build(deps): bump github.com/bep/mclib (#​14787) bdebb79 @​dependabot[bot]
• build(deps): bump google.golang.org/api from 0.267.0 to 0.276.0 52123ae @​dependabot[bot]
• build(deps): bump github.com/aws/aws-sdk-go-v2 from 1.41.5 to 1.41.6 38b8afd @​dependabot[bot]
• build(deps): bump github.com/getkin/kin-openapi from 0.134.0 to 0.135.0 (#​14781) 9276660 @​dependabot[bot]
• build(deps): bump github.com/bep/goportabletext from 0.1.0 to 0.2.0 (#​14779) 790f408 @​dependabot[bot]
• build(deps): bump golang.org/x/image from 0.38.0 to 0.39.0 (#​14780) de6955b @​dependabot[bot]
• deps: Upgrade github.com/bep/imagemeta v0.17.0 => v0.17.1 (#​14775) a77bd52 @​bep #​14758
• build(deps): bump golang.org/x/tools from 0.43.0 to 0.44.0 547ab29 @​dependabot[bot]
• build(deps): bump github.com/evanw/esbuild from 0.27.4 to 0.28.0 9a5c7e0 @​dependabot[bot]
• build(deps): bump github.com/aws/aws-sdk-go-v2 from 1.41.1 to 1.41.5 6613b08 @​dependabot[bot]
• build(deps): bump github.com/pelletier/go-toml/v2 from 2.2.4 to 2.3.0 582c26e @​dependabot[bot]
• build(deps): bump github.com/tdewolff/minify/v2 from 2.24.11 to 2.24.12 a4f2a8a @​dependabot[bot]

v0.45.2: 0.45.2

Compare Source

Release Notes

Fixed

• Interactive pickers via aliases no longer freeze with a blank screen: After the v0.44.0 fix that let aliases inherit the controlling tty (#​2380), wt sw (and other aliases that wrap wt switch) still hung — the alias child was placed in a new process group, so when the skim picker called tcsetattr on /dev/tty the kernel raised SIGTTOU and stopped it mid-render. The interactive (no-stdin-payload) execution path now keeps the alias child in wt's process group; a PID-targeted signal forwarder ensures externally-delivered signals (kill -TERM <wt-pid>) still reach the child. Hooks (which receive JSON on stdin) are unaffected. (#​2444)

Improved

• wt <alias> --help hint follows output guidelines: The hint emitted on wt <alias> --help previously printed to stdout without a status symbol, used backticks around commands, and stacked three indented bullet suggestions. It now renders as an info line plus a single semicolon-joined hint on stderr, with commands styled via underline (dim-safe). (#​2447)

Install worktrunk 0.45.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/max-sixty/worktrunk/releases/download/v0.45.2/worktrunk-installer.sh | sh && wt config shell install

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/max-sixty/worktrunk/releases/download/v0.45.2/worktrunk-installer.ps1 | iex"; git-wt config shell install

Install prebuilt binaries via Homebrew

brew install worktrunk && wt config shell install

Download worktrunk 0.45.2

Install via Cargo

cargo install worktrunk && wt config shell install

Install via Winget (Windows)

winget install max-sixty.worktrunk && git-wt config shell install

Install via AUR (Arch Linux)

paru worktrunk-bin && wt config shell install

v1.21.2

Compare Source

What's Changed

• chore(go-deps): bump the go-dependencies group with 2 updates by @​dependabot[bot] in #​423
• feat: Add no-browser option to login command by @​addshore in #​425
• Fix make lint by @​addshore in #​426
• feat(stack): include additionalProjectGlobs in stack show output by @​joshm91 in #​416
• chore(go-deps): bump github.com/mattn/go-isatty from 0.0.21 to 0.0.22 in the go-dependencies group by @​dependabot[bot] in #​424

New Contributors

• @​addshore made their first contribution in #​425
• @​joshm91 made their first contribution in #​416

Full Changelog: spacelift-io/spacectl@v1.21.1...v1.21.2

Artifacts

Binaries

The binaries are available at the bottom of this release.

Docker images

The following multi-arch (amd64 and arm64) Docker images have been published:

• ghcr.io/spacelift-io/spacectl:latest
• ghcr.io/spacelift-io/spacectl:1.21.2

v1.14.29

Compare Source

Core

• Sessions now keep a relative workspace path.
• Moonshot and Kimi tool schemas are sanitized to avoid rejected tool calls.
• MCP OAuth errors now match the native API more closely.
• Provider OAuth authorize errors now match the native API more closely.
• Shell cancellations now finish cleanly instead of leaving aborted commands in a bad state.
• Creating a session over HTTP now works with an empty request body.
• Workspace HTTP API routes are now mounted through the bridge.
• Tool streaming now defaults off for non-Anthropic models when using the Anthropic SDK.
• DeepSeek OpenAI-compatible setups now keep reasoning_content interleaved by default.
• The experimental LSP tool now forwards the workspace symbol query.
• Google Vertex now defaults tool call streaming off.

TUI

• Zed context polling stays responsive.
• Pressing Enter in dialogs now triggers the dialog instead of leaking through. (@​CasualDeveloper)
• File context is clearer, can be turned off, and clears after sending.
• opencode agent create now writes a valid permissions.deny config. (@​21pounder)

Desktop

• Per-workspace icon overrides now stay applied for subdirectories in the same repo.
• Sync state loading is more reliable for MCP, LSP, and workspace refreshes.

Thank you to 3 community contributors:

• @​21pounder:
  • fix(opencode): agent create generates permissions field with deny ins… (#​24482)
• @​SeashoreShi:
  • docs: fix duplicated word in CLI env var table (#​24614)
• @​CasualDeveloper:
  • fix(tui): consume Enter in dialog useKeyboard handlers (#​23390)

v3.9.2

Compare Source

Fixes

#​1493 Preserve original line endings when updating workflows

v3.9.1

Compare Source

v4.12.0

Compare Source

Changelog

• b5612c8 Merge pull request #​585 from jakubfronczyk/feat/shell-completion-installed-versions
• ce392ce feat: add shell completion for installed versions in use and uninstall commands
• df29766 update readme add winget installation variant (#​583)
• 78958d2 Merge pull request #​580 from tofuutils/dependabot/go_modules/tools/github.com/go-git/go-git/v5-5.18.0
• eb5d72e Merge pull request #​581 from tofuutils/dependabot/go_modules/github.com/cloudflare/circl-1.6.3
• 6d7c8b8 go: bump github.com/cloudflare/circl from 1.6.2 to 1.6.3
• 735ab08 chore(deps): bump github.com/go-git/go-git/v5 in /tools