chore(deps): update ⬆️ mise-packages

[renovate]

This PR contains the following updates:

Package	Update	Change	Pending	Age	Adoption	Passing	Confidence
aqua:BurntSushi/ripgrep	minor	15.1.0 → 15.2.0
aqua:anthropics/claude-code	patch	2.1.207 → 2.1.212	2.1.216 (+2)
aqua:astral-sh/ruff	patch	0.15.21 → 0.15.22
aqua:astral-sh/uv	patch	0.11.28 → 0.11.29	0.11.30
aqua:atuinsh/atuin	patch	18.17.0 → 18.17.1
aqua:dprint/dprint	patch	0.55.1 → 0.55.2
aqua:jesseduffield/lazygit	patch	0.63.0 → 0.63.1
aqua:openai/codex	patch	rust-v0.144.1 → rust-v0.144.5	rust-v0.144.6
aqua:securego/gosec	minor	2.27.1 → 2.28.0
aqua:snyk/cli	patch	1.1306.0 → 1.1306.1
aqua:sst/opencode	minor	1.17.18 → 1.18.3	1.18.4
aqua:tree-sitter/tree-sitter	patch	0.26.10 → 0.26.11
aqua:vercel-labs/agent-browser	minor	0.31.1 → 0.32.1	0.32.3 (+1)
github:agavra/tuicr	patch	v0.19.0 → v0.19.1
github:always-further/nono	minor	v0.67.1 → v0.68.0	v0.69.0
github:aquaproj/aqua	minor	v2.61.0 → v2.62.0
github:janosmiko/lfk	patch	v0.15.6 → v0.15.9	v0.15.12 (+2)
github:max-sixty/worktrunk	minor	v0.67.0 → v0.68.0
github:modem-dev/hunk	patch	v0.17.0 → v0.17.1	v0.17.3 (+1)
npm:markdownlint-cli	patch	0.49.0 → 0.49.1
pipx:mypy (changelog)	minor	2.2.0 → 2.3.0
pipx:semgrep (changelog)	minor	1.169.0 → 1.170.0
rust	patch	1.97.0 → 1.97.1
usage	patch	3.5.4 → 3.5.5

Release notes are maintained in a PR comment by the renovate-release-notes-comment workflow.

---

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

• Branch creation
  • Between 03:00 AM and 05:59 AM (* 3-5 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[scottames-github-bot]

Renovate Release Notes

Generated from Renovate's update table by the renovate-release-notes-comment workflow.

Packages that cannot be summarized from GitHub releases are listed explicitly below.

BurntSushi/ripgrep (aqua:BurntSushi/ripgrep)

15.2.0: 15.2.0

Compare Source

Sponsorship is appreciated!

This release fixes a number of bugs related to gitignore matching as well as
some performance improvements in directory tree traversal.

In case you haven't heard of it before, ripgrep is a line-oriented search
tool that recursively searches the current directory for a regex pattern.
By default, ripgrep will respect gitignore rules and automatically skip
hidden files/directories and binary files.

Platform support:

• aarch64-unknown-linux-musl is now included in the release binaries for
  ripgrep.

Performance improvements:

• PERF #3293:
  Improves directory traversal time on very large corpora.

Feature enhancements:

• FEATURE #3275:
  ripgrep now respects GIT_CONFIG_GLOBAL and GIT_CONFIG_SYSTEM.

Bug fixes:

• BUG #3212:
  Don't check for the existence of .jj when --no-ignore is used.
• BUG #3320,
  BUG #3376,
  BUG #3419:
  Fix gitignore matching bug when searching across multiple directories.

anthropics/claude-code (aqua:anthropics/claude-code)

v2.1.212: v2.1.212

Compare Source

What's changed

• /fork now copies your conversation into a new background session (its own row in claude agents) while you keep working; the in-session subagent it used to launch is now /subtask
• Added claude auto-mode reset to restore the default auto-mode configuration, with a confirmation prompt (pass --yes to skip)
• Added a session-wide limit on WebSearch tool calls (default 200, tunable via CLAUDE_CODE_MAX_WEB_SEARCHES_PER_SESSION) to stop runaway search loops
• Added a per-session cap on subagent spawns (default 200, override with CLAUDE_CODE_MAX_SUBAGENTS_PER_SESSION) to stop runaway delegation loops; /clear resets the budget
• MCP tool calls running longer than 2 minutes now move to the background automatically so the session stays usable; configure the threshold or disable with CLAUDE_CODE_MCP_AUTO_BACKGROUND_MS
• Typing /resume in the agent view now opens a picker of past sessions — including sessions deleted from the list — and resumes your pick as a background session
• Fixed plan mode auto-running file-modifying Bash commands (e.g. touch, rm) without a permission prompt or SDK canUseTool callback
• Fixed worktree creation following a repository-committed symlink at .claude/worktrees, which could create files outside the repository
• Fixed a continue:false hook's halt being dropped when the tool fails or completes mid-stream, and hook infrastructure errors being misreported as user rejections
• Fixed SIGTERM during a running Bash tool orphaning the command's process tree in print/SDK mode; the CLI now aborts the turn, kills the tree, and exits 143
• Fixed /background and claude --bg failing with "EUNKNOWN: unknown error, uv_spawn" on Windows when Group Policy blocks PowerShell 5.1; the daemon now prefers PowerShell 7
• Fixed shell mode (!) not executing commands containing file paths while the path autocomplete popup was open
• Fixed auto-mode denial notifications rendering broken characters when a long denial reason was truncated mid-emoji
• Fixed Ctrl+J not inserting a newline in the agent view dispatch input on terminals with extended key reporting, and surfaced the newline shortcut in the ? help overlay
• Fixed /ultrareview rejecting PR references like #123, PR 123, and pasted PR URLs; error hints now name the command you actually typed
• Fixed /ultrareview <branch> not fetching the branch from origin when it exists remotely; it now suggests the closest branch name on typos
• Fixed /ultrareview skipping the billing confirmation in a new conversation after /clear
• Fixed /ultrareview's "not a git repository" error on Claude Desktop now suggesting the project's repository folder instead of terminal commands
• Fixed hosted (host-managed) sessions failing at startup when repository settings configured mTLS certs, extra CA bundles, or OAuth scopes; these transport settings are now ignored with a warning
• Fixed a spurious "File has not been read yet" error when editing a file that had been read with offset/limit before resuming a session
• Fixed ExitWorktree failing with "no active EnterWorktree session" after resuming a session with --continue/--resume in print/SDK mode
• Fixed the workflow agent grid staying empty for Remote Control clients that join a session mid-run
• Fixed streaming-mode control requests being marked complete before their handler finished, which could lose the request on session restart
• Fixed background sessions created with /fork losing their live-parent protection after a state write failure
• Fixed reopening a stopped background session from the agent view failing silently — it now resumes the session, or shows why it can't and lets you force a restart
• Fixed agent teams: a stopping teammate could send the leader duplicate idle notifications when team initialization re-ran within a session
• Fixed the plan-approval dialog footer splitting "ctrl+g to edit in " apart when the file path is long
• Fixed the welcome banner keeping its old panel widths after a combined width+height terminal resize in fullscreen mode
• Fixed diff previews losing their line numbers and +/- markers in narrow layouts
• Fixed @​-mentions attaching nothing after a partial file read, plugin uninstall targeting the wrong marketplace, and false "Command timed out" on exit code 143
• Fixed OpenTelemetry HTTP exports being rejected with 411/400 by Azure Monitor and other endpoints that don't accept chunked transfer encoding
• Fixed OTLP event log records missing trace_id/span_id when TRACEPARENT is set in SDK/headless mode
• Fixed conversations with many images incorrectly failing with "Request too large" errors, and improved the error message to explain the actual cause
• Fixed web search and web fetch returning "API Error" text as search results or page content when the API was overloaded
• Improved web search and web fetch reliability by retrying 529 errors and rate-limited requests with bounded backoff
• Improved prompt caching: the mid-conversation system block now works behind LLM gateways and custom base URLs (Bedrock, Vertex, 1P)
• Improved background agent attach: cold-attaching now instantly shows the formatted transcript while the session boots, instead of a blank wait
• Reduced token usage in inter-agent messaging: SendMessage bodies are no longer duplicated into replayed history and tool results
• Changed /fork to name the copy after your prompt when the session has no title, so the row is recognizable in the agent view
• Changed bare /btw to reopen the side-question panel on your most recent exchange so you can browse earlier answers
• Changed the ← footer hint to pulse N done for a moment when a background agent finishes while nothing needs your input
• Deprecated the Task tool's mode parameter (now ignored); subagents inherit the parent session's permission mode by default
• Changed Enterprise forceLoginMethod to be enforced for VS Code extension, SDK, setup-token, and install-github-app logins, not just the terminal
• Changed session transcripts to record the reasoning effort level on each assistant message
• Changed headless/SDK sessions to apply a set_model control request mid-turn; the next model round-trip uses the new model instead of waiting for the next turn
• Changed agent view / claude agents --json: sessions waiting on a sandbox, MCP-input, or managed-settings prompt now show as "Needs input" instead of "Working"
• Updated the auth status panel title from "Cloud authentication" to "Authentication"
• Corrected an earlier release note (2.1.200): tmux through the 3.6 series lacks synchronized output; newer tmux with support is detected automatically

v2.1.211: v2.1.211

Compare Source

What's changed

• Added --forward-subagent-text flag and CLAUDE_CODE_FORWARD_SUBAGENT_TEXT environment variable to include subagent text and thinking in stream-json output
• Fixed permission previews relayed to chat channels not neutralizing bidirectional-override, zero-width, and look-alike quote characters, so tool inputs cannot visually alter the approval message
• Fixed auto mode overriding a PreToolUse hook's ask decision for unsandboxed Bash — a hook ask now floors the decision at a prompt
• Fixed parallel Claude Code sessions all logging out simultaneously after wake-from-sleep when many sessions share one credential store
• Fixed plugin MCP servers not reconnecting after an idle web session woke, leaving MCP calls failing until the next message
• Fixed Claude Code on Vertex and Bedrock attempting the default Opus model at startup and printing a spurious fallback notice when a model is explicitly configured
• Fixed subagents spawned with an explicit model override reverting to the parent's model when resumed or sent a follow-up message
• Fixed nested .claude/rules/*.md files loading even when setting sources exclude project settings
• Fixed file upload validation: filenames ending in a DOS device suffix (.prn) or trailing dot are now accepted, and files with multiple hard links are refused
• Fixed file uploads to Claude in Chrome from remote and CLI sessions
• Fixed edits that leave the input as "?" being silently swallowed and toggling the shortcuts panel
• Fixed a startup hang when the Claude in Chrome extension is enabled but Chrome is not running
• Fixed a 300ms delay revealing async content (Settings tabs, Stats, diff views, and other loading states)
• Fixed reopening a just-stopped background session from the agents view starting a blank conversation under the same session id
• Fixed /loop hiding the session from /resume after a single use
• Fixed screen reader users losing the audible terminal bell after /terminal-setup or onboarding terminal setup
• Fixed background jobs on LLM gateway auth (ANTHROPIC_AUTH_TOKEN + ANTHROPIC_BASE_URL) coming back "Not logged in" after the daemon respawns them
• Fixed claude agents jobs becoming permanently undeletable when git no longer recognizes their worktree — the row now shows why the delete was refused instead of silently reappearing
• Fixed /clear not resetting the session cost counter — the statusline's cost now starts at $0 after /clear
• Fixed Claude in Chrome setup pages failing to open in the browser on Windows
• Fixed headless print-mode sessions on Windows crashing or silently exiting when stdin is unreadable
• Fixed background session titles in the agents view showing the naming model's refusal text when the prompt contains a link
• Fixed background agents killed by the user auto-respawning, and revived agents re-running stale prompts from old sessions
• Fixed routines with no schedule reporting a next run time in the year 1
• Hardened synced skill/plugin directory naming on Windows and kept CCR web fetch/search proxies working after /clear
• Improved terminal layout and rendering performance
• Improved background agent result reporting — Claude now reports the status of still-running agents and waits for the real completion instead of fabricating results
• Improved the memory index over-limit warning to measure only loaded content, excluding frontmatter and HTML comments
• Updated integer environment variables (timeouts, token budgets, retry counts) to accept scientific notation and digit-separator spellings like 1e6 and 64_000
• Updated documentation links to the current docs sites
• Changed "always allow" permission rules to save at the repository root, so approvals granted in a git worktree persist across sessions and worktrees
• Changed /usage-credits to ask for confirmation before sending a request to organization admins
• Changed Vim mode s and S (substitute char/line) to work in NORMAL mode, matching vim behavior
• [VSCode] Updated the Remote Control banner to describe what it does
• Claude in Chrome: hardened file-upload path validation
• Claude in Chrome: save_to_disk on screenshot actions now writes the image to disk and returns the path; previously it did nothing
• Fixed a prompt-caching regression on Bedrock, Vertex, Mantle, and Foundry that billed the trailing system context block as fresh input tokens on every request.

v2.1.210: v2.1.210

Compare Source

What's changed

• Added a live elapsed-time counter to the collapsed tool summary line so long-running tool calls visibly tick instead of looking stuck
• Added a startup warning for Write(path), NotebookEdit(path), and Glob(path) permission rules — use Edit(path) or Read(path) instead
• Fixed isolation: 'worktree' subagents being able to run git-mutating commands against the main repo checkout instead of their own isolated worktree
• Fixed the ultracode keyword opt-in firing on non-human-originated input such as webhook payloads and relayed PR comments
• Fixed a rendered text fragment leaking into crash telemetry when a UI component returned content outside a styled text element
• Fixed paste markers leaking into external editors opened from Claude Code, which could appear as stray È/É characters around pasted text
• Fixed claude attach sometimes failing with "job not found" or "agent is still starting" errors during session transitions — attach now waits for the daemon to settle, and terminal resizes during a slow attach are applied once it completes
• Fixed a session crash when a tool's result renderer returned a numeric bigint value or plain text instead of a UI element
• Fixed a hook callback timeout being misreported to the model as a user rejection, which made unattended sessions stop and wait
• Fixed Claude assuming a cd took effect after its command was moved to the background; the tool result now states the working directory is unchanged
• Fixed plugin-provided MCP servers being torn down when MCP servers are re-synced mid-session
• Fixed plan approvals without edits being labeled "(edited by user)" and overwriting the plan file with a stale snapshot
• Fixed /doctor skipping its auto-mode-default proposal on Bedrock, Vertex, and Foundry, where auto mode no longer needs an opt-in
• Fixed Grep content mode claiming "No matches found" when paginating past the end of results
• Fixed unmatched $1/$2 positional placeholders in skills and commands being silently stripped; they are now preserved verbatim
• Fixed plugin cache writes leaving temp files behind on failure and failing on locked-file renames on Windows and network filesystems
• Fixed background workers crash-looping when a client resets its connection to the background service
• Fixed claude agents --effort ultracode not reaching dispatched sessions; the value was silently dropped
• Fixed pressing ← to open the agents view dropping the task tracker when returning to the session
• Fixed the agents dashboard retaining pasted images from abandoned reply drafts after their session was deleted
• Fixed killed background sessions leaving a permanent git worktree lock behind; the periodic sweep now releases locks whose owning process is gone
• Fixed SDK MCP servers registered via an initialize control request waiting until the next turn to start connecting
• Fixed returning to the agents view from a session leaving overlapping ghost frames with CLAUDE_CODE_DISABLE_ALTERNATE_SCREEN=1
• Fixed late-appearing .claude/* symlinks not being reconciled into the sandbox deny-write list
• Hardened the Agent tool against indirect prompt injection via content a subagent read
• Improved the Bash/PowerShell tool message when a command hits its timeout and is auto-backgrounded, so the model can distinguish a hang from an explicit background request
• Improved auto mode: the permission classifier now defaults to Sonnet 5 for external sessions, validated on the session's first request and pinned for the session
• Improved the bundled dataviz skill's chart color validation with perceptual OKLab color difference and recalibrated color-blindness thresholds
• Memory writes that leave a MEMORY.md index over its read limit now produce an explicit error instead of silent truncation
• Screen reader mode now announces permission mode changes aloud when cycling modes with Shift+Tab
• The agents footer hint now shows how many background agents are waiting on your input, with a brief color emphasis when the count changes
• Agent view: the session you pressed ← from stays visibly marked even after mouse hover or arrow keys move the selection
• Fable temporarily shows as unavailable in the advisor picker while a server-side issue causing Fable advisor failures is fixed

v2.1.209: v2.1.209

Compare Source

What's changed

• Fixed /model and other dialogs being blocked in claude agents background sessions (reverts an overly broad guard)

v2.1.208: v2.1.208

Compare Source

What's changed

• Added screen reader mode: opt-in plain-text rendering for screen reader users. Run claude --ax-screen-reader, set CLAUDE_AX_SCREEN_READER=1, or add "axScreenReader": true to settings.
• Added vimInsertModeRemaps setting: map two-key insert-mode sequences like jj to Escape in vim mode
• Added CLAUDE_CODE_PROCESS_WRAPPER: agent view and the background service now honor a corporate launcher by running every Claude Code self-spawn through a required wrapper executable
• Added mouse-click support for multi-select menus and "Other" input rows in fullscreen mode
• Fixed fast mode staying off after switching back to a model that supports it — it now restores automatically when enabled in settings
• Fixed replies typed to a background agent being lost when delivery fails — the text is now saved and delivered when the session restarts
• Fixed background-session attach failing permanently ("Couldn't start the background daemon") after an update replaced the binary a running claude agents process was launched from
• Fixed the context window (and auto-compact indicator) briefly resetting to 200k after the CLI auto-updates, causing a false "100% context used" when resuming long-context sessions
• Fixed supervised and background sessions crashing when a server closed an HTTP/2 connection with a GOAWAY while requests were in flight
• Fixed truncated stream-json/JSON output and missing result message when piping large responses from claude -p
• Fixed CLAUDE_CODE_MAX_OUTPUT_TOKENS and similar env vars silently using the mantissa of scientific-notation values (1e6 became 1)
• Fixed very large markdown tables stalling rendering or using excessive memory; tables over 200 rows show the first 200 with a "… N more rows" notice
• Fixed the Edit tool failing on files modified after reading when the target text still matches uniquely
• Fixed Read reporting empty files as "shorter than offset", Grep silently returning "No files found" for invalid regex patterns, Grep count mode under-reporting totals when paginated, and Glob crashing with an unclear error when the pattern, path, or working directory contained a null byte
• Fixed apiKeyHelper script failures being hidden behind a generic 401 after ~10 silent retries; the script's own error is now shown within 3 attempts
• Fixed Bedrock streaming requests failing with a misleading "Truncated event message received" when a gateway transforms the response — the error now names the content-type and points at the proxy
• Fixed /upgrade showing a login flow instead of the upgrade URL when the browser fails to open
• Fixed stream-json input killing the session on blank CRLF or whitespace-only lines from Windows-style SDK hosts
• Fixed headless stream-json sessions hanging permanently when a control_request carried a non-string set_model payload; the CLI now answers with an error response
• Fixed repeated "No completion record was found" notices on session resume — orphaned background tasks now collapse into a single summary
• Fixed Remote Control clients attaching to a terminal-hosted session not seeing background agents and workflow progress until a task started or stopped
• Fixed the Agent tool launching with no tools when a subagent's tools list resolves to nothing — it now returns a clear error naming the unrecognized entries
• Fixed /usage showing stale cached bars over fresher data, and /mcp not reclassifying placeholder servers after config edits
• Fixed "Change directory" in SDK hosts (e.g. Claude Desktop) failing with "A turn is in progress" on idle sessions that have a running background task
• Fixed the workflow save dialog showing ~/.claude/workflows/ instead of the CLAUDE_CONFIG_DIR location for user-scope saves
• Fixed /release-notes adding the viewed notes to the model's context — "Show all" previously injected the entire changelog into every subsequent request
• Fixed a memory leak in the agent view where pasted images were retained for the screen's lifetime after sending peek replies
• Fixed SDK sessions losing agents defined via the initialize request when a plugin refresh ran before the client attached
• Fixed several memory leaks in long sessions: MCP stdio server stderr accumulating up to 64 MB per server, LSP documents staying open indefinitely (now LRU with 50-doc cap), async hook output retained after backgrounding, and unbounded growth in headless/SDK sessions from large tool-result payloads
• Fixed a memory blowup when reading files with extremely long single lines using offset/limit — the read now returns a clean error instead of loading the whole line
• Fixed multi-second per-turn slowdowns in sessions with many permission deny/ask rules — rule matchers are now compiled once and cached
• Improved input responsiveness while agent task lists update — task updates no longer re-render the entire UI
• Reduced per-tool-call CPU overhead in print/SDK sessions with many MCP tools by caching tool-pool assembly (up to 7x faster tool rounds at high tool counts)
• Reduced memory usage by bounding the file edit read cache to 16 MB instead of pinning up to 1,000 full files
• Reduced session transcript size (up to 79x in edit-heavy sessions) and bounded checkpoint disk usage by pruning superseded file-history backups
• Reduced memory usage when resuming sessions with background agents or forks spawned from large conversations
• Completed background agents now stay listed in /tasks until cleanup instead of vanishing the moment they finish
• Attaching to a stopped background agent now shows its transcript immediately while the session warms up, instead of a blank "Session is starting" screen
• Background sessions: an older daemon no longer silently restarts workers spawned by a newer version onto the older binary
• Agent view: Ctrl+X now deletes renamed-branch worktrees, never destroys unpushed commits, keeps the session row when a worktree is kept, and reused worktree names reset to the current base
• Catastrophic removals (e.g. rm -rf ~) in commands containing $(…)/backticks/<(…) now prompt in --dangerously-skip-permissions and auto mode, matching the plain form
• /install-github-app and the /mcp settings menu no longer open in background sessions
• MCP servers configured with an empty URL now show as "not configured" in /mcp instead of a config error
• /usage now shows your last-known usage bars with an "as of" note when the usage endpoint is rate-limited, instead of an error screen
• Fixed Bedrock auth failing with "Session token not found or invalid" for AWS SSO profiles whose sso_region differs from the Bedrock region (2.1.207 regression)

astral-sh/ruff (aqua:astral-sh/ruff)

0.15.22: 0.15.22

Compare Source

Release Notes

Released on 2026-07-16.

Preview features

• [pycodestyle] Add an autofix for E402 (#22212)
• [refurb] Allow subclassing builtins in stub files (FURB189) (#26812)
• [ruff] Add rule to replace noqa comments with ruff:ignore (RUF105) (#26423)
• [ruff] Add rule to use human-readable names in ruff:ignore comments (RUF106) (#26682)
• [ruff] Add rule to use human-readable names in configuration selectors (RUF201) (#26772)

Bug fixes

• [flake8-pyi] Fix false positive in __all__ (PYI053) (#26872)

Rule changes

• [pylint] Ignore mutable type updates in redefined-loop-name (PLW2901) (#25733)

Performance

• Avoid redundant lexer token bookkeeping (#26765)
• Avoid redundant pending-indentation writes (#26774)
• Avoid unnecessary identifier lookahead (#26525)
• Reuse parser scratch buffers (#26798)

Documentation

• Document argfile support (#26803)
• [flake8-datetimez] Clarify naming guidance for datetime.today (DTZ002) (#26658)
• [pycodestyle] Document E731 fix safety (#26847)
• [ruff] Clarify intentional async contexts for unused-async (RUF029) (#26641)

Contributors

• @​dwego
• @​MichaReiser
• @​Joosboy
• @​KaufmanDmitriy
• @​PeterJCLaw
• @​ntBre
• @​charliermarsh

Install ruff 0.15.22

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.15.22/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.15.22/ruff-installer.ps1 | iex"

Download ruff 0.15.22

File	Platform	Checksum
ruff-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
ruff-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
ruff-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
ruff-i686-pc-windows-msvc.zip	x86 Windows	checksum
ruff-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
ruff-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
ruff-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum
ruff-powerpc64-unknown-linux-gnu.tar.gz	PPC64 Linux	checksum
ruff-powerpc64le-unknown-linux-gnu.tar.gz	PPC64LE Linux	checksum
ruff-riscv64gc-unknown-linux-gnu.tar.gz	RISCV Linux	checksum
ruff-s390x-unknown-linux-gnu.tar.gz	S390x Linux	checksum
ruff-x86_64-unknown-linux-gnu.tar.gz	x64 Linux	checksum
ruff-armv7-unknown-linux-gnueabihf.tar.gz	ARMv7 Linux	checksum
ruff-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
ruff-i686-unknown-linux-musl.tar.gz	x86 MUSL Linux	checksum
ruff-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum
ruff-arm-unknown-linux-musleabihf.tar.gz	ARMv6 MUSL Linux (Hardfloat)	checksum
ruff-armv7-unknown-linux-musleabihf.tar.gz	ARMv7 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/ruff

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

astral-sh/uv (aqua:astral-sh/uv)

0.11.29: 0.11.29

Compare Source

Release Notes

Released on 2026-07-15.

Python

• Use gzip-compressed artifacts for PyPy downloads (#20265)

Enhancements

• Add JSON output to uv tree (#19978)
• Add CUDA 13.2 as a supported PyTorch backend (#20267)
• Prefer local artifacts over URLs when installing from pylock.toml (#20393)
• Clarify diagnostics for unsatisfiable direct requirement ranges (#20227)
• Include the selected project name in missing-extra errors (#20358)

Preview features

• Preserve extras and dependency-group conflict context when selecting locked project tools (#20078)
• Split OSV audit queries that exceed the service's 1,000-package limit (#20398)
• Apply OSV fixed-version information only to the matching package and ecosystem (#20399)
• Skip the virtualenv distutils monkeypatch on Python 3.10 and later (#20222)
• Report invalid uv audit --service-url values instead of panicking (#20374)
• Include preview settings in the published SchemaStore schema (#20304)

Performance

• Reduce resolver work by widening selected versions across ranges without other known candidates (#20115)
• Defer client and build setup for no-op uv sync operations (#20364)
• Reuse workspace discovery during frozen syncs (#20363)
• Reuse workspace discovery after resolving settings (#20356)
• Reuse workspace discovery in uv tree, uv export, uv format, and uv audit (#20359)
• Avoid cache and interpreter setup when reading a project version (#20360)

Bug fixes

• Reject duplicate active package entries in pylock.toml (#20391)
• Preserve direct-archive hashes in uv pip freeze output (#20395)
• Explain conflicting root requirements instead of displaying an empty version range (#20228)
• Prevent build-backend data paths from escaping the project or bypassing wheel exclusions (#20397)
• Reject PEP 517 backend paths outside the source tree, including paths that escape through symlinks (#20387)
• Redact credentials from failed Git fetch commands (#20401)
• Fix exclusive post-release range ordering to match PEP 440 (#20268)
• Canonicalize equivalent PEP 440 ranges during dependency resolution (#20182)
• Honor Python version pins when initializing scripts (#20404)
• Respect package-scoped source filtering for scripts (#20389)
• Report existing environment incompatibilities when uv pip install --strict has nothing to install (#20388)
• Continue scanning platlib when purelib is missing (#20405)
• Handle versionless .egg-info files as legacy package metadata (#20403)
• Make repeated locking idempotent for impossible cross-variable platform markers (#20369)
• Report invalid cloud credential endpoint URLs instead of panicking (#20372)
• Report invalid pylock.toml artifact URLs instead of panicking (#20373)
• Report non-UTF-8 virtual environment paths instead of panicking while generating activation scripts (#20375)
• Return an unsupported-operation error from unimplemented build-backend requirement hooks (#20376)

Documentation

• Clarify --no-build behavior for editable requirements (#20234)
• Document uv's threat model (#20236)
• Reduce the number of badges in the README (#11257)

Install uv 0.11.29

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.29/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.29/uv-installer.ps1 | iex"

Download uv 0.11.29

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
uv-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
uv-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz	PPC64LE Linux	checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz	RISCV Linux	checksum
uv-s390x-unknown-linux-gnu.tar.gz	S390x Linux	checksum
uv-x86_64-unknown-linux-gnu.tar.gz	x64 Linux	checksum
uv-armv7-unknown-linux-gnueabihf.tar.gz	ARMv7 Linux	checksum
uv-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
uv-i686-unknown-linux-musl.tar.gz	x86 MUSL Linux	checksum
uv-riscv64gc-unknown-linux-musl.tar.gz	RISCV MUSL Linux	checksum
uv-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum
uv-arm-unknown-linux-musleabihf.tar.gz	ARMv6 MUSL Linux (Hardfloat)	checksum
uv-armv7-unknown-linux-musleabihf.tar.gz	ARMv7 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

atuinsh/atuin (aqua:atuinsh/atuin)

v18.17.1: 18.17.1

Compare Source

Release Notes

Bug Fixes

• (ai) Default to non-Hub mode for custom AI endpoints (#3620)
• (import) Fix order of entries imported from zsh history (#3597)
• (import) Fix import order of nushell history entries (#3598)
• Various prefix mode bugs (#3616)

Documentation

• Document output capture and mcp (#3595)

Features

• (tui) Truncate long commands from middle to show start...end (#3602)

Miscellaneous Tasks

• (logging) Remove the log crate in favor of tracing (#3608)
• Update to rust 1.97 (#3617)

atuin 18.17.1

Install atuin 18.17.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/atuinsh/atuin/releases/download/v18.17.1/atuin-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/atuinsh/atuin/releases/download/v18.17.1/atuin-installer.ps1 | iex"

Download atuin 18.17.1

File	Platform	Checksum
atuin-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
atuin-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
atuin-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
atuin-x86_64-unknown-linux-gnu.tar.gz	x64 Linux	checksum
atuin-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
atuin-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo atuinsh/atuin

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

atuin-server 18.17.1

Install atuin-server 18.17.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/atuinsh/atuin/releases/download/v18.17.1/atuin-server-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/atuinsh/atuin/releases/download/v18.17.1/atuin-server-installer.ps1 | iex"

Download atuin-server 18.17.1

File	Platform	Checksum
atuin-server-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
atuin-server-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
atuin-server-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
atuin-server-x86_64-unknown-linux-gnu.tar.gz	x64 Linux	checksum
atuin-server-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
atuin-server-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo atuinsh/atuin

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

dprint/dprint (aqua:dprint/dprint)

0.55.2: 0.55.2

Compare Source

Changes

• fix: build linux gnu binaries against glibc 2.17 (fix: build linux gnu binaries against glibc 2.17 dprint/dprint#1203)

Install

Run dprint upgrade or see https://dprint.dev/install/

Checksums

Artifact	SHA-256 Checksum
dprint-x86_64-apple-darwin.zip	b7074cf6c814f995b783b5baa7e516b34e783c42c9baf7af553dbad731adb3a7
dprint-aarch64-apple-darwin.zip	e9ba8ed7988f3350501a8cf8af92da616cdec8d9d5c831c069293c587311b49d
dprint-x86_64-pc-windows-msvc.zip	12e8c26abc8c436223e70f5a30a2864001c92fa356a859eb93e06b97ab7dbd12
dprint-x86_64-pc-windows-msvc-installer.exe	60ecca3c071224d3097570dc07148457e86b97a85aba868cd0714377208825cd
dprint-aarch64-pc-windows-msvc.zip	65846975b2a8f4e36982ddff875147157c2c9b04c6eb17134d6655ed51e3a931
dprint-x86_64-unknown-linux-gnu.zip	d7ccde62d789dfb048717252d259e21253e32feffe4cbf2dab9954eeab492219
dprint-x86_64-unknown-linux-musl.zip	45fc0eef3216af21c4c22c6e7e233aa45c3080fac07b6e94db7008a5c8e5c67a
dprint-aarch64-unknown-linux-gnu.zip	299923f2b56d66756ad2c7c220650c72f26437fd3f48b3fb6c0df664073eb1d1
dprint-aarch64-unknown-linux-musl.zip	f0101217dd0abc94f1ac01b83d306d0288aeee8a501e8614a5e2bbe037500be0
dprint-riscv64gc-unknown-linux-gnu.zip	ed70faf3ecfbb67786470c62fd3eee44172451fa91166f660c7a52a9d9c36979
dprint-loongarch64-unknown-linux-gnu.zip	9dccf17fd3d79885ece6b3442639cb62cc1ac3852d9a30467fb2f18b4c0997f4
dprint-loongarch64-unknown-linux-musl.zip	11eb0a855e862bc27c002b863125e96fa794b8d149f919759639fd76d6f31032
dprint-powerpc64le-unknown-linux-gnu.zip	bb7b367b0ad41b413d4b0828cf96d5344e0686e14ab3bb1705a0705b340dd3ec
dprint-powerpc64le-unknown-linux-musl.zip	7973e0203bd5ca23fa50b75c45c61284080500fa50ec45b7ba422bd0f1dad0ed
dprint-aarch64-linux-android.zip	879a8de2c7e2b17dfd36fff855807803793fefdf8da9b1f69bc07c0a31f94ca3
dprint-x86_64-linux-android.zip	986c5f1926d9a1ae5049ac87c03f0d4cd7fdb823840d47af4fc6080725f3db32

jesseduffield/lazygit (aqua:jesseduffield/lazygit)

v0.63.1: v0.63.1

Compare Source

Fixes for a few regressions introduced in the v0.63.0 release.

What's Changed

Fixes 🔧

• Improve index.lock retry mechanism by @​stefanhaller in Improve index.lock retry mechanism jesseduffield/lazygit#5788
• Fix userEvents panic by @​stefanhaller in Fix userEvents panic jesseduffield/lazygit#5793
• Fix a deadlock on Windows when switching between longer diffs by @​stefanhaller in Fix a deadlock on Windows when switching between longer diffs jesseduffield/lazygit#5815

Maintenance ⚙️

• Allow releasing from a branch other than master by @​stefanhaller in Allow releasing from a branch other than master jesseduffield/lazygit#5819

Full Changelog: jesseduffield/lazygit@v0.63.0...v0.63.1

openai/codex (aqua:openai/codex)

rust-v0.144.5: 0.144.5

Compare Source

Bug Fixes

• Improved dangerous-command detection, including more forced rm forms, and provides clearer rejection reasons when commands are denied. (#33455)

Changelog

Full Changelog: openai/codex@rust-v0.144.4...rust-v0.144.5

• #33455 [release/0.144] fix(core) expand is_dangerous_command @​dylan-hurd-oai

securego/gosec (aqua:securego/gosec)

v2.28.0: v2.28.0

Compare Source

Changelog

• 9e75c0576c9878035d4221392108d458abe10fc3 feat(G101): detect AWS temporary access keys (#1702)
• 14f493ab92f212e1f3d69aeaa561989e5baf9d6f Update to go version 1.26.5 and 1.25.12 (#1704)
• ffd5ba1d3354928fae89ac31912bd1d730798799 Update all dependencies (#1703)
• 849570622f56a251c015c0e2417aebafc0216e17 Update all dependencies (#1699)
• 11023e51e1f46c4ea63315bdb7670f073442168f Update all dependencies (#1698)
• f88a0781159d73052ba792962e624749904783d6 fix: min+max G115 false positives (#1697)
• 6a008f60b8f7f3d7fae8f126984a9df5d4b7e0cf Update all dependencies (#1696)
• caf8857bbd3276599d0176b0528e9712bb0b5bec fix(G404): flag missing math/rand weak-random functions (#1694)
• cbef395cb1e2e3a35f6223f5b97f1657f7144797 Update all dependencies (#1695)
• f1c81de5fcdf7b466b229fb24ca02d1a8406dd09 Update all dependencies (#1693)
• 9addc97cefc9460a114e3c36f536b935da3b98c9 Update to go version 1.26.4 and 1.25.11 (#1690)
• 92ed8df32846e85d4e81b0b62012567afddfdc95 Update the gosec in the Github action to v2.27.1 (#1688)

snyk/cli (aqua:snyk/cli)

v1.1306.1: v1.1306.1

Compare Source

1.1306.1 (2026-07-16)

The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their
needs. For details please see this documentation

Bug Fixes

• deps: Updates dependencies to fix vulnerabilities:
  • CVE-2026-41907 (6775c1e)
  • CVE-2026-13149,
    CVE-2026-59869 (7673263)
  • CVE-2026-59873,
    CVE-2026-39244 (9bf7ce7)

[scottames-github-bot]

sst/opencode (aqua:sst/opencode)

v1.18.3: v1.18.3

Compare Source

Core

Improvements

• Added an Up Arrow shortcut to close the subagent picker when the first item is selected.

Desktop

Bugfixes

• Fixed home page scrolling so sticky headers and the session list behave correctly.
• Fixed startup readiness so WSL server loading is included before the desktop app reports ready.
• Removed the inactive help button from the app layout.
• Fixed custom agent selector visibility when custom agents are available.

Improvements

• Home page command palette search can now find and open sessions.

v1.18.2: v1.18.2

Compare Source

Core

Bugfixes

• Stopped subagents from launching nested subagents by default, with a configurable subagent_depth limit when needed.
• Improved default reasoning depth for Meta models.

Desktop

Improvements

• Added Mod+N as another shortcut for opening a new tab.

Bugfixes

• Restored the Help button in release builds.
• Kept sessions with null archive times visible instead of dropping them from the home list.
• Hid the drawer close button on Windows where it conflicts with the window chrome.

Thank you to 1 community contributor:

• @​BB-84C:
  • fix(core): tolerate AlreadyExists in FSUtil.ensureDir (#36542)

v1.18.1: v1.18.1

Compare Source

Desktop

Bugfixes

• Fixed spacing between model provider sections in Settings.

v1.18.0: v1.18.0

Compare Source

Desktop

Improvements

• Completed the Desktop v2 migration, including upgrade handling for the new layout and first-launch onboarding.
• Added a setting to switch between the new and old Desktop layouts during the transition period.

Bugfixes

• Fixed file views using the wrong background in the v2 layout.
• Fixed connected project picker positioning when its anchor is still loading.
• Kept permission auto-accept state separate for each server.
• Fixed a project picker positioning crash.
• Kept terminal tab rename focused while editing.
• Enabled remote sessions to auto-accept permissions correctly.
• Fixed terminal tabs stealing focus when they mount.
• Loaded more timeline history at once to reduce repeated backfill while scrolling.
• Resynced the timeline correctly after reconnecting.
• Preserved the composer caret after request updates.
• Reduced Home cold-load time substantially.
• Preserved timeline bottom anchoring more reliably.
• Clarified status indicator severity.

v1.17.20: v1.17.20

Compare Source

Core

Bugfixes

• Removed an obsolete Codex workaround that could interfere with OpenAI Luna Responses Lite requests.

Improvements

• Updated Azure AI support for GPT-5.6.

v1.17.19: v1.17.19

Compare Source

Core

Bugfixes

• Supported OpenAI pro reasoning mode.
• Disabled response storage by default for xAI Responses. (@​geraint0923)
• Added OAuth support for Luna Responses Lite.
• Switched to another available org after logging out in the console.
• Used Codex context limits for GPT-5.6 over OAuth. (@​nabilfreeman)

TUI

Bugfixes

• Forwarded CLI environment variables to the TUI worker.

Desktop

Bugfixes

• Removed interface transition changes that were accidentally shipped to dev.
• Fixed clipped labels and branch tooltips.
• Stopped the review panel width from jumping when opening or closing it.
• Focused the prompt input when starting a new session.
• Prevented some new-session updates from blocking the UI.
• Fixed timeline outlines getting clipped.
• Aligned context token counts with usage totals.
• Kept the file tree visible while opening files.

Improvements

• Redesigned attachment cards and file comment chips in the new interface.
• Updated the review panel with persistent file browsing, better file tabs, and easier open-in-app actions.
• Restyled the Edit Project modal to match the new interface.
• Added middle-click to open sessions in a new tab.
• Added a temporary setting to switch between the old and new interface.
• Added per-prompt model selection in the composer.
• Polished the new interface styling across the session view and terminal.

Thank you to 2 community contributors:

• @​nabilfreeman:
  • fix(openai): use codex context limits for gpt-5.6 (#36248)
• @​geraint0923:
  • fix(xai): default store to false for Responses (#36629)

tree-sitter/tree-sitter (aqua:tree-sitter/tree-sitter)

v0.26.11: v0.26.11

Compare Source

What's Changed

• fix(deps): zig manifest for wasmtime is missing windows hashes by @​tree-sitter-ci-bot[bot] in fix(deps): zig manifest for wasmtime is missing windows hashes tree-sitter/tree-sitter#5720
• fix(xtask): eliminate silent errors in zig fetch by @​WillLillis in fix(xtask): eliminate silent errors in zig fetch tree-sitter/tree-sitter#5724
• fix(query): short-circuit longest-match dedup for disjoint states by @​tree-sitter-ci-bot[bot] in fix(query): short-circuit longest-match dedup for disjoint states tree-sitter/tree-sitter#5726
• fix(query): various anchor fixes by @​tree-sitter-ci-bot[bot] in fix(query): various anchor fixes tree-sitter/tree-sitter#5727
• Fix C++ compilation errors in array macros. by @​tree-sitter-ci-bot[bot] in Fix C++ compilation errors in array macros. tree-sitter/tree-sitter#5735
• fix(rust): address new clippy lints by @​WillLillis in fix(rust): address new clippy lints tree-sitter/tree-sitter#5743
• fix(generate): strip non-ASCII case folds by @​tree-sitter-ci-bot[bot] in fix(generate): strip non-ASCII case folds tree-sitter/tree-sitter#5744
• fix(ci): re-set executable permission on release artifacts before zipping by @​clason in fix(ci): re-set executable permission on release artifacts before zipping tree-sitter/tree-sitter#5746
• release v0.26.11 by @​clason in release v0.26.11 tree-sitter/tree-sitter#5748

Full Changelog: tree-sitter/tree-sitter@v0.26.10...v0.26.11

vercel-labs/agent-browser (aqua:vercel-labs/agent-browser)

v0.32.1: v0.32.1

Compare Source

Improvements

• Widened eve compatibility for @​agent-browser/eve to accept eve 0.23 and future major releases without peer-resolution warnings (#1563)

Documentation

• Standardized eve branding to use lowercase styling across the docs, examples, package readmes, and release notes (#1557)

Contributors

• @​ctate

v0.32.0: v0.32.0

Compare Source

New Features

• Eve extension - Added @​agent-browser/eve, an Eve extension that mounts the agent-browser tool set with namespaced browser tools, sandbox bootstrap helpers, docs, examples, CI, and release packaging (#1547)

Security

• Hardened domain allowlists by blocking WebRTC bypasses, applying network containment across launch modes, workers, popups, restored state, and reused daemon sessions, rejecting unsafe startup arguments, and adding Chrome regression coverage (#1546)

Bug Fixes

• Fixed completed-page waits so load and DOMContentLoaded waits resolve immediately when the current document is already ready, with structured Eve wait timeout handling and focused coverage (#1554)

Contributors

• @​ctate
• @​dnukumamras

v0.31.2: v0.31.2

Compare Source

New Features

• WebGPU launch preset - Added --webgpu across the CLI, config, environment, and MCP surfaces, with hardware backends on macOS and Windows, software Vulkan on Linux, automatic Xvfb for displayless headed sessions, and a doctor --webgpu render and screenshot probe (#1529)

Improvements

• Added periodic restore-state autosaves while the browser remains open, preserving recent state after a browser window is closed by hand and capturing background page changes while honoring the restore save policy. The interval is configurable with AGENT_BROWSER_AUTOSAVE_INTERVAL_MS (#1509)

Contributors

• @​ctate

agavra/tuicr (github:agavra/tuicr)

v0.19.1: v0.19.1

Compare Source

What's Changed

• Fix false-positive binary detection on hunk headers containing "Binary" by @​antonio2368 in Fix false-positive binary detection on hunk headers containing "Binary" agavra/tuicr#459
• fix :edit on PR-s where you're forked by @​ferdinandyb in fix :edit on PR-s where you're forked agavra/tuicr#453
• remove comment types by default by @​agavra in remove comment types by default agavra/tuicr#460
• fix: route PR inline commit-range reload through the forge backend by @​agavra in fix: route PR inline commit-range reload through the forge backend agavra/tuicr#464
• release: v0.19.1 by @​github-actions[bot] in release: v0.19.1 agavra/tuicr#465

New Contributors

• @​antonio2368 made their first contribution in Fix false-positive binary detection on hunk headers containing "Binary" agavra/tuicr#459

Full Changelog: agavra/tuicr@v0.19.0...v0.19.1

always-further/nono (github:always-further/nono)

v0.68.0: v0.68.0

Compare Source

What's Changed

• chore(deps): bump docker/build-push-action from 7.2.0 to 7.3.0 by @​dependabot[bot] in chore(deps): bump docker/build-push-action from 7.2.0 to 7.3.0 nolabs-ai/nono#1356
• chore(deps): bump docker/setup-qemu-action from 4.1.0 to 4.2.0 by @​dependabot[bot] in chore(deps): bump docker/setup-qemu-action from 4.1.0 to 4.2.0 nolabs-ai/nono#1354
• chore(deps): bump nolabs-ai/agent-sign from 0.0.11 to 0.1.0 by @​dependabot[bot] in chore(deps): bump nolabs-ai/agent-sign from 0.0.11 to 0.1.0 nolabs-ai/nono#1355
• chore(deps): bump docker/login-action from 4.2.0 to 4.4.0 by @​dependabot[bot] in chore(deps): bump docker/login-action from 4.2.0 to 4.4.0 nolabs-ai/nono#1357
• chore(deps): bump docker/setup-buildx-action from 4.1.0 to 4.2.0 by @​dependabot[bot] in chore(deps): bump docker/setup-buildx-action from 4.1.0 to 4.2.0 nolabs-ai/nono#1359
• chore(deps): bump sigstore-sign from 0.8.0 to 0.10.0 by @​dependabot[bot] in chore(deps): bump sigstore-sign from 0.8.0 to 0.10.0 nolabs-ai/nono#1361
• chore(deps): bump rand from 0.10.1 to 0.10.2 by @​dependabot[bot] in chore(deps): bump rand from 0.10.1 to 0.10.2 nolabs-ai/nono#1362
• chore(deps): bump time from 0.3.52 to 0.3.53 by @​dependabot[bot] in chore(deps): bump time from 0.3.52 to 0.3.53 nolabs-ai/nono#1358
• chore(deps): bump ignore from 0.4.26 to 0.4.27 by @​dependabot[bot] in chore(deps): bump ignore from 0.4.26 to 0.4.27 nolabs-ai/nono#1363
• chore(deps): bump clap_complete from 4.6.5 to 4.6.7 by @​dependabot[bot] in chore(deps): bump clap_complete from 4.6.5 to 4.6.7 nolabs-ai/nono#1360
• chore(deps): bump crossbeam-epoch from 0.9.18 to 0.9.20 by @​SequeI in chore(deps): bump crossbeam-epoch from 0.9.18 to 0.9.20 nolabs-ai/nono#1369
• fix(proxy): skip credential_capture entries with missing helper binaries by @​kipz in fix(proxy): skip credential_capture entries with missing helper binaries nolabs-ai/nono#1368
• fix(why): respect proxy domain filter in --profile and --self host queries by @​SequeI in fix(why): respect proxy domain filter in --profile and --self host queries nolabs-ai/nono#1372
• feat(profile): add platform_overrides field for per-OS profile patches by @​SequeI in feat(profile): add platform_overrides field for per-OS profile patches nolabs-ai/nono#1371
• feat(proxy): add deny_domain to block domains through the proxy by @​SequeI in feat(proxy): add deny_domain to block domains through the proxy nolabs-ai/nono#1374
• fix(command-policy): resolve command_policies binaries once, in parallel, with caching by @​kipz in fix(command-policy): resolve command_policies binaries once, in parallel, with caching nolabs-ai/nono#1373
• fix(profile): preserve platform_overrides through extends resolution by @​kipz in fix(profile): preserve platform_overrides through extends resolution nolabs-ai/nono#1380
• docs(codex): clarify codex docs around the optional login-shell hardening by @​jsynowiec in docs(codex): clarify codex docs around the optional login-shell hardening nolabs-ai/nono#1381
• feat(tool-sandbox): add per-command exec_paths for multi-call binaries by @​kipz in feat(tool-sandbox): add per-command exec_paths for multi-call binaries nolabs-ai/nono#1384
• feat(proxy): support plain HTTP forward-proxying via HTTP_PROXY by @​panga in feat(proxy): support plain HTTP forward-proxying via HTTP_PROXY nolabs-ai/nono#1335
• fix(registry): add X-Nono-Pull-Reason header to distinguish pull triggers (#1383) by @​scp7 in fix(registry): add X-Nono-Pull-Reason header to distinguish pull triggers (#1383) nolabs-ai/nono#1386
• feat(policy): add bun runtime preset by @​rlex in feat(policy): add bun runtime preset nolabs-ai/nono#1305
• feat(policy): mise policy by @​rlex in feat(policy): mise policy nolabs-ai/nono#1387
• fix(tool-sandbox): grant env-shebang scripts their re-exec interpreter by @​kipz in fix(tool-sandbox): grant env-shebang scripts their re-exec interpreter nolabs-ai/nono#1394
• fix: missing ~/.cache on macOS by @​subbyte in fix: missing ~/.cache on macOS nolabs-ai/nono#1378
• fix(sandbox): grant Refer in execute-restriction layer on Linux by @​kipz in fix(sandbox): grant Refer in execute-restriction layer on Linux nolabs-ai/nono#1397
• fix(profile): omit inheritable Option fields when None on save (#1400) by @​dselivanov in fix(profile): omit inheritable Option fields when None on save (#1400) nolabs-ai/nono#1402
• fix: keep orphaned descendants in supervisor ancestry by @​maufl in fix: keep orphaned descendants in supervisor ancestry nolabs-ai/nono#1401
• chore: migrate registry namespace references from always-further to nolabs-ai by @​SequeI in chore: migrate registry namespace references from always-further to nolabs-ai nolabs-ai/nono#1405
• chore(deps): bump sigstore-sign from 0.10.0 to 0.11.0 by @​dependabot[bot] in chore(deps): bump sigstore-sign from 0.10.0 to 0.11.0 nolabs-ai/nono#1407
• chore(deps): bump regex from 1.12.4 to 1.13.0 by @​dependabot[bot] in chore(deps): bump regex from 1.12.4 to 1.13.0 nolabs-ai/nono#1406
• chore(deps): bump bytes from 1.12.0 to 1.12.1 by @​dependabot[bot] in chore(deps): bump bytes from 1.12.0 to 1.12.1 nolabs-ai/nono#1408
• chore(deps): bump sigstore-trust-root from 0.9.0 to 0.11.0 by @​dependabot[bot] in chore(deps): bump sigstore-trust-root from 0.9.0 to 0.11.0 nolabs-ai/nono#1410
• fix(tool-sandbox): preserve argv[0] for symlink-dispatched commands by @​kipz in fix(tool-sandbox): preserve argv[0] for symlink-dispatched commands nolabs-ai/nono#1413
• feat: add port range support to sandbox profiles by @​SequeI in feat: add port range support to sandbox profiles nolabs-ai/nono#1398
• feat(resources): cap sandbox process count with --max-processes (cgroup v2 pids.max) by @​connrg in feat(resources): cap sandbox process count with --max-processes (cgroup v2 pids.max) nolabs-ai/nono#1403
• chore: release v0.68.0 by @​SequeI in chore: release v0.68.0 nolabs-ai/nono#1418

New Contributors

• @​jsynowiec made their first contribution in docs(codex): clarify codex docs around the optional login-shell hardening nolabs-ai/nono#1381
• @​rlex made their first contribution in feat(policy): add bun runtime preset nolabs-ai/nono#1305
• @​subbyte made their first contribution in fix: missing ~/.cache on macOS nolabs-ai/nono#1378
• @​dselivanov made their first contribution in fix(profile): omit inheritable Option fields when None on save (#1400) nolabs-ai/nono#1402
• @​maufl made their first contribution in fix: keep orphaned descendants in supervisor ancestry nolabs-ai/nono#1401

Full Changelog: nolabs-ai/nono@v0.67.1...v0.68.0

aquaproj/aqua (github:aquaproj/aqua)

v2.62.0: v2.62.0

Compare Source

aquaproj/aqua@v2.61.0...v2.62.0

Features

#5024 Embed fallback X.509 roots to support sandboxed environments

Fixes

#5018 More signature related filename extension exclusions @​scop
#5025 Extract packages into a temp dir and rename atomically

Documentation

#5023 Add a guide to use aqua with Claude Code's sandbox

janosmiko/lfk (github:janosmiko/lfk)

v0.15.9: v0.15.9

Compare Source

0.15.9 (2026-07-16)

Bug Fixes

• dashboard: stop trackpad momentum from scrolling the wrong list (#524) (#537) (d70f7fd)
• roll up generic CRD summaries by phase (#536) (#539) (2f52f6c)

v0.15.8: v0.15.8

Compare Source

0.15.8 (2026-07-14)

Bug Fixes

• dashboard: scroll the fullscreen dashboard with the mouse wheel (#524) (#534) (654d4b4)

v0.15.7: v0.15.7

Compare Source

0.15.7 (2026-07-13)

Features

• pinned dashboard summaries (#525) (#532) (34b8ddf)

max-sixty/worktrunk (github:max-sixty/worktrunk)

v0.68.0: 0.68.0

Compare Source

Release Notes

Improved

• wt switch preview tabs fill on demand: Navigating to a preview tab (e.g. alt-3, the branch diff) could show "Loading…" for ~10 seconds in a large repo while the tab waited its turn in the background precompute queue. A local-git tab (working tree, log, branch diff, upstream) now computes as soon as it's viewed: a cold tab costs its own git command, and a previously computed one fills from the disk cache in milliseconds. An alt-r refresh also discards in-flight results from before the refresh rather than letting them repopulate the cleared cache. (#3439)

• wt config state flags a stale default-branch cache: The detected default branch is cached and not re-validated on every command, so a later change to origin/HEAD (a rename followed by git remote set-head origin -a) went unnoticed. wt config state now flags the cache when it differs from the remote's local HEAD; set adopts the new branch and clear re-detects. (#3478, closes #3471, thanks @​starlightromero for reporting)

• Branch-worktree path mismatch demoted to a dim note: wt list flagged a worktree whose path doesn't match its templated location in red, alarming for the agent-harness worktrees that routinely park at non-standard paths. The mismatch now renders as a dim informational note, and only in wt list: the inline notices on wt switch, wt remove, wt merge, and wt step prune are removed. (#3419, for #3389, thanks @​dmsmidt for raising it)

• wt config update writes the upcoming [list] json-schema = 2: With the key unset, update previously pinned the current default (= 1), entrenching the schema being retired; it now writes = 2, moving JSON consumers forward. The default is unchanged: schema 1 applies until the key is set. (#3436)

• wt step promote --format text|json: Parity with the other step subcommands (rebase, push, …). (#3424, thanks @​fuleinist)

Fixed

• Bare-repo project config survives the default branch being checked out nowhere: When no worktree had the default branch checked out (e.g. a linked worktree parked on another branch, common in agent-driven workflows), wt found no on-disk .config/wt.toml and silently ran with no project config and no project hooks. It now reads the default branch's committed config from the object store, and wt config show reports that source. (#3462, #3466, #3477, closes #3461, thanks @​shuntaka9576 for reporting)

• Relative WORKTRUNK_PROJECT_CONFIG_PATH anchors to the worktree root: A relative override resolved against the process's current directory, so running wt from a subdirectory silently disabled it. It now resolves from the worktree root, like the default .config/wt.toml. (#3460, thanks @​indexzero for reporting in #3454)

• Misplaced nested config keys name the file they belong in: A key valid only in the other config file (e.g. list.columns, user-config only, set in the project config) was flagged only as an unknown field; the warning now says which file it belongs in. (#3473, thanks @​KieranP for reporting in #3469)

• Shell integration detects the shell that invoked wt: wt switch could tell a fish user "shell integration requires a restart" because $SHELL names the login shell, not the shell in use. Detection now walks the process tree to find the enclosing shell, falling back to $SHELL when the walk can't resolve one. (#3455)

• Claude plugin's WorktreeCreate hook runs from the project directory: The hook inherited the session shell's working directory, so a session that had cd'd outside the repository failed every worktree creation with "not a git repository". (#3453, thanks @​silvanshade)

• Codex plugin installs ship skills: codex plugin add copies the plugin via a mechanism that doesn't follow symlinks, so the skills symlink shipped no skills to Codex installs; Windows checkouts, where symlinks materialize as plain text files, had the same gap. The plugin now carries a generated real-file mirror of the skills. (#3440)

• LLM prompt size bounded for long diffs: Commit-message, squash, and branch-summary generation could exceed the model's context window on a large diff. Diffs and squash commit lists now truncate within a fixed budget. (#3438)

• wt list task-failure warnings show git's full message: A failure was truncated to its first line, dropping git's own recovery guidance (e.g. the index.lock advice). Warnings now render the whole message, and the summary footer no longer restates the warning header's failure count in different vocabulary. In buffered (piped) output the ○ Showing … summary line also moves to stderr, so stdout ends after the last row. (#3435, #3442, #3467)

• Watchdog status lines name the running operation: A long wait read "Waiting for the commit message (4s)", as if blocked on user input; it now reads "Waiting for the commit generation command (4s)", and likewise for version checks and PR/MR lookups. (#3443)

• Carriage returns normalized in captured stdout: A failing command with progress output on stdout (e.g. git's Receiving objects: 42%\r…) could return the cursor to column 0 and corrupt the rendered error block. stdout is now normalized as stderr already was, and the failure sites that bypassed the standard error renderer (git plumbing, plugin CLI calls, LLM commands) now route through it, so every failed command shows the canonical ✗ <command> failed (exit N) header and output gutter. (#3459, #3474, #3483)

• PowerShell wrapper no longer leaks a stray exit-code line to stdout. (#3425)

Internal

• MSRV bumped to 1.96. (#3428)

• Dropped the ragged-table panic workaround; the upstream termimad fix ships in 0.35.1. (#3422)

Install worktrunk 0.68.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/max-sixty/worktrunk/releases/download/v0.68.0/worktrunk-installer.sh | sh && wt config shell install

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/max-sixty/worktrunk/releases/download/v0.68.0/worktrunk-installer.ps1 | iex"; git-wt config shell install

Install prebuilt binaries via Homebrew

brew install worktrunk && wt config shell install

Download worktrunk 0.68.0

File	Platform	Checksum
worktrunk-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
worktrunk-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
worktrunk-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
worktrunk-aarch64-unknown-linux-musl.tar.xz	ARM64 MUSL Linux	checksum
worktrunk-x86_64-unknown-linux-musl.tar.xz	x64 MUSL Linux	checksum

Install via Cargo

cargo install worktrunk && wt config shell install

Install via Winget (Windows)

winget install max-sixty.worktrunk && git-wt config shell install

Install via AUR (Arch Linux)

paru worktrunk-bin && wt config shell install

modem-dev/hunk (github:modem-dev/hunk)

v0.17.1: v0.17.1

Compare Source

What's Changed

• Prevent Windows end-of-diff scrolling crashes and Apple Silicon Yoga warning spam by upgrading OpenTUI to 0.4.3 by @​benvinegar in fix: upgrade OpenTUI for renderer stability modem-dev/hunk#538
• Reduce retained memory in large reviews by lazily materializing cached geometry row plans by @​matthew-hre in fix: reduce retained geometry memory in large reviews modem-dev/hunk#521
• Fix global config discovery on Windows when HOME is unavailable by @​benvinegar in fix(config): read Windows user-profile config modem-dev/hunk#533

Full Changelog: modem-dev/hunk@v0.17.0...v0.17.1

igorshubovych/markdownlint-cli (npm:markdownlint-cli)

v0.49.1: v0.49.1

Compare Source

• Update markdownlint dependency to 0.41.1
  • Improve MD029
  • Fix module resolution under webpack
  • Update dependencies
• Update all dependencies via Dependabot

semgrep/semgrep (pipx:semgrep)

v1.170.0: Release v1.170.0

Compare Source

1.170.0 - 2026-07-15

### Added

• Pro C/C++ scans now skip code inside statically-dead preprocessor branches
  (for example, #if 0 ... #else ... #endif). Patterns that would otherwise
  match against intentionally-disabled code no longer report on it. (cpp-if-zero-filter)
• Restored obackward: semgrep-core and semgrep-core-proprietary once again print a backtrace when receiving a fatal signal (e.g. SIGSEGV) (obackward)
• semgrep install-semgrep-pro now sends usage metrics so that
  installation errors can be tracked. Metrics can be disabled with
  --metrics off or SEMGREP_SEND_METRICS=off. Metrics payloads also
  now include the method used to install the Semgrep CLI (pip, homebrew,
  docker, or unknown), detected heuristically. See metrics.md for
  more details of what exactly is sent. (engine-2858)

### Changed

• Increased the timeout for dynamic dependency resolution subprocesses from
  600 to 900 seconds, giving large projects more time to resolve dependencies
  before timing out. (SC-3699)
• Pro C/C++ #if 0 filtering now also handles cases where the directive splits a
  syntactic unit. For example, a function signature toggle like #if 0 void foo(int i) { #else void foo(uint32_t i) { #endif. (engine-994)

### Fixed

• Fixed a crash at startup (Fatal error: Failed to allocate signal stack for domain 0) when running Semgrep on systems with musl 1.2.6 (e.g. Alpine 3.24) on
  recent Intel CPUs whose kernel-reported minimum signal-stack size exceeds musl's
  build-time SIGSTKSZ (notably AMX-capable Xeons). (ENGINE-2863)

• Dockerfile: Fixed parse errors on RUN instructions that use heredoc syntax
  (<<EOF, <<-EOF, quoted delimiters). (LANG-263)

• metavariable-type now supports fully qualified type names in languages
  where a qualified name in type position parses as an expression (e.g.
  Python's types: [a.b.C]) when the metavariable's type is determined by
  type inference, such as Pro engine cross-file type resolution. (LANG-583)

• Updated the ocaml-tree-sitter-core dependency to the latest main.

  • Fails loudly on a parser/runtime ABI mismatch
  • Stamps every generated parser.c with the tree-sitter version that produced it.
  • Changed paths where tree-sitter versions are installed (lang-591)

rust-lang/rust (rust)

1.97.1: Rust 1.97.1

Compare Source

• rustc: Fix miscompilation in LLVM optimization This backports an LLVM submodule bump to include the LLVM-side fix and a revert of the rustc change that is one known trigger for the bug. The rustc side revert should not be strictly necessary but is done out of abundance of caution.

jdx/usage (usage)

v3.5.5: v3.5.5: Hyphen-prefixed flag values

Compare Source

A small patch release that lets value-taking flags accept hyphen-prefixed values (such as passthrough args to a wrapped CLI), plus a redesigned logo.

Fixed

• parse: allow hyphen-prefixed flag values (#715, fixes #713). Flags that carry passthrough values (e.g. forwarding args to terraform/terragrunt) previously lost values that started with - when the first letter collided with an existing short flag — ./repro -a -destroy would tokenize -destroy as -d estroy and silently drop the intended value of -a. Value flags can now opt in via allow_hyphen_values=#true, and the parser will consume the next -… token as that flag's value before short/long flag parsing kicks in:

  flag "-a --args <ARGS>" allow_hyphen_values=#true

  This works for -a -destroy, --args=-destroy, and repeated variadic values like -a -val1 -a -val2. Flags without the opt-in keep their existing behavior. The built-in usage complete-word --cword flag now sets this internally so negative cword indices parse correctly.

Documentation

• Redesigned logo (#714). Replaces the previous raster logo with a clean flat vector flag mark — an ink flagpole with a green (#22c55e) swallowtail banner carrying the -- flag prefix. All derived favicons and app icons were regenerated from the new vector source, and an SVG favicon is now served for browsers that support it.

Full Changelog: jdx/usage@v3.5.4...v3.5.5

💚 Sponsor usage

usage is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise, aube, hk, and more. Work on usage is funded by sponsorships.

If usage powers CLI specs, docs, or completions for a tool you maintain or use, please consider sponsoring at jdx.dev. Every sponsorship helps the project stay independent and moving.

Skipped Packages

GitHub Release Notes Unavailable

• pipx:mypy: No GitHub release was found for 2.3.0