chore(deps-dev): bump the dev-dependencies group with 5 updates

Closed
DE
9d ago
+1800-1798

Bumps the dev-dependencies group with 5 updates:

PackageFromTo
@biomejs/biome2.5.142.5.15
@earendil-works/pi-coding-agent0.87.11.0.2
@earendil-works/pi-tui0.87.11.0.2
@types/node26.6.326.6.4
vitest5.0.25.0.3

Updates @biomejs/biome from 2.5.14 to 2.5.15

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.15

2.5.15

Patch Changes

  • #10634 b436ba0 Thanks @​subaru-hello! - Added the new nursery rule noReactObjectTypeAsDefaultProp, which disallows array, object, and function values as default props in React components.

    For example, the following snippet triggers the rule.

    function Component({ items = [] }) {
  return items;
}

  • #11956 faa8b37 Thanks @​dyc3! - Added the nursery rule noSvelteExportLet, which disallows declaring Svelte component props with the legacy export let syntax. Use the $props() rune instead.

    <script>
  export let name;
</script>

  • #10816 1b9479e Thanks @​Th3S4mur41! - Added a new nursery rule useLogicalProperties that enforces the use of logical properties in CSS, promoting better internationalization and accessibility practices. The rule supports a direction option with "ltr" as the default and "rtl" as the alternative. This is a first rule covering parts of #9034

    {
  "linter": {
    "rules": {
      "nursery": {
        "useLogicalProperties": {
          "level": "warn",
          "options": {
            "direction": "rtl"
          }
        }
      }
    }
  }
}

  • #11960 1fdb5c2 Thanks @​dyc3! - Added the nursery rule useSvelteKitRuneImports, which reports imports from the deprecated $app/stores module and suggests $app/state instead.

    import { page } from "$app/stores";

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.15

Patch Changes

  • #10634 b436ba0 Thanks @​subaru-hello! - Added the new nursery rule noReactObjectTypeAsDefaultProp, which disallows array, object, and function values as default props in React components.

    For example, the following snippet triggers the rule.

    function Component({ items = [] }) {
  return items;
}

  • #11956 faa8b37 Thanks @​dyc3! - Added the nursery rule noSvelteExportLet, which disallows declaring Svelte component props with the legacy export let syntax. Use the $props() rune instead.

    <script>
  export let name;
</script>

  • #10816 1b9479e Thanks @​Th3S4mur41! - Added a new nursery rule useLogicalProperties that enforces the use of logical properties in CSS, promoting better internationalization and accessibility practices. The rule supports a direction option with "ltr" as the default and "rtl" as the alternative. This is a first rule covering parts of #9034

    {
  "linter": {
    "rules": {
      "nursery": {
        "useLogicalProperties": {
          "level": "warn",
          "options": {
            "direction": "rtl"
          }
        }
      }
    }
  }
}

  • #11960 1fdb5c2 Thanks @​dyc3! - Added the nursery rule useSvelteKitRuneImports, which reports imports from the deprecated $app/stores module and suggests $app/state instead.

    import { page } from "$app/stores";

  • #11723 3b429d1 Thanks @​m1handr! - Fixed #11656: noAstroSetHtmlDirective now correctly reports set:html directives inside Astro template expressions.

... (truncated)

Commits

Updates @earendil-works/pi-coding-agent from 0.87.1 to 1.0.2

Release notes

Sourced from @​earendil-works/pi-coding-agent's releases.

v1.0.2

New Features

  • Sampling by thinking level — samplingParamsByThinkingLevel in models.json sets sampling parameters such as temperature and top_p for each thinking level on OpenAI-compatible APIs. See Configure sampling by thinking level.

Added

v1.0.1

New Features

  • Nix flake — nix run github:earendil-works/pi/stable runs the latest release, and nix profile add github:earendil-works/pi/stable installs it. See Install pi.
  • Project overrides for MCP servers — .pi/mcp.json and /mcp can enable, disable, or change the exposure of a user-level server for one project. See Configure servers.
  • MCP Client ID Metadata Documents — oauth.clientRegistration: "cimd" lets authorization servers allow pi by its document URL instead of dynamic registration. See Authenticate with OAuth.
  • Tool renderers for any tool — pi.registerToolRenderer() draws calls to tools that are not registered yet, such as MCP tools in resumed sessions. See Tool rendering.
  • Cloudflare Clef classifiers — @cf/cloudflare/clef and @cf/cloudflare/clef-flash are usable from codemode scripts and extensions. See Use classifier models.

Added

  • Added a copy key (app.message.copy, default ctrl+x) to OAuth sign-in screens in /login, /mcp, and /mcp login, which copies the sign-in URL when the browser cannot be opened or the wrapped link cannot be selected.
  • Added oauth.clientRegistration: "cimd" for MCP servers, which identifies pi with its Client ID Metadata Document on pi.dev instead of dynamic client registration, so authorization servers can allow pi by URL (#10302)
  • Added project overrides for user-level MCP servers: a .pi/mcp.json entry without command or url sets only enabled, exposure, and toolExposure of the user-level server, and /mcp can enable or disable a server for the current project (#10277)
  • Added Cloudflare's Clef and Clef Flash classifier models to cloudflare-workers-ai, usable from codemode scripts and extensions (#10316 by @​ndisidore, #10322 by @​RealAlexandreAI)
  • Added pi.registerToolRenderer(), which chooses how calls to a tool are drawn, including tools that are not registered (#10285)
  • Added a Nix flake for macOS and Linux: nix run github:earendil-works/pi/stable runs the latest release, and nix profile add github:earendil-works/pi/stable installs it. See Install pi (#9137)

Changed

  • pi update on global npm installations now recommends migrating to the managed installation from the pi.dev installer, which pins all dependencies.
  • Anthropic tools added or redefined mid-conversation are now defined inline in the conversation, so redefining a tool under the same name keeps the prompt cache instead of resending the full tool list.

Fixed

  • Fixed installations resolving vulnerable brace-expansion 5.0.9 by pinning brace-expansion 5.0.12 as a direct dependency (GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7, GHSA-6j4f-fj2g-mc7p) (#10288)
  • Fixed a trailing comma in --models adding an extra model to the model cycle (#10334)
  • Fixed a codemode script that prints in a loop crashing pi by running out of memory: a script fails once its output passes 16 Mi characters or 100000 items (#10283)
  • Fixed JPEG, GIF, and WebP images rendered by extensions through Image not appearing in Kitty, Ghostty, WezTerm, and Warp (#10292)
  • Fixed MCP tool calls in resumed sessions and HTML exports rendering fully expanded until their server connected, or for good if it never did (#10285)
  • Fixed fullscreen Kitty images collapsing to a one-row strip after scrolling in WezTerm (#10319)
  • Fixed "Selected model is at capacity" provider errors ending the turn instead of being retried (#10278)
  • Fixed Cloudflare AI Gateway Claude models failing with a 404 by using dashed model IDs (claude-opus-5-5 instead of claude-opus-5.5)
  • Fixed Sign in with ChatGPT continuing when its callback port is taken by another login, which made the browser show "OAuth state mismatch"; it now fails with a port-in-use error (#10265)
  • Fixed Amazon Bedrock OpenAI models costing requests above 272k input tokens at the short-context rate; Bedrock models now include the pricing tiers listed on models.dev (#10326)
  • Fixed Amazon Bedrock Claude requests failing with "Invalid signature in thinking block" after the system prompt or tools changed (#10324)
  • Fixed Together DeepSeek V4 Pro losing its thinking level controls after Together renamed it to deepseek-ai/DeepSeek-V4-Pro-0813 (#10336 by @​cv)
  • Fixed the default NVIDIA model pointing at nvidia/nemotron-3-super-120b-a12b, which NVIDIA no longer serves; the default is now nvidia/nemotron-3-ultra-550b-a55b

Removed

... (truncated)

Changelog

Sourced from @​earendil-works/pi-coding-agent's changelog.

[1.0.2] - 2026-10-04

New Features

  • Sampling by thinking level — samplingParamsByThinkingLevel in models.json sets sampling parameters such as temperature and top_p for each thinking level on OpenAI-compatible APIs. See Configure sampling by thinking level.

Added

[1.0.1] - 2026-10-03

New Features

  • Nix flake — nix run github:earendil-works/pi/stable runs the latest release, and nix profile add github:earendil-works/pi/stable installs it. See Install pi.
  • Project overrides for MCP servers — .pi/mcp.json and /mcp can enable, disable, or change the exposure of a user-level server for one project. See Configure servers.
  • MCP Client ID Metadata Documents — oauth.clientRegistration: "cimd" lets authorization servers allow pi by its document URL instead of dynamic registration. See Authenticate with OAuth.
  • Tool renderers for any tool — pi.registerToolRenderer() draws calls to tools that are not registered yet, such as MCP tools in resumed sessions. See Tool rendering.
  • Cloudflare Clef classifiers — @cf/cloudflare/clef and @cf/cloudflare/clef-flash are usable from codemode scripts and extensions. See Use classifier models.

Added

  • Added a copy key (app.message.copy, default ctrl+x) to OAuth sign-in screens in /login, /mcp, and /mcp login, which copies the sign-in URL when the browser cannot be opened or the wrapped link cannot be selected.
  • Added oauth.clientRegistration: "cimd" for MCP servers, which identifies pi with its Client ID Metadata Document on pi.dev instead of dynamic client registration, so authorization servers can allow pi by URL (#10302)
  • Added project overrides for user-level MCP servers: a .pi/mcp.json entry without command or url sets only enabled, exposure, and toolExposure of the user-level server, and /mcp can enable or disable a server for the current project (#10277)
  • Added Cloudflare's Clef and Clef Flash classifier models to cloudflare-workers-ai, usable from codemode scripts and extensions (#10316 by @​ndisidore, #10322 by @​RealAlexandreAI)
  • Added pi.registerToolRenderer(), which chooses how calls to a tool are drawn, including tools that are not registered (#10285)
  • Added a Nix flake for macOS and Linux: nix run github:earendil-works/pi/stable runs the latest release, and nix profile add github:earendil-works/pi/stable installs it. See Install pi (#9137)

Changed

  • pi update on global npm installations now recommends migrating to the managed installation from the pi.dev installer, which pins all dependencies.
  • Anthropic tools added or redefined mid-conversation are now defined inline in the conversation, so redefining a tool under the same name keeps the prompt cache instead of resending the full tool list.

Fixed

  • Fixed installations resolving vulnerable brace-expansion 5.0.9 by pinning brace-expansion 5.0.12 as a direct dependency (GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7, GHSA-6j4f-fj2g-mc7p) (#10288)
  • Fixed a trailing comma in --models adding an extra model to the model cycle (#10334)
  • Fixed a codemode script that prints in a loop crashing pi by running out of memory: a script fails once its output passes 16 Mi characters or 100000 items (#10283)
  • Fixed JPEG, GIF, and WebP images rendered by extensions through Image not appearing in Kitty, Ghostty, WezTerm, and Warp (#10292)
  • Fixed MCP tool calls in resumed sessions and HTML exports rendering fully expanded until their server connected, or for good if it never did (#10285)
  • Fixed fullscreen Kitty images collapsing to a one-row strip after scrolling in WezTerm (#10319)
  • Fixed "Selected model is at capacity" provider errors ending the turn instead of being retried (#10278)
  • Fixed Cloudflare AI Gateway Claude models failing with a 404 by using dashed model IDs (claude-opus-5-5 instead of claude-opus-5.5)
  • Fixed Sign in with ChatGPT continuing when its callback port is taken by another login, which made the browser show "OAuth state mismatch"; it now fails with a port-in-use error (#10265)
  • Fixed Amazon Bedrock OpenAI models costing requests above 272k input tokens at the short-context rate; Bedrock models now include the pricing tiers listed on models.dev (#10326)
  • Fixed Amazon Bedrock Claude requests failing with "Invalid signature in thinking block" after the system prompt or tools changed (#10324)
  • Fixed Together DeepSeek V4 Pro losing its thinking level controls after Together renamed it to deepseek-ai/DeepSeek-V4-Pro-0813 (#10336 by @​cv)
  • Fixed the default NVIDIA model pointing at nvidia/nemotron-3-super-120b-a12b, which NVIDIA no longer serves; the default is now nvidia/nemotron-3-ultra-550b-a55b

... (truncated)

Commits
  • cd32f77 Release v1.0.2
  • 750105c docs(ai,coding-agent): move #9776 changelog entries to Unreleased
  • 76dfb88 feat(ai): add per-thinking-level sampling parameters (#9776)
  • 4c6fb7c Add [Unreleased] section for next cycle
  • a7229dd Release v1.0.1
  • 49b9df4 fix(coding-agent): default NVIDIA to Nemotron 3 Ultra
  • 4215d4d docs(ai,coding-agent): audit changelog entries since v1.0.0
  • 1144973 fix(coding-agent): render MCP tool calls before their server connects
  • a276dab fix(tui,coding-agent): convert non-PNG images for Kitty in Image
  • 1387af7 feat(coding-agent): allow project mcp.json to override enabled and exposure o...
  • Additional commits viewable in compare view

Updates @earendil-works/pi-tui from 0.87.1 to 1.0.2

Release notes

Sourced from @​earendil-works/pi-tui's releases.

v1.0.2

New Features

  • Sampling by thinking level — samplingParamsByThinkingLevel in models.json sets sampling parameters such as temperature and top_p for each thinking level on OpenAI-compatible APIs. See Configure sampling by thinking level.

Added

v1.0.1

New Features

  • Nix flake — nix run github:earendil-works/pi/stable runs the latest release, and nix profile add github:earendil-works/pi/stable installs it. See Install pi.
  • Project overrides for MCP servers — .pi/mcp.json and /mcp can enable, disable, or change the exposure of a user-level server for one project. See Configure servers.
  • MCP Client ID Metadata Documents — oauth.clientRegistration: "cimd" lets authorization servers allow pi by its document URL instead of dynamic registration. See Authenticate with OAuth.
  • Tool renderers for any tool — pi.registerToolRenderer() draws calls to tools that are not registered yet, such as MCP tools in resumed sessions. See Tool rendering.
  • Cloudflare Clef classifiers — @cf/cloudflare/clef and @cf/cloudflare/clef-flash are usable from codemode scripts and extensions. See Use classifier models.

Added

  • Added a copy key (app.message.copy, default ctrl+x) to OAuth sign-in screens in /login, /mcp, and /mcp login, which copies the sign-in URL when the browser cannot be opened or the wrapped link cannot be selected.
  • Added oauth.clientRegistration: "cimd" for MCP servers, which identifies pi with its Client ID Metadata Document on pi.dev instead of dynamic client registration, so authorization servers can allow pi by URL (#10302)
  • Added project overrides for user-level MCP servers: a .pi/mcp.json entry without command or url sets only enabled, exposure, and toolExposure of the user-level server, and /mcp can enable or disable a server for the current project (#10277)
  • Added Cloudflare's Clef and Clef Flash classifier models to cloudflare-workers-ai, usable from codemode scripts and extensions (#10316 by @​ndisidore, #10322 by @​RealAlexandreAI)
  • Added pi.registerToolRenderer(), which chooses how calls to a tool are drawn, including tools that are not registered (#10285)
  • Added a Nix flake for macOS and Linux: nix run github:earendil-works/pi/stable runs the latest release, and nix profile add github:earendil-works/pi/stable installs it. See Install pi (#9137)

Changed

  • pi update on global npm installations now recommends migrating to the managed installation from the pi.dev installer, which pins all dependencies.
  • Anthropic tools added or redefined mid-conversation are now defined inline in the conversation, so redefining a tool under the same name keeps the prompt cache instead of resending the full tool list.

Fixed

  • Fixed installations resolving vulnerable brace-expansion 5.0.9 by pinning brace-expansion 5.0.12 as a direct dependency (GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7, GHSA-6j4f-fj2g-mc7p) (#10288)
  • Fixed a trailing comma in --models adding an extra model to the model cycle (#10334)
  • Fixed a codemode script that prints in a loop crashing pi by running out of memory: a script fails once its output passes 16 Mi characters or 100000 items (#10283)
  • Fixed JPEG, GIF, and WebP images rendered by extensions through Image not appearing in Kitty, Ghostty, WezTerm, and Warp (#10292)
  • Fixed MCP tool calls in resumed sessions and HTML exports rendering fully expanded until their server connected, or for good if it never did (#10285)
  • Fixed fullscreen Kitty images collapsing to a one-row strip after scrolling in WezTerm (#10319)
  • Fixed "Selected model is at capacity" provider errors ending the turn instead of being retried (#10278)
  • Fixed Cloudflare AI Gateway Claude models failing with a 404 by using dashed model IDs (claude-opus-5-5 instead of claude-opus-5.5)
  • Fixed Sign in with ChatGPT continuing when its callback port is taken by another login, which made the browser show "OAuth state mismatch"; it now fails with a port-in-use error (#10265)
  • Fixed Amazon Bedrock OpenAI models costing requests above 272k input tokens at the short-context rate; Bedrock models now include the pricing tiers listed on models.dev (#10326)
  • Fixed Amazon Bedrock Claude requests failing with "Invalid signature in thinking block" after the system prompt or tools changed (#10324)
  • Fixed Together DeepSeek V4 Pro losing its thinking level controls after Together renamed it to deepseek-ai/DeepSeek-V4-Pro-0813 (#10336 by @​cv)
  • Fixed the default NVIDIA model pointing at nvidia/nemotron-3-super-120b-a12b, which NVIDIA no longer serves; the default is now nvidia/nemotron-3-ultra-550b-a55b

Removed

... (truncated)

Changelog

Sourced from @​earendil-works/pi-tui's changelog.

[1.0.2] - 2026-10-04

[1.0.1] - 2026-10-03

Added

  • Added setImageTranscoder(), which lets Image convert JPEG, GIF, and WebP images to PNG for the Kitty graphics protocol (#10292)

Fixed

  • Fixed non-PNG images rendering as nothing on Kitty-protocol terminals: without a registered transcoder, or when conversion fails, Image now shows its text fallback (#10292)
  • Fixed fullscreen Kitty images collapsing to a one-row strip after scrolling in WezTerm (#10319).

[1.0.0] - 2026-10-01

Added

  • Added TuiAltScreen.getScreenLines(), which returns the lines of the last rendered frame.

Fixed

  • Fixed color bleeding past mouse selections and search highlights in fullscreen mode when a styled token ends at the highlight boundary (#10169)
  • Fixed memory retained per rendered message: Markdown holds its parsed tokens weakly, and Markdown, Text, and Box flatten their cached lines. A long assistant message keeps about a fifth of the heap it kept before.
  • Fixed slash command autocompletion not triggering when the input starts with whitespace (#10218 by @​haoqixu)

[0.99.2] - 2026-09-30

[0.99.1] - 2026-09-29

[0.99.0] - 2026-09-29

Breaking Changes

  • Replaced TUI.queryTerminalColorScheme() and TUI.queryTerminalBackgroundColor() with TUI.queryTerminalColors(), which queries the default foreground, background, and 16 ANSI colors (OSC 10, 11, and 4) in one round trip and returns TerminalColors. Removed parseOsc11BackgroundColor().

Added

  • Added "auto" to TuiAltScreenOptions.wheelScrollLines, which accelerates fast wheel spins on terminals that send one event per notch, and TuiAltScreen.setWheelScrollLines() for runtime updates (#9758).
  • Added color values and styling: the Color type (indexed ANSI, sRGB, or OKLCH), parseColor() for #rgb, #rrggbb, oklch(), and okhsl() values, indexedColor(), rgbColor(), oklchColor(), okhslColor(), mixColors(), colorToHex(), colorToRgb(), colorToOklch(), colorToOkhsl(), styleText(), getTerminalColorMode(), and related helpers.
  • Added NativeClipboard.getFilePaths(), which reads file URLs from the macOS clipboard (#9999, #10136 by @​christianklotz).

Changed

  • Terminals with TERM=*-direct are now detected as truecolor.

Fixed

  • Fixed /skill autocomplete appearing empty when loaded skill names did not contain the letters in skill (#9944).
  • Fixed path and @ autocomplete not working after opening wrappers such as (, [, {, <, or a backtick, e.g. (~/Dev<Tab>.
  • Reduced image stretching in terminals that use the Kitty graphics protocol (#8938, #9957 by @​rwachtler).

... (truncated)

Commits
  • cd32f77 Release v1.0.2
  • 4c6fb7c Add [Unreleased] section for next cycle
  • a7229dd Release v1.0.1
  • a276dab fix(tui,coding-agent): convert non-PNG images for Kitty in Image
  • 672000c fix(tui): preserve WezTerm images while scrolling
  • 86dfcee Add [Unreleased] section for next cycle
  • a13d35a Release v1.0.0
  • 92fc452 docs: audit changelogs and add new features for next release
  • ca9c925 fix(coding-agent): show text wordmark instead of logo in Apple Terminal
  • 54c19a2 fix(tui): reduce memory retained per rendered message
  • Additional commits viewable in compare view

Updates @types/node from 26.6.3 to 26.6.4

Commits

Updates vitest from 5.0.2 to 5.0.3

Release notes

Sourced from vitest's releases.

v5.0.3

   🐞 Bug Fixes

    View changes on GitHub
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Summary by cubic

Bumps five dev dependencies, including major version jumps for @earendil-works/pi-coding-agent (0.87.1 → 1.0.2) and @earendil-works/pi-tui (0.87.1 → 1.0.2). Minor/patch bumps cover @biomejs/biome (2.5.15), @types/node (26.6.4), and vitest (5.0.3).

  • @earendil-works/pi-tui 1.0.0 replaces TUI.queryTerminalColorScheme() and TUI.queryTerminalBackgroundColor() with TUI.queryTerminalColors() and removes parseOsc11BackgroundColor().
  • @biomejs/biome 2.5.15 adds several nursery rules (noReactObjectTypeAsDefaultProp, noSvelteExportLet, useLogicalProperties, useSvelteKitRuneImports) that only take effect if enabled.