chore(deps): update bump-dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
@anthropic-ai/claude-code	2.1.220 → 2.1.221				patch	2.1.224 (+2)
@earendil-works/pi-coding-agent (source)	0.82.1 → 0.83.0				minor	0.84.1 (+1)
@google/gemini-cli	0.52.0 → 0.53.1				minor	0.54.4 (+1)
containerd.io	2.2.6-1~debian.13~trixie → 2.3.3-1~debian.13~trixie				minor
debian_13/jq	1.7.1-6+deb13u2 → 1.7.1-6+deb13u3				patch
docker-buildx-plugin	0.36.0-1~debian.13~trixie → 0.36.1-1~debian.13~trixie				patch
docker-ce	5:29.7.0-1~debian.13~trixie → 5:29.7.2-1~debian.13~trixie				patch
docker-compose-plugin	5.3.1-1~debian.13~trixie → 5.4.0-1~debian.13~trixie				minor
node (source)	dfa43ab → 66bb8d3			final	digest
node (source)	dfa43ab → 66bb8d3			stage	digest
opencode-ai	1.18.8 → 1.18.13				patch	1.18.15 (+1)

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

anthropics/claude-code (@​anthropic-ai/claude-code)

v2.1.221

Compare Source

• [VSCode] Added Focus view: a chat-menu toggle that hides tool activity behind an expandable per-turn summary with a live running-tool indicator, toggled with Ctrl+Alt+F or the "Claude Code: Toggle Focus view" command
• Added mode: "mask" for sandbox credential files on Linux and WSL — sandboxed commands read a sentinel copy (the whole file, or just the spans captured by an extract regex) while the sandbox proxy substitutes the real value on egress; on macOS file masking falls back to deny
• Added warnings to claude plugin validate when a marketplace or plugin name would be rejected by Claude Desktop's managed marketplace sync
• Added a prompt-audit subcommand to the claude-api skill for auditing prompts and tool descriptions for patterns written for older models
• Fixed a Bash tool permission-check bypass where zsh could execute hidden commands in [[ ]] regex conditionals; affected commands now prompt for permission
• Fixed PowerShell permission checks mishandling paths containing quote characters on Windows; such paths now prompt for approval
• Fixed the thinking toggle having no effect for the rest of a session that started with thinking off; disabling an MCP server mid-connect no longer silently reverts
• Fixed MCP servers from --mcp-config not being connected before the first turn in print mode (-p), which made the model emit tool calls as literal text
• Fixed @​-mentioned files being silently dropped when pressing Esc to retract a prompt and resubmitting it
• Fixed a crash when preparing API requests for SDK MCP tools named after built-in object properties such as constructor
• Fixed WebSearch failing with a 400 error at effort xhigh/max when thinking is disabled
• Fixed sandboxed large uploads failing with TLS errors through the sandbox proxy
• Fixed Team and Enterprise spend-limit message incorrectly blaming the org's monthly limit instead of your individual spend limit
• Fixed Bedrock authentication with AWS SSO named profiles failing in desktop-managed sessions on Windows machines that set a stray HOME environment variable
• Fixed CLAUDE_CODE_RESUME_INTERRUPTED_TURN=0 not disabling interrupted-turn auto-resume; falsy values are now honored
• Fixed a rare wake-from-sleep race where two Claude Code processes could both refresh the same MCP connector or WIF OAuth token at once, forcing re-authentication
• Fixed renaming a session from Claude Code Desktop or claude.ai not updating the CLI's session name; session names from every rename surface are now sanitized
• Fixed plugin- and org-delivered skills named after terminal-only built-ins (e.g. /help, /feedback) being un-invocable in non-interactive sessions
• Fixed the "Plugins changed" notification lingering after plugins were reloaded instead of clearing
• Fixed Vim mode: the yank register now survives dialogs, history search, and the transcript view instead of being silently emptied
• Fixed Vim mode: undoing back to an empty prompt now arms the "press ← again" confirm before returning to the agent view
• Improved tool search on Google Vertex AI: re-enabled for Claude 4.5-generation and newer models
• Improved auto mode: permission checks for parallel tool calls are now cache-efficient, and switching modes while a check is pending reliably prompts instead of applying the stale result
• Reduced prompt-cache costs for auto-mode permission checks by reusing the cached conversation prefix across decisions
• Improved Stats panel to count cache tokens in its token totals, with a breakdown by input, output, cache read, and cache write
• Improved /ultrareview error messages when a repo shares no history with its base: a checkout with no branches is now refused up front with advice to create one, and refusal hints no longer suggest git fetch --unshallow on clones that are already complete
• Improved Windows startup: process creation times are now read via a native kernel32 call instead of spawning PowerShell, so endpoint security tools that gate powershell.exe no longer prompt
• Changed background sessions to commit and push to preserve work, open a draft PR only when the task calls for one, follow your CLAUDE.md git instructions, and always end by reporting where the work lives
• Changed /plugin install to refresh a stale marketplace catalog and retry before reporting a plugin not found
• Changed plugins installed from /plugin to activate immediately when safe, instead of always requiring /reload-plugins
• Changed plugins to accept "." as a skills path, and the root-level SKILL.md validation error now suggests using the plugin root
• Changed /status to show the session kind: interactive, or a background job that is attached or unattended
• Changed emoji autocomplete to accept common alternate shortcodes like :thumbsup:, :thumbsdown:, and :love:
• Changed sessions forked with /fork to create a new worktree of their own instead of working in the original session's checkout
• Changed Claude in Chrome to close the browser tabs it opens once it no longer needs them
• Changed fast mode to report on the stream when usage credits run out mid-session, instead of failing silently
• Changed Monitor: a watch that exits without producing any output now says so instead of reporting "stream ended"
• Changed the Gateway model field validation: non-string values are rejected with a 400 instead of being forwarded
• Removed the repeated "Permission mode changed while the auto-mode classifier call was queued" notice from approval prompts

earendil-works/pi (@​earendil-works/pi-coding-agent)

v0.83.0

Compare Source

New Features

• Credential export for external clients — pi auth print-api-key and pi auth print-bearer-token export configured credentials with automatic OAuth refresh and minimum-validity enforcement.
• Headless OpenRouter sign-in — Complete /login over SSH by pasting the redirect URL or authorization code when the loopback callback is unavailable. See OpenRouter.
• Claude Opus 5 on GitHub Copilot — Use Claude Opus 5 through GitHub Copilot with adaptive thinking and a 1M context window. See GitHub Copilot.

Breaking Changes

• Upgraded bundled TypeBox aliases to 1.3.7, removing deprecated APIs including Type.Base, Type.Awaited, Type.Promise, Type.AsyncIterator, Type.Iterator, Type.Options, and Value.Mutate, while fixing compiled validation of nullable array tool arguments. Extensions using removed APIs must migrate to supported TypeBox APIs. See Package Dependencies (#​7243 by @​petrroll).

Added

• Added pi auth print-api-key and pi auth print-bearer-token commands for exporting configured credentials to external clients, including automatic OAuth refresh and configurable minimum token validity (#​7168).
• Exposed the session's resolved model scope as ctx.scopedModels to extensions. See Extension Context (#​7191 by @​pungggi, #​7215).
• Added inherited per-request fetch injection for supported text and image provider transports.
• Added the inherited "pending" stop reason for partial streaming messages. See Custom Provider Stream Pattern (#​7151 by @​lucasmeijer).
• Added inherited raw provider stop reasons across Google, Anthropic, Amazon Bedrock, Mistral, and OpenAI streams; unmapped terminal reasons now surface as provider errors instead of successful stops (#​7272).
• Added manual redirect URL and authorization-code entry to OpenRouter login for remote and headless environments. See OpenRouter (#​7114 by @​rgarcia).
• Added inherited Claude Opus 5 support for GitHub Copilot with adaptive thinking and a 1M context window. See GitHub Copilot (#​7158 by @​jay-aye-see-kay).

Changed

• Changed inherited OAuth credential resolution to refresh tokens with less than five minutes of validity remaining instead of waiting until expiration (#​7168).

Fixed

• Added a status line when the tool output expansion is toggled (#​7180).
• Fixed file-backed SYSTEM.md and APPEND_SYSTEM.md prompts being omitted from the interactive startup context listing. See System Prompt Files (#​7096).
• Fixed context files loading twice when a linked Git worktree is nested under its main repository. See Context Files (#​7221 by @​arajkumar).
• Fixed llama.cpp streamed responses reporting zero token usage and leaving session context accounting empty. See llama.cpp (#​7258 by @​SteveImmanuel).
• Fixed session replacement and committed tree navigation during an active response to abort and persist the outgoing turn instead of leaving dangling tool calls. See Sessions (#​7022 by @​tmustier).
• Fixed failed Git package installs leaving partial directories that blocked clean retries. See Install and Manage (#​7210 by @​haoqixu).
• Fixed the /model selector retaining a stale selection while filtering instead of highlighting the top match (#​7211 by @​christianbasch).
• Fixed direct RPC bash commands bypassing extension user_bash handlers. See User Bash Events (#​7214).
• Fixed skills, prompts, and themes losing package source metadata after extensions reload resources. See Resource Events (#​6968).
• Fixed cancellation of concurrently running user bash commands so every active command is aborted (#​7103 by @​yzhg1983).
• Fixed duplicate messages appearing when extensions switch sessions during interactive startup (#​7110 by @​yzhg1983).
• Fixed inherited Qwen Token Plan reasoning models to send their service-specific thinking controls and supported reasoning-effort levels (#​6951, #​6998).
• Fixed inherited Z.AI output limits being sent through an unsupported parameter. See Providers (#​7174 by @​HyeokjaeLee).
• Fixed explicitly configured Amazon Bedrock profiles being overridden by ambient AWS access keys. See Amazon Bedrock (#​7176 by @​christianbasch).
• Fixed inherited image fallback paths overflowing narrow terminals, shortened home-directory paths, and made absolute paths clickable when terminal hyperlinks are available (#​7262).
• Fixed inherited OpenAI-compatible tool calls losing their function arguments when malformed deltas also contain an empty custom object (#​7288 by @​sunnyyoung).

google-gemini/gemini-cli (@​google/gemini-cli)

v0.53.1

Compare Source

What's Changed

• fix(patch): cherry-pick f47d6c6 to release/v0.53.0-pr-28566 [CONFLICTS] by @​gemini-cli-robot in #​28610

Full Changelog: google-gemini/gemini-cli@v0.53.0...v0.53.1

v0.53.0

Compare Source

What's Changed

• fix(core,a2a): group cancelled tool responses and coalesce consecutive roles to prevent 400 Bad Request by @​luisfelipe-alt in #​28407
• feat(caretaker-triage): implement LLM triage orchestrator and container build by @​chadd28 in #​28345
• refactor(cli): align macOS permissive Seatbelt profiles with deny-default model by @​ompatel-aiml in #​28424
• fix(core): mitigate infinite ReAct loops and prompt injection loops by @​amelidev in #​28429
• fix(a2a-server): enforce workspace trust and task isolation to prevent RCE by @​luisfelipe-alt in #​28470
• fix(core): sequentially verify cached credentials and restore GOOGLE_APPLICATION_CREDENTIALS fallback by @​luisfelipe-alt in #​28472
• feat(evals): add eval coverage report command by @​ved015 in #​28169

Full Changelog: google-gemini/gemini-cli@v0.52.0...v0.53.0

v0.53.0-preview.0

Compare Source

What's Changed

• fix(core,a2a): group cancelled tool responses and coalesce consecutive roles to prevent 400 Bad Request by @​luisfelipe-alt in #​28407
• feat(caretaker-triage): implement LLM triage orchestrator and container build by @​chadd28 in #​28345
• refactor(cli): align macOS permissive Seatbelt profiles with deny-default model by @​ompatel-aiml in #​28424
• fix(core): mitigate infinite ReAct loops and prompt injection loops by @​amelidev in #​28429
• fix(a2a-server): enforce workspace trust and task isolation to prevent RCE by @​luisfelipe-alt in #​28470
• fix(core): sequentially verify cached credentials and restore GOOGLE_APPLICATION_CREDENTIALS fallback by @​luisfelipe-alt in #​28472
• feat(evals): add eval coverage report command by @​ved015 in #​28169

Full Changelog: google-gemini/gemini-cli@v0.52.0-preview.0...v0.53.0-preview.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Only on Wednesday (* * * * 3)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.