chore(deps): update ⬆️ aqua-packages

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change
alltuner/mise-completions-sync	minor	v0.4.4 → v0.5.0
anthropics/claude-code	patch	v2.1.87 → v2.1.90
aquaproj/aqua-registry	minor	v4.489.0 → v4.491.0
astral-sh/uv	patch	0.11.2 → 0.11.3
block/goose	minor	v1.28.0 → v1.29.0
crate-ci/typos	minor	v1.44.0 → v1.45.0
dprint/dprint	patch	0.53.1 → 0.53.2
github/copilot-cli	patch	v1.0.12 → v1.0.15
gohugoio/hugo	patch	v0.159.1 → v0.159.2
jdx/mise	minor	v2026.3.17 → v2026.4.1
nektos/act	patch	v0.2.86 → v0.2.87
openai/codex	minor	v0.117.0 → v0.118.0
rhysd/actionlint	patch	v1.7.11 → v1.7.12
sst/opencode	patch	v1.3.7 → v1.3.13
tassiovirginio/try-rs	patch	v1.7.1 → v1.7.2
thiagokokada/gh-gfm-preview	patch	v1.1.0 → v1.1.2
tree-sitter/tree-sitter	patch	v0.26.7 → v0.26.8

---

Release Notes

alltuner/mise-completions-sync (alltuner/mise-completions-sync)

v0.5.0

Compare Source

Features

• add new tools (#​40) (4617152)
• add prek completion support (#​48) (b2bb8a9), closes #​36

Bug Fixes

• deps: update rust crate toml to v1 (#​35) (ea3241f)
• generate-registry: migrate from mise registry.toml to API endpoint (#​42) (329a9b9)
• remove unused json import in generate-registry (#​47) (d3e7c29)

anthropics/claude-code (anthropics/claude-code)

v2.1.90

Compare Source

What's changed

• Added /powerup — interactive lessons teaching Claude Code features with animated demos
• Added CLAUDE_CODE_PLUGIN_KEEP_MARKETPLACE_ON_FAILURE env var to keep the existing marketplace cache when git pull fails, useful in offline environments
• Added .husky to protected directories (acceptEdits mode)
• Fixed an infinite loop where the rate-limit options dialog would repeatedly auto-open after hitting your usage limit, eventually crashing the session
• Fixed --resume causing a full prompt-cache miss on the first request for users with deferred tools, MCP servers, or custom agents (regression since v2.1.69)
• Fixed Edit/Write failing with "File content has changed" when a PostToolUse format-on-save hook rewrites the file between consecutive edits
• Fixed PreToolUse hooks that emit JSON to stdout and exit with code 2 not correctly blocking the tool call
• Fixed collapsed search/read summary badge appearing multiple times in fullscreen scrollback when a CLAUDE.md file auto-loads during a tool call
• Fixed auto mode not respecting explicit user boundaries ("don't push", "wait for X before Y") even when the action would otherwise be allowed
• Fixed click-to-expand hover text being nearly invisible on light terminal themes
• Fixed UI crash when malformed tool input reached the permission dialog
• Fixed headers disappearing when scrolling /model, /config, and other selection screens
• Hardened PowerShell tool permission checks: fixed trailing & background job bypass, -ErrorAction Break debugger hang, archive-extraction TOCTOU, and parse-fail fallback deny-rule degradation
• Improved performance: eliminated per-turn JSON.stringify of MCP tool schemas on cache-key lookup
• Improved performance: SSE transport now handles large streamed frames in linear time (was quadratic)
• Improved performance: SDK sessions with long conversations no longer slow down quadratically on transcript writes
• Improved /resume all-projects view to load project sessions in parallel, improving load times for users with many projects
• Changed --resume picker to no longer show sessions created by claude -p or SDK invocations
• Removed Get-DnsClientCache and ipconfig /displaydns from auto-allow (DNS cache privacy)

v2.1.89

Compare Source

What's changed

• Added "defer" permission decision to PreToolUse hooks — headless sessions can pause at a tool call and resume with -p --resume to have the hook re-evaluate
• Added CLAUDE_CODE_NO_FLICKER=1 environment variable to opt into flicker-free alt-screen rendering with virtualized scrollback
• Added PermissionDenied hook that fires after auto mode classifier denials — return {retry: true} to tell the model it can retry
• Added named subagents to @ mention typeahead suggestions
• Added MCP_CONNECTION_NONBLOCKING=true for -p mode to skip the MCP connection wait entirely, and bounded --mcp-config server connections at 5s instead of blocking on the slowest server
• Auto mode: denied commands now show a notification and appear in /permissions → Recent tab where you can retry with r
• Fixed Edit(//path/**) and Read(//path/**) allow rules to check the resolved symlink target, not just the requested path
• Fixed voice push-to-talk not activating for some modifier-combo bindings, and voice mode on Windows failing with "WebSocket upgrade rejected with HTTP 101"
• Fixed Edit/Write tools doubling CRLF on Windows and stripping Markdown hard line breaks (two trailing spaces)
• Fixed StructuredOutput schema cache bug causing ~50% failure rate when using multiple schemas
• Fixed memory leak where large JSON inputs were retained as LRU cache keys in long-running sessions
• Fixed a crash when removing a message from very large session files (over 50MB)
• Fixed LSP server zombie state after crash — server now restarts on next request instead of failing until session restart
• Fixed prompt history entries containing CJK or emoji being silently dropped when they fall on a 4KB boundary in ~/.claude/history.jsonl
• Fixed /stats undercounting tokens by excluding subagent usage, and losing historical data beyond 30 days when the stats cache format changes
• Fixed -p --resume hangs when the deferred tool input exceeds 64KB or no deferred marker exists, and -p --continue not resuming deferred tools
• Fixed claude-cli:// deep links not opening on macOS
• Fixed MCP tool errors truncating to only the first content block when the server returns multi-element error content
• Fixed skill reminders and other system context being dropped when sending messages with images via the SDK
• Fixed PreToolUse/PostToolUse hooks to receive file_path as an absolute path for Write/Edit/Read tools, matching the documented behavior
• Fixed autocompact thrash loop — now detects when context refills to the limit immediately after compacting three times in a row and stops with an actionable error instead of burning API calls
• Fixed prompt cache misses in long sessions caused by tool schema bytes changing mid-session
• Fixed nested CLAUDE.md files being re-injected dozens of times in long sessions that read many files
• Fixed --resume crash when transcript contains a tool result from an older CLI version or interrupted write
• Fixed misleading "Rate limit reached" message when the API returned an entitlement error — now shows the actual error with actionable hints
• Fixed hooks if condition filtering not matching compound commands (ls && git push) or commands with env-var prefixes (FOO=bar git push)
• Fixed collapsed search/read group badges duplicating in terminal scrollback during heavy parallel tool use
• Fixed notification invalidates not clearing the currently-displayed notification immediately
• Fixed prompt briefly disappearing after submit when background messages arrived during processing
• Fixed Devanagari and other combining-mark text being truncated in assistant output
• Fixed rendering artifacts on main-screen terminals after layout shifts
• Fixed voice mode failing to request microphone permission on macOS Apple Silicon
• Fixed Shift+Enter submitting instead of inserting a newline on Windows Terminal Preview 1.25
• Fixed periodic UI jitter during streaming in iTerm2 when running inside tmux
• Fixed PowerShell tool incorrectly reporting failures when commands like git push wrote progress to stderr on Windows PowerShell 5.1
• Fixed a potential out-of-memory crash when the Edit tool was used on very large files (>1 GiB)
• Improved collapsed tool summary to show "Listed N directories" for ls/tree/du instead of "Read N files"
• Improved Bash tool to warn when a formatter/linter command modifies files you have previously read, preventing stale-edit errors
• Improved @-mention typeahead to rank source files above MCP resources with similar names
• Improved PowerShell tool prompt with version-appropriate syntax guidance (5.1 vs 7+)
• Changed Edit to work on files viewed via Bash with sed -n or cat, without requiring a separate Read call first
• Changed hook output over 50K characters to be saved to disk with a file path + preview instead of being injected directly into context
• Changed cleanupPeriodDays: 0 in settings.json to be rejected with a validation error — it previously silently disabled transcript persistence
• Changed thinking summaries to no longer be generated by default in interactive sessions — set showThinkingSummaries: true in settings.json to restore
• Documented TaskCreated hook event and its blocking behavior
• Preserved task notifications when backgrounding a running command with Ctrl+B
• PowerShell tool on Windows: external-command arguments containing both a double-quote and whitespace now prompt instead of auto-allowing (PS 5.1 argument-splitting hardening)
• /env now applies to PowerShell tool commands (previously only affected Bash)
• /usage now hides redundant "Current week (Sonnet only)" bar for Pro and Enterprise plans
• Image paste no longer inserts a trailing space
• Pasting !command into an empty prompt now enters bash mode, matching typed ! behavior
• /buddy is here for April 1st — hatch a small creature that watches you code

v2.1.88

Compare Source

aquaproj/aqua-registry (aquaproj/aqua-registry)

v4.491.0

Compare Source

Issues | Pull Requests | aquaproj/aqua-registry@v4.490.0...v4.491.0

🎉 New Packages

#​51349 azu/dockerfile-pin - A CLI tool that adds @sha256:<digest> to FROM lines in Dockerfiles and image fields in docker-compose.yml to prevent supply chain attacks @​azu

Fixes

#​51341 Enable windows support for latest Zellij @​attakei
#​51352 goreleaser/goreleaser: Disable cosign verification at v2.15.0 and v2.15.1
#​51351 anthropics/claude-code: Exclude v2.1.88 as it's unavailable
#​51350 Re-scaffold dandavison/delta

v4.490.0

Compare Source

Issues | Pull Requests | aquaproj/aqua-registry@v4.489.0...v4.490.0

🎉 New Packages

#​51332 getdbt.com/dbt-fusion The next-generation engine for dbt @​ryan-pip

[!NOTE]
To update this package using Renovate, please update aqua-renovate-config to 2.12.0 or later.
https://github.com/aquaproj/aqua-renovate-config/releases/tag/2.12.0

Fixes

#​51331 steveyegge/beads: Rename gastownhall/beads
#​51272 Azure/azure-dev: Re-scaffold @​Petermarcu
#​51222 shinagawa-web/gomarklint: no assets for 2.1.0 @​scop
#​51046 Re-scaffold magefile/mage @​frozenbonito

Security

#​51254 lxc/incus: GitHub artifact attestations config @​scop

astral-sh/uv (astral-sh/uv)

v0.11.3

Compare Source

Released on 2026-04-01.

Enhancements

• Add progress bar for hashing phase in uv publish (#​18752)
• Add support for ROCm 7.2 (#​18730)
• Emit abi3t tags for every abi3 version (#​18777)
• Expand uv workspace metadata with dependency information from the lock (#​18356)
• Implement support for PEP 803 (#​18767)
• Pretty-print platform in built wheel errors (#​18738)
• Publish installers to /installers/uv/latest on the mirror (#​18725)
• Show free-threaded Python in built-wheel errors (#​18740)

Preview features

• Add --ignore and --ignore-until-fixed to uv audit (#​18737)

Bug fixes

• Bump simple API cache (#​18797)
• Don't drop blake2b hashes (#​18794)
• Handle broken range request implementations (#​18780)
• Remove powerpc64-unknown-linux-gnu from release build targets (#​18800)
• Respect dependency metadata overrides in uv pip check (#​18742)
• Support debug CPython ABI tags in environment compatibility (#​18739)

Documentation

• Document false opt-out for exclude-newer-package (#​18768, #​18803)

block/goose (block/goose)

v1.29.0

Compare Source

✨ Features

• Ability to manage sub recipes in desktop UI #​6360
• Display delegate sub agents logs in UI #​7519
• Pass toolInfo to MCP Apps via hostContext #​7506
• Ability to expand sidebar to see chat names #​7816
• Sigstore/SLSA provenance verification for Rust self-update #​7818
• GOOSE_SHELL env var to configure preferred shell #​7909
• CodeMode ToolDisclosure variants support #​7926
• Feature-gate local inference dependencies #​7976
• ACP session/set_config and stabilize list, delete and close #​7984
• Gemini-ACP provider with subscription models support #​8000
• Orchestration support #​7999
• Upgrade ink for performance, use stdio instead of http #​8004
• Filter tools by MCP Apps visibility metadata #​8022

🐛 Bug Fixes

• Empty tool results from resource content (e.g. auto visualiser) #​7866
• Clean up OAuth token cache on provider deletion #​7908
• SSE parsers to accept optional space after data: prefix #​7929
• Hard-coded tool call id in code mode callback #​7939
• Config for GOOSE_MAX_BACKGROUND_TASKS #​7940
• Unregister goosed child process's listener #​7956
• Include token usage in Databricks streaming responses #​7959
• Overwrite the deprecated googledrive extension config #​7974
• Emit user-facing message on compaction failure #​7975
• Use Responses API for gpt-5.4 #​7982
• Auto-focus chat input on Hub mount #​8007
• Apps extension: coerce string arguments from inner LLM responses #​8030
• Handle mid-stream error events in OpenAI SSE streaming #​8031
• Fullscreen header bar + always-visible close controls #​8033
• Use default provider and model when provider in session no longer exists #​8035
• Gemini models via Databricks #​8042
• Handle reasoning content blocks in OpenAI-compat streaming parser #​8078
• Remove configured marker when deleting OAuth provider configuration #​7887
• Download manager #​7933
• macOS Intel signing #​8218

🔧 Improvements

• Improve formatting of tool calls, show thinking, treat Reasoning and Thinking the same #​7626
• Separate SSE streaming from POST work submission #​7834
• Optimize tool summarization #​7938
• Support reasoning and gpt-5.4 for ChatGPT Codex #​7941
• Fix N+1 thinking message storage issue #​7958
• Remove unnecessary Arc from tool execution pipeline #​7979
• Remove lead/worker provider #​7989
• Allow delete all types #​8018
• Improve terminal output formatting and visual clarity #​8025
• Consolidate duplicated dependencies into workspace #​8041
• Show setup instructions for ACP providers in settings modal #​8065
• Replace sigstore-verification with sigstore-verify to remove vulnerabilities #​8064
• Update tar version to avoid CVE-2026-33056 #​8073
• Code review step using short-lived provider token #​7932

📚 Documentation

• Remote Access section with Telegram Gateway documentation #​7955
• WebMCP for Beginners blog post #​7957
• GOOSE_INPUT_LIMIT in config-files.md #​7961
• Claude Code approve mode permission routing #​7949
• VMware-AIOps MCP extension documentation #​8055
• Correct gosoe typo to goose #​8062

crate-ci/typos (crate-ci/typos)

v1.45.0

Compare Source

Bug Fixes

• Ignore numbers as identifiers (a00831c8)
• Improve the organization of --help (a48a457c)

Features

• Dump files, identifiers, and words (ce365ae1, closes #​41)
• Give control over allowed identifier characters for leading vs rest (107308a6)

Performance

• Use standard identifier rules to avoid doing umber checks (107308a6)
• Only do hex check if digits are in identifiers (68cd36d0)

dprint/dprint (dprint/dprint)

v0.53.2

Compare Source

Changes

• fix: use original URL for plugin type detection after redirect (#​1121)

Install

Run dprint upgrade or see https://dprint.dev/install/

Checksums

Artifact	SHA-256 Checksum
dprint-x86_64-apple-darwin.zip	902a9cff86a0ce643d5f1bb53e3e2434096511542363924e18016ee7bedb769f
dprint-aarch64-apple-darwin.zip	a185ba53f74e1e3a8ccdaf03a5d6f96b67d3fdf3f86d0d0f98950d15817eb0c4
dprint-x86_64-pc-windows-msvc.zip
dprint-x86_64-pc-windows-msvc-installer.exe
dprint-x86_64-unknown-linux-gnu.zip	dcb73c6890c80dff15d5c91f7e01c09a5eb6e4c96373525765d08a60f02e4598
dprint-x86_64-unknown-linux-musl.zip	7ff2cf9b25c687bd59867528ae9a5526c17e75e82e9788bf1f84a0e3ca7163b6
dprint-aarch64-unknown-linux-gnu.zip	490b620a386497b09ce25cc92c4cb784dfdb9d15448db972b164721d6f795ddd
dprint-aarch64-unknown-linux-musl.zip	c3843a4604dac7428f41f762c4c352e409c63bd634172765bbac482dc59773ba
dprint-riscv64gc-unknown-linux-gnu.zip	9fe90a2e414cfd59c6df984a3910ce11e0c349d5326ab7debec06682f3ba1150
dprint-loongarch64-unknown-linux-gnu.zip	e8d7b0f440ea1dac65eeb1c11407a2e77dfa31f72fdb28b15b5eb8ca75b5cb83
dprint-loongarch64-unknown-linux-musl.zip	a5901a80e331c8e4201fbb321c02b742a3ad618ce2e72a9dc2738b7283f5baa9

github/copilot-cli (github/copilot-cli)

v1.0.15: 1.0.15

Compare Source

2026-04-01

• Remove support for gpt-5.1-codex, gpt-5.1-codex-mini, and gpt-5.1-codex-max models
• Copilot mascot now blinks with subtle eye animations in interactive mode
• User switcher and /user list display accounts in alphabetical order
• Add mcp.config.list, mcp.config.add, mcp.config.update, and mcp.config.remove server RPCs for managing persistent MCP server configuration
• Add device code flow (RFC 8628) as a fallback for MCP OAuth in headless and CI environments
• Add /mcp auth command and re-authentication UI for MCP OAuth servers with account switching support
• Add postToolUseFailure hooks for tool errors and make postToolUse run only after successful tool calls
• Add /share html command to export sessions and research reports as self-contained interactive HTML files
• Autopilot no longer continues after pressing Escape or Ctrl+C to cancel
• Keystrokes typed while the CLI is loading are no longer lost
• Large tool output preview shows correct character count and up to 500 characters
• Add Home/End and Page Up/Page Down navigation to the diff viewer
• CLI exits immediately after a session ends instead of waiting up to 10 seconds
• Config settings askUser, autoUpdate, storeTokenPlaintext, logLevel, skillDirectories, and disabledSkills now use camelCase names (snake_case still accepted)
• Many settings keys now prefer camelCase names (snake_case names still work)
• Ctrl+D no longer queues a message; use Ctrl+Q or Ctrl+Enter to queue
• MCP servers that are slow to connect no longer block the agent from starting
• Pasting images from the Windows clipboard now works in WSL environments

v1.0.14: 1.0.14

Compare Source

2026-03-31

• Images are correctly sent to Anthropic models when using BYOM
• Model picker selection correctly overrides the --model flag for the current session
• Terminal output no longer clears or jumps on error exit
• Shift+Enter inserts a newline in terminals with Kitty keyboard protocol support
• Show underlying error details when a Git marketplace URL fails to clone
• Temp file operations no longer trigger unnecessary permission prompts on macOS
• Allow SDK session participants to respond to elicitation requests via handlePendingElicitation API
• Shell processes are cleaned up properly when a session ends
• SDK exit_plan_mode.requested event is now always emitted, regardless of whether a direct callback is configured
• MCP servers using Microsoft Entra ID authentication no longer show the consent screen on every login
• Grep and glob search results return promptly when a timeout is reached
• Keystrokes are no longer dropped when typing quickly in elicitation dialogs
• Clipboard copy on native Windows no longer includes a stray U+FEFF character at the start of pasted text
• Fixed --config-dir being ignored when resuming a session, causing paths to silently fall back to ~/.copilot
• MCP servers blocked by allowlist policy are now hidden from /mcp show
• Reasoning effort setting now applies correctly when using Bring Your Own Model (BYOM) providers
• Ensure clear error messaging when using classic PATs
• grep tool handles large files and long lines without running out of memory
• MCP server OAuth authentication works when the CLI runs in ACP mode
• Split $BROWSER on spaces
• Pasted text is no longer corrupted when mouse support is active
• Uninstalling a marketplace plugin removes its cached data from disk
• Reduce CPU usage during streaming by optimizing spinner rendering and task polling
• Reduce CLI startup time by running terminal detection, auth, and git operations in parallel
• MCP registry lookups are more reliable with automatic retries and request timeouts
• CLI starts faster due to V8 compile cache reducing parse and compile time on repeated invocations
• Remove support for gemini-3-pro-preview model

v1.0.13: 1.0.13

Compare Source

2026-03-30

• Shell processes are cleaned up properly when a session ends
• Reduce CPU usage during streaming by optimizing spinner rendering and task polling
• SDK exit_plan_mode.requested event is now always emitted, regardless of whether a direct callback is configured
• MCP servers using Microsoft Entra ID authentication no longer show the consent screen on every login
• Grep and glob search results return promptly when a timeout is reached
• Keystrokes are no longer dropped when typing quickly in elicitation dialogs
• Clipboard copy on native Windows no longer includes a stray U+FEFF character at the start of pasted text
• Fixed --config-dir being ignored when resuming a session, causing paths to silently fall back to ~/.copilot
• Reduce CLI startup time by running terminal detection, auth, and git operations in parallel
• /rewind and double-Esc now open a timeline picker that can roll back to any point in conversation history, not just the previous snapshot
• MCP registry lookups are more reliable with automatic retries and request timeouts
• CLI starts faster due to V8 compile cache reducing parse and compile time on repeated invocations
• MCP servers can request LLM inference (sampling) with user approval via a new review prompt
• MCP servers blocked by allowlist policy are now hidden from /mcp show
• Reasoning effort setting now applies correctly when using Bring Your Own Model (BYOM) providers
• Ensure clear error messaging when using classic PATs
• grep tool handles large files and long lines without running out of memory
• MCP server OAuth authentication works when the CLI runs in ACP mode
• Split $BROWSER on spaces
• Pasted text is no longer corrupted when mouse support is active
• Uninstalling a marketplace plugin removes its cached data from disk
• Remove support for gemini-3-pro-preview model

gohugoio/hugo (gohugoio/hugo)

v0.159.2

Compare Source

Note that the security fix below is not a potential threat if you either:

• Trust your Markdown content files.
• Have custom render hook template for links and images.

EDIT IN: This release also adds release archives for non-extended-withdeploy builds.

What's Changed

• Fix potential content XSS by escaping dangerous URLs in Markdown links and images 479fe6c @​bep
• resources/page: Fix shared reader in Source.ValueAsOpenReadSeekCloser df520e3 @​jmooring #​14684

jdx/mise (jdx/mise)

[v2026.4.1](https://re

---

Configuration

📅 Schedule: Branch creation - Between 05:00 AM and 07:59 AM ( * 5-7 * * * ) in timezone America/Los_Angeles, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.