Skip to content

⬆️ deps: Update dependencies (non-major) - #26

Open
renovate[bot] wants to merge 1 commit into
codex/fix-renovate-pr-guardsfrom
renovate/dependencies-(non-major)
Open

⬆️ deps: Update dependencies (non-major)#26
renovate[bot] wants to merge 1 commit into
codex/fix-renovate-pr-guardsfrom
renovate/dependencies-(non-major)

Conversation

@renovate

@renovate renovate Bot commented Jul 27, 2026 •
edited
Loading

Copy link
Copy Markdown

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update
@agentclientprotocol/sdk 1.2.1 → 1.3.0 age confidence pnpm.catalog.default minor
@astrojs/check (source) 0.9.9 → 0.9.10 age confidence devDependencies patch
@astrojs/starlight (source) 0.41.4 → 0.41.5 age confidence dependencies patch
@connectrpc/connect-node>undici (source) 6.27.0 → 6.28.0 age confidence pnpm-workspace.overrides minor
@cursor/sdk (source) 1.0.23 → 1.0.26 age confidence dependencies patch
@cursor/sdk-darwin-arm64 (source) 1.0.23 → 1.0.26 age confidence optionalDependencies patch
@cursor/sdk-darwin-x64 (source) 1.0.23 → 1.0.26 age confidence optionalDependencies patch
@cursor/sdk-linux-arm64 (source) 1.0.23 → 1.0.26 age confidence optionalDependencies patch
@cursor/sdk-linux-x64 (source) 1.0.23 → 1.0.26 age confidence optionalDependencies patch
@cursor/sdk-win32-x64 (source) 1.0.23 → 1.0.26 age confidence optionalDependencies patch
@earendil-works/pi-ai (source) ^0.82.1 → ^0.83.0 age confidence dependencies minor
@earendil-works/pi-coding-agent (source) ^0.82.1 → ^0.83.0 age confidence devDependencies minor
@earendil-works/pi-tui (source) ^0.82.1 → ^0.83.0 age confidence dependencies minor
@inlang/paraglide-js (source) 2.20.2 → 2.23.0 age confidence devDependencies minor
@j178/prek (source) 0.4.6 → 0.4.11 age confidence devDependencies patch
@lucide/svelte (source) 1.18.0 → 1.28.0 age confidence dependencies minor
@modelcontextprotocol/sdk (source) 1.29.0 → 1.30.0 age confidence pnpm.catalog.default minor
@modelcontextprotocol/sdk>@hono/node-server 2.0.11 → 2.0.12 age confidence pnpm-workspace.overrides patch
@orpc/client (source) 1.14.8 → 1.14.13 age confidence pnpm.catalog.default patch
@orpc/contract (source) 1.14.8 → 1.14.13 age confidence pnpm.catalog.default patch
@orpc/server (source) 1.14.8 → 1.14.13 age confidence pnpm.catalog.default patch
@sveltejs/adapter-node (source) 5.5.4 → 5.5.7 age confidence dependencies patch
@sveltejs/kit (source) 2.65.1 → 2.70.2 age confidence dependencies minor
@types/node (source) 26.1.1 → 26.1.2 age confidence devDependencies patch
astro (source) 7.1.3 → 7.1.6 age confidence dependencies patch
es-toolkit (source) 1.49.0 → 1.50.0 age confidence pnpm.catalog.default minor
jscpd (source) 5.0.12 → 5.0.14 age confidence devDependencies patch
knip (source) 6.27.0 → 6.29.0 age confidence devDependencies minor
kysely (source) ^0.28.7 → ^0.29.0 age confidence dependencies minor
minimatch 10.2.5 → 10.2.6 age confidence dependencies patch
minimatch>brace-expansion 5.0.7 → 5.0.9 age confidence pnpm-workspace.overrides patch
node (source) 26.3.1 → 26.5.1 age confidence minor
playwright (source) 1.61.1 → 1.62.1 age confidence devDependencies minor
pnpm (source) 11.8.0 → 11.18.0 age confidence packageManager minor
smol-toml 1.6.1 → 1.7.1 age confidence dependencies minor
svelte (source) 5.56.7 → 5.56.8 age confidence dependencies patch
svelte-check 4.6.0 → 4.7.4 age confidence devDependencies minor
tsx (source) 4.22.4 → 4.23.1 age confidence devDependencies minor
typebox 1.3.6 → 1.3.8 age confidence pnpm.catalog.default patch
wrangler (source) 4.113.0 → 4.116.0 age confidence devDependencies minor
ws 8.21.0 → 8.21.1 age confidence pnpm.catalog.default patch

Release Notes

agentclientprotocol/typescript-sdk (@​agentclientprotocol/sdk)

v1.3.0

Compare Source

Features
withastro/astro (@​astrojs/check)

v0.9.10

Compare Source

Patch Changes
withastro/starlight (@​astrojs/starlight)

v0.41.5

Compare Source

Patch Changes
nodejs/undici (@​connectrpc/connect-node>undici)

v6.28.0

Compare Source

Full Changelog: nodejs/undici@v6.27.0...v6.28.0

earendil-works/pi (@​earendil-works/pi-ai)

v0.83.0

Compare Source

Breaking Changes
  • Upgraded the exported TypeBox dependency to 1.3.7, removing deprecated APIs including Type.Base, Type.Awaited, Type.Promise, Type.AsyncIterator, Type.Iterator, Type.Options, and Value.Mutate, while fixing compiled validation of nullable array tool arguments. Consumers using removed APIs must migrate to supported TypeBox APIs (#​7243 by @​petrroll).
Added
  • Added per-request fetch injection for supported text and image provider transports; Google adapters reject non-global implementations rather than silently bypassing them.
  • Added Claude Opus 5 support for the GitHub Copilot provider, routing through the Anthropic Messages API with adaptive thinking, 1M context, and the Copilot minimal thinking-level override (#​7158 by @​jay-aye-see-kay).
  • Added the "pending" stop reason for partial streaming messages. See Stop Reasons (#​7151 by @​lucasmeijer).
  • Added AssistantMessage.rawStopReason and populated it across Google, Anthropic, Amazon Bedrock, Mistral, and OpenAI streams; unmapped terminal reasons now surface as provider errors instead of successful stops (#​7272).
  • Added manual redirect URL and authorization-code entry to OpenRouter OAuth login for remote and headless environments (#​7114 by @​rgarcia).
  • Added AuthResolutionOverrides.minOAuthValidityMs so callers can require and refresh OAuth credentials with a minimum remaining validity (#​7168).
Changed
  • Changed stored OAuth credentials to refresh when less than five minutes of validity remain instead of waiting until expiration (#​7168).
Fixed
  • Fixed Qwen Token Plan reasoning models to send their service-specific thinking controls and supported reasoning-effort levels (#​6951, #​6998).
  • Fixed Z.AI providers and compatible custom endpoints to send output limits through max_tokens, which those endpoints honor (#​7174 by @​HyeokjaeLee).
  • Fixed explicitly configured Amazon Bedrock profiles being overridden by ambient AWS access keys (#​7176 by @​christianbasch).
  • Fixed malformed OpenAI-compatible tool-call deltas with both a valid function payload and an empty custom object discarding the function arguments (#​7288 by @​sunnyyoung).
earendil-works/pi (@​earendil-works/pi-coding-agent)

v0.83.0

Compare Source

New Features
  • Credential export for external clients — pi auth print-api-key and pi auth print-bearer-token export configured credentials with automatic OAuth refresh and minimum-validity enforcement.
  • Headless OpenRouter sign-in — Complete /login over SSH by pasting the redirect URL or authorization code when the loopback callback is unavailable. See OpenRouter.
  • Claude Opus 5 on GitHub Copilot — Use Claude Opus 5 through GitHub Copilot with adaptive thinking and a 1M context window. See GitHub Copilot.
Breaking Changes
  • Upgraded bundled TypeBox aliases to 1.3.7, removing deprecated APIs including Type.Base, Type.Awaited, Type.Promise, Type.AsyncIterator, Type.Iterator, Type.Options, and Value.Mutate, while fixing compiled validation of nullable array tool arguments. Extensions using removed APIs must migrate to supported TypeBox APIs. See Package Dependencies (#​7243 by @​petrroll).
Added
  • Added pi auth print-api-key and pi auth print-bearer-token commands for exporting configured credentials to external clients, including automatic OAuth refresh and configurable minimum token validity (#​7168).
  • Exposed the session's resolved model scope as ctx.scopedModels to extensions. See Extension Context (#​7191 by @​pungggi, #​7215).
  • Added inherited per-request fetch injection for supported text and image provider transports.
  • Added the inherited "pending" stop reason for partial streaming messages. See Custom Provider Stream Pattern (#​7151 by @​lucasmeijer).
  • Added inherited raw provider stop reasons across Google, Anthropic, Amazon Bedrock, Mistral, and OpenAI streams; unmapped terminal reasons now surface as provider errors instead of successful stops (#​7272).
  • Added manual redirect URL and authorization-code entry to OpenRouter login for remote and headless environments. See OpenRouter (#​7114 by @​rgarcia).
  • Added inherited Claude Opus 5 support for GitHub Copilot with adaptive thinking and a 1M context window. See GitHub Copilot (#​7158 by @​jay-aye-see-kay).
Changed
  • Changed inherited OAuth credential resolution to refresh tokens with less than five minutes of validity remaining instead of waiting until expiration (#​7168).
Fixed
  • Added a status line when the tool output expansion is toggled (#​7180).
  • Fixed file-backed SYSTEM.md and APPEND_SYSTEM.md prompts being omitted from the interactive startup context listing. See System Prompt Files (#​7096).
  • Fixed context files loading twice when a linked Git worktree is nested under its main repository. See Context Files (#​7221 by @​arajkumar).
  • Fixed llama.cpp streamed responses reporting zero token usage and leaving session context accounting empty. See llama.cpp (#​7258 by @​SteveImmanuel).
  • Fixed session replacement and committed tree navigation during an active response to abort and persist the outgoing turn instead of leaving dangling tool calls. See Sessions (#​7022 by @​tmustier).
  • Fixed failed Git package installs leaving partial directories that blocked clean retries. See Install and Manage (#​7210 by @​haoqixu).
  • Fixed the /model selector retaining a stale selection while filtering instead of highlighting the top match (#​7211 by @​christianbasch).
  • Fixed direct RPC bash commands bypassing extension user_bash handlers. See User Bash Events (#​7214).
  • Fixed skills, prompts, and themes losing package source metadata after extensions reload resources. See Resource Events (#​6968).
  • Fixed cancellation of concurrently running user bash commands so every active command is aborted (#​7103 by @​yzhg1983).
  • Fixed duplicate messages appearing when extensions switch sessions during interactive startup (#​7110 by @​yzhg1983).
  • Fixed inherited Qwen Token Plan reasoning models to send their service-specific thinking controls and supported reasoning-effort levels (#​6951, #​6998).
  • Fixed inherited Z.AI output limits being sent through an unsupported parameter. See Providers (#​7174 by @​HyeokjaeLee).
  • Fixed explicitly configured Amazon Bedrock profiles being overridden by ambient AWS access keys. See Amazon Bedrock (#​7176 by @​christianbasch).
  • Fixed inherited image fallback paths overflowing narrow terminals, shortened home-directory paths, and made absolute paths clickable when terminal hyperlinks are available (#​7262).
  • Fixed inherited OpenAI-compatible tool calls losing their function arguments when malformed deltas also contain an empty custom object (#​7288 by @​sunnyyoung).
earendil-works/pi (@​earendil-works/pi-tui)

v0.83.0

Compare Source

Fixed
  • Fixed long image fallback paths overflowing narrow terminals, shortened home-directory paths, and made absolute paths clickable when terminal hyperlinks are available (#​7262).
opral/paraglide-js (@​inlang/paraglide-js)

v2.23.0

Minor Changes

  • c2b9c17: Replace the experimental per-locale framework-output specialization with a
    Vite 8+ environment architecture. experimentalPerLocaleBuild: true now
    generates locale source modules before bundling, builds independent native
    Rolldown graphs, supports unminified builds and source maps, and emits
    paraglide-vite-locales.json without rewriting completed chunks or framework
    output.

    Remove the private TanStack Start and SvelteKit renderer integrations. Those
    frameworks now require public client-variant build and render-selection APIs
    before they can compose with experimental per-locale builds.

Patch Changes
  • 608385f: Use baseLocale as the exhaustive branch in generated message functions.

v2.22.0

Minor Changes
  • 2571af2: Add experimental Vite 8 per-locale client builds for TanStack Start and SvelteKit. Enable the same experimentalPerLocaleBuild: true flag in either framework; Paraglide detects the framework and serves compiler-specialized client assets for each locale.

v2.21.0

Minor Changes

  • ab5bfc7: fix emitTsDeclarations with TypeScript 7 #​711

    TypeScript 7 (the Go-based compiler) no longer ships the in-process compiler API that Paraglide used to generate .d.ts files, which made paraglide-js compile --emit-ts-declarations fail with TypeError: Cannot read properties of undefined (reading 'ESNext'). Paraglide now detects this and invokes TypeScript's tsc CLI instead. TypeScript 5 and 6 keep using the compiler API as before.

    Note that the declaration output of TypeScript 7 differs cosmetically from TypeScript 5/6 (quote style, declaration ordering, export declare const vs export const) but is semantically equivalent.

j178/prek (@​j178/prek)

v0.4.11

Compare Source

Released on 2026-07-25.

Highlights

  • This release adds two new builtin hooks, deny-pattern and require-pattern,
    as native alternatives for pygrep use cases. deny-pattern fails when a
    configured pattern is found, while require-pattern ensures every selected
    file contains a match. By matching natively without spawning a Python
    subprocess, they run over 4x faster than pygrep in benchmarks. Note that
    they use
    Rust regex syntax, which does
    not support look-around features such as negative lookbehind.

  • prek run now supports --glob <PATTERN> to run hooks on tracked files
    matching a glob. It can be repeated or combined with --files and
    --directory.

  • Hook priorities now support reusable aliases:

    [priorities]
checks = 10

[[repos]]
repo = "builtin"
hooks = [
  { id = "check-json", priority = "checks" },
  { id = "check-yaml", priority = "checks" },
]

    This makes parallel scheduling easier to read and maintain.

Enhancements
  • Add deny-pattern and require-pattern builtin hooks (#​2359)
  • Support --glob patterns in prek run (#​2381)
  • Support reusable aliases for hook priorities (#​2331)
  • Implement requirements-txt-fixer as a builtin hook (#​2390)
  • Improve user-facing warnings and errors (#​2380)
  • Install Node hooks through git url (#​2394)
Performance
  • Reduce blocking-pool overhead in file hooks (#​2384)
  • Speed up mixed-line-ending scans with memchr2 (#​2391)
Bug fixes
  • Honor filenames in builtin hook entry and args (#​2389)
  • Match identify tags across filename parts (#​2399)
  • Preserve hook output order with a shared pipe (#​2385)
  • Preserve system download policy when applying metadata (#​2395)
Contributors

v0.4.10

Compare Source

Released on 2026-07-16.

Enhancements
  • Add PHP language support (#​2314)
  • Add freeze option to update settings (#​2323)
  • Add tag filters to update configuration (#​2354)
  • Identify 'mts' and 'cts' as TypeScript files (#​2209)
  • Publish Alpine Docker images (#​2352)
  • Support builtin and meta in try-repo (#​2350)
Bug fixes
  • Fix Python discovery order (#​2348)
  • Fix Windows progress rendering (#​2328)
  • Preserve configured repo values for updates (#​2324)
  • Scope synthetic GIT_WORK_TREE to git commands (#​2356)
Documentation
  • Expand common workflows guide (#​2351)
Contributors

v0.4.9

Compare Source

Released on 2026-07-11.

Note: This release changes the repository identity schema stored in cached hook environments. Existing
hook environments will be invalidated, and prek will reinstall them automatically when needed.

Enhancements
  • Preserve additional dependency order (#​2311)
  • Remove parallel Ruby gem installation (#​2307)
  • Warn for missing update repositories (#​2316)
Bug fixes
  • Fix mixed workspace selectors (#​2306)
  • Fix try-repo local path resolution (#​2310)
  • Use resolved gem executable (#​2308)
  • Validate complete XML documents in check-xml (#​2312)
Contributors

v0.4.8

Compare Source

Released on 2026-07-04.

Enhancements
  • Add default_env configuration (#​2288)
  • Rename auto-update to update (#​2286)
Bug fixes
  • Fix progress collapse ordering (#​2291)
  • Fix progress insertion after collapsed rows (#​2292)
Contributors

v0.4.7

Compare Source

lucide-icons/lucide (@​lucide/svelte)

v1.28.0: Version 1.28.0

Compare Source

What's Changed

Full Changelog: lucide-icons/lucide@1.27.0...1.28.0

v1.27.0: Version 1.27.0

Compare Source

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.26.0...1.27.0

v1.26.0: Version 1.26.0

Compare Source

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.25.0...1.26.0

v1.25.0: Version 1.25.0

Compare Source

What's Changed

Full Changelog: lucide-icons/lucide@1.24.0...1.25.0

v1.24.0: Version 1.24.0

Compare Source

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.23.0...1.24.0

v1.23.0: Version 1.23.0

Compare Source

What's Changed

New Contributors

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/dependencies-(non-major) branch 19 times, most recently from eb17bed to eb7ae45 Compare July 29, 2026 02:39
@renovate
renovate Bot force-pushed the renovate/dependencies-(non-major) branch 9 times, most recently from 97b4159 to 2d870f1 Compare July 30, 2026 04:34
@renovate
renovate Bot force-pushed the renovate/dependencies-(non-major) branch 7 times, most recently from 0867f34 to f392bc4 Compare July 31, 2026 01:52
@zrr1999 zrr1999 mentioned this pull request Jul 31, 2026
Open
@zrr1999
zrr1999 changed the base branch from main to codex/fix-renovate-pr-guards July 31, 2026 02:17
@zrr1999
zrr1999 force-pushed the renovate/dependencies-(non-major) branch from f392bc4 to d5a4819 Compare July 31, 2026 02:18
@renovate

renovate Bot commented Jul 31, 2026

Copy link
Copy Markdown
Author

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

@zrr1999 zrr1999 mentioned this pull request Jul 31, 2026
Merged
zrr1999 added a commit to zrr1999/renovate-config that referenced this pull request Jul 31, 2026
@zrr1999
🔧 chore: align Renovate with pnpm release age (#2)
3d15466 
## Summary

- require npm releases to be at least one day old before Renovate
selects them
- use strict internal filtering so pending releases do not enter
dependency branches
- preserve immediate updates for the trusted `@earendil-works/pi-ai` and
`@earendil-works/pi-tui` kernel packages

## Root cause

Spark uses pnpm's 24-hour minimum-release-age supply-chain policy. The
shared Renovate preset could still rebuild the grouped non-major PR with
newly published npm versions, producing a lockfile that every
frozen-install CI lane rejects. This caused zendev-lab/spark#26 to
become red again after rebasing even though its title and Pi exceptions
were fixed.

The shared preset now filters direct npm updates before branch creation.
pnpm remains the final guard for transitive lockfile entries.

## Validation

- `jq empty default.json`
- Renovate `44.3.2`: `renovate-config-validator --no-global
default.json` passed
- targeted `jq -e` assertions for both package rules passed
- `git diff --check`

`renovate-config-validator --strict` still reports two pre-existing
migration warnings (`config:base` to `config:recommended` and `pin:
true` to `pin.enabled: true`); this PR intentionally does not mix those
migrations into the release-age policy change.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants