Skip to content

chore(deps): update ⬆️ mise-packages - #1029

Merged
scottames merged 2 commits into
mainfrom
renovate/mise-packages
Aug 26, 2026
Merged

chore(deps): update ⬆️ mise-packages#1029
scottames merged 2 commits into
mainfrom
renovate/mise-packages

Conversation

@renovate

@renovate renovate Bot commented Aug 26, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change Pending Age Adoption Passing Confidence
aqua:astral-sh/ruff tools patch 0.16.30.16.4 age adoption passing confidence
aqua:bootandy/dust tools patch 1.2.41.2.5 age adoption passing confidence
aqua:cli/cli tools minor 2.97.02.98.0 age adoption passing confidence
aqua:dprint/dprint tools patch 0.56.00.56.1 age adoption passing confidence
aqua:golangci/golangci-lint tools minor 2.12.22.13.1 age adoption passing confidence
aqua:mikefarah/yq tools patch 4.53.44.53.6 age adoption passing confidence
aqua:openai/codex tools minor rust-v0.148.0rust-v0.149.0 rust-v0.149.1 age adoption passing confidence
aqua:sst/opencode tools patch 1.18.181.18.21 1.18.23 (+1) age adoption passing confidence
aqua:zellij-org/zellij tools minor 0.44.30.45.0 age adoption passing confidence
bun tools minor 1.3.141.4.0 age adoption passing confidence
github:agavra/tuicr tools patch v0.23.0v0.23.1 v0.24.0 age adoption passing confidence
github:anthropics/claude-code tools patch v2.1.235v2.1.240 v2.1.246 (+2) age adoption passing confidence
github:backnotprop/plannotator tools patch v0.27.4v0.27.6 v0.27.8 (+1) age adoption passing confidence
github:janosmiko/lfk tools minor v0.17.4v0.18.1 v0.18.2 age adoption passing confidence
github:nolabs-ai/nono tools minor v0.73.0v0.74.0 age adoption passing confidence
go tools minor 1.26.61.27.0 age adoption passing confidence
npm:cspell (source) tools minor 10.0.110.1.0 10.1.1 age adoption passing confidence
pipx:semgrep (changelog) tools minor 1.173.01.174.0 age adoption passing confidence
rust (source, changelog) tools minor 1.97.11.98.0 age adoption passing confidence

Release notes are maintained in a PR comment by the renovate-release-notes-comment workflow.


Configuration

📅 Schedule: (in timezone America/Los_Angeles)

  • Branch creation
    • Between 03:00 AM and 05:59 AM (* 3-5 * * *)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from scottames as a code owner August 26, 2026 15:12
@renovate
renovate Bot enabled auto-merge (squash) August 26, 2026 15:12
@renovate
renovate Bot force-pushed the renovate/mise-packages branch 2 times, most recently from 8e01244 to b2ac36f Compare August 26, 2026 15:49
@scottames-github-bot

Copy link
Copy Markdown
Contributor

Renovate Release Notes

Generated from Renovate's update table by the renovate-release-notes-comment workflow.

Packages that cannot be summarized from GitHub releases are listed explicitly below.

astral-sh/ruff (aqua:astral-sh/ruff)

0.16.4: 0.16.4

Compare Source

Release Notes

Released on 2026-08-20.

Preview features

  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)

Bug fixes

  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)

Rule changes

  • [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
  • [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
  • [syntax-errors] Detect duplicate keyword arguments (#17804)
  • [syntax-errors] Detect parameters declared nonlocal (#27628)

Server

  • Offer display-only fixes and mark safe fixes preferred (#27807)
  • Support pull diagnostics for notebook cells (#27779)

Documentation

  • Add default indicator to rules table (#27724)
  • Fix broken link to Python docs (#27757)

Other changes

  • Fix s390x stacker assembly in release builds (#27776)
  • Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
  • Reduce configuration deserialization code size (#27924)
  • Check packed AST index bounds (#27849)

Contributors

Install ruff 0.16.4

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.4/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.16.4/ruff-installer.ps1 | iex"

Download ruff 0.16.4

File Platform Checksum
ruff-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
ruff-x86_64-apple-darwin.tar.gz Intel macOS checksum
ruff-aarch64-pc-windows-msvc.zip ARM64 Windows checksum
ruff-i686-pc-windows-msvc.zip x86 Windows checksum
ruff-x86_64-pc-windows-msvc.zip x64 Windows checksum
ruff-aarch64-unknown-linux-gnu.tar.gz ARM64 Linux checksum
ruff-i686-unknown-linux-gnu.tar.gz x86 Linux checksum
ruff-powerpc64-unknown-linux-gnu.tar.gz PPC64 Linux checksum
ruff-powerpc64le-unknown-linux-gnu.tar.gz PPC64LE Linux checksum
ruff-riscv64gc-unknown-linux-gnu.tar.gz RISCV Linux checksum
ruff-s390x-unknown-linux-gnu.tar.gz S390x Linux checksum
ruff-x86_64-unknown-linux-gnu.tar.gz x64 Linux checksum
ruff-armv7-unknown-linux-gnueabihf.tar.gz ARMv7 Linux checksum
ruff-aarch64-unknown-linux-musl.tar.gz ARM64 MUSL Linux checksum
ruff-i686-unknown-linux-musl.tar.gz x86 MUSL Linux checksum
ruff-x86_64-unknown-linux-musl.tar.gz x64 MUSL Linux checksum
ruff-arm-unknown-linux-musleabihf.tar.gz ARMv6 MUSL Linux (Hardfloat) checksum
ruff-armv7-unknown-linux-musleabihf.tar.gz ARMv7 MUSL Linux checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/ruff

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>
bootandy/dust (aqua:bootandy/dust)

v1.2.5: v1.2.5

Compare Source

No release notes body was provided by GitHub.

cli/cli (aqua:cli/cli)

v2.98.0: GitHub CLI 2.98.0

Compare Source

Security

A security vulnerability has been identified, and fixed, that binds the local forwarded port to all available network interfaces by default.

Users of gh codespace ports forward are advised to update gh to version v2.98.0 as soon as possible.

For more information see: GHSA-vfhh-p7hm-pxfh

Support worktrees in pr checkout

Users can now checkout a pull request into a git worktree by using the new --worktree PATH flag in gh pr checkout:

gh pr checkout 12 --worktree ../wt-feature

Add semantic search to search issues

The gh search issues command now supports semantic search for issues. Users can select the search type by passing the --search-type flag:

gh search issues --search-type semantic ...

gh search issues --search-type hybrid ...

For more information about semantic search see: "Improved Search for github issues is now generally available".

What's Changed

✨ Features

🐛 Fixes

📚 Docs & Chores

:dependabot: Dependencies

New Contributors

Full Changelog: cli/cli@v2.97.0...v2.98.0

dprint/dprint (aqua:dprint/dprint)

0.56.1: 0.56.1

Compare Source

Changes

  • fix: format zero files when --stdin-files is empty (#1227)

Install

Run dprint upgrade or see https://dprint.dev/install/

Checksums

Artifact SHA-256 Checksum
dprint-x86_64-apple-darwin.zip f944e33a1bf8f6125eaa5ea77ee8a01db96093a6fb80df127b390f2a106774f7
dprint-aarch64-apple-darwin.zip c9af77af134987fada60344e8b9f23b2238081f7eea94a7bcd53ec49369354f6
dprint-x86_64-pc-windows-msvc.zip d2c5ee170ff88c0b16ea1f5f214e4d74877c7edb9ca701da5c9851c0c1ef9338
dprint-x86_64-pc-windows-msvc-installer.exe 7de50bfd34bc6659c37b9421486460e2d11b015b26de0988264fe1ccd934a3e7
dprint-aarch64-pc-windows-msvc.zip 11163770683a21283f0f4adce645f055295736148308a12b65ce1f8e613bfb66
dprint-x86_64-unknown-linux-gnu.zip 51729ee501593c84e2a2e8233f55959edf2bbd95cbb3998e9f8a81ecad942dba
dprint-x86_64-unknown-linux-musl.zip 913032d493340643d6b98ce250a2407c5d0abab8613b3e16a09d92661131425a
dprint-aarch64-unknown-linux-gnu.zip e9dc29baca00edf30d66b1b7a8de490c3a1bda4091bbc7b69f01f4a88db06c01
dprint-aarch64-unknown-linux-musl.zip 6f9541637ff47289409d709e4b006eeed84fd11c212dc029c4d26504a2cae0ff
dprint-riscv64gc-unknown-linux-gnu.zip 04f6470f2d0f584bfb90ffab03c8717e9354f0db98d33ee998e59b09d6a65c52
dprint-loongarch64-unknown-linux-gnu.zip 7d215fd58795d4adabcfab32344a8eca8a25d056514c53695ae6f5eb4bf9bf2b
dprint-loongarch64-unknown-linux-musl.zip 39e2bbe47657b411c2f7b0a2ced3ff120fdcbbf5023cca9904e0be262f558a16
dprint-powerpc64le-unknown-linux-gnu.zip a264d977e5b0ead41d9149855aad710786eb1ff3737351f118c9d834f4e74982
dprint-powerpc64le-unknown-linux-musl.zip e57e201bc9f28937f65f2a94a5c08ec72386f93a8b916429c08cf2e4e848b493
dprint-aarch64-linux-android.zip dde000fea7f23cc33cac686146a266716353a71fdc01f0530f56a0890464f13d
dprint-x86_64-linux-android.zip a31eda2069738b9d629b179e40b517d8fb061c71386e22b294dc85c8fade1dfa
golangci/golangci-lint (aqua:golangci/golangci-lint)

v2.13.1: v2.13.1

Compare Source

golangci-lint is a free and open-source project built by volunteers.

If you value it, consider supporting us, the maintainers and linter authors.

We appreciate it! ❤️

For key updates, see the changelog.

Changelog

  • c3ab374844721687ee00313e847d6e8a7d4cffa2 build(deps): bump github.com/bombsimon/wsl/v5 from 5.8.0 to 5.9.0 (#6737)
  • e602199aba3a75d917b300815b0ba7f7dbd6360b build(deps): bump github.com/nunnatsa/ginkgolinter from 0.23.1 to 0.24.0 (#6735)
  • 62afbbeaf6d09592bfd9d93ec3795b7eae5d83af build(deps): bump github.com/sirupsen/logrus from 1.10.0 to 1.10.1 (#6734)
  • 0924cfd9899de3a6f89eb2eeeecc01ed471195b4 build(deps): bump gofmt to e84e05053792 (#6740)
  • e2a4f0a347ef99790f5ecbcac33f911a4bab6797 build(deps): bump honnef.co/go/tools from 0.8.0-rc.1 to 0.8.0 (#6738)
  • eac982716187a41e859a6e24bcac18666dd4e1e2 build(deps): bump the github-actions group with 2 updates (#6739)

v2.13.0: v2.13.0

Compare Source

golangci-lint is a free and open-source project built by volunteers.

If you value it, consider supporting us, the maintainers and linter authors.

We appreciate it! ❤️

For key updates, see the changelog.

Changelog

  • 7c5a9af062793dc58339bae7f5a61bb9904d6f65 build(deps): bump 4d63.com/gocheckcompilerdirectives from 1.3.0 to 1.4.0 (#6584)
  • 6d5618a95711065986cc79041076ed7c6fd7665b build(deps): bump charm.land/lipgloss/v2 from 2.0.3 to 2.0.4 (#6646)
  • c508ecf3b16f8c781b79a5d2457f45abc489075b build(deps): bump charm.land/lipgloss/v2 from 2.0.4 to 2.0.5 (#6658)
  • 6217aab418b3e1706de6194b25ed2185227de6d3 build(deps): bump charm.land/lipgloss/v2 from 2.0.5 to 2.0.6 (#6716)
  • 6b274d25c1e38f136ab75ac9b9e4785fc22f9421 build(deps): bump dev.gaijin.team/go/exhaustruct/v5 from 4.0.0 to 5.0.2 (#6592)
  • 2b2fbafa6bf52d3852d82e7daf6061f0a2ed4c4c build(deps): bump dev.gaijin.team/go/exhaustruct/v5 from 5.0.2 to 5.0.3 (#6710)
  • 6827c19bdde9e33b95a1f34c5327e9436b18827e build(deps): bump github.com/Abirdcfly/dupword from 0.1.7 to 0.1.8 (#6569)
  • 1f273ea1c347aa6a2c2fafcdeed1d239206623aa build(deps): bump github.com/AlwxSin/noinlineerr from 1.0.5 to 1.0.6 (#6727)
  • aba6edea87755841d203f693ddee8ed2f0b07ec7 build(deps): bump github.com/Antonboom/errname from 1.1.1 to 1.1.2 (#6596)
  • 1880cb9c3ea20cc4ea13a69a88768be028ccc4ea build(deps): bump github.com/Antonboom/nilnil from 1.1.1 to 1.1.2 (#6599)
  • 33bf67975730051f220930a0b863c8a99cd36ecd build(deps): bump github.com/ClickHouse/clickhouse-go-linter from 1.2.0 to 1.2.1 (#6598)
  • 083f4ba91bcab7d59ad14993baf92727d2ac2dcd build(deps): bump github.com/alecthomas/chroma/v2 from 2.24.1 to 2.26.1 (#6605)
  • 4645dbe52e175aec2aa9e70b9f793facc3fbb7a7 build(deps): bump github.com/alecthomas/chroma/v2 from 2.26.1 to 2.27.0 (#6645)
  • 3e9f89be9416079e560e44cabca5a0e1663ecbc9 build(deps): bump github.com/butuzov/mirror from 1.3.0 to 1.3.3 (#6609)
  • 17b0746d8802b6b29df5b60e657a48ab5936cd87 build(deps): bump github.com/firefart/nonamedreturns from 1.0.6 to 1.0.7 (#6644)
  • d3c47e14f944bfe14d0b013a613cb39037748aeb build(deps): bump github.com/firefart/nonamedreturns from 1.0.7 to 1.0.8 (#6661)
  • 8c90a87d9c9839599f0391fbf296009799165b12 build(deps): bump github.com/fsnotify/fsnotify from 1.5.4 to 1.9.0 (#6586)
  • 2e6979e2bf8a37fe3d672d82eeb7937439a57ab8 build(deps): bump github.com/ghostiam/protogetter from 0.3.20 to 0.3.21 (#6575)
  • e60c9371ca6ba0b722b4f883c0d1b42c2ab012bc build(deps): bump github.com/go-critic/go-critic from 0.14.3 to 0.14.4 (#6651)
  • ef3710ea54701a6d93112479a3fc14004693361d build(deps): bump github.com/jgautheron/goconst from 1.10.0 to 1.10.1 (#6576)
  • 3c81e863593775d086270fd91fcba5072c6fe337 build(deps): bump github.com/jgautheron/goconst from 1.10.1 to 1.10.2 (#6606)
  • e18ac9ef38ff1b420704eea64ed40f902b3322b2 build(deps): bump github.com/jgautheron/goconst from 1.10.2 to 1.11.0 (#6694)
  • 90acf733dc5e5dec3e66814f6ae9a2043f0d6edd build(deps): bump github.com/kisielk/errcheck from 1.10.0 to 1.20.0 (#6581)
  • 8baaf6d0eacf5b1a7c10c200f6766662cff3964c build(deps): bump github.com/ldez/gomoddirectives from 0.8.0 to 0.9.0 (#6620)
  • 36a879f10eb7c914d34e58d516f720655c40f4ca build(deps): bump github.com/mattn/go-colorable from 0.1.14 to 0.1.15 (#6604)
  • 6b2ddf9224768e2097b028b7ac7f6efb97a5f9f6 build(deps): bump github.com/nunnatsa/ginkgolinter from 0.23.0 to 0.23.1 (#6685)
  • 14ed862c72f71d6cb705a82c280d7aa0c13a4584 build(deps): bump github.com/pelletier/go-toml/v2 from 2.3.1 to 2.4.2 (#6650)
  • e1fb9a0e2c9dd6bc2f1c9da3d67c4a103b91ab5e build(deps): bump github.com/pelletier/go-toml/v2 from 2.4.2 to 2.4.3 (#6659)
  • 46ac64003b84b233e6b4b351e67e22520ad67e5c build(deps): bump github.com/raeperd/recvcheck from 0.2.0 to 0.3.0 (#6567)
  • 9c7d94f2499ef912c56e7cde8743406faa76b896 build(deps): bump github.com/rogpeppe/go-internal from 1.14.1 to 1.15.0 (#6607)
  • ad01b866eac551d0f176ec0aad9de34fbc417676 build(deps): bump github.com/rogpeppe/go-internal from 1.15.0 to 1.16.0 (#6704)
  • 6d1fc3b4d5fe7b06a2bf59ec79ce00d4c3590fd7 build(deps): bump github.com/santhosh-tekuri/jsonschema/v6 from 6.0.2 to 6.0.3 (#6706)
  • 1b8ff177ff27d7840bd78d6d817b6e68d8a742e7 build(deps): bump github.com/securego/gosec/v2 from 2.26.1 to 2.27.1 (#6611)
  • a95c8ac5288b82d04559c0929a24dae6af34c9ac build(deps): bump github.com/securego/gosec/v2 from 2.27.1 to 2.28.0 (#6675)
  • 40c94e07a8506e9ae17604d9e1fc17017fc565fd build(deps): bump github.com/shirou/gopsutil/v4 from 4.26.4 to 4.26.5 (#6610)
  • 39e88c8639e2aee449eb82dff125befdc8c7ab60 build(deps): bump github.com/shirou/gopsutil/v4 from 4.26.5 to 4.26.6 (#6660)
  • 6c8ca6a875e0219adde0fda12505b24d6e31892e build(deps): bump github.com/shirou/gopsutil/v4 from 4.26.6 to 4.26.7 (#6705)
  • 4de5b3aa610b08133e3989d88d340972c90f401c build(deps): bump github.com/sirupsen/logrus from 1.9.4 to 1.10.0 (#6720)
  • 10b4803b33a14dd08113d7de04376b7fd94fcead build(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 (#6722)
  • d0f29a2177c7c0d2bd0a73714ee7f9223ff83548 build(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 in /scripts/gen_github_action_config in the scripts group (#6719)
  • b1ae2185cd125334fedf3a68538c83671752b6f1 build(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 (#6725)
  • d76c25de3a4f5068837d12af87dd1c4d3b5f22b0 build(deps): bump github.com/uudashr/iface from 1.4.2 to 1.4.3 (#6589)
  • b49366ddf496e8e517d9d390f32b0a3454e18826 build(deps): bump github.com/uudashr/iface from 1.4.3 to 1.5.0 (#6595)
  • 0fffb1b46b3adbf5fd8e76b8e59a77e3d2724cb9 build(deps): bump github/codeql-action from 4.35.2 to 4.35.3 in the github-actions group (#6582)
  • 08843409801524e56bdb5aaa2553d65bc733c904 build(deps): bump github/codeql-action from 4.35.3 to 4.35.4 in the github-actions group (#6594)
  • 9e89eac4f50c1062ea8c772eb89f4fd2cf1bba39 build(deps): bump github/codeql-action from 4.36.1 to 4.36.2 in the github-actions group (#6640)
  • 396d55329848fd8db196ffef1a5324854be64d9a build(deps): bump go.augendre.info/fatcontext from 0.9.0 to 0.10.0 (#6653)
  • c7e3d327f96201fa04c1dc2cdb1e887d5525e397 build(deps): bump go.yaml.in/yaml/v3 from 3.0.4 to 3.0.5 (#6686)
  • b7dc3a1390b6ef1ebdd83972126a69030b2120d4 build(deps): bump golang.org/x/mod from 0.35.0 to 0.36.0 (#6578)
  • c4b085b658fa2e09eda5e1b28686cc6d97fbf1da build(deps): bump golang.org/x/mod from 0.36.0 to 0.37.0 (#6637)
  • 62677e72b8284085512fe4257fa154dd13d896e1 build(deps): bump golang.org/x/mod from 0.37.0 to 0.38.0 (#6668)
  • 8f9326aa9a53d215920942c1c085a8543203dd28 build(deps): bump golang.org/x/mod from 0.38.0 to 0.39.0 (#6715)
  • 6e8c051a55d8c79c25731ea1e76d88eb7273ad0e build(deps): bump golang.org/x/mod from 0.39.0 to 0.40.0 (#6723)
  • 0f08d30088922a298d1e8a72f70f6daf6c539830 build(deps): bump golang.org/x/sync from 0.20.0 to 0.21.0 (#6636)
  • a67e605068e07504cbb64ae398a7c6a1aec1f3b0 build(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 (#6669)
  • 1976f339b38177d9223125892a7340a909c9c868 build(deps): bump golang.org/x/sys from 0.43.0 to 0.44.0 (#6580)
  • 39eb564bca29735d919b9291ed8c98129522b2e4 build(deps): bump golang.org/x/sys from 0.44.0 to 0.45.0 (#6597)
  • 7f83be056cb248d9156e76f3d32148a16daae169 build(deps): bump golang.org/x/sys from 0.45.0 to 0.46.0 (#6635)
  • 1ea35bf1348c5cfe16b7f152c19f8359494df78f build(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 (#6666)
  • 3ad7cb06d673241671520c4b194a989c3d725b3d build(deps): bump golang.org/x/tools from 0.44.0 to 0.45.0 (#6579)
  • 2c56c9c84fbfa69db9c3fa70b0cc763d6d1a1746 build(deps): bump golang.org/x/tools from 0.45.0 to 0.46.0 (#6638)
  • 87b977018c69c97519b000085daa8ce693e8ed22 build(deps): bump golang.org/x/tools from 0.46.0 to 0.47.0 (#6652)
  • 10c91265b545cd974ad5be1cc292d25857e2bce6 build(deps): bump golang.org/x/tools from 0.47.0 to 0.48.0 (#6667)
  • 46090328af2413063f1512527da43871ccbf25a8 build(deps): bump golang.org/x/tools from 0.48.0 to 0.49.0 (#6721)
  • eed6cffceff3cfb9820fc376ef24a0d159efa9cf build(deps): bump mvdan.cc/gofumpt from 0.9.2 to 0.11.0 (#6687)
  • 9626c9a723901674a89721762f21c95944825afd build(deps): bump mvdan.cc/unparam to HEAD (#6709)
  • 5da58b25c583d30eb5a4665a96d634dc4b8dcfbd build(deps): bump mvdan.cc/unparam to HEAD (#6724)
  • c1d8288e1543ca40bc2638e755fd7e8d26bcc2fe build(deps): bump the github-actions group with 2 updates (#6629)
  • b9b03cdb320eecc9b8763dedb286663720d1b070 build(deps): bump the github-actions group with 2 updates (#6682)
  • 2bff0e3f1cc5f6dcd18755dc3a0d9e997f2bdef2 build(deps): bump the github-actions group with 3 updates (#6602)
  • 8e4331e51c969fd2fb258314f4c10e96a6111a0e build(deps): bump the github-actions group with 3 updates (#6654)
  • 9b5e24cba6e9964465bc892ab9377fae5a60cb97 build(deps): bump the github-actions group with 3 updates (#6663)
  • 2cce7356513cf1394bad5158205fe62a12eb0b41 build(deps): bump the github-actions group with 4 updates (#6698)
  • 78b2ed90d31080bcf621d4054ff219487dafa241 build(deps): bump the github-actions group with 5 updates (#6618)
  • d5de4e14c8f811cc6294105b99d022a543687b63 build(deps): bump the github-actions group with 5 updates (#6672)
  • 5cc065bd977ffe01f00ae480b88436b345baa593 build(deps): bump the github-actions group with 5 updates (#6712)
  • 681c654da71d381f59b97b98f699bdffbf3070b7 build(deps): bump the github-actions group with 6 updates (#6690)
  • 450b509b583e69a1c4209c568465f149079a951f build(deps): bump the linter-testdata group across 2 directories with 4 updates (#6655)
  • 57667f0191553d1e8ad2f4bc7ccca703d945d17b build(deps): bump the linter-testdata group across 3 directories with 3 updates (#6692)
  • 0da5bde5476d1743a399a11e966253b3de3681dd build(deps): bump the linter-testdata group across 4 directories with 6 updates (#6726)
  • 9ca1399740622743ffb5149145a2a0f2ff86dd8d build(deps): bump the linter-testdata group across 5 directories with 6 updates (#6616)
  • a9b484189fa255f772b661b0e8f2e93a02252ae6 fix: cache package facts (#6649)
  • 88e4578e9018557cf0b63accf5d0af9b72c3ec6a fix: cache package facts size (#6683)
  • 9c5ec8122806403581f78b7dc880e9d2e43b575e funcorder: add missing Function field (#6627)
  • 42a05302e2bbb966fc3ed0636001dbe4fc2b0c58 go1.27 support (#6642)
  • 6276aff9b61737ce29570de31353499bfe81ffbe goconst: add option exclude-types (#6573)
  • 665ac6a69bd812925c2271c9b92da89108073076 gomoddirectives: add missing IgnoreForbidden field (#6625)
  • 8f7b017e38ac659d76512fdbe239208877c1e4c1 iface: update documentation (#6600)
mikefarah/yq (aqua:mikefarah/yq)

v4.53.6: v4.53.6

Compare Source

  • Fixing release build issue
  • Fixed line wrapping bug (#2824, #2823) Thanks @​mxey
  • Bumped dependencies
openai/codex (aqua:openai/codex)

rust-v0.149.0: 0.149.0

Compare Source

New Features

  • Added an interactive codex agents dashboard for searching, starting, opening, renaming, and stopping tasks, with configurable shortcuts. (#39094, #39112, #39114, #39142)
  • Added /cd, /pwd, and /cwd commands for managing the working directory in TUI sessions. (#38894)
  • Added codex queue for sending messages to existing local or remote sessions. (#39092)
  • Expanded Vim editing with character replacement and more change motions such as cw, c$, and cc. (#39661)
  • codex doctor now diagnoses endpoint protection, network/proxy failures, desktop app state, and update connectivity. (#38827, #38918, #39060, #39074)
  • SDK users can now pass exact CLI config overrides and select max or ultra reasoning effort. (#38817, #39662)

Bug Fixes

  • Queued messages now wake idle sessions reliably, resolve duplicate session names more usefully, and preserve pasted or deferred command semantics. (#39034, #39385, #39604)
  • Resumed and forked threads now restore their active permission profile instead of silently falling back to current defaults. (#39153)
  • Fixed duplicate sub-agent activity and tightened TUI routing for sub-agent notifications and approvals. (#39049, #39088)
  • Realtime WebRTC sideband connections now reconnect after unexpected transport loss without dropping pending output. (#39257)
  • Inline TUI history now remains available in Windows Terminal scrollback. (#39619)
  • Inactive TUI thread replay buffers are now bounded to prevent excessive retained streamed output. (#39081)

Documentation

  • Clarified that external contributions should go through issues and design discussion rather than pull requests. (#39089)
  • Documented DNS exfiltration risks and trust limitations for secure devcontainers. (#39283)

Changelog

Full Changelog: openai/codex@rust-v0.148.0...rust-v0.149.0

  • #38817 Add raw config overrides to the TypeScript SDK @​copyberry
  • #38819 Support metadata staging for reserved thread IDs @​copyberry
  • #38822 Avoid cloning TUI history span content @​copyberry
  • #38823 Avoid allocating per character when decorating hyperlinks @​copyberry
  • #38827 Add endpoint protection checks to codex doctor @​copyberry
  • #38830 Isolate external editor buffers from sandbox-writable paths @​copyberry
  • #38837 Share editor keymaps across TUI composer components @​copyberry
  • #38840 Identify Mac mini hosts in remote control handshakes @​copyberry
  • #38893 Restore thread timestamp maxima independently @​copyberry
  • #38894 Add working-directory commands to the TUI @​copyberry
  • #38899 Move requirements policy ownership to execpolicy @​copyberry
  • #38902 Honor per-environment shell variable policies @​copyberry
  • #38907 Edit queued messages with Vim history-up @​copyberry
  • #38913 Stop rendering columns after filling their area @​copyberry
  • #38916 Honor legacy :project_roots permission entries @​copyberry
  • #38918 Improve codex doctor network diagnostics @​copyberry
  • #38919 Reject obsolete app-server permission profile fields @​copyberry
  • #38921 Compact successful command activity in the TUI @​copyberry
  • #38940 Add experimental app-server project APIs @​copyberry
  • #38941 Prevent Noise auth tokens from reaching child processes @​copyberry
  • #38942 Enforce environment-specific command policies @​copyberry
  • #38947 Stop loading legacy managed config on Windows @​copyberry
  • #38978 Add a configurable skill catalog token budget @​copyberry
  • #38980 Bound Guardian v2 parent compaction context @​copyberry
  • #38987 Include images in Guardian v2 transcripts @​copyberry
  • #38990 Source Guardian v2 defaults from the model catalog @​copyberry
  • #38993 Evaluate recent and character-routed skill selection @​copyberry
  • #38994 Remove the workspace settings gate for apps and plugins @​copyberry
  • #38997 Retry transient Guardian sampling failures @​copyberry
  • #39001 Ignore stale Guardian tool risk scores @​copyberry
  • #39005 Disable Guardian V2 for managed automatic reviewers @​copyberry
  • #39006 Emit API-key turn cost telemetry from app-server @​copyberry
  • #39007 Wait for Guardian score progress in approval tests @​copyberry
  • #39008 Add task context to shadow skill selection @​copyberry
  • #39017 Move MCP policy types into codex-protocol @​copyberry
  • #39019 Isolate MCP resource headers during OAuth requests @​copyberry
  • #39020 Restrict Windows IDE pipe client impersonation @​copyberry
  • #39022 Hang soft-break whitespace in the TUI composer @​copyberry
  • #39023 Reduce retained MCP result data in TUI history @​copyberry
  • #39025 Speed up the large diff highlighting test @​copyberry
  • #39026 Use simulated time in the long typing test @​copyberry
  • #39028 Cache the test pet spritesheet encoding @​copyberry
  • #39030 Speed up the in-app resume cwd test @​copyberry
  • #39032 Encapsulate TUI shimmer under the motion module @​copyberry
  • #39033 Bound legacy resume preview scans @​copyberry
  • #39034 Dispatch queued messages written by other processes @​copyberry
  • #39035 Add app-server coverage for Guardian V2 approval routing @​copyberry
  • #39036 Allow config reads to join active app-server read batches @​copyberry
  • #39038 Restore Guardian risk scores across thread lifecycles @​copyberry
  • #39040 Preserve foreign paths in managed network approvals @​copyberry
  • #39043 Enforce managed authentication backend settings @​copyberry
  • #39045 Add managed gates for in-app chat and dictation @​copyberry
  • #39046 Restrict MCP HTTP redirects to the configured origin @​copyberry
  • #39047 Skip plugin hook loading when hooks are disabled @​copyberry
  • #39049 Avoid rendering sub-agent activity twice in the TUI @​copyberry
  • #39050 Prepare the telemetry shutdown worker during initialization @​copyberry
  • #39051 Use installed callable apps for TUI mentions @​copyberry
  • #39055 Add network policy metadata to environment configuration @​copyberry
  • #39056 Verify the pinned zsh manifest in release builds @​copyberry
  • #39057 Rate-limit TUI frames from their actual emission time @​copyberry
  • #39058 Tag Codex Apps protocol discovery metrics @​copyberry
  • #39060 Add desktop app diagnostics to codex doctor @​copyberry
  • #39061 Avoid rerendering streamed code fences @​copyberry
  • #39063 Render only visible rows in the transcript pager @​copyberry
  • #39064 Restrict queued-message editing to its dedicated binding @​copyberry
  • #39065 Limit terminal hyperlink layout to the visible viewport @​copyberry
  • #39067 Add desktop security enforcement diagnostics @​copyberry
  • #39068 Remove skill model delegation support @​copyberry
  • #39072 Persist generated images through turn executors @​copyberry
  • #39073 Propagate caller metadata to rendezvous connections @​copyberry
  • #39074 Add desktop update diagnostics to codex doctor @​copyberry
  • #39075 Avoid redundant terminal row clears @​copyberry
  • #39077 Build filesystem JSON params only for remote TUI sessions @​copyberry
  • #39078 Preserve tracing context for environment resolution @​copyberry
  • #39079 Apply user MCP policy to selected executor plugins @​copyberry
  • #39081 Bound TUI thread replay buffers by delta size @​copyberry
  • #39082 Prompt for project trust in remote TUI workspaces @​copyberry
  • #39083 Harden Windows sandbox provisioning against reparse points @​copyberry
  • #39084 Preserve filesystem permission path conventions @​copyberry
  • #39087 Read plugin authentication state from AuthManager @​copyberry
  • #39088 Harden TUI subagent navigation @​copyberry
  • #39089 Clarify the external contribution policy @​copyberry
  • #39092 Add a command to queue messages for existing sessions @​copyberry
  • #39094 Add an agents overview dashboard to the TUI @​copyberry
  • #39098 Trace exec-server requests from receipt through completion @​copyberry
  • #39100 Avoid redundant terminal size queries during history insertion @​copyberry
  • #39101 Update rmcp to 3.1.2 @​copyberry
  • #39102 Raise the GPT-5.6 maximum context window @​copyberry
  • #39103 Drop capabilities from Linux sandbox processes @​copyberry
  • #39112 Make the agents overview an interactive task dashboard @​copyberry
  • #39113 Surface interactive requests in realtime conversations @​copyberry
  • #39114 Add a dedicated codex agents dashboard command @​copyberry
  • #39115 Remove the experimental thread config endpoint @​copyberry
  • #39117 Reject lossy legacy permission projections @​copyberry
  • #39122 Fail closed on deeply nested command wrappers @​copyberry
  • #39131 Validate identifiers in plugin creator workflows @​copyberry
  • #39141 Redact auth tokens from app-server response logs @​copyberry
  • #39142 Add configurable shortcuts for the agents dashboard @​copyberry
  • #39143 Hydrate recommended plugin metadata on selection @​copyberry
  • #39145 Persist active permission profiles in turn context @​copyberry
  • #39147 Centralize persisted resume settings lookup @​copyberry
  • #39152 Update PyPI publish action to v1.14.2 @​copyberry
  • #39153 Restore permission profiles when resuming threads @​copyberry
  • #39154 Box the TUI future to bound CLI stack usage @​copyberry
  • #39155 Prepare Python SDK 0.147.0 stable release @​copyberry
  • #39157 Notify clients when Guardian requires strict review @​copyberry
  • #39159 Require approval for commands with dynamic shell words @​copyberry
  • #39163 Refresh collaboration instructions when their content changes @​copyberry
  • #39165 Prevent marketplace identity spoofing @​copyberry
  • #39174 Skip empty user messages for automatic idle turns @​copyberry
  • #39176 Drop descendant progress updates after remote compaction @​copyberry
  • #39187 Scope MCP app resource reads to their originating call @​copyberry
  • #39192 Preserve MCP resource origins across compaction @​copyberry
  • #39200 Add a symlink-safe reader for sensitive files @​copyberry
  • #39205 Reject symbolic links in memory workspaces @​copyberry
  • #39213 Add a fail-closed Tree-sitter PowerShell lowerer @​copyberry
  • #39214 Prevent custom providers from inheriting ambient auth @​copyberry
  • #39220 Reconnect Guardian sampling WebSockets after auth changes @​copyberry
  • #39221 Skip redirected external-agent migration destinations @​copyberry
  • #39224 Add Guardian v2 approval review metrics @​copyberry
  • #39227 Include node_repl screenshots in Guardian v2 reviews @​copyberry
  • #39235 Decouple Noise relay streams from JSON-RPC processing @​copyberry
  • #39240 Deduplicate remote plugin bundle syncs with shared semaphores @​copyberry
  • #39241 Record Guardian v2 classification metrics @​copyberry
  • #39242 Add safe permission profile intersection @​copyberry
  • #39244 Scope MCP resource reads by connector @​copyberry
  • #39246 Give Guardian classifier connections distinct thread identities @​copyberry
  • #39249 Add exec-server forwarding mode @​copyberry
  • #39256 Deduplicate rollout moves when archiving threads @​copyberry
  • #39257 Reconnect WebRTC Realtime sideband transports @​copyberry
  • #39259 Simplify unified exec output snapshots @​copyberry
  • #39261 Stop TUI chats on misalignment policy violations @​copyberry
  • #39262 Prevent ConPTY DLL loading from the current directory @​copyberry
  • #39264 Improve Guardian v2 risk classification @​copyberry
  • #39266 Require fresh approval beneath denied permission paths @​copyberry
  • #39267 Inject Node REPL policy into Guardian review sessions @​copyberry
  • #39273 Preserve thread names during rollout migration @​copyberry
  • #39274 Add provider-owned authentication recovery @​copyberry
  • #39277 Declare experimental Amazon Bedrock setup APIs @​copyberry
  • #39278 Preserve owner-provided environment configuration @​copyberry
  • #39279 Propagate Windows sandbox ACL update failures @​copyberry
  • #39281 Move shell snapshot scripts into codex-shell-command @​copyberry
  • #39283 Document secure devcontainer DNS exfiltration risk @​copyberry
  • #39284 Report network disconnects during approval @​copyberry
  • #39285 Show file destinations in TUI change approvals @​copyberry
  • #39287 Report diagnostic upload failures @​copyberry
  • #39288 Register the async message feature flag @​copyberry
  • #39290 Add Windows sandbox diagnostics to codex doctor @​copyberry
  • #39293 Remove app-server's direct reqwest dependency @​copyberry
  • #39294 Increase SQLite log sink batching @​copyberry
  • #39296 Enable MCP tool hooks in Codex sessions @​copyberry
  • #39298 Allow overriding Codex package versions @​copyberry
  • #39299 Restrict agent roles to bounded configuration overrides @​copyberry
  • #39301 Prevent Node REPL auth tokens from reaching child processes @​copyberry
  • #39303 Record Guardian v2 classification token usage @​copyberry
  • #39304 Keep Guardian v2 risk scores in memory @​copyberry
  • #39306 Honor managed config during project discovery @​copyberry
  • #39307 Fail closed on Guardian V2 risk scoring errors @​copyberry
  • #39309 Attribute executor skill invocations to plugins @​copyberry
  • #39311 Bind unified exec approvals to shell executables @​copyberry
  • #39312 Add async delivery metadata to agent messages @​copyberry
  • #39314 Run hooks with the captured session environment @​copyberry
  • #39315 Evict guardian transcript entries in cacheable chunks @​copyberry
  • #39316 Support Edu Plus and Edu Pro account plans @​copyberry
  • #39319 Add the async user message tool @​copyberry
  • #39320 Expand OAuth metadata redirect test coverage @​copyberry
  • #39322 Enforce workspace restrictions for header authentication @​copyberry
  • #39325 Stop migrating Cursor sandbox settings @​copyberry
  • #39331 Route hook MCP calls through current connections @​copyberry
  • #39335 Enforce environment MCP policies @​copyberry
  • #39372 Scope TUI approval requests to their threads @​copyberry
  • #39385 Prefer the most recent session when queueing by name @​copyberry
  • #39402 Remove npm package staging from repo checks @​copyberry
  • #39404 Support FD mounts with older system Bubblewrap versions @​copyberry
  • #39410 Refresh expired AWS credentials for Bedrock @​copyberry
  • #39452 Remove the feature gate for async user messages @​copyberry
  • #39474 Consolidate Guardian extensions into codex-guardian-v2 @​copyberry
  • #39480 Move shell snapshot tests into shell-command @​copyberry
  • #39493 Make head-tail buffer capacity const generic @​copyberry
  • #39494 Test panoramic Guardian transcript image resizing @​copyberry
  • #39496 Use default timeouts in cyber exec policy tests @​copyberry
  • #39497 Correct normalized dynamic tool coverage across response modes @​copyberry
  • #39501 Use a narrow fixture for the unified image resize test @​copyberry
  • #39505 Test text stringify errors in the code mode runtime @​copyberry
  • #39506 Test code mode notifications without a sync tool call @​copyberry
  • #39509 Test disabled enhanced Node REPL transcript images separately @​copyberry
  • #39510 Track built-in control tool calls in analytics @​copyberry
  • #39514 Use stored item types when materializing turn summaries @​copyberry
  • #39515 Use mem::take to drain unified exec output buffers @​copyberry
  • #39520 Isolate automatic plugin Git operations @​copyberry
  • #39523 Persist thread section moves before the first turn @​copyberry
  • #39524 Stop treating Git commands as inherently safe @​copyberry
  • #39584 Add a just recipe for assembling Codex packages @​copyberry
  • #39585 Test plugin sync isolation from repository Git config @​copyberry
  • #39586 Isolate IPC in Bubblewrap sandboxes @​copyberry
  • #39588 Preserve unparsed shell wrappers in exec policy @​copyberry
  • #39590 Harden plugin manifest handling during installation @​copyberry
  • #39592 Prevent SQLx warnings from feeding back into SQLite logs @​copyberry
  • #39594 Raise the MCP tool name limit to 128 bytes @​copyberry
  • #39595 Keep marketplace upgrade state out of config @​copyberry
  • #39597 Separate thread settings from environment configuration @​copyberry
  • #39599 Protect macOS Seatbelt writable root anchors @​copyberry
  • #39601 Keep async user messages on the direct tool surface @​copyberry
  • #39602 Use in-process parsing for PowerShell command classification @​copyberry
  • #39604 Preserve queued TUI input semantics @​copyberry
  • #39605 Hide approved automatic review warnings in the TUI @​copyberry
  • #39606 Enable user namespaces in shared CI setup @​copyberry
  • #39607 Resolve model-provided shells by type @​copyberry
  • #39608 Harden skill installation against unsafe symlinks @​copyberry
  • #39609 Limit Bazel integration test threads on macOS @​copyberry
  • #39611 Harden MCP OAuth fallback credential writes @​copyberry
  • #39614 Prevent apply_patch from widening write permissions @​copyberry
  • #39615 Bind MCP OAuth refresh tokens to their issuer @​copyberry
  • #39616 Validate linked worktrees before inheriting project trust @​copyberry
  • #39618 Apply composer editing preferences to TUI text prompts @​copyberry
  • #39619 Preserve inline TUI scrollback in Windows Terminal @​copyberry
  • #39620 Stream executor capability and skill file reads @​copyberry
  • #39623 Prevent protected-path rename bypasses in macOS Seatbelt @​copyberry
  • #39625 Add cwd-relative turn diff paths @​copyberry
  • #39629 Preserve parent repository discovery through sandbox metadata mounts @​copyberry
  • #39630 Retire the untrusted approval policy @​copyberry
  • #39631 Skip sandboxed shell commands in Guardian v2 by default @​copyberry
  • #39632 Expose permission profile resolution in the core API @​copyberry
  • #39635 Show strict review warnings in the TUI @​copyberry
  • #39637 Treat invalid_grant refresh failures as permanent @​copyberry
  • #39640 Prompt to unarchive sessions before resuming or forking @​copyberry
  • #39641 Sanitize developer context in full-history agent forks @​copyberry
  • #39645 Enforce managed residency for model providers @​copyberry
  • #39646 Exercise restricted-token sandboxing in cyber policy tests @​copyberry
  • #39649 Resolve bundled Windows helpers through bin junctions @​copyberry
  • #39653 Enforce filesystem permissions when loading AGENTS.md @​copyberry
  • #39655 Make core integration test permissions explicit @​copyberry
  • #39656 Advertise the Desktop app in graphical Linux sessions @​copyberry
  • #39657 Warn when launching the deprecated MCP server @​copyberry
  • #39658 Let Guardian V2 satisfy required model reviews @​copyberry
  • #39659 Harden unsandboxed patch filesystem access @​copyberry
  • #39661 Expand Vim change commands and add character replacement @​copyberry
  • #39662 Add max and ultra reasoning efforts to the SDKs @​copyberry
  • #39663 Restrict plugin migration to home scope @​copyberry
  • #39665 Add macOS Seatbelt filesystem integration tests @​copyberry
  • #39666 Improve no-follow filesystem behavior across platforms @​copyberry
sst/opencode (aqua:sst/opencode)

v1.18.21: v1.18.21

Compare Source

Core

Bugfixes

  • Continue responses when a model reports an unknown finish reason instead of stopping early
  • Route Vertex AI eu and us multi-region Gemini requests through REP endpoints

Desktop

Bugfixes

  • Keep file search results visible while the next search is loading
  • Register the archive session command in both desktop layouts (@​NathanTCode)

Thank you to 1 community contributor:

  • @​NathanTCode:
    • fix(app): register archive session command in both layouts (#41741)

v1.18.20: v1.18.20

Compare Source

Core

Bugfixes

  • Surface failed subagent tool calls with a resumable task_id.
  • Retry provider responses that end with finish_reason: network_error.
  • Retry more network error variants, including network-error and network_error.
  • Surface resumable subagent failures instead of returning an empty result.
  • Preserve Cerebras max_completion_tokens without applying an extra output cap.
  • Answer permission requests triggered by subagents during opencode run.
  • Retry xAI capacity and temporary unavailability stream errors.

v1.18.19: v1.18.19

Compare Source

Core

Improvements

  • Added native OpenAI and Anthropic passthroughs for Cloudflare AI Gateway models.
  • Matched Codex rate limits more closely to ChatGPT subscription limits. (@​GameOn223)

Bugfixes

  • Removed built-in Qwen sampling defaults that could send unsupported settings.
  • Properly show authenticated providers in /connect. (@​OpeOginni)
  • Ignore malformed model pricing instead of breaking usage cost calculation.
  • Fall back when OpenAI websocket requests exceed message size limits.
  • Forward ChatGPT workspace compute residency to Codex requests.
  • Updated the default Console URL used by account connection flows.
  • Enabled web search when using the OpenCode Go provider.
  • Preserved compatibility with existing v1 databases.

Desktop

Bugfixes

  • Kept saved server details editable in the server dialog.

Thank you to 4 community contributors:

  • @​TechyAditya:
    • fix(skills): Update global config path in documentation (#42337)
  • @​GameOn223:
    • tweak: match codex limits for openai models exactly when using chatgpt subscription (#39082)
  • @​OpeOginni:
    • fix(opencode): properly show authed providers on /connect command (#39915)
  • @​bhuvan2134686:
    • docs: add SCX.ai to the providers list (#42520)

@scottames-github-bot

Copy link
Copy Markdown
Contributor
zellij-org/zellij (aqua:zellij-org/zellij)

v0.45.0: Release v0.45.0

Compare Source

This release includes some major long-requested integrations with modern terminals as well as with Zellij itself: nested sessions become a first-class experience, images render through the Kitty graphics protocol, the scrollback understands shell prompts, and the default interface gets a redesign.

Following is a non-exhaustive list of some major and significant changes:

Nested Sessions

Running Zellij inside a Zellij pane (eg. after ssh-ing to a remote machine) is now a first-class workflow. The inner session announces itself to the outer one, and the outer session reacts when its pane gains focus, providing the user with 2 options:

  1. Zoom in and control the nested session - the nested session takes up the whole screen until toggled back (Ctrl o + f, or clicking the session breadcrumbs in the tab-bar)
  2. Control the nested session on focus - keys and mouse are routed directly to it, with the outer session's chrome dimmed. Ascend back with Ctrl o + ], descend again with Ctrl o + [

The behavior is controlled with the new nested_session_handling config option (ask (default) / fullscreen / descend / never).

Kitty Graphics Protocol

Zellij now implements the Kitty graphics protocol in addition to the existing Sixel support. Image placements are tracked per pane and behave correctly across resizes, relayouts, scrollback, fullscreen and floating/pinned panes. The host terminal needs to support the protocol as well (queried at startup); the feature can be disabled with support_kitty_graphics_protocol false.

Relatedly, Sixel support is now only advertised to applications (through DA1 / XTSMGRAPHICS) when the attached terminal actually supports it.

Shell Integration (OSC 133)

Zellij now parses the OSC 133 "semantic prompt" sequences (emitted by fish out of the box; bash/zsh need a shell integration snippet). This enables:

  • Jump between prompts in the scrollback: [ / ] in scroll and search modes
  • Select a command with its whole output: m in scroll mode, or triple-click inside the output (opt-out of triple-click with osc133_command_selection in the config)
  • Copy the last command's output to the clipboard: c in scroll mode

Also in the selection department: word boundaries for double-click selection are now configurable with word_separators.

More info: https://zellij.dev/documentation/shell-integration.html

New UI

Title frames: pane frames now default to a single title line above each pane instead of a full border. To restore the classic look:

pane_frame_style "full"

The style can also be changed at runtime with zellij action set-pane-frame-style or the new SetPaneFrameStyle keybinding action.

Stacked lists: stacked panes now render as a list of one-line titles with the expanded pane pinned to the bottom, including exit-status indication in collapsed titles and bulk float/embed operations. To restore the previous in-place rendering:

stacked_pane_list false

Some mouse behaviors can also now be specifically opted out of in the config: mouse_hover_tips false (hover help tips) and mouse_scroll_resize false (Ctrl + scroll wheel resizing).

Mobile Web UI + PWA

The built-in web client now detects mobile browsers and switches to a dedicated touch interface: pane/tab pickers, an on-screen keyboard, panning and fit toggling, single-pane fullscreen and a light theme. The web client can also be installed as a standalone app (PWA) directly from the browser, including behind a base_url reverse-proxy prefix.

Per-Client Tab Sizes

Each tab is now sized according to the viewports of only the clients currently viewing it. Clients focused on different tabs no longer force the whole session down to the smallest terminal; clients on the same tab converge to a common size.

Desktop Notifications

Given the prevalence of a few different desktop notifications protocols, Zellij now supports all and consolidates them to a protocol the host (probably) supports, detected by relevant env variables. Previously Zellij would forward OSC99 directly to the terminal, now this is conditioned on the terminal actually supporting OSC99. Zellij now also supports OSC9 and OSC777 in the same way.

Focus Last Pane and No-UI Fullscreen

A new FocusLastPane action returns focus to the previously focused pane (Ctrl p + ;, or Alt \ in any mode). A new ToggleFocusNoUiFullscreen action (Ctrl p + Shift f) makes the focused pane cover the entire display, including the UI bars (zen mode). Floating panes can now be made fullscreen as well.

CLI Additions

  • zellij --layout-string <KDL> - use a raw KDL layout string instead of a layout file (new tabs inside a session, a new session otherwise). Also available on new-tab, override-layout and switch-session
  • --no-focus - open panes, plugins and tabs in the background without changing any client's focus (on run, edit, plugin, new-pane, new-tab, launch-plugin)
  • --tab-id - target a specific tab (on run, edit, plugin and many actions)
  • zellij action new-pane --pane-id - choose which pane to replace with --in-place
  • New actions: focus-last-pane, toggle-no-ui-fullscreen, set-pane-frame-style, set-dark-theme, set-light-theme, toggle-theme

Some of the new features come with new default keybindings. The release notes screen detects which of these are missing from existing config files and offers to add them with a single keypress.

Plugin API

New commands include new_tab_unfocused, new_tiled_pane_in_tab, focus_last_pane, focus_host_session, toggle_focus_no_ui_fullscreen, set_pane_frame_style, toggle_floating_panes, get_session_list and set_soft_keyboard. New events include CommandChanged, InitialKeybinds, HostTerminalThemeChanged, SoftKeyboardVisibilityChanged, HintText and ActivePaneScroll.

Source-level breaking changes for plugin authors:

  • kill_sessions, delete_dead_session and delete_all_dead_sessions now return Result<(), String> and block until acknowledged (the old wire protocol variants remain valid, so old plugin binaries keep working)
  • open_command_pane_in_new_tab now requires the RunCommands permission, and open_editor_pane_in_new_tab requires OpenFiles
  • The PaneRenderReportWithAnsi event was removed; the plain-text PaneRenderReport remains

Clipboard Reads

It's now possible to opt in to allowing terminal programs to read the clipboard through OSC52. This is disabled by default for security reasons, and opting in to it is only recommended with care. An opt-in would mean that any program running in the terminal (including over an SSH connection) can read your clipboard without your knowledge. This can be enabled with dangerously_enable_paste_buffer_read true.

Notes for Packagers and Distributors

  • MSRV raised from 1.92.0 to 1.95.0
  • YAML converter removed: the convert-config, convert-layout and convert-theme subcommands and the automatic YAML-to-KDL conversion at startup are gone. Users with YAML-era files must convert them with a Zellij release of 0.44.x or older
  • Manpage removed: the manpage source and its build integration were dropped; packages should no longer attempt to install one
  • Dependency floors raised: clap 4.6, crossterm 0.29, nix 0.30, vte 0.15, miette 7.6, notify 8.2, axum-extra 0.12, axum-server 0.8, rcgen 0.14 and others - relevant for distros patching to system crate versions
  • clap 4 migration side effects: repeating a flag overrides the previous value instead of erroring
  • Bundled plugin wasm files can now be properly unbundled when stripped (#5433)
  • cargo xtask run informational output moved to stderr, so cargo xtask run -- setup --generate-completion fish > file produces a clean file

For the full list of changes, see the CHANGELOG.

Addendum: Zellij.online

Want to get a sneak peak at something the Zellij maintainers have been working on?

Check out https://zellij.online

Please Support the Zellij Developer ❤️

Zellij is a labor of love and is provided free and open-source to anyone who wishes to use it.

Zellij will never display ads or collect your data.

To help sustain the project, please consider a recurring donation so that the developer can pay their bills: https://github.com/sponsors/imsnif

agavra/tuicr (github:agavra/tuicr)

v0.23.1: v0.23.1

Compare Source

What's Changed

Full Changelog: agavra/tuicr@v0.23.0...v0.23.1

anthropics/claude-code (github:anthropics/claude-code)

v2.1.240: v2.1.240

Compare Source

What's changed

  • Bug fixes and reliability improvements

v2.1.239: v2.1.239

Compare Source

What's changed

  • Cost estimates (/cost, status line, --max-budget-usd) now include the 1.1× US-only-inference premium for data-residency workspaces
  • Added the one-time fullscreen renderer offer on Bedrock, Vertex, Foundry and other previously excluded setups; new installs there now start in fullscreen
  • Added /claude-api upgrade to migrate Python projects from anthropic 0.x to 1.x, and updated the skill's Python reference for 1.x (timeouts use anthropic.Timeout, not httpx.Timeout)
  • Cloud sessions: plugins synced from claude.ai now show as name@&#8203;synced, work with claude plugin enable/disable <name>@&#8203;synced, and never override a same-named plugin you installed
  • Alpine/musl builds: native image paste, clipboard, and audio-capture add-ons now load (musl-built binaries instead of glibc ones refused by the runtime)
  • The usage-limit message shown when your monthly spend limit is already used up now also says when your session or weekly limit resets
  • Fixed Bedrock streaming behind proxies that strip the response Content-Type header, which silently doubled billed API calls by re-running every turn non-streaming
  • Fixed Claude Code hanging at startup behind an HTTPS proxy when using Bedrock with an SSO profile and awsAuthRefresh — the credential pre-check now honors HTTPS_PROXY
  • Fixed a raw crash dump when starting Claude Code from a directory that no longer exists; it now prints a clear message
  • Fixed Edit and Write calls pausing for about 5 seconds in JetBrains IDE terminals when the Claude Code plugin is connected
  • Fixed a race where pressing Esc with a prompt queued could let the next turn finish early, leaving the session idle while Claude was still working and letting a later resubmit repeat actions
  • Fixed WebFetch retaining expired page content in memory for the whole session instead of the intended 15 minutes
  • Fixed cloud sessions (Claude Code on the web, desktop and mobile apps) resuming out of plan mode after an idle worker restart
  • Fixed MCP elicitation forms taller than the terminal being clipped in fullscreen mode: the form now fits the window, with hidden fields reachable by scrolling and Accept/Decline always visible
  • Fixed remote MCP servers staying failed after a transient 5xx on a mid-session reconnect in cloud sessions or via SDK setMcpServers()
  • Fixed custom session titles disappearing from /resume after more than ~64 KB of conversation was written following the rename
  • Fixed claude -c/resume picking up sessions from a different directory whose path differed only by characters like _, -, or .
  • Fixed /resume and the agents view showing a session as recently changed (and reordering it) when only its file was touched or it was merely reopened
  • Fixed /resume in all-projects mode telling you to cd into a deleted directory (e.g. a removed worktree); such sessions now resume in the current directory
  • Fixed the dark-ansi theme rendering expanded tool results in fullscreen mode with text the same color as the background
  • Fixed the fullscreen renderer prompt reappearing on every launch when it could never be answered; it now stops after being shown on three launches
  • Fixed .worktreeinclude patterns starting with **/ silently matching nothing when the target lived in a gitignored directory
  • Fixed agents, skills, and commands whose .md file starts with a UTF-8 BOM being silently ignored
  • Fixed /insights echoing literal <message> tags in its response on some models
  • Fixed marketplace metadata.pluginRoot having no effect: bare plugin source names now resolve under it as the docs describe
  • Fixed mouse movement in browser-based terminals inserting text like "35;150;7M" into the prompt when a mouse report arrived split across writes
  • Fixed custom theme overrides for the effort/ultracode status badge colors being ignored
  • Fixed OpenTelemetry trace fragmentation: tool executions deferred by a PreToolUse hook now resume in the original turn's trace instead of starting a new trace
  • Fixed vim mode in the agent view: Escape now switches to NORMAL mode and keeps your text instead of clearing the prompt
  • Fixed the selection:copy keybinding silently dropping a text selection that had been extended with Shift+Arrow keys
  • Fixed the /voice startup tip still appearing after voice dictation was enabled via the voice.enabled setting
  • Fixed shell-mode (!) Tab completion dropping the ./ from a ./script path, which left a command the shell couldn't run
  • Fixed fullscreen mode answering a permission prompt or pressing a button when you clicked the terminal window only to bring it back into focus
  • Fixed slash-command panels (e.g. /config, /model) in fullscreen mode covering the latest messages; the conversation now stays pinned above the panel
  • Fixed the /workflows detail dialog overflowing the terminal and losing its header off-screen when opened while Claude is still responding
  • Fixed the Linux sandbox making a nonexistent .git/config.worktree unreadable, which broke every sandboxed git command in repos with extensions.worktreeConfig set
  • Fixed hooks failing with "posix_spawn ENOENT" after the session's working directory was deleted; they now run from the project root or home directory instead
  • Fixed claudeMdExcludes not excluding a symlinked .claude/rules file when the pattern names the rules directory or the symlink rather than its target
  • Fixed runaway session-title syncing to Remote Control when two Claude Code processes shared one background job's state (2.1.232 regression); title updates are now deduplicated and rate-limited
  • Fixed sessions whose title starts with / being unaddressable by SendMessage and shown as "(untitled)" in ListAgents
  • Fixed Ctrl+W, Ctrl+U, Ctrl+K, Option+Backspace, Option+D and vim df/dt leaving a broken [Pasted text #N] placeholder when the cursor was inside it
  • Fixed masked (password-style) inputs such as the login code field letting their text be pasted back with Ctrl+Y elsewhere or saved to prompt history when cleared with double Esc
  • Fixed Ctrl+Backspace deleting one character instead of a word in search boxes
  • Fixed a request rejected by an organization policy check being re-sent before the rejection was shown
  • Improved the reminder shown after compaction so a skill's original arguments are not re-run as a new request
  • Long file paths on tool-use rows now truncate in the middle to stay on one line
  • Remote sessions keep sending keep-alives while a long SessionStart or Setup hook runs, so the container is not idle-reaped mid-hook
  • /goal: repeat check-ins on long-running background work now back off (30 min, then 1 h, then every 2 h) instead of repeating every 30 minutes
  • /goal: resuming a session from the claude --resume picker now restores its active goal
  • ListAgents now tells a session its own name (the one peers use to message it), and SendMessage to your own name says so instead of "no agent named …"
  • ListAgents and /list-agents now list your live teammates (previously only subagents and other sessions appeared, so a reachable teammate looked absent)
  • keybindingFlavor: "readline" now also matches Bash for word keys: Alt+F and Ctrl/Option+→ stop at the end of the word, Alt+D deletes to it (Ctrl+Y pastes it back), and punctuation separates words
  • Persistent retry mode (CLAUDE_CODE_RETRY_WATCHDOG) now fails immediately on organization spend-limit and out-of-credits errors instead of waiting indefinitely for a reset
  • Claude in Chrome: /clear now closes the session's Chrome tab group, and empty groups are closed on /resume and when Claude Code exits
  • Remote sessions: images uploaded from mobile now include their saved file path, so Claude can copy them into files it creates
  • Claude Code on the web: requests from Bash and other tools to non-API anthropic.com hosts (e.g. www, docs) now go through the session's network proxy, so your environment's allowed domains apply
  • Remote Control: clearer message and claude doctor wording when Remote Control isn't enabled for your account
  • Windows: cross-session messaging is now available, so Claude Code sessions across your machines can message each other with SendMessage and find each other with ListAgents, as on macOS and Linux
  • [VSCode] "View usage" in the usage-limit banner now sits inline with the warning text instead of floating mid-banner

v2.1.238: v2.1.238

Compare Source

What's changed

  • Added a keybindingFlavor setting: set it to "readline" to make Ctrl+W in the prompt delete back to the previous whitespace, as in Bash; the default ("classic") is unchanged
  • Plugin marketplaces: headersHelper on a url marketplace or a catalog entry runs a command that mints HTTP headers (e.g. a short-lived token) for catalog and same-origin archive fetches
  • A catalog entry's headersHelper runs only when you install or update that plugin, after its command is shown; claude plugin install/update ask [y/N] (or pass -y)
  • Added claude self-hosted-runner --defer-shutdown-max-min <minutes>: on SIGTERM, keep serving attached sessions, park what is left after that many minutes, then exit
  • Added claude self-hosted-runner --proxy-authorization-command / --proxy-authorization-file for egress proxies that require a freshly issued Proxy-Authorization header on every connection
  • Fixed unbounded memory growth in long interactive sessions: subagent tool results are now released once they leave the recent display window
  • Fixed custom, project, and plugin output styles drifting back to the default voice mid-session
  • Fixed CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION=true not keeping prompt suggestions on when your account is near, but not over, its usage limit
  • Fixed worktree-isolation Bash refusals telling you to remove a redirect when the command had none
  • Fixed self-hosted runners occasionally being removed by the server after a single slow or lost poll request, handing their healthy session to another runner
  • Fixed MCP elicitation dialogs showing nothing for URLs longer than 4,096 characters, and permission prompts dropping the "don't ask again" option when the project path didn't fit the terminal width
  • Fixed leftover /tmp/claude-*-cwd files when a Bash command is killed, times out, or is interrupted
  • Fixed held Backspace being ignored on terminals that send Ctrl+H for Backspace when keystrokes arrive in large bursts (slow SSH/mosh links)
  • Fixed text-wrapping in permission prompt diffs: lines containing wide multi-code-point characters (such as emoji) or tabs are no longer clipped
  • Fixed killing a suspended (Ctrl+Z) session sometimes leaving the terminal in bracketed-paste mode with the cursor hidden
  • Fixed stdio MCP servers receiving a server/discover request before initialize, forcing lazy servers to start their backend on every session open
  • Fixed a proxy's refusal of a connection being reported as a generic network error instead of naming the proxy
  • Fixed the /model and /effort cache-miss warning appearing when the prompt cache had already expired
  • Fixed per-task Stop from the Remote Control tasks panel doing nothing on CLI-hosted sessions
  • Fixed remote sessions exiting when a client delivered a user message without a valid role
  • Fixed Remote Control sessions started by claude remote-control inheriting session-scoped environment variables from the launching shell
  • Fixed a Remote Control session whose process crashed staying unavailable until claude remote-control was restarted; it can now be reused when you next message it
  • Fixed Remote Control messages sent from the web or Desktop while Claude is mid-turn disappearing from the transcript after the turn finishes
  • Fixed Remote Control model picks made on a phone or web not updating the model shown in the terminal
  • Fixed Remote Control disconnecting with "login expired" when a brief network hiccup delays renewing your sign-in; it now retries and stays connected
  • Fixed Remote Control reporting a failed reconnect on sign-out; signing out now ends the session with a clear message
  • Fixed ListAgents/SendMessage reporting "Remote Control is not connected" in sessions run by claude remote-control (server mode) or Desktop/IDE hosts; they now list and reach Remote Control peers
  • Fixed ListAgents and SendMessage exposing the idle worker that the agent view pre-warms for your next background session; it now appears only once a task claims it
  • Cross-session messaging: sending to a session on this machine that refuses inbound messages (e.g. crossSessionInbound: "refuse") now reports "refused" to the sender instead of a silent success
  • Cross-session messaging: a session whose inbox drops your messages (rate limit or full queue) now tells your session, instead of the messages vanishing silently
  • Improved startup: bare claude starts sooner on macOS
  • Improved Bash tool permission checking for zsh-specific syntax in shell conditionals
  • Improved Remote Control connection resilience: brief HTTP 403 refusals from a network edge, VPN, or proxy are now tolerated for up to 3 minutes, with the refusing party named when a block persists
  • Improved startup responsiveness: the automatic update check now runs about 10 seconds after launch instead of competing with startup for CPU
  • Updated the bundled claude-api skill for the Managed Agents Aug 19 release: web search/fetch domain settings and memory stores on self-hosted sandboxes
  • Changed Ctrl+L and Cmd+K in fullscreen to always just repaint — the double-press /clear shortcut was removed, and 1-row nvim terminals no longer trigger automatic /clear loops
  • Changed claude mcp list and claude mcp get to show disabled servers as ⊘ Disabled instead of connecting to them for a health check
  • MCP headersHelper in a project .mcp.json, and inline MCP servers in project or --add-dir agent files, now require that folder's trust dialog to have been accepted (also under claude -p)
  • MCP headersHelper from a project .mcp.json, plugin, or agent file runs without inherited credential env vars; user, managed and claude.ai-scope helpers now run from the Claude config dir

v2.1.237: v2.1.237

Compare Source

What's changed

  • Fixed prompt caching for sessions using an LLM gateway or custom base URL
  • Added a built-in "Concise" output style: Claude leads with results and skips preamble and narration, while doing the work just as thoroughly. Select it under Output style in /config.

v2.1.236: v2.1.236

Compare Source

What's changed

  • Added ANTHROPIC_DEFAULT_MODEL environment variable: sets the model new sessions start on, while a /model pick still overrides it and persists across restarts (unlike ANTHROPIC_MODEL)
  • Added notify_when_idle to cross-session SendMessage: ask another Claude Code session on this machine to send one notice when it next goes idle — opt-in, one-shot, no polling (macOS and Linux)
  • Sandbox: on macOS, wildcard read-deny rules (e.g. **/.env) now take precedence inside allowed read regions, cover matched directories' contents, and can't be bypassed by renaming the denied file
  • Fixed clipboard copy, background housekeeping, background sessions, and local MCP logs breaking after the directory a session had switched into was removed (since 2.1.229)
  • Fixed the fullscreen renderer failing permanently after a single failed start: it now falls back to the classic renderer instead of exiting on every subsequent launch
  • Fixed the /model picker rendering taller than the terminal: it now shows only as many models as fit the window, with the rest reachable by scrolling
  • Fixed SendMessage calls being rejected when a malformed closing tag left the message text inside the summary field
  • Fixed unhandled promise rejections when a subprocess fails to start, for example powershell.exe on WSL with Windows interop disabled (regression in 2.1.234)
  • Fixed fullscreen mode sometimes not showing a newly sent message until the next update after the terminal was resized
  • Fixed a blank band that could remain above the prompt after clearing a multi-line prompt, and panes not repainting after resizing the terminal away and back, in fullscreen mode
  • Fixed the managed-settings approval prompt sometimes not appearing at startup while still capturing the first keypress as approval
  • Fixed terminal tab titles jumping in tmux (iTerm tmux integration): the title is now written only when its text changes instead of animating every 960ms
  • Fixed an unclear error when the cloud environments list came back empty or malformed
  • Fixed the Fable 5 first-time usage-credits prompt auto-selecting the fallback model after 60 seconds with no answer when using Remote Control
  • Fixed spinner tips never appearing, with a repeated background error, when the cached guest-pass reward in ~/.claude.json was malformed
  • Fixed skills hot-reload in SDK/VS Code sessions raising an error on every skills change after the session's working directory was deleted (2.1.229+)
  • Fixed self-hosted runner sessions released on idle, retire, or startup timeout occasionally resuming on another runner before the post-session hook had finished
  • Fixed the Clawd mascot's eyes and feet rendering unevenly in iTerm2 at some font sizes
  • Fixed occasional runaway session recaps: recap text (automatic and /recap) is now capped at 400 characters, cut at a word boundary
  • Improved startup performance: the session counter is now written in the background
  • Improved auto mode: Monitor allow rules are now set aside while auto mode is active, so Monitor commands are reviewed the same way Bash commands are
  • Improved auto mode on Bedrock, Vertex AI, and Foundry, and when telemetry is disabled: the classifier now uses the same defaults as on the Claude API, including severity-scored classification
  • Improved auto mode: the git status check can no longer be fooled by a repo's status.showUntrackedFiles=no setting into reporting a clean tree
  • Changed the /model picker to highlight only the newest model's name, so the highlight marks the new release rather than an arbitrary subset of the list
  • /goal: an idle session whose goal is parked behind long-running background work now checks in automatically after 30 minutes (then 1h, 2h) instead of waiting for you to return
  • /usage now shows the usage-credits spend row for Team and Enterprise members, and shows a capped row at 0% before anything is spent
  • SIGTERM in print/SDK mode no longer records an interrupted turn or synthetic tool denials before exiting; running commands are still terminated and the process still exits with code 143
  • Pressing Enter on a slash-command typo or a command unavailable in this session now reports it instead of running the closest fuzzy match; prefixes and aliases still run
  • Remote Control now marks a session offline within seconds when the CLI exits or its terminal closes
  • SendMessage now refuses further messages to a session up front once a rapid burst would exceed what that session's inbox accepts, instead of reporting them sent while they were dropped
  • Aligned the session title chip on the prompt border with the footer's right edge
  • Right-aligned footer items (goal indicator, session state, background agent status) and truncated notices now share a consistent right margin with the rest of the prompt area
  • [VSCode] Added screen reader support for the transcript: live announcements for replies, permission requests, errors, and status changes, plus per-turn heading navigation

@scottames-github-bot

Copy link
Copy Markdown
Contributor
backnotprop/plannotator (github:backnotprop/plannotator)

v0.27.6: v0.27.6

Compare Source

Follow @​plannotator on X for updates

Missed recent releases?
Release Highlights
v0.27.5 Annotate your running app, Agent TUI placement, collapsed lockfiles, VS Code theme fix, Pi fixes
v0.27.4 Portable Guided Review exports, guides.show share links, guide CLI, favicon switcher, jj Call Flow
v0.27.3 Folder watcher freeze fix on large repos, first SBOM-attested release pipeline
v0.27.2 Mobile plan and code review, Codex CLI 0.147 fix, folder annotate cold-start, configurable markdown extensions
v0.27.1 Open-in-editor launch fix, file headers respect Viewed/Git-add visibility toggles
v0.27.0 Call Flow analysis, --tailscale remote reviews, review panel remembers your view, Pi rebuild (breaking command rename), focus-mode shortcut
v0.26.8 Placed comment markers on HTML pages, shift-click multi-select, live app annotation
v0.26.7 Pinpoint targets any element on HTML pages, smarter hover labels, zero-scan hit testing
v0.26.6 Fixed empty environment variables in sandboxed sessions (Bun 1.3.14 builds)
v0.26.5 HTML pinpoint element annotations, durable annotate submissions, installer fallback for old git, vim HUD cursor fix
v0.26.4 Skill-menu hover jitter fix (same-day patch on v0.26.3)
v0.26.3 Skill references in comments with / or $, reachable remote session URLs, worktree switcher tooltips

What's New in v0.27.6

You can now annotate your running app. Point plannotator annotate at a localhost URL and the actual application opens inside the annotate UI: click any element to comment on it, press Esc to use the app normally, and send it all back to your agent. This works on Claude Code and Pi. The release also brings configurable Agent TUI placement, collapsed lockfiles in code review, and a wave of fixes across Pi, VS Code, and the annotation surface. Nineteen PRs, three from first-time contributors.

Note: v0.27.6 is v0.27.5 plus same-day Pi support for live app annotation; these notes cover both.

Annotate your running app

plannotator annotate http://localhost:5173 no longer converts the page to a snapshot. A per-session loopback proxy mirrors your dev server and opens the real, running app inside the annotate UI, hot reload and SPA navigation included. Click any element to pin a comment on it, shift-click to join more elements into the same comment, and use placed numbered markers to track everything. --static forces the old conversion; --app forces live mode and fails loudly if the server is not reachable.

The security boundary is deliberate: the proxy binds loopback only, validates the Host header before touching your app, authenticates every message between the page and the editor with a per-session token, and refuses to run at all in remote or tailnet-published sessions (use --static there). Live sessions write no session content to disk beyond your annotation draft, which is keyed per target app.

Pi users get the same feature. The proxy's decision logic (injection, host validation, security gates, redirect handling) lives in one shared core used by both server runtimes, and the Pi extension ships its own Node transport with every security guard test-covered, including working hot reload through the proxied WebSocket. /plannotator-annotate http://localhost:5173 on Pi opens the live app.

One behavior change to know: under PLANNOTATOR_REMOTE, annotating a localhost URL previously converted the page silently. It now exits with a clear message asking for --static, because silently converting when you asked for the live app hides what you are actually reviewing.

This closes the oldest open feature request in the tracker. Thanks @​JulianS-Uni for the original ask in #642, and @​notxcain, who saw this feature early and built the first working take on a preview proxy in #1049 before we landed a from-scratch implementation.

One interaction model for HTML and live pages

HTML and live-app annotate sessions now open with annotation armed: hover outlines what you are pointing at, a click opens the comment composer. Press Esc and you are in interact mode, where clicks, forms, and navigation reach the page itself. The pen button in the header (or Mod+Shift+A) re-arms annotation, text selection comments work in both modes, and the eye button hides every floating control when you just want to read. These surfaces are comment-only now: the markup-delete and label tools were markdown concepts that never fit pages, and removing them made the whole flow simpler. On phones and tablets the same controls live in the Options menu.

This also fixes the class of bug where a JS-driven page could not be used at all during annotation, reported by @​Chrysweel in #1360 for slide decks.

Put the Agent TUI where you want it

The annotate-mode agent terminal can now dock Left or Right, or stay Hidden until you ask for it. The preference persists in ~/.plannotator/config.json, and the terminal's Position control lives in its Display popover with a matching entry in Settings. A bug fix rides along: entering wide mode used to unmount the terminal and kill a running agent session; it now stays alive in the background.

  • #1050 by @​leoreisdias

Lockfiles stop burying your review

Generated files (lockfiles, minified bundles, source maps, and anything marked linguist-generated in .gitattributes) now start collapsed in the all-files review view, the way GitHub treats them. The patch itself is never filtered; a visible notice shows what was collapsed and one click expands any of it.

  • #1346 by @​backnotprop, closing #1317 reported by @​FluxxField

Your VS Code theme choice wins

The VS Code extension used to force the IDE's colors onto the panel, so choosing Plannotator's light theme in a dark IDE gave you a broken mix. Now your chosen theme always wins and only the System setting follows the IDE, with a one-time migration so panels upgraded from older versions follow a light IDE again instead of being stuck on an auto-seeded dark.

Pi fixes

Three fixes for the Pi extension. thinking: "max" in phase config is accepted now (the whitelist predated Pi adding the level) and unrecognized values warn instead of vanishing, closing #1304 reported by @​edision. Hosts that do not expose Pi's project-trust capability get an honest warning instead of being told to update Pi, closing #1353 reported by @​materemias from OMP. And turning plan mode off can no longer leave stale planning instructions steering the session, closing #1320 reported by @​nwhitley-trAIner.

Additional Changes

  • Shift+1-4 switches annotation mode from the keyboard, and the shortcuts yield when you are typing into the comment toolbar. #1244 by @​galmadar
  • The review annotation toolbar stays on screen when the sidebar is closed, clamped exactly to the viewport. #1354 by @​unexge
  • Concurrent settings writes no longer lose changes: config saves take a bounded advisory lock, and two server processes sharing a data dir both land their writes. Part of #1364
  • guides.show touches: two real example guides linked on the landing page, a "Made with Plannotator" link in the viewer header, and a footer credit to diffs.com. #1339, #1340, #1342, #1347
  • Docs caught up with the code: the annotate command page covers live apps, and the config reference documents the new Agent TUI settings. #1361
  • Security scanning: guides.show share links are allowlisted in gitleaks so encrypted share URLs stop tripping secret scanning. #1343

Install / Update

macOS / Linux:

curl -fsSL https://plannotator.ai/install.sh | bash

Windows:

irm https://plannotator.ai/install.ps1 | iex

Claude Code Plugin: Run /plugin in Claude Code, find plannotator, and click "Update now".

Pi: Update @&#8203;plannotator/pi-extension to 0.27.6 and restart Pi.

OpenCode: Clear cache and restart:

rm -rf ~/.bun/install/cache/@&#8203;plannotator

What's Changed

  • guides-show: drop the @​ redirect on the 2x screenshot, credit diffs.com in the footer by @​backnotprop in #1339
  • guides-show: "Made with Plannotator" link in the viewer header by @​backnotprop in #1340
  • guides-show: link two real example guides under the screenshot by @​backnotprop in #1342
  • ci(security): allowlist guides.show share links in gitleaks by @​backnotprop in #1343
  • feat(review): collapse generated files by default in the all-files view by @​backnotprop in #1346
  • guides-show: landing copy fix by @​backnotprop in #1347
  • fix(pi): countermand stale plan-mode instructions on toggle-off by @​backnotprop in #1348
  • feat(ui): Shift+1-4 shortcuts to switch annotation mode by @​galmadar in #1244
  • feat(annotate): live local app annotation through a loopback reverse proxy by @​backnotprop in #1352
  • fix(review): clamp annotation toolbar to viewport by @​unexge in #1354
  • fix(pi): accept Pi's full thinking-level range and warn on unknown values by @​backnotprop in #1356
  • fix(vscode): user-chosen theme wins over IDE theme sync by @​backnotprop in #1357
  • fix(pi): honest capability warning when the host lacks ctx.isProjectTrusted by @​backnotprop in #1355
  • feat(annotate): configurable Agent TUI placement with durable config and Hidden state by @​leoreisdias in #1050
  • docs: align AGENTS.md and public docs with the v0.27.5 behavior by @​backnotprop in #1361
  • fix(vscode): migrate the legacy auto-seeded dark theme cookie to system by @​backnotprop in #1362
  • fix(annotate): armed-mode interaction fixes from the v0.27.5 QA gate by @​backnotprop in #1363
  • fix(server): live-proxy injection and config write hardening by @​backnotprop in #1364
  • feat(pi): live local app annotation through a shared proxy core and Node transport by @​backnotprop in #1366

New Contributors

  • @​leoreisdias made their first contribution in #1050
  • @​galmadar made their first contribution in #1244
  • @​unexge made their first contribution in #1354

Contributors

Three first-time contributors landed code in this release. @​leoreisdias built the Agent TUI placement feature, and it arrived alongside a stack of other PRs from them that are working through review; more of that work lands soon. @​galmadar added the Shift+1-4 annotation mode shortcuts. @​unexge fixed the review toolbar drifting off screen, with before/after recordings that made the review easy.

@​notxcain gets a special mention: their PR #1049 was the first working take on live localhost annotation, months before this release shipped it. We missed the PR at the time, which was our failure, not theirs.

Community reports that shaped this release:

  • @​JulianS-Uni requested website annotation in #642, the oldest request closed by this release
  • @​Chrysweel reported slide decks being unusable during annotation in #1360
  • @​it-sha reported the VS Code light theme bug in #1053
  • @​edision reported the ignored thinking: "max" setting in #1304
  • @​materemias filed the detailed OMP compatibility report in #1353
  • @​FluxxField requested collapsed generated files in #1317
  • @​nwhitley-trAIner reported the plan-mode toggle bug in #1320
  • @​felipebn shared the OpenCode per-agent model config pattern in #1059

Full Changelog: backnotprop/plannotator@v0.27.4...v0.27.6

v0.27.5: v0.27.5

Compare Source

Follow @​plannotator on X for updates

Missed recent releases?
Release Highlights
v0.27.4 Portable Guided Review exports, guides.show share links, guide CLI, favicon switcher, jj Call Flow
v0.27.3 Folder watcher freeze fix on large repos, first SBOM-attested release pipeline
v0.27.2 Mobile plan and code review, Codex CLI 0.147 fix, folder annotate cold-start, configurable markdown extensions
v0.27.1 Open-in-editor launch fix, file headers respect Viewed/Git-add visibility toggles
v0.27.0 Call Flow analysis, --tailscale remote reviews, review panel remembers your view, Pi rebuild (breaking command rename), focus-mode shortcut
v0.26.8 Placed comment markers on HTML pages, shift-click multi-select, live app annotation
v0.26.7 Pinpoint targets any element on HTML pages, smarter hover labels, zero-scan hit testing
v0.26.6 Fixed empty environment variables in sandboxed sessions (Bun 1.3.14 builds)
v0.26.5 HTML pinpoint element annotations, durable annotate submissions, installer fallback for old git, vim HUD cursor fix
v0.26.4 Skill-menu hover jitter fix (same-day patch on v0.26.3)
v0.26.3 Skill references in comments with / or $, reachable remote session URLs, worktree switcher tooltips
v0.26.2 Single-file diff tabs render fully, no more silently dropped review files, light/dark theme pairs, palette-matched code blocks

What's New in v0.27.5

You can now annotate your running app. Point plannotator annotate at a localhost URL and the actual application opens inside the annotate UI: click any element to comment on it, press Esc to use the app normally, and send it all back to your agent. This release also brings configurable Agent TUI placement, collapsed lockfiles in code review, and a wave of fixes across Pi, VS Code, and the annotation surface. Eighteen PRs, three from first-time contributors.

Annotate your running app

plannotator annotate http://localhost:5173 no longer converts the page to a snapshot. A per-session loopback proxy mirrors your dev server and opens the real, running app inside the annotate UI, hot reload and SPA navigation included. Click any element to pin a comment on it, shift-click to join more elements into the same comment, and use placed numbered markers to track everything. --static forces the old conversion; --app forces live mode and fails loudly if the server is not reachable.

The security boundary is deliberate: the proxy binds loopback only, validates the Host header before touching your app, authenticates every message between the page and the editor with a per-session token, and refuses to run at all in remote or tailnet-published sessions (use --static there). Live sessions write no session content to disk beyond your annotation draft, which is keyed per target app.

One behavior change to know: under PLANNOTATOR_REMOTE, annotating a localhost URL previously converted the page silently. It now exits with a clear message asking for --static, because silently converting when you asked for the live app hides what you are actually reviewing.

This closes the oldest open feature request in the tracker. Thanks @​JulianS-Uni for the original ask in #642, and @​notxcain, who saw this feature early and built the first working take on a preview proxy in #1049 before we landed a from-scratch implementation.

One interaction model for HTML and live pages

HTML and live-app annotate sessions now open with annotation armed: hover outlines what you are pointing at, a click opens the comment composer. Press Esc and you are in interact mode, where clicks, forms, and navigation reach the page itself. The pen button in the header (or Mod+Shift+A) re-arms annotation, text selection comments work in both modes, and the eye button hides every floating control when you just want to read. These surfaces are comment-only now: the markup-delete and label tools were markdown concepts that never fit pages, and removing them made the whole flow simpler. On phones and tablets the same controls live in the Options menu.

This also fixes the class of bug where a JS-driven page could not be used at all during annotation, reported by @​Chrysweel in #1360 for slide decks.

Put the Agent TUI where you want it

The annotate-mode agent terminal can now dock Left or Right, or stay Hidden until you ask for it. The preference persists in ~/.plannotator/config.json, and the terminal's Position control lives in its Display popover with a matching entry in Settings. A bug fix rides along: entering wide mode used to unmount the terminal and kill a running agent session; it now stays alive in the background.

  • #1050 by @​leoreisdias

Lockfiles stop burying your review

Generated files (lockfiles, minified bundles, source maps, and anything marked linguist-generated in .gitattributes) now start collapsed in the all-files review view, the way GitHub treats them. The patch itself is never filtered; a visible notice shows what was collapsed and one click expands any of it.

  • #1346 by @​backnotprop, closing #1317 reported by @​FluxxField

Your VS Code theme choice wins

The VS Code extension used to force the IDE's colors onto the panel, so choosing Plannotator's light theme in a dark IDE gave you a broken mix. Now your chosen theme always wins and only the System setting follows the IDE, with a one-time migration so panels upgraded from older versions follow a light IDE again instead of being stuck on an auto-seeded dark.

Pi fixes

Three fixes for the Pi extension. thinking: "max" in phase config is accepted now (the whitelist predated Pi adding the level) and unrecognized values warn instead of vanishing, closing #1304 reported by @​edision. Hosts that do not expose Pi's project-trust capability get an honest warning instead of being told to update Pi, closing #1353 reported by @​materemias from OMP. And turning plan mode off can no longer leave stale planning instructions steering the session, closing #1320 reported by @​nwhitley-trAIner.

Additional Changes

  • Shift+1-4 switches annotation mode from the keyboard, and the shortcuts yield when you are typing into the comment toolbar. #1244 by @​galmadar
  • The review annotation toolbar stays on screen when the sidebar is closed, clamped exactly to the viewport. #1354 by @​unexge
  • Concurrent settings writes no longer lose changes: config saves take a bounded advisory lock, and two server processes sharing a data dir both land their writes. Part of #1364
  • guides.show touches: two real example guides linked on the landing page, a "Made with Plannotator" link in the viewer header, and a footer credit to diffs.com. #1339, #1340, #1342, #1347
  • Docs caught up with the code: the annotate command page covers live apps, and the config reference documents the new Agent TUI settings. #1361
  • Security scanning: guides.show share links are allowlisted in gitleaks so encrypted share URLs stop tripping secret scanning. #1343

Install / Update

macOS / Linux:

curl -fsSL https://plannotator.ai/install.sh | bash

Windows:

irm https://plannotator.ai/install.ps1 | iex

Claude Code Plugin: Run /plugin in Claude Code, find plannotator, and click "Update now".

OpenCode: Clear cache and restart:

rm -rf ~/.bun/install/cache/@&#8203;plannotator

What's Changed

  • guides-show: drop the @​ redirect on the 2x screenshot, credit diffs.com in the footer by @​backnotprop in #1339
  • guides-show: "Made with Plannotator" link in the viewer header by @​backnotprop in #1340
  • guides-show: link two real example guides under the screenshot by @​backnotprop in #1342
  • ci(security): allowlist guides.show share links in gitleaks by @​backnotprop in #1343
  • feat(review): collapse generated files by default in the all-files view by @​backnotprop in #1346
  • guides-show: landing copy fix by @​backnotprop in #1347
  • fix(pi): countermand stale plan-mode instructions on toggle-off by @​backnotprop in #1348
  • feat(ui): Shift+1-4 shortcuts to switch annotation mode by @​galmadar in #1244
  • feat(annotate): live local app annotation through a loopback reverse proxy by @​backnotprop in #1352
  • fix(review): clamp annotation toolbar to viewport by @​unexge in #1354
  • fix(pi): accept Pi's full thinking-level range and warn on unknown values by @​backnotprop in #1356
  • fix(vscode): user-chosen theme wins over IDE theme sync by @​backnotprop in #1357
  • fix(pi): honest capability warning when the host lacks ctx.isProjectTrusted by @​backnotprop in #1355
  • feat(annotate): configurable Agent TUI placement with durable config and Hidden state by @​leoreisdias in #1050
  • docs: align AGENTS.md and public docs with the v0.27.5 behavior by @​backnotprop in #1361
  • fix(vscode): migrate the legacy auto-seeded dark theme cookie to system by @​backnotprop in #1362
  • fix(annotate): armed-mode interaction fixes from the v0.27.5 QA gate by @​backnotprop in #1363
  • fix(server): live-proxy injection and config write hardening by @​backnotprop in #1364

New Contributors

  • @​leoreisdias made their first contribution in #1050
  • @​galmadar made their first contribution in #1244
  • @​unexge made their first contribution in #1354

Contributors

Three first-time contributors landed code in this release. @​leoreisdias built the Agent TUI placement feature, and it arrived alongside a stack of other PRs from them that are working through review; more of that work lands soon. @​galmadar added the Shift+1-4 annotation mode shortcuts. @​unexge fixed the review toolbar drifting off screen, with before/after recordings that made the review easy.

@​notxcain gets a special mention: their PR #1049 was the first working take on live localhost annotation, months before this release shipped it. We missed the PR at the time, which was our failure, not theirs.

Community reports that shaped this release:

  • @​JulianS-Uni requested website annotation in #642, the oldest request closed by this release
  • @​Chrysweel reported slide decks being unusable during annotation in #1360
  • @​it-sha reported the VS Code light theme bug in #1053
  • @​edision reported the ignored thinking: "max" setting in #1304
  • @​materemias filed the detailed OMP compatibility report in #1353
  • @​FluxxField requested collapsed generated files in #1317
  • @​nwhitley-trAIner reported the plan-mode toggle bug in #1320
  • @​felipebn shared the OpenCode per-agent model config pattern in #1059

Full Changelog: backnotprop/plannotator@v0.27.4...v0.27.5

janosmiko/lfk (github:janosmiko/lfk)

v0.18.1: v0.18.1

Compare Source

0.18.1 (2026-08-22)

Bug Fixes

  • cut idle CPU on the cluster dashboard (#669) (b2ef440)
  • let two tests render under t.Parallel without racing (#671) (251b36f)

v0.18.0: v0.18.0

Compare Source

0.18.0 (2026-08-21)

Features

Bug Fixes

  • bound local-cluster List calls and thread reqCtx into kubectl apply (#650) (b54be9f)
  • cancel superseded update listeners in the port-forward and capture managers (#664) (ab1e7b4)
  • close exec PTYs on shutdown and evict dead port-forward entries (#654) (749ae45)
  • harden the log redactor against structured secret shapes (#658) (5aa651e)
  • keep the discovery-error fallback from clobbering a deeper level (#667) (9bd2ba9)
  • log the pod sub-fetch error in the CronJob resource tree (#653) (5938ad7)
  • redact subprocess output before it reaches logs and the status bar (#647) (4b4b29b)
  • sanitize the exec terminal title before rendering (#651) (0fbc0ca)
  • score fuzzy-filtered items on the field that matched them (#668) (5889618)

Performance Improvements

  • cache the per-frame recomputation in the explorer render path (#655) (d60cddd)
  • serve watch-tick refreshes from the informer cache (#659) (de7a51d)
  • skip preview refetch when the hovered object is unchanged (#656) (612da6f)
  • throttle list metrics refresh to a minimum interval (#661) (4abb7a6)

v0.17.5: v0.17.5

Compare Source

0.17.5 (2026-08-19)

Bug Fixes

  • sort relative-time columns by duration (#643) (49013f8)
nolabs-ai/nono (github:nolabs-ai/nono)

v0.74.0: v0.74.0

Compare Source

What's Changed

Full Changelog: nolabs-ai/nono@v0.73.0...v0.74.0

semgrep/semgrep (pipx:semgrep)

v1.174.0: Release v1.174.0

Compare Source

1.174.0 - 2026-08-20

### Added

  • Diff scans now report which dependency source files were added or modified relative to the merge base. (changed-dependency-sources)

### Changed

  • Partial scans (--x-partial-scan-rule-id) now resolve dependencies only for
    subprojects whose ecosystem is evaluated by the rules being run. Subprojects in
    any other ecosystem are skipped and reported to semgrep-app as skipped
    subprojects. (SC-3830)

Skipped Packages

Non-GitHub Sources

GitHub Release Notes Unavailable

  • bun: No GitHub release was found for 1.4.0

  • go: No GitHub release was found for 1.27.0

@renovate
renovate Bot force-pushed the renovate/mise-packages branch from aa7f87a to d53a3d6 Compare August 26, 2026 16:48
@scottames
scottames disabled auto-merge August 26, 2026 17:14
@scottames
scottames merged commit a633909 into main Aug 26, 2026
5 of 6 checks passed
@scottames
scottames deleted the renovate/mise-packages branch August 26, 2026 17:14
scottames pushed a commit that referenced this pull request Aug 26, 2026
🤖 I have created a release *beep* *boop*
---


## [0.51.0](v0.50.0...v0.51.0)
(2026-08-26)


### Updates & Misc Chores

* **deps:** lock file maintenance
([#1023](#1023))
([21aa7bc](21aa7bc))
* **deps:** update ⬆️ agent extensions
([#1008](#1008))
([27fcf84](27fcf84))
* **deps:** update ⬆️ aqua-packages
([#1006](#1006))
([e27736d](e27736d))
* **deps:** update ⬆️ aqua-packages to v4.548.0
([#1012](#1012))
([546615c](546615c))
* **deps:** update ⬆️ aqua-packages to v4.549.0
([#1015](#1015))
([5e1f812](5e1f812))
* **deps:** update ⬆️ aqua-packages to v4.551.0
([#1016](#1016))
([2c61054](2c61054))
* **deps:** update ⬆️ aqua-packages to v4.553.0
([#1027](#1027))
([14e27e8](14e27e8))
* **deps:** update ⬆️ dagger to v0.21.8
([#1007](#1007))
([d1c9857](d1c9857))
* **deps:** update ⬆️ github-actions to v24.19.0
([#1019](#1019))
([f1ec18f](f1ec18f))
* **deps:** update ⬆️ mise-packages
([#1013](#1013))
([9975403](9975403))
* **deps:** update ⬆️ mise-packages
([#1020](#1020))
([ee15b02](ee15b02))
* **deps:** update ⬆️ mise-packages
([#1022](#1022))
([99a86d6](99a86d6))
* **deps:** update ⬆️ mise-packages
([#1025](#1025))
([4b2e66c](4b2e66c))
* **deps:** update ⬆️ mise-packages
([#1028](#1028))
([c8fe436](c8fe436))
* **deps:** update ⬆️ mise-packages
([#1029](#1029))
([a633909](a633909))
* **deps:** update ⬆️ mise-packages (major)
([#1031](#1031))
([24aeb11](24aeb11))
* **deps:** update ⬆️ mise-packages to v1.25.0
([#1026](#1026))
([c9a04c9](c9a04c9))
* **deps:** update ⬆️ mise-packages to v3
([#1021](#1021))
([c6d35ce](c6d35ce))
* **deps:** update ⬆️ mise-packages to v5
([#1014](#1014))
([e98d1ca](e98d1ca))
* **deps:** update dependency gabm/satty to v0.22.0
([#1018](#1018))
([3574d6a](3574d6a))
* **deps:** update dependency ryanoasis/nerd-fonts to v3.5.0
([#1010](#1010))
([d41b747](d41b747))
* **deps:** update dependency ryanoasis/nerd-fonts to v3.5.1
([#1030](#1030))
([09be75d](09be75d))
* **deps:** update github-actions
([#1011](#1011))
([535154f](535154f))
* **lazygit:** update config schema
([688dab9](688dab9))
* **mise/herdr:** bump herdr 0.8.2
([cc02837](cc02837))
* **pi:** bump default model to gpt-5.6-terra
([9a48abb](9a48abb))
* **renovate:** disable lockfile maintenance on pi extensions
([3264d62](3264d62))
* upgrade trunk ([#1017](#1017))
([305ae55](305ae55))
* upgrade trunk ([#1024](#1024))
([4379cef](4379cef))
* **zen-browser:** update keybinds from latest
([5c8dba0](5c8dba0))


### Features

* **herdr:** symbols for ui.status_indicators
([d30493b](d30493b))
* **pi:** migrate statusline to starship
([cf39db5](cf39db5))
* **zennotes:** handle distrobox zennotes bin
([c3eccd5](c3eccd5))


### Bug Fixes

* **mise/claude:** use github over broken aqua registry
([eb54907](eb54907))


### Code Refactoring

* **openpackage:** trim larger skill packages
([734023a](734023a))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: scottames-github-bot[bot] <162828115+scottames-github-bot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant