chore(deps): update bump-dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
@anthropic-ai/claude-code	2.1.239 → 2.1.241				patch	2.1.247 (+4)
@earendil-works/pi-coding-agent (source)	0.84.2 → 0.84.3				patch
debian_13/bubblewrap	0.11.0-2+deb13u1 → 0.12.0-1~deb13u1				minor
github.com/securego/gosec/v2	v2.28.0 → v2.29.0				minor
libops/.github (changelog)	5f44a8c → 7277eac			workflow	digest
node (source)	66bb8d3 → e3883d5			final	digest
node (source)	66bb8d3 → e3883d5			stage	digest

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

anthropics/claude-code (@​anthropic-ai/claude-code)

v2.1.241

Compare Source

• Bug fixes and reliability improvements

v2.1.240

Compare Source

• Bug fixes and reliability improvements

earendil-works/pi (@​earendil-works/pi-coding-agent)

v0.84.3

Compare Source

New Features

• PowerShell tool — Use optional native PowerShell command execution on Windows. See PowerShell Tool.
• Safer managed updates — Stage, verify, and atomically activate updates for installer-managed installations. See Install and Manage.
• Model and thinking controls — Select thinking levels with /thinking, search defaults, keep selections session-scoped, and persist them explicitly with Ctrl+S. See Models and Thinking.

Breaking Changes

• Renamed the inherited GoogleThinkingLevel type to GoogleApiThinkingLevel and added ResolvedGoogleThinkingLevel for normalized adapter levels.

Added

• Added an optional powershell tool for Windows, configurable through defaultTools and the SDK. See PowerShell Tool.
• Added a /thinking selector and searchable default choices to the model and thinking selectors; Ctrl+S saves the selected model as the global default. See Models and Thinking.
• Added optional routing session IDs to exported compaction summary helpers so callers can preserve provider routing without enabling prompt cache writes.
• Added

usage notices for compaction and branch summaries when cache miss notices are enabled.

• Added session_compact_failed extension events so compaction failures and aborts expose their reason, retry state, source, and error message to handlers (#​8175).
• Added inherited provider-neutral toolChoice support to simple stream requests.
• Added inherited automatic Anthropic server-side refusal fallback for supported first-party models, including returned-model usage pricing (#​8017).
• Added inherited configurable OpenAI-compatible thinking-token budget fields for vLLM, Qwen/SGLang, and llama.cpp servers. See OpenAI Compatibility (#​8275 by @​bnsd55).
• Added inherited China-specific ZAI Coding Plan models, including GLM-4.6V vision support and API-equivalent usage cost estimates (#​8220).
• Added inherited deepseek-v4-pro-0813 support to the Qwen Token Plan Individual catalog (#​8194).

Changed

• Changed experimental installer-managed installations so pi update stages, verifies, and atomically activates the selected release in place. See Install and Manage.
• Changed inherited built-in xAI models to use the Responses API with encrypted reasoning replay and made Grok 4.6 the default xAI model (#​8124 by @​Jaaneek).
• Changed inherited Anthropic, Azure OpenAI, Google, Mistral, and OpenAI adapters to send Pi's default User-Agent unless overridden (#​8305).
• Changed Windows and WSL keybinding defaults to avoid terminal-reserved shortcuts for image paste, model cycling, editor undo, fullscreen transcript navigation and search, and message queueing (#​8372).
• Changed Bun release archives to ship the native clipboard binary only inside the wrapper package, removing a duplicate platform package from each archive.
• Changed package resource glob expansion to use Node.js's built-in implementation with deterministic visible-path matching, reducing the installed runtime dependency tree.
• Changed the bundled Node.js runtime to load jiti only when importing an extension and Babel only when uncached source needs transformation, reducing CLI startup time and bundle size.
• Changed syntax highlighting to initialize only twenty common languages eagerly and defer the remaining grammars until after the initial TUI render, reducing CLI startup time.
• Changed the Node.js CLI and RPC entrypoints to load a bundled runtime, reducing startup filesystem reads while keeping the public library and legacy module paths on the modular runtime for normal dependency identity.
• Changed session sharing to render clickable terminal links, display only the canonical Radius artifact URL, and include the current system prompt and active tool definitions in Radius session shares.

Fixed

• Fixed failed extension factories leaving event subscriptions, provider registrations, and default flag state active (#​8424 by @​acmerfight).
• Fixed models.json typings omitting the documented OpenAI-compatible compat.supportsFinishReason provider and model override (#​8487 by @​petrroll).
• Fixed /model and /thinking selections being persisted globally unless explicitly saved with Ctrl+S (#​5263).
• Fixed JSON and RPC toolcall_start events omitting the tool call id and name (#​7953 by @​christianklotz).
• Fixed extensions failing to load when the Node.js CLI runs as a single-executable application (#​8237).
• Fixed nested Markdown skills inside .agents/skills/ grouping directories not being discovered.
• Fixed compaction and branch summarization requests exposing tools to providers.
• Fixed single-object edit tool inputs failing validation by accepting them as one-edit arrays in both coding-agent and harness edit tools (#​7835).
• Fixed root Markdown files such as README.md and AGENTS.md in skill directories being reported as broken skills unless they declare valid skill frontmatter (#​7805).
• Fixed the default Cerebras model referencing an unavailable Z.AI model.
• Fixed inherited OpenAI-compatible Chat Completions reasoning replay to preserve and resend assistant-level reasoning_details verbatim and in order (#​7994).
• Fixed inherited Anthropic server-side fallback responses being priced with the requested model instead of the returned fallback model (#​8285).
• Fixed inherited GitHub Copilot login triggering model-policy rate limits by limiting policy updates, retrying model discovery once, and honoring server retry delays (#​7850).
• Fixed inherited Amazon Bedrock dropping and failing to replay opaque redacted reasoning from non-Anthropic models (#​8314 by @​seiji).
• Fixed inherited Z.AI Coding Plan models deriving incomplete reasoning-effort metadata, including missing GLM-5.3 low, high, and max levels (#​8336).
• Fixed inherited DeepSeek V4 Flash on OpenCode and OpenCode Go omitting its supported low thinking level (#​8181 by @​tianshuang).
• Fixed inherited Azure OpenAI Responses ignoring toolChoice in provider-specific stream requests.
• Fixed inherited Amazon Bedrock response hooks receiving only a synthesized request id instead of the raw response headers (#​8234).
• Fixed inherited Kimi usage reporting so top-level cached_tokens count as cache reads instead of normal input tokens (#​8075).
• Fixed inherited Google custom models ignoring thinkingLevelMap, which dropped extended thinking controls (#​8135).
• Fixed writes to auth.json and models-store.json overriding administrator-managed file permissions and ACLs (#​7779).
• Fixed UTF-8 BOM markers preventing frontmatter and user configuration files from loading (#​8337).
• Fixed invalid settings files being easy to miss during interactive startup by rendering warnings with the file path inside the TUI (#​7829).
• Fixed the subagent example repeatedly prompting before running project-local agents in trusted repositories (#​8261).
• Added session_compact_failed extension events so compaction failures and aborts expose their reason, retry state, source, and error message to handlers (#​8175).
• Fixed truncated compaction and branch summaries being persisted when generation reaches its output token limit (#​7048).
• Fixed npm package update checks treating older registry versions as available updates, preventing pi update from downgrading already-newer installed packages (#​8226).
• Fixed built-in llama.cpp models disappearing from /model when /llama refreshed a configured server under PI_OFFLINE, and included idle-slept sleeping router models plus autoloadable unloaded presets in the selectable catalog (#​8167).
• Fixed pi.registerFlag() accepting default values that do not match the declared flag type (#​8064).
• Fixed Z.AI Coding Plan defaults referencing the removed GLM-5.1 model (#​8096).
• Fixed repeated ambiguous truncated-response recovery being mislabeled as context overflow (#​8130).
• Fixed duplicate fullscreen right-click paste in VS Code-based terminals on Windows (#​8186).
• Fixed inherited padded text exceeding narrow terminal widths (#​8252).
• Fixed inherited wrapped Markdown table links leaking color into borders and neighboring cells, including tables inside blockquotes (#​8335).
• Fixed llama.cpp login guidance to direct users to /llama before /model when no local models are loaded (#​8203).
• Fixed hung pi.dev model catalog requests consuming the entire refresh deadline without retrying (#​8198).
• Fixed inherited Xiaomi model catalogs listing shut-down MiMo V2 models in /model and --list-models (#​8187).
• Fixed branch summary entries recording the navigation destination in fromId instead of the pre-navigation source leaf.
• Fixed threshold auto-compaction being skipped when providers omit streaming usage data (#​8328).
• Fixed dash-prefixed prompts being parsed as options by supporting -- as an end-of-options delimiter (#​7269).

securego/gosec (github.com/securego/gosec/v2)

v2.29.0

Compare Source

Changelog

• deb5446 analyzers/G703: stop treating Clean/Abs/PathEscape as path-traversal sanitizers (#​1723)
• 2e13f16 fix(junit): properly escape XML in failure text (#​1718)
• 3833037 fix(csv): capture and report write errors on flush (#​1716)
• f6d07d7 fix(report): root path matching in formatters (#​1719)
• 17d3916 fix(config): handle nosec tags with leading hash (#​1717)
• 3958f0e Update all dependencies (#​1720)
• 9c38a86 Add support for go version 1.27.0 and update to version 1.25.14 and 1… (#​1726)
• 2eb4727 Update all dependencies (#​1713)
• 5e72efc Update all dependencies (#​1710)
• 45b083a fix(G202): don't flag strings.Builder built from constants (#​1707)
• 82da19c ci: allow fork PR checkout in barry-ai-security-review job (#​1708)
• 9f7cd13 Update all dependencies (#​1709)
• 1769a22 Downgrade min Go version (#​1706)
• 5bb2909 Udpate action to use gosec v2.28.0 (#​1705)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Only on Wednesday (* * * * 3)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.