chore(deps): update bump-dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
@anthropic-ai/claude-code	2.1.112 → 2.1.116				patch	2.1.119 (+2)
@google/gemini-cli	0.38.1 → 0.38.2				patch	0.39.1 (+1)
@openai/codex (source)	0.121.0 → 0.122.0				minor	0.124.0 (+1)
node	554a850 → 135dc9a			final	digest
opencode-ai	1.4.7 → 1.14.19				minor	1.14.22 (+2)

---

Release Notes

anthropics/claude-code (@​anthropic-ai/claude-code)

v2.1.116

Compare Source

• /resume on large sessions is significantly faster (up to 67% on 40MB+ sessions) and handles sessions with many dead-fork entries more efficiently
• Faster MCP startup when multiple stdio servers are configured; resources/templates/list is now deferred to first @-mention
• Smoother fullscreen scrolling in VS Code, Cursor, and Windsurf terminals — /terminal-setup now configures the editor's scroll sensitivity
• Thinking spinner now shows progress inline ("still thinking", "thinking more", "almost done thinking"), replacing the separate hint row
• /config search now matches option values (e.g. searching "vim" finds the Editor mode setting)
• /doctor can now be opened while Claude is responding, without waiting for the current turn to finish
• /reload-plugins and background plugin auto-update now auto-install missing plugin dependencies from marketplaces you've already added
• Bash tool now surfaces a hint when gh commands hit GitHub's API rate limit, so agents can back off instead of retrying
• The Usage tab in Settings now shows your 5-hour and weekly usage immediately and no longer fails when the usage endpoint is rate-limited
• Agent frontmatter hooks: now fire when running as a main-thread agent via --agent
• Slash command menu now shows "No commands match" when your filter has zero results, instead of disappearing
• Security: sandbox auto-allow no longer bypasses the dangerous-path safety check for rm/rmdir targeting /, $HOME, or other critical system directories
• Claude Code and installer now use https://downloads.claude.ai/claude-code-releases instead of https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases
• Fixed Devanagari and other Indic scripts rendering with broken column alignment in the terminal UI
• Fixed Ctrl+- not triggering undo in terminals using the Kitty keyboard protocol (iTerm2, Ghostty, kitty, WezTerm, Windows Terminal)
• Fixed Cmd+Left/Right not jumping to line start/end in terminals that use the Kitty keyboard protocol (Warp fullscreen, kitty, Ghostty, WezTerm)
• Fixed Ctrl+Z hanging the terminal when Claude Code is launched via a wrapper process (e.g. npx, bun run)
• Fixed scrollback duplication in inline mode where resizing the terminal or large output bursts would repeat earlier conversation history
• Fixed modal search dialogs overflowing the screen at short terminal heights, hiding the search box and keyboard hints
• Fixed scattered blank cells and disappearing composer chrome in the VS Code integrated terminal during scrolling
• Fixed an intermittent API 400 error related to cache control TTL ordering that could occur when a parallel request completed during request setup
• Fixed /branch rejecting conversations with transcripts larger than 50MB
• Fixed /resume silently showing an empty conversation on large session files instead of reporting the load error
• Fixed /plugin Installed tab showing the same item twice when it appears under Needs attention or Favorites
• Fixed /update and /tui not working after entering a worktree mid-session

v2.1.114

Compare Source

• Fixed a crash in the permission dialog when an agent teams teammate requested tool permission

v2.1.113

Compare Source

• Changed the CLI to spawn a native Claude Code binary (via a per-platform optional dependency) instead of bundled JavaScript
• Added sandbox.network.deniedDomains setting to block specific domains even when a broader allowedDomains wildcard would otherwise permit them
• Fullscreen mode: Shift+↑/↓ now scrolls the viewport when extending a selection past the visible edge
• Ctrl+A and Ctrl+E now move to the start/end of the current logical line in multiline input, matching readline behavior
• Windows: Ctrl+Backspace now deletes the previous word
• Long URLs in responses and bash output stay clickable when they wrap across lines (in terminals with OSC 8 hyperlinks)
• Improved /loop: pressing Esc now cancels pending wakeups, and wakeups display as "Claude resuming /loop wakeup" for clarity
• /extra-usage now works from Remote Control (mobile/web) clients
• Remote Control clients can now query @-file autocomplete suggestions
• Improved /ultrareview: faster launch with parallelized checks, diffstat in the launch dialog, and animated launching state
• Subagents that stall mid-stream now fail with a clear error after 10 minutes instead of hanging silently
• Bash tool: multi-line commands whose first line is a comment now show the full command in the transcript, closing a UI-spoofing vector
• Running cd <current-directory> && git … no longer triggers a permission prompt when the cd is a no-op
• Security: on macOS, /private/{etc,var,tmp,home} paths are now treated as dangerous removal targets under Bash(rm:*) allow rules
• Security: Bash deny rules now match commands wrapped in env/sudo/watch/ionice/setsid and similar exec wrappers
• Security: Bash(find:*) allow rules no longer auto-approve find -exec/-delete
• Fixed MCP concurrent-call timeout handling where a message for one tool call could silently disarm another call's watchdog
• Fixed Cmd-backspace / Ctrl+U to once again delete from the cursor to the start of the line
• Fixed markdown tables breaking when a cell contains an inline code span with a pipe character
• Fixed session recap auto-firing while composing unsent text in the prompt
• Fixed /copy "Full response" not aligning markdown table columns for pasting into GitHub, Notion, or Slack
• Fixed messages typed while viewing a running subagent being hidden from its transcript and misattributed to the parent AI
• Fixed Bash dangerouslyDisableSandbox running commands outside the sandbox without a permission prompt
• Fixed /effort auto confirmation — now says "Effort level set to max" to match the status bar label
• Fixed the "copied N chars" toast overcounting emoji and other multi-code-unit characters
• Fixed /insights crashing with EBUSY on Windows
• Fixed exit confirmation dialog mislabeling one-shot scheduled tasks as recurring — now shows a countdown
• Fixed slash/@​ completion menu not sitting flush against the prompt border in fullscreen mode
• Fixed CLAUDE_CODE_EXTRA_BODY output_config.effort causing 400 errors on subagent calls to models that don't support effort and on Vertex AI
• Fixed prompt cursor disappearing when NO_COLOR is set
• Fixed ToolSearch ranking so pasted MCP tool names surface the actual tool instead of description-matching siblings
• Fixed compacting a resumed long-context session failing with "Extra usage is required for long context requests"
• Fixed plugin install succeeding when a dependency version conflicts with an already-installed plugin — now reports range-conflict
• Fixed "Refine with Ultraplan" not showing the remote session URL in the transcript
• Fixed SDK image content blocks that fail to process crashing the session — now degrade to a text placeholder
• Fixed Remote Control sessions not streaming subagent transcripts
• Fixed Remote Control sessions not being archived when Claude Code exits
• Fixed thinking.type.enabled is not supported 400 error when using Opus 4.7 via a Bedrock Application Inference Profile ARN

google-gemini/gemini-cli (@​google/gemini-cli)

v0.38.2

Compare Source

What's Changed

• fix(patch): cherry-pick 14b2f35 to release/v0.38.1-pr-24974 to patch version v0.38.1 and create version 0.38.2 by @​gemini-cli-robot in #​25585

Full Changelog: google-gemini/gemini-cli@v0.38.1...v0.38.2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Only on Wednesday (* * * * 3)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.