Skip to content

chore(deps): update ⬆️ mise-packages - #1042

Merged
renovate[bot] merged 2 commits into
mainfrom
renovate/mise-packages
Aug 30, 2026
Merged

chore(deps): update ⬆️ mise-packages#1042
renovate[bot] merged 2 commits into
mainfrom
renovate/mise-packages

Conversation

@renovate

@renovate renovate Bot commented Aug 30, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change Pending Age Adoption Passing Confidence
aqua:astral-sh/uv tools patch 0.12.5 → 0.12.6 0.12.7 age adoption passing confidence
aqua:atuinsh/atuin tools minor 18.19.0 → 18.20.0 18.20.1 age adoption passing confidence
aqua:editorconfig-checker/editorconfig-checker tools patch 3.11.1 → 3.11.2 age adoption passing confidence
aqua:google/go-containerregistry tools minor 0.21.9 → 0.22.0 age adoption passing confidence
aqua:securego/gosec tools minor 2.28.0 → 2.29.0 age adoption passing confidence
aqua:sharkdp/fd tools minor 10.4.2 → 10.5.0 age adoption passing confidence
aqua:walles/moor tools minor 2.17.0 → 2.18.0 age adoption passing confidence
droid (source) minor 0.204.0 → 0.205.1 0.208.1 (+2) age adoption passing confidence
github:agavra/tuicr tools minor v0.23.1 → v0.24.0 age adoption passing confidence
github:anthropics/claude-code tools patch v2.1.245 → v2.1.246 v2.1.251 (+3) age adoption passing confidence
github:modem-dev/hunk tools minor v0.19.1 → v0.20.0 v0.20.1 age adoption passing confidence
node (source) tools minor 24.19.0 → 24.20.0 age adoption passing confidence
npm:socket tools patch 1.1.158 → 1.1.160 1.1.162 (+1) age adoption passing confidence
usage tools patch 6.4.0 → 6.4.1 6.5.0 age adoption passing confidence

Release notes are maintained in a PR comment by the renovate-release-notes-comment workflow.

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

  • Branch creation
    • Between 03:00 AM and 05:59 AM (* 3-5 * * *)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from scottames as a code owner August 30, 2026 10:07
@renovate
renovate Bot enabled auto-merge (squash) August 30, 2026 10:07
@scottames-github-bot

scottames-github-bot Bot commented Aug 30, 2026

Copy link
Copy Markdown
Contributor

Renovate Release Notes

Generated from Renovate's update table by the renovate-release-notes-comment workflow.

Packages that cannot be summarized from GitHub releases are listed explicitly below.

astral-sh/uv (aqua:astral-sh/uv)

0.12.6: 0.12.6

Compare Source

Release Notes

Released on 2026-08-25.

Python

  • Update CPython to use OpenSSL 3.5.8 and libffi 3.4.8 #21295)

Enhancements

  • Report cache-cleaning space savings from filesystem block allocation and avoid double-counting hard links (#21261)
  • Limit warnings about unbounded uv_build requirements to source-distribution builds (#21078)
  • Display byte counts below 1 KiB without a fractional part (#21237)

Preview features

  • Add uv workspace metadata --sync --exact to remove packages outside the selected resolution (#21117)
  • Add the artifact-hash-filtering preview feature to make uv pip compile --generate-hashes honor --only-binary and --no-binary (#21235)
  • Respect package-specific exclude-newer cutoffs when uv check selects its ty executable (#21227)
  • Preserve virtual-environment hints from tar-codec source-distribution errors when the base interpreter is outside a bin directory (#21146)

Performance

  • Enable profile-guided optimization for Linux x86-64 release binaries (#21001)
  • Enable profile-guided optimization for Windows x86-64 release binaries (#21003)
  • Enable profile-guided optimization for macOS ARM64 release binaries (#21002)
  • Enable profile-guided optimization for Linux ARM64 release binaries (#21004)
  • Speed up syncing projects with many activated conflict items by reusing their encoded representation (#21148)

Bug fixes

  • Allow explicit uv build and non-editable first-party workspace packages when no-build is enabled (#21294)
  • Reuse configured index credentials during uv tool upgrade when the tool receipt references the same index (#21275)
  • Ensure full 40-character Git commit pins resolve to the requested object instead of a SHA-named branch (#21224)
  • Prevent TLS segfaults in riscv64 musl release binaries (#21158)
  • Preserve dependencies selected by recursive extras when markers mix production and extra conditions (#21181)
  • Preserve version constraints from transitively referenced recursive extras (#21209)
  • Resolve repository-relative Git archive dependencies inside the checkout during the initial uv sync (#21264)
  • Return an error instead of panicking when a bearer token cannot be encoded as an HTTP header (#21282)
  • Do not misclassify package URLs ending in .py as local script paths (#21144)
  • Use directory creation times consistently across libc implementations for directory cache-keys entries (#21137)
  • Promote human-readable sizes to the next unit at rounding boundaries (#21136)

Other changes

  • Add Python 3.15 release-candidate Docker images (#21293)
  • Raise the minimum supported Rust version to 1.96 and update the repository toolchain to Rust 1.98 (#21258)

Install uv 0.12.6

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.6/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.6/uv-installer.ps1 | iex"

Download uv 0.12.6

File Platform Checksum
uv-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
uv-x86_64-apple-darwin.tar.gz Intel macOS checksum
uv-aarch64-pc-windows-msvc.zip ARM64 Windows checksum
uv-i686-pc-windows-msvc.zip x86 Windows checksum
uv-x86_64-pc-windows-msvc.zip x64 Windows checksum
uv-aarch64-unknown-linux-gnu.tar.gz ARM64 Linux checksum
uv-i686-unknown-linux-gnu.tar.gz x86 Linux checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz PPC64LE Linux checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz RISCV Linux checksum
uv-s390x-unknown-linux-gnu.tar.gz S390x Linux checksum
uv-x86_64-unknown-linux-gnu.tar.gz x64 Linux checksum
uv-armv7-unknown-linux-gnueabihf.tar.gz ARMv7 Linux checksum
uv-aarch64-unknown-linux-musl.tar.gz ARM64 MUSL Linux checksum
uv-i686-unknown-linux-musl.tar.gz x86 MUSL Linux checksum
uv-riscv64gc-unknown-linux-musl.tar.gz RISCV MUSL Linux checksum
uv-x86_64-unknown-linux-musl.tar.gz x64 MUSL Linux checksum
uv-arm-unknown-linux-musleabihf.tar.gz ARMv6 MUSL Linux (Hardfloat) checksum
uv-armv7-unknown-linux-musleabihf.tar.gz ARMv7 MUSL Linux checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>
atuinsh/atuin (aqua:atuinsh/atuin)

v18.20.0: 18.20.0

Compare Source

Release Notes

Bug Fixes

  • (ai) Execute commands from enter in the bash integration (#3892)
  • (ai) Answer unrecognized tool calls with an error result (#3893)
  • (bash) Localize "READLINE_{LINE,POINT}" in Bash <= 3.2 (#3926)
  • (common) Survive wide characters on a one-column screen (#3876)
  • (docs) Don't say enter_accept defaults to true in example config.toml (#3865)
  • (history) Don't misclassify users named after an agent as agents (#3951)
  • (install) Atuin init for bash (#3919)
  • (nix) Add an RPATH for OpenSSL so the built binary runs (#3852)
  • (search) Prepare daemon search index in shell init scripts (#3864)
  • (search) Fall back when daemon-fuzzy fails (#3895)
  • (search) Don't overflow on a session id with an out-of-range uuid timestamp (#3965)
  • (sync) Fix off-by-one bugs in sync (#3913)
  • (wrapped) Panic when every command is in stats.ignored_commands (#3925)
  • (zsh) Don't clobber RPS1 when wrapping the prompt for OSC 133 (#3861)
  • 'atuin login' prints 401 failures until authorized (#3916)
  • Silence hub 401 log spam during installer login (#3918)
  • Fix panics from vt100::Parser::new (#3933)
  • Make pty-proxy socket path shorter (#3991)

Documentation

  • Document rstest/proptest testing conventions in AGENTS.md (#3942)

Features

  • (common) Add rmp::serde iterator-to-MessagePack helper (#3897)
  • (daemon) Change default daemon socket path (#3910)
  • (domain) Add RecordTag string enum (#3899)
  • (sync) Send the auth token on the capabilities fetch when logged in (#3974)
  • Add agent hooks for opencode (#3844)
  • Add devcontainers (#3871)
  • Setup claude in devcontainers (#3878)
  • Add windows/powershell highlighting (#3883)
  • Add turn time and tips to Atuin AI (#3870)
  • Enable syntax highlighting on illumos (#3879)
  • Offer account login during install setup (#3849)
  • Client-side history packfiles (#3737)
  • Parallel packfile upload/download (#3944)
  • Eager Key Query (#3968)
  • Capabilities-driven sync page size (#3979)
  • Improve powershell highlighting (#3917)
  • Enable gzip and zstd for reqwest (#3980)

Miscellaneous Tasks

  • (ai) Remove obsolete atuin ai init command (#3936)
  • (docker) Install the toolchain pinned by rust-toolchain.toml (#3963)
  • (lints) Use workspace lints instead of overriding lints in GHA workflow (#3949)
  • (rustfmt) Update Rustfmt config (#3945)
  • (tests) Fix flaky pty-proxy test (#3874)
  • Add profiling to the app (#3853)
  • Temporarily drop tailscale and atuin (#3873)
  • Instruct agents to use rstest in AGENTS.md (#3912)
  • More xdg compliance (#3932)
  • Remove atuin-nucleo (#3950)
  • Enable more Clippy lints (#3953)
  • Update to rust 1.98 (#3964)
  • Revert changes to atuin-pty-proxy from lab share PR / feat: store pty-proxy sockets in /tmp/atuin-$UID (#3988)

Performance

  • (sql) Chunked bulk inserts + shared sqlite wrapper (#3981)
  • (sync) Batch post-sync history indexing into bulk transactions (#3947)
  • (sync) Parallel record downloads (#3955)
  • (tracing) OTel export + instrumentation coverage (#3952)

Refactor

  • (ai/bash) Use existing facility for accept-line (#3928)
  • (bash) Remove redundant check of existing preexec-backend (#3927)
  • (caps) CapClient owns its client and warms on construction (#3898)
  • (client) Own sync_addr via Arc, drop Client lifetime (#3896)
  • (client) Remove the Database trait in favor of Sqlite (#3946)
  • (deps) Bump pymdown-extensions from 11.0 to 11.0.1 in /docs in the uv group across 1 directory (#3875)
  • (domain) Make Record::with_data consume self, add with_data_clone (#3900)
  • (domain) Make Record.version a RecordVersion enum (#3903)
  • (domain) Drop the vestigial Host.name field (#3941)
  • (encryption) Introduce PasetoV4Key newtype for the encryption key (#3860)
  • (encryption) Move encryption into atuin-common. (#3863)
  • (record) Name the (host, tag) pair as RecordSeriesKey (#3961)
  • (sqlx) Use FromRow instead of manual row mapping (#3958)
  • (sync) Introduce SyncEngine to hold shared sync state (#3962)
  • Add a CmdOrigin Type (#3943)

Bug

  • Avoid rare race condition in sync (#3972)

atuin-server 18.20.0

Install atuin-server 18.20.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/atuinsh/atuin/releases/download/v18.20.0/atuin-server-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/atuinsh/atuin/releases/download/v18.20.0/atuin-server-installer.ps1 | iex"

Download atuin-server 18.20.0

File Platform Checksum
atuin-server-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
atuin-server-x86_64-apple-darwin.tar.gz Intel macOS checksum
atuin-server-x86_64-pc-windows-msvc.zip x64 Windows checksum
atuin-server-aarch64-unknown-linux-gnu.tar.gz ARM64 Linux checksum
atuin-server-x86_64-unknown-linux-gnu.tar.gz x64 Linux checksum
atuin-server-aarch64-unknown-linux-musl.tar.gz ARM64 MUSL Linux checksum
atuin-server-x86_64-unknown-linux-musl.tar.gz x64 MUSL Linux checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo atuinsh/atuin

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

atuin 18.20.0

Install atuin 18.20.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/atuinsh/atuin/releases/download/v18.20.0/atuin-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/atuinsh/atuin/releases/download/v18.20.0/atuin-installer.ps1 | iex"

Download atuin 18.20.0

File Platform Checksum
atuin-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
atuin-x86_64-apple-darwin.tar.gz Intel macOS checksum
atuin-x86_64-pc-windows-msvc.zip x64 Windows checksum
atuin-aarch64-unknown-linux-gnu.tar.gz ARM64 Linux checksum
atuin-x86_64-unknown-linux-gnu.tar.gz x64 Linux checksum
atuin-aarch64-unknown-linux-musl.tar.gz ARM64 MUSL Linux checksum
atuin-x86_64-unknown-linux-musl.tar.gz x64 MUSL Linux checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo atuinsh/atuin

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>
editorconfig-checker/editorconfig-checker (aqua:editorconfig-checker/editorconfig-checker)

v3.11.2: v3.11.2

Compare Source

editorconfig-checker v3.11.2 (2026-08-25T21:11:31Z)

Welcome to this new release of editorconfig-checker!

Changelog

Others

Thanks!

Those were the changes on v3.11.2!

google/go-containerregistry (aqua:google/go-containerregistry)

v0.22.0: v0.22.0

Compare Source

What's Changed

New Contributors

Full Changelog: google/go-containerregistry@v0.21.9...v0.21.10

securego/gosec (aqua:securego/gosec)

v2.29.0: v2.29.0

Compare Source

Changelog

  • deb54465fea23d19a77f037e11e6589021f8501d analyzers/G703: stop treating Clean/Abs/PathEscape as path-traversal sanitizers (#1723)
  • 2e13f16ff12497b4af18e915ba3f819916828e9e fix(junit): properly escape XML in failure text (#1718)
  • 38330372ed9a6b612bfd988ff4ecc050cc24abef fix(csv): capture and report write errors on flush (#1716)
  • f6d07d7887600938dace7f29e1b11a09130a5ac9 fix(report): root path matching in formatters (#1719)
  • 17d3916e34a3d052b67f88fcccae9f1e43730bac fix(config): handle nosec tags with leading hash (#1717)
  • 3958f0ed831c3020752ed07e45a8a24a531edd91 Update all dependencies (#1720)
  • 9c38a8648388bc22c13673207ac091df80100be2 Add support for go version 1.27.0 and update to version 1.25.14 and 1… (#1726)
  • 2eb4727ebc7504944ddbcdd2f7157db492026c3f Update all dependencies (#1713)
  • 5e72efc19d97e11549b3427b83fab3257a8c9894 Update all dependencies (#1710)
  • 45b083a0cb42119d61b1e0e364d8c62c68f6f5cd fix(G202): don't flag strings.Builder built from constants (#1707)
  • 82da19cc73c6fb5034aaab7a779a2ef1b123c791 ci: allow fork PR checkout in barry-ai-security-review job (#1708)
  • 9f7cd131bdd1160cd7c0205d89856ebd99530da7 Update all dependencies (#1709)
  • 1769a22fd149bfd9e5e546e06a7f9d596eab2f65 Downgrade min Go version (#1706)
  • 5bb2909d48fa8072136f38ad329b37575ab15c9f Udpate action to use gosec v2.28.0 (#1705)
sharkdp/fd (aqua:sharkdp/fd)

v10.5.0: 10.5.0

Compare Source

Features

  • Add --ignore-parent option to override --no-ignore-parent, see #1958 (@​tmchow)
  • Add --exact option to match the entire filename exactly (literal, non-substring).

Bugfixes

  • Sanitize control characters and bidirectional override characters in filenames
    when output goes to a terminal, to prevent terminal escape-sequence injection.
    Also reject a placeholder as the executable for --exec-batch, while still
    allowing it for --exec.
  • Handle invalid working directories gracefully when using --full-path, see #1900 (@​Xavrir).
  • Fire the "search pattern contains a path separator" diagnostic for any pattern containing /, not just patterns that happen to name an existing directory. Preserves the legacy Windows behaviour that also flags native \ separators when the pattern resolves to a real directory. See #1873.
  • Also fire the "search pattern contains a path separator" diagnostic for --and patterns, not only the primary positional pattern. --and patterns are matched against the file name just like the primary pattern, so a path separator in them silently returned zero results. See #1873.
  • Fix bug where passing "-" as a directory argument didn't actually search that directory, see chore(deps): update ⬆️ aqua-packages #849 (@​Sean-Kenneth-Doherty).
  • Fix panic when --changed-before/--changed-within is given an out-of-range @&#8203; Unix timestamp; the value is now rejected gracefully, see #2081 (@​nikolauspschuetz).

New Contributors

Full Changelog: sharkdp/fd@v10.4.2...v10.5.0

walles/moor (aqua:walles/moor)

v2.18.0: v2.18.0: Support embedding moor with your own screen

Compare Source

With this release, applications that embed moor can supply their own
twin.Screen via PageFromStreamWithScreen instead of moor always owning
the real terminal, and feed it input using the new NewEventRune,
NewEventKeyCode, and NewEventMouse constructors.

Also, this release bumps Go to 1.27, bringing in Unicode 17 support.

agavra/tuicr (github:agavra/tuicr)

v0.24.0: v0.24.0

Compare Source

What's Changed

New Contributors

Full Changelog: agavra/tuicr@v0.23.1...v0.24.0

anthropics/claude-code (github:anthropics/claude-code)

v2.1.246: v2.1.246

Compare Source

What's changed

  • Added a startup warning for Bash allow rules with a wildcard before the subcommand (e.g. Bash(git * main)), since they also match options inserted before the subcommand
  • Added an Auto mode tab to /permissions for viewing and editing auto mode classifier rules
  • Added the turn's completion time to the end-of-turn duration line, e.g. ✻ Sautéed for 23s · done 6:05 PM
  • Fixed fullscreen mode showing a blank transcript after resizing the terminal and jumping to the bottom until the next keypress
  • Fixed a severe transcript slowdown when a diff contained a very long single line (e.g. a base64 string); such lines now render truncated with a marker
  • Fixed erratic fullscreen scrolling when positioned at an earlier message, including jump-to-bottom getting stuck mid-transcript
  • Fixed background sessions failing to open after 45 seconds when Claude Code's starting directory had been deleted, the machine had slept, or the host is slow to start processes
  • Fixed background sessions failing to open with "Couldn't start the background service … EACCES" when another Claude Code process was re-installing the npm package at that moment
  • Fixed markdown rendering being disabled for a whole message when its first 500 characters contained no markdown, and for +/N) lists and setext headings
  • Fixed MCP tool calls interrupted by an incoming message in headless/remote sessions being reported to the model as "completed with no output" instead of an explicit interrupted error
  • Fixed MCP tool arguments being sent as JSON strings when the parameter's schema is empty ({}), instead of their real type
  • Fixed a command interrupted mid-run showing as "Ran 1 shell command" with no sign it was cut
  • Fixed pressing ← or running /background during a dynamic workflow restarting its finished subagents; it now asks first and says how many subagents would restart
  • Fixed opening a just-started session in claude agents while its worker was still booting (common on Windows) stopping it with "was stopped while the respawn was in flight"
  • Fixed claude agents listing a backgrounded named session twice; backgrounding the same conversation again now numbers the new row (e.g. my-session (2))
  • Fixed the background retention sweep removing git worktrees under .claude/worktrees/ that you created yourself when an old background-session record pointed at them
  • Fixed auto mode tool calls being denied as "temporarily unavailable" on very large sessions by scaling the safety-check deadline with prompt size
  • Fixed the plugin cache creating duplicate SHA-named directories for the same plugin
  • Fixed plugin skills whose frontmatter name already includes the <plugin>: prefix showing it doubled in the slash menu (e.g. /plugin:plugin:skill)
  • Fixed claude plugin update failing for an installed plugin given its bare name (only the fully-qualified name worked)
  • Fixed plugin installation failing when plugin.json was saved with a UTF-8 byte-order mark (BOM)
  • Fixed /reload-plugins reporting 0 skills for plugins that define skills under skills/*/SKILL.md
  • Fixed hook error messages showing a literal ${CLAUDE_PLUGIN_ROOT} instead of the resolved plugin path
  • Fixed /rename replacing the theme's prompt border color (including a custom theme's promptBorder) with the default cyan; the border now keeps your theme's color unless you pick one with /color
  • Fixed custom theme diff colors (diffAdded/diffRemoved and their dimmed variants) being ignored in diffs and the /theme preview
  • Fixed a keybindings.json binding with an unknown action name silently deadening that key; it is now skipped so the default binding keeps working, and a warning is logged under --debug
  • Fixed /stats activity heatmap showing each day's activity one cell off (Sunday's count under Monday) in timezones east of UTC
  • Fixed /fork from an already-forked or backgrounded session starting the new session with an empty conversation
  • Fixed prompts beginning with /-- (e.g. Lean doc comments) being rejected as an unknown slash command instead of being sent to Claude
  • Fixed the @&#8203; file picker staying open after the typed text stopped matching a real path
  • Fixed the status line's cost and duration resetting to zero after navigating to the agents view and back
  • Fixed fullscreen mode moving keyboard focus onto the control under the pointer when you clicked the terminal window only to bring it back into focus
  • Fixed path completion failing when the completion token or working directory contained a null byte
  • Windows/macOS: Fixed headless sessions not cleaning up stale entries in ~/.claude/sessions left by sessions that exited uncleanly
  • Fixed the UI stopping with a render error on the first tool call when a third-party Anthropic-compatible endpoint (ANTHROPIC_BASE_URL) streams a tool_use block without an id
  • Fixed the Write tool reporting "Out of memory" or freezing for a long time after overwriting a very large existing file, even though the file had been written
  • Fixed claude plugin install <name> exiting silently (or hanging in a terminal) instead of reporting an error when ~/.claude/plugins/known_marketplaces.json is empty or corrupted
  • Fixed resumed sessions failing every turn with a 400 when the saved history contains tool blocks the Anthropic API does not accept (typically written by a third-party API proxy)
  • Fixed curl -fsSL https://claude.ai/install.sh | bash failing with "Raw mode is not supported" for some Team/Enterprise users with server-managed settings
  • Fixed sessions that ended in plan mode resuming outside plan mode in the VS Code extension, and in claude -p --continue/--resume with a permission prompt tool, when no permission mode was set
  • Fixed the Notification hook not firing while the sandbox "Network request outside of sandbox" permission prompt is waiting
  • Fixed Bash permission checks to always require approval for malformed commands with a dangling && or || operator
  • Fixed --strict-mcp-config sessions prompting to approve .mcp.json servers they would never load, which left background sessions waiting at startup
  • Fixed telemetry and metrics requests to Anthropic carrying the API key configured for a third-party gateway (ANTHROPIC_BASE_URL); a credential is now only sent to its own host
  • Fixed a visible API error on the first prompt after idle when apiKeyHelper returns short-lived JWTs: an expired cached token is now refreshed before sending, and 401/403 auth errors retry quietly
  • Fixed memory growing with session length in the fullscreen and Ctrl+O transcript views: each rendered message row no longer retains a full copy of the transcript-wide tool lookups
  • Fixed /ultrareview runs and cloud sessions launched at the same time from one repository (e.g. from several worktrees) sometimes starting with another launch's uncommitted changes
  • Fixed the task progress count (e.g. 3/5) shown for background cloud sessions such as /autofix-pr occasionally missing a task
  • Fixed Remote Control sessions keeping their placeholder name in claude.ai and the Claude app until the second prompt; the auto-generated title now appears after the first prompt
  • Fixed MCP tools marked requiresUserInteraction still offering "Yes, and don't ask again" in their permission prompt; the option wrote an allow rule the tool then ignored
  • Fixed the self-hosted runner ending its live sessions or exiting when a work-poll response is malformed (e.g. an intercepting proxy's HTML page); it now retries the poll
  • Improved /cd: the new directory's project settings, hooks, .mcp.json servers (behind the usual approval prompt), skills, and agents now take effect right after the move instead of on --resume
  • Improved Bash tool latency on bash shells by replaying snapshot functions without a base64 subshell per function
  • Improved subagent results: a subagent that stops at its maxTurns limit now returns its output marked as partial, with a hint to continue it via SendMessage, instead of appearing finished
  • Improved non-interactive sessions (-p, SDK, cloud sessions) to automatically continue a response cut off mid-stream by a server error, connection loss, or stall instead of ending with an error
  • Improved attribution of usage telemetry to your organization for workload identity federation sessions, events sent while apiKeyHelper runs at startup, and after a login token expired while idle
  • Changed /code-review so Claude can also start it on its own on Bedrock, Vertex AI, and Foundry, through the Claude apps gateway, and when telemetry or non-essential traffic is disabled
  • /goal: Changed idle sessions to start at most three check-ins on long-running background work per goal; your next message allows three more
  • Changed claude install and claude update to defer a pending managed-settings consent prompt to the next interactive session instead of prompting mid-command
  • Changed OpenTelemetry plugin events for plugins synced from claude.ai: plugin_id_hash now reflects the plugin's real marketplace, and enabled_via is admin-install for admin-installed plugins
  • Fixed the command sandbox's filesystem configuration not respecting --setting-sources
modem-dev/hunk (github:modem-dev/hunk)

v0.20.0: v0.20.0

Compare Source

What's Changed

Hunk 0.20 makes it easier to install, keep current, and extend—while making everyday reviews faster and more precise.

Highlights

  • Install Hunk on macOS and Linux with a checksum-verified curl installer, then keep npm, Homebrew, and curl installations current with hunk update, by @​benvinegar in #799 and #788.
  • Explore a searchable directory of 12 community extensions covering GitHub reviews, Mercurial, search, CODEOWNERS, commit-by-commit workflows, exports, and more, introduced by @​benvinegar in #811, with catalog contributions from @​phl28, @​gentilfp, and @​sadick254 in #822, #826, and #842.
  • Build deeper integrations with exact selected-line context and immutable snapshots of reviewed files and saved notes, by @​benvinegar in #779 and #833.
  • Click exact diff lines—including blank lines—and open inline comments without shifting their target code, by @​benvinegar in #840 and #809.
  • Navigate and revisit highlighted diffs with less work, while --fast now offloads syntax highlighting for eligible files with 40 or more lines, by @​benvinegar in #791, #803, and #810.

Release notes: https://hunk.dev/changelog/0.20/
Full Changelog: modem-dev/hunk@v0.19.0...v0.20.0

v0.19.2: v0.19.2

Compare Source

What's Changed

Hunk 0.19.2 backports an important session reload security fix to the 0.19 release line.

Highlights

  • Reject option-like Git ranges and refs in session reloads, preventing local session broker callers from injecting Git flags such as --output=<path> and writing diff output to arbitrary paths, by @​benvinegar in #894.

Full Changelog: modem-dev/hunk@v0.19.1...v0.19.2

SocketDev/socket-cli (npm:socket)

v1.1.160: v1.1.160

Compare Source

What's Changed

Full Changelog: SocketDev/socket-cli@v1.1.159...v1.1.160

v1.1.159: v1.1.159

Compare Source

What's Changed

Full Changelog: SocketDev/socket-cli@v1.1.158...v1.1.159

jdx/usage (usage)

v6.4.1: v6.4.1: Colorful Help and Sharper Negative-Value Parsing

Compare Source

A focused patch release that adds terminal-aware color to interpreted help output, tightens how negative numbers are parsed as flag values, and lowers the published crates' minimum supported Rust version.

Added

  • Colorized help output. The usage CLI, usage bash, and usage exec now render interpreted help with terminal-aware semantic styling (headings, options, metavars, inline markdown, and help_template {$…} tags). Coloring is auto-detected from the terminal and honors NO_COLOR and CLICOLOR_FORCE; plain rendering remains available for snapshots and generated artifacts (#1309, @​jdx).

Fixed

  • More predictable negative-value parsing. Tokens like -1 are only consumed as a detached flag value when allow_negative_numbers is set or when the flag's value is truly required (no default_missing, not optional). This keeps optional and default_missing flags from swallowing negative numbers during subcommand and external_subcommand discovery, while required flags and explicit opt-ins still bind them correctly. Missing-value errors are also now reported for the awaiting flag even when another recognized option follows (#1317, #1318, @​jdx).
  • Hidden commands excluded from Markdown docs. Single-file Markdown reference generation no longer emits sections for commands marked hide=#true, matching the existing index and flag/arg filtering (#1315, @​jdx).
  • Simplified the required_unless predicate logic for arguments and flags with no change in behavior (#1326, @​jdx).

Changed

  • Lowered MSRV to Rust 1.91. The published usage-lib, usage-dynamic, clap_usage, and usage-cli crates now build on Rust 1.91 (down from 1.95), letting usage-cli install on runner images that ship Rust 1.94 (#1314, @​jdx).

Dependency Updates

  • Updated winnow to v1 (#1313, @​renovate[bot]).

Full Changelog: jdx/usage@v6.4.0...v6.4.1

💚 Sponsor usage

usage is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise, aube, hk, and more. Work on usage is funded by sponsorships.

If usage powers CLI specs, docs, or completions for a tool you maintain or use, please consider sponsoring at jdx.dev. Every sponsorship helps the project stay independent and moving.

Skipped Packages

Non-GitHub Sources

GitHub Release Notes Unavailable

  • droid: No GitHub release was found for 0.205.1

@renovate
renovate Bot merged commit 28f7af1 into main Aug 30, 2026
6 checks passed
@renovate
renovate Bot deleted the renovate/mise-packages branch August 30, 2026 10:11
@scottames-github-bot scottames-github-bot Bot mentioned this pull request Aug 29, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@renovate-approve renovate-approve[bot] renovate-approve[bot] approved these changes
@scottames scottames Awaiting requested review from scottames scottames is a code owner

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants