Skip to content

chore(deps): update ⬆️ aqua-packages - #843

Merged
renovate[bot] merged 2 commits into
mainfrom
renovate/aqua-packages
Apr 14, 2026
Merged

chore(deps): update ⬆️ aqua-packages#843
renovate[bot] merged 2 commits into
mainfrom
renovate/aqua-packages

Conversation

@renovate

@renovate renovate Bot commented Apr 14, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Update Change Pending
anthropics/claude-code patch v2.1.97v2.1.100 v2.1.107 (+3)
astral-sh/ruff patch 0.15.90.15.10
charmbracelet/glow patch v2.1.1v2.1.2
dagger/dagger patch v0.20.4v0.20.5
github/copilot-cli patch v1.0.21v1.0.22 v1.0.25 (+2)
jdx/mise patch v2026.4.7v2026.4.8 v2026.4.11 (+2)
max-sixty/worktrunk patch v0.35.2v0.35.3 v0.37.0 (+1)
sst/opencode patch v1.4.1v1.4.3

Release Notes

anthropics/claude-code (anthropics/claude-code)

v2.1.100

Compare Source

v2.1.98

Compare Source

What's changed

  • Added interactive Google Vertex AI setup wizard accessible from the login screen when selecting "3rd-party platform", guiding you through GCP authentication, project and region configuration, credential verification, and model pinning
  • Added CLAUDE_CODE_PERFORCE_MODE env var: when set, Edit/Write/NotebookEdit fail on read-only files with a p4 edit hint instead of silently overwriting them
  • Added Monitor tool for streaming events from background scripts
  • Added subprocess sandboxing with PID namespace isolation on Linux when CLAUDE_CODE_SUBPROCESS_ENV_SCRUB is set, and CLAUDE_CODE_SCRIPT_CAPS env var to limit per-session script invocations
  • Added --exclude-dynamic-system-prompt-sections flag to print mode for improved cross-user prompt caching
  • Added workspace.git_worktree to the status line JSON input, set whenever the current directory is inside a linked git worktree
  • Added W3C TRACEPARENT env var to Bash tool subprocesses when OTEL tracing is enabled, so child-process spans correctly parent to Claude Code's trace tree
  • LSP: Claude Code now identifies itself to language servers via clientInfo in the initialize request
  • Fixed a Bash tool permission bypass where a backslash-escaped flag could be auto-allowed as read-only and lead to arbitrary code execution
  • Fixed compound Bash commands bypassing forced permission prompts for safety checks and explicit ask rules in auto and bypass-permissions modes
  • Fixed read-only commands with env-var prefixes not prompting unless the var is known-safe (LANG, TZ, NO_COLOR, etc.)
  • Fixed redirects to /dev/tcp/... or /dev/udp/... not prompting instead of auto-allowing
  • Fixed stalled streaming responses timing out instead of falling back to non-streaming mode
  • Fixed 429 retries burning all attempts in ~13s when the server returns a small Retry-After — exponential backoff now applies as a minimum
  • Fixed MCP OAuth oauth.authServerMetadataUrl config override not being honored on token refresh after restart, affecting ADFS and similar IdPs
  • Fixed capital letters being dropped to lowercase on xterm and VS Code integrated terminal when the kitty keyboard protocol is active
  • Fixed macOS text replacements deleting the trigger word instead of inserting the substitution
  • Fixed --dangerously-skip-permissions being silently downgraded to accept-edits mode after approving a write to a protected path via Bash
  • Fixed managed-settings allow rules remaining active after an admin removed them, until process restart
  • Fixed permissions.additionalDirectories changes not applying mid-session — removed directories lose access immediately and added ones work without restart
  • Fixed removing a directory from additionalDirectories revoking access to the same directory passed via --add-dir
  • Fixed Bash(cmd:*) and Bash(git commit *) wildcard permission rules failing to match commands with extra spaces or tabs
  • Fixed Bash(...) deny rules being downgraded to a prompt for piped commands that mix cd with other segments
  • Fixed false Bash permission prompts for cut -d /, paste -d /, column -s /, awk '{print $1}' file, and filenames containing %
  • Fixed permission rules with names matching JavaScript prototype properties (e.g. toString) causing settings.json to be silently ignored
  • Fixed agent team members not inheriting the leader's permission mode when using --dangerously-skip-permissions
  • Fixed a crash in fullscreen mode when hovering over MCP tool results
  • Fixed copying wrapped URLs in fullscreen mode inserting spaces at line breaks
  • Fixed file-edit diffs disappearing from the UI on --resume when the edited file was larger than 10KB
  • Fixed several /resume picker issues: --resume <name> opening uneditable, filter reload wiping search state, empty list swallowing arrow keys, cross-project staleness, and transient task-status text replacing conversation summaries
  • Fixed /export not honoring absolute paths and ~, and silently rewriting user-supplied extensions to .txt
  • Fixed /effort max being denied for unknown or future model IDs
  • Fixed slash command picker breaking when a plugin's frontmatter name is a YAML boolean keyword
  • Fixed rate-limit upsell text being hidden after message remounts
  • Fixed MCP tools with _meta["anthropic/maxResultSizeChars"] not bypassing the token-based persist layer
  • Fixed voice mode leaking dozens of space characters into the input when re-holding the push-to-talk key while the previous transcript is still processing
  • Fixed DISABLE_AUTOUPDATER not fully suppressing the npm registry version check and symlink modification on npm-based installs
  • Fixed a memory leak where Remote Control permission handler entries were retained for the lifetime of the session
  • Fixed background subagents that fail with an error not reporting partial progress to the parent agent
  • Fixed prompt-type Stop/SubagentStop hooks failing on long sessions, and hook evaluator API errors showing "JSON validation failed" instead of the real message
  • Fixed feedback survey rendering when dismissed
  • Fixed Bash grep -f FILE / rg -f FILE not prompting when reading a pattern file outside the working directory
  • Fixed stale subagent worktree cleanup removing worktrees that contain untracked files
  • Fixed sandbox.network.allowMachLookup not taking effect on macOS
  • Improved /resume filter hint labels and added project/worktree/branch names in the filter indicator
  • Improved footer indicators (Focus, notifications) to stay on the mode-indicator row instead of wrapping at narrow terminal widths
  • Improved /agents with a tabbed layout: a Running tab shows live subagents, and the Library tab adds Run agent and View running instance actions
  • Improved /reload-plugins to pick up plugin-provided skills without requiring a restart
  • Improved Accept Edits mode to auto-approve filesystem commands prefixed with safe env vars or process wrappers
  • Improved Vim mode: j/k in NORMAL mode now navigate history and select the footer pill at the input boundary
  • Improved hook errors in the transcript to include the first line of stderr for self-diagnosis without --debug
  • Improved OTEL tracing: interaction spans now correctly wrap full turns under concurrent SDK calls, and headless turns end spans per-turn
  • Improved transcript entries to carry final token usage instead of streaming placeholders
  • Updated the /claude-api skill to cover Managed Agents alongside Claude API
  • [VSCode] Fixed false-positive "requires git-bash" error on Windows when CLAUDE_CODE_GIT_BASH_PATH is set or Git is installed at a default location
  • Fixed CLAUDE_CODE_MAX_CONTEXT_TOKENS to honor DISABLE_COMPACT when it is set.
  • Dropped /compact hints when DISABLE_COMPACT is set.
astral-sh/ruff (astral-sh/ruff)

v0.15.10

Compare Source

Released on 2026-04-09.

Preview features
  • [flake8-logging] Allow closures in except handlers (LOG004) (#​24464)
  • [flake8-self] Make SLF diagnostics robust to non-self-named variables (#​24281)
  • [flake8-simplify] Make the fix for collapsible-if safe in preview (SIM102) (#​24371)
Bug fixes
  • Avoid emitting multi-line f-string elements before Python 3.12 (#​24377)
  • Avoid syntax error from E502 fixes in f-strings and t-strings (#​24410)
  • Strip form feeds from indent passed to dedent_to (#​24381)
  • [pyupgrade] Fix panic caused by handling of octals (UP012) (#​24390)
  • Reject multi-line f-string elements before Python 3.12 (#​24355)
Rule changes
  • [ruff] Treat f-string interpolation as potential side effect (RUF019) (#​24426)
Server
  • Add support for custom file extensions (#​24463)
Documentation
  • Document adding fixes in CONTRIBUTING.md (#​24393)
  • Fix JSON typo in settings example (#​24517)
Contributors
charmbracelet/glow (charmbracelet/glow)

v2.1.2

Compare Source

Small patch

Hey all! It has been a long time, but we're bringing this small release with two small fixes.

showLineNumbers on config file now works

The title says it all. It wasn't working as expected, but @​prithvijj jumped in and implemented a fix. ✨

Improved $PAGER

Our support for the $PAGER env was there, but somewhat limited. It could break on certain scenarios, like if you needed to use spaces in arguments (with quotes), etc. We're now using a proper shell syntax parser to accurately parse the program and arguments there. Thank you @​mvanhorn for working on this!

Changelog

Fixed

Verifying the artifacts

First, download the checksums.txt file and the checksums.txt.sigstore.json file files, for example, with wget:

wget 'https://github.com/charmbracelet/glow/releases/download/v2.1.2/checksums.txt'
wget 'https://github.com/charmbracelet/glow/releases/download/v2.1.2/checksums.txt.sigstore.json'

Then, verify it using cosign:

cosign verify-blob \
  --certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --bundle 'checksums.txt.sigstore.json' \
  ./checksums.txt

If the output is Verified OK, you can safely use it to verify the checksums of other artifacts you downloaded from the release using sha256sum:

sha256sum --ignore-missing -c checksums.txt

Done! You artifacts are now verified!

The Charm logo

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

dagger/dagger (dagger/dagger)

v0.20.5

Compare Source

Fixed
  • Fix TUI final rendering so progress output, checkmarks, and error details are still shown on stderr when a command exits while quitting by @​eunomie in #​12936
  • Fix honoring _EXPERIMENTAL_DAGGER_RUNNER_HOST environment variable by @​tiborvass in #​12943
  • Fix workspace module sources declared in dagger.json so they resolve relative to the config file rather than the caller's current working directory when connecting from a subdirectory by @​shykes in #​12934
  • Fix .env validation so Dagger only uploads the .env file being checked instead of the entire parent directory by @​shykes in fab203a
  • Fix noisy legacy-default-path compatibility warnings so they are no longer printed during module function loading by @​shykes in 0b1e3b8
What to do next?
github/copilot-cli (github/copilot-cli)

v1.0.22: 1.0.22

Compare Source

2026-04-09

  • MCP tools with non-standard JSON schemas are now sanitized for compatibility with all model providers
  • Better handling of large images from MCP and extension tools
  • Improved rendering performance with a new simplified inline renderer
  • Show a clear message to contact your organization administrator when remote sessions are blocked by policy
  • Sub-agent activity no longer shows duplicated tool names (e.g. "view view the file...")
  • Permission checks and other hooks now work correctly when using Anthropic models via BYOM/BYOK configuration
  • Slash command picker appears above the text input for a more stable layout
  • Custom agents can now declare a skills field to eagerly load skill content into agent context at startup
  • Plugins can now display a post-install message with setup instructions after installation
  • Remove .vscode/mcp.json and .devcontainer/devcontainer.json as MCP server config sources; CLI now only reads .mcp.json. A migration hint appears when .vscode/mcp.json is detected without .mcp.json.
  • Plugins remain enabled across sessions and auto-install on startup based on user config
  • Add sub-agent depth and concurrency limits to prevent runaway agent spawning
  • Warn when resuming a session that is already in use by another CLI or application
  • CLI no longer crashes on systems affected by a V8 engine bug in grapheme segmentation
  • sessionStart and sessionEnd hooks fire once per session in interactive mode instead of once per prompt
  • Plugin agents respect the model specified in their frontmatter
jdx/mise (jdx/mise)

v2026.4.8: : Task engine stability and Go subpath version resolution

Compare Source

This release brings significant stability improvements to the task runner -- fixing hangs, deadlocks, and panics across several edge cases in task dependency graphs and parallel execution. It also overhauls Go version resolution for subpath packages by querying the module proxy directly, and adds new configuration options for sandbox environment filtering and lockfile platform targeting.

Highlights

  • Go subpath version resolution fixed -- Tools like go:github.com/foo/bar/cmd/baz that live under a subpath of their Go module now resolve versions correctly, eliminating persistent "no latest version found" warnings.
  • Five task runner stability fixes -- Resolved hangs with skipped dependencies, deadlocks with MISE_JOBS=1, panics in replacing output mode, stale source caching in dependency chains, and warnings with remote tasks.
  • Wildcard allow_env patterns -- Sandbox env filtering now supports globs like MYAPP_* to allow entire namespaces of environment variables.
  • lockfile_platforms setting -- Restrict lockfile operations to only the platforms you care about, avoiding unnecessary checksum resolution.

Added

  • Wildcard patterns in sandbox allow_env -- allow_env now supports glob wildcards (e.g., MYAPP_*) to pass through namespaces of environment variables in sandboxed tasks and exec. Works in both CLI flags and task config. #​8974 by @​jdx

    [task.build]
    allow_env = ["NODE_*", "npm_*", "MYAPP_*"]
  • lockfile_platforms setting -- New setting to restrict which platforms are targeted during lockfile operations. When set, mise install, mise use, and mise lock only resolve checksums/URLs for the configured platforms instead of all common platforms. Explicit mise lock --platform flags still override this setting. #​8966 by @​cameronbrill

    [settings]
    lockfile_platforms = ["macos-arm64", "linux-x64"]
  • Examples rendered in task --help -- #USAGE example directives in task scripts now appear in --help output, thanks to an upgrade to usage-lib v3. #​8890 by @​baby-joel

Fixed

  • Go subpath package version resolution -- The Go backend previously used go list -m -versions to resolve versions, which returns an empty version list for subpath packages (e.g., github.com/ankitpokhrel/jira-cli/cmd/jira), making it impossible to resolve "latest". mise now queries the Go module proxy ($GOPROXY) directly, generating path prefix candidates and using HTTP responses to distinguish real modules from non-module subpaths. This respects the GOPROXY environment variable and falls back to go list for GOPROXY=direct. #​8968 by @​c22

  • Task hang when skipped task has dependents -- When a task with sources/outputs was skipped (up-to-date), a race condition in the dependency graph could leave downstream dependents hanging indefinitely. The failed channel send now properly resets the task's "sent" state so it can be re-emitted on a new channel. #​8937 by @​jdx

  • Dependent task source invalidation -- When a dependency task runs because its own sources changed, downstream tasks that depend on it now also re-run, even if their own sources haven't changed. Sourceless dependencies (which always run) do not trigger this invalidation, preserving the usefulness of sources on dependents. #​8975 by @​jdx

  • Deadlock with MISE_JOBS=1 and sub-task references -- When MISE_JOBS=1 and a task's run array contains both sub-task references ({ task = "foo" }) and scripts, the parent task now temporarily releases its semaphore permit before waiting on the sub-task, preventing a classic deadlock. #​8976 by @​jdx

  • Panic with parallel sub-tasks in replacing output mode -- Running parallel sub-tasks (via tasks = [...] in run steps) with output = "replacing" no longer panics. Dynamically injected sub-tasks are now lazily initialized in the progress reporter map. #​8986 by @​jdx

  • Remote task warning with arguments -- Remote git task files are now fetched before parsing usage specs, fixing spurious "failed to parse task file" warnings when running remote tasks with arguments. #​8979 by @​jdx

  • Tera templates in tool postinstall hooks -- Tool-level postinstall scripts (e.g., [tools.ripgrep] postinstall) now render Tera templates before execution, so variables like {{tools.ripgrep.path}} work correctly. #​8978 by @​jdx

  • Missing env vars in tool postinstall hooks -- MISE_CONFIG_ROOT and MISE_PROJECT_ROOT are now set in tool-level postinstall hooks, matching the behavior of project-level hooks. #​8977 by @​jdx

  • mise upgrade tool@version not updating lockfile -- mise upgrade tool@version and mise lock tool@version now properly update the lockfile with the specified version. When the version doesn't match the current config prefix (e.g., upgrading from "2" to 3.0.1), the config is auto-bumped to match while preserving the original version precision. #​8983 by @​jdx

  • Bash 3.2 activation with set -u -- The bash activation script no longer fails with __MISE_FLAGS[@&#8203;]: unbound variable on macOS's default bash 3.2 when set -u (nounset) is enabled and no flags are set. #​8988 by @​jdx

New Contributors

Full Changelog: jdx/mise@v2026.4.7...v2026.4.8

max-sixty/worktrunk (max-sixty/worktrunk)

v0.35.3: 0.35.3

Compare Source

Release Notes

Improved
  • wt step prune streams removals inline: Removals and "Skipped" messages now print as each integration check completes, overlapping with still-running checks — previously there was a visible gap of silence while all parallel checks finished before any output appeared. (#​2015)

  • Fewer redundant git worktree list calls in prune and multi-remove: prepare_worktree_removal() now accepts a pre-fetched worktree list, eliminating N+1 subprocess calls when removing many worktrees. (#​2025)

Fixed
  • Picker preview UI lag: The picker's preview cache now stores pager-rendered output, so cache hits skip the pager subprocess entirely. Previously, scrolling past an item with a large diff froze the UI briefly on every re-render because the pager ran on every call. (#​2021)

  • Template error hint underlining: The "Available variables" hint in template expansion errors now underlines each variable name individually instead of wrapping the entire comma-separated list in a single underline span. (#​2028)

Documentation
  • Cross-linked vars references: The vars feature is documented in the hook template variables table, wt config state vars page, and tips-patterns recipes — these now link to each other so readers can navigate between "how to set" and "how to use in templates". (#​2034)

  • Clearer project config intro: Improved the project config introduction and template variable heading in wt config help text. (#​2032)

Install worktrunk 0.35.3

Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/max-sixty/worktrunk/releases/download/v0.35.3/worktrunk-installer.sh | sh && wt config shell install
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://github.com/max-sixty/worktrunk/releases/download/v0.35.3/worktrunk-installer.ps1 | iex"; git-wt config shell install
Install prebuilt binaries via Homebrew
brew install worktrunk && wt config shell install

Download worktrunk 0.35.3

File Platform Checksum
worktrunk-aarch64-apple-darwin.tar.xz Apple Silicon macOS checksum
worktrunk-x86_64-apple-darwin.tar.xz Intel macOS checksum
worktrunk-x86_64-pc-windows-msvc.zip x64 Windows checksum
worktrunk-aarch64-unknown-linux-musl.tar.xz ARM64 MUSL Linux checksum
worktrunk-x86_64-unknown-linux-musl.tar.xz x64 MUSL Linux checksum
Install via Cargo
cargo install worktrunk && wt config shell install
Install via Winget (Windows)
winget install max-sixty.worktrunk && git-wt config shell install
Install via AUR (Arch Linux)
paru worktrunk-bin && wt config shell install
sst/opencode (sst/opencode)

v1.4.3

Compare Source

Core

  • Fixed agent create for OpenAI accounts authenticated with OAuth.
  • Interrupted Bash commands now keep their final output and truncation details instead of ending as aborted.
  • Added fast mode variants for supported Claude and GPT models.

TUI

  • Restored the hidden session scrollbar as the default.

Extensions

  • Added configurable OAuth redirect URIs for remote MCP servers. (@​egze)

Thank you to 2 community contributors:

  • @​egze:
    • feat(mcp): add OAuth redirect URI configuration for MCP servers (#​21385)
  • @​simonklee:
    • opencode: lazy-load top-level CLI commands
    • Revert "opencode: lazy-load top-level CLI commands" (#​21726)

v1.4.2

Compare Source

TUI

  • Fix subagents not being clickable until finished

Desktop

  • Removed the forced loading delay while the app connects

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

  • Branch creation
    • Between 05:00 AM and 07:59 AM (* 5-7 * * *)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from scottames as a code owner April 14, 2026 13:40
@renovate
renovate Bot enabled auto-merge (squash) April 14, 2026 13:40
@renovate
renovate Bot merged commit 1cddca7 into main Apr 14, 2026
5 checks passed
@renovate
renovate Bot deleted the renovate/aqua-packages branch April 14, 2026 13:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants