Visitar URL original
chore(deps): update ⬆️ mise-packages by renovate[bot] · Pull Request #882 · scottames/dots · GitHub
Skip to content

chore(deps): update ⬆️ mise-packages - #882

Merged
renovate[bot] merged 2 commits into
mainfrom
renovate/mise-packages
May 11, 2026
Merged

renovate[bot] merged 2 commits into
mainfrom
renovate/mise-packages

Conversation

@renovate

@renovate renovate Bot commented May 11, 2026 •

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Update Change Pending Age Adoption Passing Confidence
aqua:google/osv-scanner patch 2.3.6 → 2.3.7 2.3.8 age adoption passing confidence
aqua:sst/opencode patch 1.14.33 → 1.14.41 1.14.48 (+6) age adoption passing confidence
aqua:vercel-labs/agent-browser minor 0.26.0 → 0.27.0 age adoption passing confidence
github:agavra/tuicr minor 0.10.0 → 0.11.0 v0.12.0 age adoption passing confidence
github:always-further/nono minor 0.46.0 → 0.49.0 v0.52.2 (+5) age adoption passing confidence
github:janosmiko/lfk patch 0.10.2 → 0.10.4 v0.11.1 (+1) age adoption passing confidence
go patch 1.26.2 → 1.26.3 age adoption passing confidence
npm:@google/gemini-cli minor 0.40.1 → 0.41.2 age adoption passing confidence
npm:socket patch 1.1.91 → 1.1.92 1.1.93 age adoption passing confidence
npm:stylelint (source) minor 17.10.0 → 17.11.0 age adoption passing confidence
pipx:guarddog minor 2.9.0 → 2.10.0 age adoption passing confidence
pipx:semgrep (changelog) minor 1.161.0 → 1.162.0 age adoption passing confidence

Release Notes

google/osv-scanner (aqua:google/osv-scanner)

v2.3.7

Compare Source

Fixes:
  • Fix installation issues with go install due to dependency conflicts (downgrade containerd/cgroups/v3, moby/buildkit and opencontainers/runtime-spec).
  • Bug #​2762 Skip packages with short commit hashes instead of aborting scan.
  • Bug #​2781 Secure file path handling with os.OpenRoot.
  • Bug #​2766 Correct typos across docs, configs, and Go source.
Misc:
  • Update osv-scalibr to v0.4.6-0.20260504042738-9293bfa4f86f.
  • Remove replace directive (#​2782).
  • Update contributing.md (#​2779).
sst/opencode (aqua:sst/opencode)

v1.14.41

Compare Source

Core

Bugfixes
  • Restored formatter output handling so formatting still works when formatters write to stdout or stderr. (@​ferdinandyb)
Improvements
  • Warping a session to another workspace can now carry over your uncommitted file changes.

TUI

Bugfixes
  • Restored custom provider setup in /connect.

Desktop

Bugfixes
Improvements
  • Moved the desktop app's local server into a separate utility process for more reliable startup and shutdown.

Extensions

Improvements
  • ACP clients now restore the last model, mode, and effort when loading sessions, and can close sessions cleanly.

Thank you to 4 community contributors:

v1.14.40

Compare Source

Core

Improvements
  • Support .well-known/opencode configs that point to a separate remote config file.
Bugfixes
  • Preserve assistant text when replaying signed reasoning blocks. (@​edevil)
  • Return consistent not-found errors for missing sessions.
  • Apply CORS headers before auth so browser clients can reach legacy server endpoints.
  • Fix serve, web, and ACP network options triggering runtime re-entry errors.
  • Only show connected workspaces in warp flows, and carry the new directory into the session after warping.
  • Restore web terminal CSP allowances.
  • Sanitize invalid surrogate characters before provider transforms.
  • Fix Cloudflare AI Gateway provider options for OpenAI-compatible models. (@​NathanDrake2406)
  • Use the current workspace with /new, including local-project warps.
  • Keep editor selection context stable until it is sent.
  • Retry server_is_overloaded API errors automatically.
  • Restore Mistral Medium 3.5 variants so model selection works correctly.
  • Show compaction summaries before retained tail messages.

TUI

Bugfixes
  • Keep the selected model when model data refreshes.
  • Fix /agent create to use the /agents path. (@​OpeOginni)

Desktop

Improvements
  • Allow trusted app windows to write to the clipboard without permission failures.
Bugfixes
  • Ignore broken pipe (EPIPE) errors in desktop console logging.
  • Stop auto-installing updates when quitting the app.
  • Silence noisy browser API Sentry reports in production.
  • Prevent sync bootstrap queries from failing during app startup.

Thank you to 6 community contributors:

v1.14.39

Compare Source

Desktop

Bugfixes
  • Respect HTTP_PROXY and related proxy environment variables in the desktop app.
  • Return null instead of failing when the desktop app cannot read a stored value.

v1.14.38

Compare Source

Core

Bugfixes
  • Embedded UI requests now work with arbitrary connect-src origins under the default CSP.

Desktop

Bugfixes
  • Desktop now trusts system CA certificates for HTTPS connections.

v1.14.37

Compare Source

Core

Bugfixes
  • Canceling a task now also cancels child subtask sessions.
Improvements
  • Improved v2 session rendering with cleaner tool states, better compaction summaries, and more accurate timing.
  • Warp a session into another workspace or back to the local project.

Desktop

Bugfixes
  • Run the desktop migration on startup so existing installs transition correctly after the desktop packaging move.
  • Stabilized the Windows titlebar when changing zoom levels.

v1.14.35

Compare Source

Core

Bugfixes
  • Preserve diff patch boundaries so session diffs keep rendering correctly when file contents include diff --git text.

v1.14.34

Compare Source

Core

Improvements
  • Add PTY connection tickets so authenticated terminal websockets work more reliably across clients.
  • Add v2 session failure events so clients can detect and show failed runs.
  • Improve shell command handling for Bash, PowerShell, and cmd sessions.
Bugfixes
  • Return structured error bodies from the effect HTTP server instead of empty failures.
  • Reload server auth environment variables correctly for each new HTTP listener.
  • Stop worktree creation from hanging while bootstrap commands run.
  • Fix Azure Anthropic model resolution when using the Anthropic SDK.
  • Fix the web UI proxy so public manifest assets load and proxied responses do not break on transfer-encoding. (@​OpeOginni)
  • Allow Codex Spark models when signing in with Codex OAuth. (@​Utkub24)
  • Fix embedded UI serving from the standalone server build.
  • Fix PTY websocket connections from Desktop when using the HttpApi server.
  • Respect custom basic auth usernames in opencode clients.
  • Prompt browsers for basic auth on protected server logins. (@​OpeOginni)
  • Show real server error messages in the CLI and SDK instead of bare {}.
  • Prevent large diffs from using unbounded memory.
  • Fix v2 session API responses to encode optional fields correctly.
  • Fix pagination Link headers to use the real request host.

TUI

Improvements
  • Add debug info to print environment and diagnostic details.
Bugfixes
  • Add a --username option for basic-auth server connections. (@​OpeOginni)
  • Pass server auth through internal ACP connections.
  • Show provider login errors from stderr instead of swallowing them.

Desktop

Bugfixes
  • Prevent terminal reconnect loops after recovery failures.
  • Preserve auth-token credentials when reopening the app.

Thank you to 4 community contributors:

vercel-labs/agent-browser (aqua:vercel-labs/agent-browser)

v0.27.0

Compare Source

New Features
  • React introspection - First-class React DevTools integration with new react tree, react inspect <fiberId>, react renders start|stop, and react suspense commands for full component-tree visibility, per-fiber props/hooks/state inspection, render profiling with mount/re-render counts and change details, and Suspense boundary classification with root-cause grouping and recommendations. React DevTools hook is vendored (MIT) and embedded in the binary with zero runtime dependencies (#​1257)
  • Web Vitals - New vitals [url] command that reports Core Web Vitals (LCP, CLS, TTFB, FCP, INP) plus React hydration phases for any page (#​1257)
  • SPA navigation - New pushstate <url> command for client-side SPA navigations without a full page load (#​1257)
  • Init scripts and feature flags - New --init-script <path> flag (repeatable; env AGENT_BROWSER_INIT_SCRIPTS) to register scripts before first navigation, and --enable <feature> flag (repeatable; env AGENT_BROWSER_ENABLE) for built-in init scripts such as react-devtools (#​1257)
  • Network route resource type filter - network route now accepts --resource-type <csv> to filter intercepted requests by CDP resource type (#​1257)
  • cURL cookie import - cookies set --curl <file> auto-detects JSON, cURL, and Cookie-header formats for bulk cookie import (#​1257)
  • Dashboard proxy support - The observability dashboard now works from proxied origins via a same-origin proxy, enabling deployment behind reverse proxies and path-based routing (#​1111)
Bug Fixes
  • Fixed doctor command generating duplicate check ids when called multiple times in the same process (#​1330)
Infrastructure
  • Switched npm publishing to trusted publishing via GitHub Actions OIDC, removing the need for manually managed npm tokens (#​1273)
Contributors
agavra/tuicr (github:agavra/tuicr)

v0.11.0

Compare Source

What's Changed

New Contributors

Full Changelog: agavra/tuicr@v0.10.0...v0.11.0

always-further/nono (github:always-further/nono)

v0.49.0

Compare Source

What's Changed

Full Changelog: nolabs-ai/nono@v0.48.0...v0.49.0

v0.48.0

Compare Source

What's Changed

Full Changelog: nolabs-ai/nono@v0.47.1...v0.48.0

v0.47.1

Compare Source

What's Changed

Full Changelog: nolabs-ai/nono@v0.47.0...v0.47.1

v0.47.0

Compare Source

What's Changed

New Contributors

Full Changelog: nolabs-ai/nono@v0.46.0...v0.47.0

janosmiko/lfk (github:janosmiko/lfk)

v0.10.4

Compare Source

Changelog

  • c285bc7 chore(main): release 0.10.4 (#​162)
  • 3784fc6 feat(argocd): add Sync Wave Timeline overlay (#​160)
  • 8c50bec feat(release): add cloudsmith deb+rpm channel (#​163)
  • f4fe4a5 feat(release): add scoop, winget, chocolatey channels (#​161)
  • 28488b6 fix(release): apt install mono-devel before choco wrapper (ubuntu-24.04) (#​168)
  • d3d0eb3 fix(release): install chocolatey via mono wrapper per chezmoi pattern (#​166)
  • 56b0dde fix(release): use ArtifactPath template in cloudsmith publisher (#​169)
  • 1673a83 fix(release): use pip --user for cloudsmith-cli to avoid workspace pollution (#​164)

v0.10.3

Compare Source

Features
  • release: foundation for new package-manager channels (#​159) (0a4a353)
  • ui: dim explorer behind overlays via dim_overlay option (#​99) (df167f4)
Bug Fixes
  • filter: clear active filter preset on Esc (#​156) (7b22dff)
  • filter: clear stale preview when filter preset matches zero items (#​157) (5a8f28c)
  • theme: keep parent highlight readable on themes with near-text border (b5fc86f)
golang/go (go)

v1.26.3

Compare Source

google-gemini/gemini-cli (npm:@​google/gemini-cli)

v0.41.2

Compare Source

What's Changed

Full Changelog: google-gemini/gemini-cli@v0.41.1...v0.41.2

v0.41.1

Compare Source

What's Changed

Full Changelog: google-gemini/gemini-cli@v0.41.0...v0.41.1

v0.41.0

Compare Source

What's Changed

New Contributors

Full Changelog: google-gemini/gemini-cli@v0.40.1...v0.41.0

SocketDev/socket-cli (npm:socket)

v1.1.92

Compare Source

stylelint/stylelint (npm:stylelint)

v17.11.0

Compare Source

It adds 2 features, including a loader property to referenceFiles: {} for when the order of appearance in the reference styles matters.

DataDog/guarddog (pipx:guarddog)

v2.10.0

Compare Source

semgrep/semgrep (pipx:semgrep)

v1.162.0

Compare Source

### Added
  • pro: Improved support for tracking taint through nested functions. (LANG-95)
  • Added indexes to file targeting to improve performance of semgrepignore matching. (gh-27830)
### Changed
  • Faster JSON rule parsing: rule files in JSON format now parse roughly 5x faster end-to-end (measured ~134s → ~28s on a 382MB rule pack) by going through a new hand-written RFC 8259 parser instead of the previous JS-parser-based chain. (ENGINE-2725)
  • Scala projects are now identified for Supply Chain only by their root build.sbt, rather than treating each build.sbt as a different subproject. (SC-3293)
  • MCP semgrep_findings tool: added a refs parameter to filter findings by branch (defaults to the primary branch when not specified), and made autotriage_verdict optional so that findings without an AI verdict can also be returned. (engine-2723)
### Fixed
  • jsonnet: import and importstr now reject paths that resolve outside the
    rule file's parent directory. (ENGINE-2727)
  • semgrep ci: redact URL-embedded credentials and Authorization header
    values from git error messages and from the captured tracebacks sent to
    the fail-open telemetry endpoint, preventing leaks of secrets like
    CI_JOB_TOKEN from a failed git fetch in GitLab CI. Also closes
    ENGINE-2731 (raw, unsanitized tracebacks in fail-open telemetry). (ENGINE-2728)
  • semgrep ci no longer transmits SCM tokens to the Semgrep Platform. (ENGINE-2729)
  • semgrep CLI: the on-disk log file (~/.semgrep/semgrep.log or $SEMGREP_LOG_FILE) now respects the requested log level instead of always being written at DEBUG. This narrows the surface for credentials to land on disk via CI runner filesystems or job artifacts; pass --debug to restore the previous behavior. (ENGINE-2730)
  • jsonnet rules: bound recursion in both rule loading and evaluation so a
    malicious rule can no longer hang semgrep via mutually-recursive imports
    or runtime function calls that recurse forever. (ENGINE-2727-dos)
  • Scala: Merging consecutive top-level package declarations into a single package path. (LANG-374)
  • Fixed PHP parse errors during highly-parallel parsing. (gh-6197)
  • Fixed Scala parse errors during highly-parallel parsing. (gh-6198)
  • Surface a clearer error from the MCP scan tool when metrics is off and auto config is specified (gh-11649)
  • Fixed unknown option error when spawning the MCP daemon (gh-11660)

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

  • Branch creation
    • Between 03:00 AM and 05:59 AM (* 3-5 * * *)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from scottames as a code owner May 11, 2026 10:35
@renovate
renovate Bot enabled auto-merge (squash) May 11, 2026 10:35
@scottames
scottames disabled auto-merge May 11, 2026 15:12
@renovate
renovate Bot force-pushed the renovate/mise-packages branch from 7a847f0 to 9fe141a Compare May 11, 2026 15:53
@renovate
renovate Bot enabled auto-merge (squash) May 11, 2026 15:53
@renovate
renovate Bot force-pushed the renovate/mise-packages branch from ee7d95d to e03e9c3 Compare May 11, 2026 16:15
@renovate

renovate Bot commented May 11, 2026

Copy link
Copy Markdown
Contributor Author

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

@renovate
renovate Bot merged commit 0885dee into main May 11, 2026
5 checks passed
@renovate
renovate Bot deleted the renovate/mise-packages branch May 11, 2026 16:20
scottames pushed a commit that referenced this pull request May 11, 2026
🤖 I have created a release *beep* *boop*
---


## [0.45.0](v0.44.0...v0.45.0)
(2026-05-11)


### Updates & Misc Chores

* **aqua/mise:** move 'alltuner/mise-completions-sync' to mise
([b155789](b155789))
* **deps:** lock file maintenance
([#872](#872))
([b4cd81d](b4cd81d))
* **deps:** update ⬆️ aqua-packages
([#869](#869))
([28ee891](28ee891))
* **deps:** update ⬆️ aqua-packages
([#871](#871))
([7665c93](7665c93))
* **deps:** update ⬆️ aqua-packages
([#873](#873))
([12beaed](12beaed))
* **deps:** update ⬆️ aqua-packages
([#875](#875))
([f23f469](f23f469))
* **deps:** update ⬆️ aqua-packages
([#878](#878))
([397d75a](397d75a))
* **deps:** update ⬆️ mise-packages
([#870](#870))
([e14bc98](e14bc98))
* **deps:** update ⬆️ mise-packages
([#874](#874))
([a026c77](a026c77))
* **deps:** update ⬆️ mise-packages
([#882](#882))
([0885dee](0885dee))
* **deps:** update ⬆️ mise-packages (major)
([#883](#883))
([2ec6fa4](2ec6fa4))
* **deps:** update ⬆️ mise-packages to v1.14.33
([#879](#879))
([4d78982](4d78982))
* **deps:** update ⬆️ mise-packages to v17.10.0
([#877](#877))
([4af370e](4af370e))
* **opencode:** add permissions
([ece47f0](ece47f0))
* **release-please:** move to manifest/config driven
([dbbb3e4](dbbb3e4))
* upgrade trunk ([#880](#880))
([ce2107a](ce2107a))
* **zen:** update keybinds based on version upgrade
([984c215](984c215))


### Features

* **mise:** add ghui
([17fc02a](17fc02a))
* **mise:** add lfk
([c5cb06d](c5cb06d))
* **opencode:** add /tree plugin
([f2de1cb](f2de1cb))
* **worktrunk:** add step copy-ignored to post-start
([580cb23](580cb23))


### Bug Fixes

* **aqua:** disable ecr-cred-helper for mac
([f837a7c](f837a7c))
* **mac:** nix / fix updates
([cf7fa3e](cf7fa3e))
* **opencode:** tmpl/init fixes
([149aa59](149aa59))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: scottames-github-bot[bot] <162828115+scottames-github-bot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants