Skip to content

fix(deps): update pi extension dependency closure - #82

Closed
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/pi-extension-dependency-closure
Closed

fix(deps): update pi extension dependency closure#82
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/pi-extension-dependency-closure

Conversation

@renovate

@renovate renovate Bot commented Aug 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
@biomejs/biome (source) ^2.5.8 → ^2.5.9 age confidence
@juicesharp/rpiv-ask-user-question (source) 2.5.2 → 2.6.1 age confidence
@juicesharp/rpiv-todo (source) 2.5.2 → 2.6.1 age confidence
@juicesharp/rpiv-web-tools (source) 2.5.2 → 2.6.1 age confidence
@plannotator/pi-extension (source) 0.27.3 → 0.27.4 age confidence
@quintinshaw/pi-dynamic-workflows 3.5.1 → 3.6.0 age confidence
pi-mcp-adapter 2.25.0 → 2.26.0 age confidence
pi-subagents 0.49.0 → 0.50.0 age confidence
typebox 1.3.14 → 1.3.15 age confidence

Release Notes

biomejs/biome (@​biomejs/biome)

v2.5.9

Compare Source

Patch Changes

  • #​11321 41386f3 Thanks @​dyc3! - Fixed #​11315: The CSS parser now recovers at declaration boundaries after bogus declarations, allowing subsequent valid declarations to be parsed.

  • #​11248 57b197e Thanks @​yanthomasdev! - Expanded the environment variable metadata used by biome rage to include BIOME_BINARY, BIOME_LOG_FILE, and RUST_BACKTRACE as well as reworded explanations for better readability.

  • #​11377 a8798ea Thanks @​Netail! - Added a new nursery rule useNamedLayer which disallows anonymous cascade layers.

    @layer {
  a {
    color: red;
  }
}

  • #​11327 6771cf5 Thanks @​dyc3! - The HTML formatter now preserves meaningful blank lines in HTML, including spacing after elements with trailing spaces and blank lines between comment groups.

     <div>
   <!-- first group -->
+
   <!-- second group -->
 </div>

  • #​10312 ba8aa18 Thanks @​dyc3! - Added the nursery rule useTailwindShorthandClasses, which suggests shorter Tailwind utility classes. For example, the rule suggests replacing w-4 h-4 with size-4.

  • #​11333 715e0cd Thanks @​kkkhs! - Fixed #​11328: lint/nursery/useExpect now recognizes Vitest Browser Mode expect.element() calls as assertions.

  • #​11343 9b98211 Thanks @​johncarmack1984! - Fixed #​11311: the CSS parser now accepts Tailwind container-query variant names in @variant, such as @xl and @max-xl. These previously produced a parse error and a noUnknownAtRules diagnostic.

    @variant @xl {
  div {
    background: red;
  }
}

  • #​11220 3e8c488 Thanks @​santichausis! - Fixed #​9541: noUndeclaredVariables, noUnusedImports, and noUnusedVariables now correctly recognise exported variables and functions declared in one embedded <script> block as usable from a sibling <script> block, in Svelte's <script module>/<script> pair and Vue's non-setup <script> blocks.

    For example, Biome no longer reports greet as undeclared in the following Svelte component:

    <script module>
  export function greet() {
    console.log("Hello!");
  }
</script>

<script>
  greet();
</script>

  • #​11300 36430eb Thanks @​dyc3! - Fixed the HTML formatter's whitespace handling for marquee, noscript, video, audio, and object elements.

    - <marquee behavior="alternate"> This text will bounce </marquee>
+ <marquee behavior="alternate">This text will bounce</marquee>

  • #​11299 6559e6c Thanks @​jp-knj! - Added the nursery rule useAstroClientOnlyDirectiveValue, which reports Astro client:only directives without an initializer.

    For example, <Component client:only /> triggers the rule.

  • #​11365 7529811 Thanks @​MHJahanbakhsh! - Fixed #​11229: The useGenericFontNames rule now treats math as a valid generic font family.

  • #​11346 674f5f4 Thanks @​Jayllyz! - Fixed #​11335: noComponentHookFactories now reports a use-prefixed variable only when a function is assigned to it directly.

    function factory() {
  const useColors = true; // no longer reported
  const useStore = createStore({ count: 0 }); // no longer reported
  const useData = () => useState(null); // still reported
  return useColors;
}

  • #​11334 c87c46a Thanks @​zkasuran! - Fixed #​11317: noSvgWithoutTitle no longer reports an svg that uses the boolean shorthand aria-hidden (equivalent to aria-hidden={true} in React).

  • #​11364 13853b1 Thanks @​ematipico! - Fixed a bug where useJsxKeyInIterable incorrectly flagged Astro files.

  • #​11321 41386f3 Thanks @​dyc3! - Fixed #​11315: Invalid CSS declarations in HTML style attributes now produce parser diagnostics instead of causing a panic.

  • #​11325 67c3bf0 Thanks @​dyc3! - Fixed HTML text wrapping to account for the width of an adjacent closing tag, avoiding lines that exceed the configured width when the final word and tag must move together.

     <a-long-long-long-element
-  >foo bar foo bar foo bar foo bar foo bar foo bar foo bar</a-long-long-long-element
+  >foo bar foo bar foo bar foo bar foo bar foo
+  bar</a-long-long-long-element
 >

  • #​11367 fe5b5d4 Thanks @​ematipico! - Fixed TypeScript compilerOptions.paths resolution when mapping targets omit ./. Biome now resolves these targets relative to their configured path base.

  • #​11316 17e48d6 Thanks @​wanxiankai! - Fixed #​11289: the safe fix for noExtraBooleanCast now preserves parentheses around nested conditional expressions.

  • #​11254 d25d113 Thanks @​dyc3! - Fixed #​11242: Biome no longer crashes with an access violation when analysing files on Windows ARM64.

  • #​11221 85aac73 Thanks @​freeatnet! - Added the nursery rule noUnsafeTypeAssertion, which disallows TypeScript type assertions while allowing const assertions.

    const value = input as SomeType;

  • #​11314 7ffb677 Thanks @​ematipico! - Fixed #​11310: Restored the performance of noMisusedPromises and noFloatingPromises when analyzed expressions share deep imported type paths.

  • #​11356 6cd3263 Thanks @​johncarmack1984! - The Tailwind parser now understands modifiers on bare utilities (@container/sidebar, shadow/50).

  • #​11318 76059e9 Thanks @​johncarmack1984! - The Tailwind parser now understands container-query variants (@sm:, @max-lg:, @min-[400px]:) and child and descendant variants (*:, **:).

  • #​11357 faa2074 Thanks @​johncarmack1984! - The Tailwind parser now accepts the legacy leading ! important marker (!flex, hover:!p-4).

  • #​11344 f34e15c Thanks @​johncarmack1984! - The Tailwind parser now understands combinator selectors in arbitrary variants (has-[>svg]:, has-[+p]:), modifiers on variants (group-hover/menu:, @sm/main:), and arbitrary container-query sizes (@[400px]:).

  • #​11324 2f5d452 Thanks @​dyc3! - Fixed HTML formatting that inserted rendered whitespace between an element and touching text when the line wrapped.

      <div>
-   before<meter value=".5"></meter>
-   after
+   before<meter value=".5"></meter
+   >after
  </div>

  • #​11312 e65f07e Thanks @​xosnos! - Added a new nursery rule useControlLabel for both HTML and JSX, which reports interactive control elements (button, menuitem) without an accessible label.

    <button />

  • #​11364 13853b1 Thanks @​ematipico! - Fixed SVG parsing for files with an XML declaration followed by a PUBLIC doctype, such as <?xml version="1.0"?><!DOCTYPE svg PUBLIC "a" "b">.

  • #​11301 610ee28 Thanks @​dyc3! - Fixed parent tag wrapping when an HTML element starts or ends with a block-like or hidden child such as source, track, or param.

    - <video src="brave.webm"><track kind="subtitles" src="brave.en.vtt"></video>
+ <video src="brave.webm">
+   <track kind="subtitles" src="brave.en.vtt">
+ </video>
juicesharp/rpiv-mono (@​juicesharp/rpiv-ask-user-question)

v2.6.1

Compare Source

Added
  • New guidance.description config field: a non-empty string in $XDG_CONFIG_HOME/rpiv-ask-user-question/config.json now replaces the entire built-in ask_user_question tool description (no merging); empty or non-string values keep the default. Note: a description key that previously sat unused under guidance now takes effect.
  • Package card cover on pi.dev: package.json now declares pi.image pointing at the package's docs/cover.png.

v2.6.0

Compare Source

Added
  • The questionnaire emits one standard terminal BEL (\x07) when it starts waiting for input in an interactive TTY — terminal configuration decides whether that is an audible alert, a visual alert, or nothing. Redirected and non-TTY output (including RPC pipes) is untouched (#​140).
juicesharp/rpiv-mono (@​juicesharp/rpiv-todo)

v2.6.1

Compare Source

Added
  • Package card cover on pi.dev: package.json now declares pi.image pointing at the package's docs/cover.png.

v2.6.0

Compare Source

juicesharp/rpiv-mono (@​juicesharp/rpiv-web-tools)

v2.6.1

Compare Source

Added
  • Package card cover on pi.dev: package.json now declares pi.image pointing at the package's docs/cover.png.
Changed
  • readConfig now degrades per field on a schema violation instead of returning an empty config: only the offending paths are dropped (schema-driven via Value.Errors), so one wrong-typed leaf — e.g. guidance.web_search.description after its enrollment in the shared GuidanceFieldsSchema — no longer wipes provider, API keys, base URLs, interceptors and guidance for the session (or on disk via the next /web-tools save). An empty config remains the floor when nothing salvageable is left; unknown-key pass-through is unchanged.

v2.6.0

Compare Source

backnotprop/plannotator (@​plannotator/pi-extension)

v0.27.4

Compare Source

Follow @​plannotator on X for updates

Missed recent releases?
Release Highlights
v0.27.3 Folder watcher freeze fix on large repos, first SBOM-attested release pipeline
v0.27.2 Mobile plan and code review, Codex CLI 0.147 fix, folder annotate cold-start, configurable markdown extensions
v0.27.1 Open-in-editor launch fix, file headers respect Viewed/Git-add visibility toggles
v0.27.0 Call Flow analysis, --tailscale remote reviews, review panel remembers your view, Pi rebuild (breaking command rename), focus-mode shortcut
v0.26.8 Placed comment markers on HTML pages, shift-click multi-select, live app annotation
v0.26.7 Pinpoint targets any element on HTML pages, smarter hover labels, zero-scan hit testing
v0.26.6 Fixed empty environment variables in sandboxed sessions (Bun 1.3.14 builds)
v0.26.5 HTML pinpoint element annotations, durable annotate submissions, installer fallback for old git, vim HUD cursor fix
v0.26.4 Skill-menu hover jitter fix (same-day patch on v0.26.3)
v0.26.3 Skill references in comments with / or $, reachable remote session URLs, worktree switcher tooltips
v0.26.2 Single-file diff tabs render fully, no more silently dropped review files, light/dark theme pairs, palette-matched code blocks
v0.26.1 GitButler 0.22.0 compatibility via capability-probed JSON flags

What's New in v0.27.4

A Guided Review can now leave Plannotator. This release ships portable guide exports, share links on guides.show, and a guide CLI any agent can drive, alongside a favicon style switcher, jj support for Call Flow, GitLab artifact fixes in PR review, and a smoother call-flow Lens. Eighteen PRs, four from community contributors, two of them first-timers.

Portable Guided Reviews and guides.show

Guided Reviews used to live and die inside your review session. Now a guide has three ways out:

Download it. Every guide gets a "Download portable guide" button that produces one HTML file containing the full guide and the diff it describes. It opens anywhere, renders exactly like the in-app guide with side-by-side diffs and per-section reviewed checkboxes, and needs no Plannotator install. The file stays small because it carries your content, not the renderer: the viewer loads from guides.show, pinned by filename and cryptographic checksum, so a tampered or wrong viewer never executes. Offline, the file degrades to a readable plain-text version of the guide.

Share it. "Create share link" uploads the guide to guides.show and hands you a link anyone can open in a browser. Shares are end-to-end encrypted by default: the key lives in the URL fragment after the #, which browsers never send to the server, so guides.show stores bytes it cannot read. You also get a one-time delete token, and "Remove link" works from the same dialog for as long as that Plannotator remembers the share. An optional "Allow link previews" checkbox stores the guide unencrypted so chat apps can show its title; that is a choice, never the default. Setting PLANNOTATOR_SHARE=disabled turns all of this off.

Author it from anywhere. The new plannotator guide subcommands (list, export, share, unshare) let any agent or script produce and publish a guide from a guide JSON and a patch, without a browser in the loop.

Saved guides from v0.27.x load unchanged. The share service runs on Cloudflare with add-only, content-hashed viewer publishing and per-IP rate limiting on creation.

Choose your favicon: Totman or the classic P

The browser-tab icon is now a setting. Appearance settings offer two styles with visual previews: Totman, the current mascot, and Classic P, the original Plannotator mark restored byte-for-byte from the pre-mascot era. The server remembers your choice and serves it directly, so tabs show the right icon from the first paint without flashing the default. Hosts that embed the published UI packages are unaffected unless they opt in.

Call Flow analysis on jj repositories

Call Flow previously required a plain Git checkout. Reviews running on jj (Jujutsu) colocated repos now get the same changed-call-path analysis: the jj snapshot is resolved to the underlying Git objects and fed to the same CallDiff engine, with the same per-file Lens and dock views. Diff collection is untouched; this only extends where the analysis can run.

GitLab PR artifacts fetch reliably and more safely

Reviewing GitLab merge requests with uploaded artifacts (screenshots, logs, design files) got a hardening pass. Uploads now fetch through the authenticated API with a strict rewrite that only touches real upload URLs, falls back to the original web route when a self-hosted GitLab predates the API route, maps 401/403 responses to a clear "run glab auth login" hint, and no longer serves HTML or JavaScript content types through the artifact proxy. A regression test pins the invariant that credentials never follow a cross-origin redirect.

The call-flow Lens stops fighting your scroll

Community feedback within hours of trying Call Flow in Safari: the per-file Lens popover closed randomly mid-scroll and popped open for every badge that passed under the cursor. Three causes, three fixes: the Lens's internal scroll no longer chains to the page when momentum hits its edge (the chain moved the popup out from under a stationary pointer, which read as a random close and was worst under Safari rubber-banding); hover now has a 100ms intent delay so drive-by badges stay closed; and an in-flight page scroll holds any pending close until the scroll settles.

Reported by Rustan (@​acewhocares on X).

Additional Changes
  • Touch selection survives the comment composer. On phones and tablets, dragging a multi-line range in a single-file diff no longer collapses the selection when the composer opens; the range you dragged is the range you comment on. #​1333
  • Skill picker works with screen readers. The / and $ skill reference menu now exposes real listbox semantics with option roles and active-descendant tracking, so assistive tech announces what Enter will insert, closing #​1233. #​1316 by @​ashish921998
  • Blog: an interactive UI for the grill-me skill. A new post on using /plannotator-last as the review surface for Matt Pocock's grill-me workflow, at plannotator.ai. #​1321, #​1322, #​1323, #​1332
  • Security page linked from the site footer. #​1305

Install / Update

macOS / Linux:

curl -fsSL https://plannotator.ai/install.sh | bash

Windows:

irm https://plannotator.ai/install.ps1 | iex

Claude Code Plugin: Run /plugin in Claude Code, find plannotator, and click "Update now".

OpenCode: Clear cache and restart:

rm -rf ~/.bun/install/cache/@plannotator

What's Changed

New Contributors

Contributors

Four community authors shipped code in this release, two for the first time:

  • @​FNDEVVE built the favicon style switcher in #​1325, including restoring the classic P icon exactly as it shipped before the mascot era, and worked through a review round that added server-side icon serving so the choice applies without a flash. Their second contribution.
  • @​graemefolk extended Call Flow analysis to jj repositories in #​1312, their third contribution to Plannotator's jj support, which they have carried since the original provider landed.
  • @​yuensunn fixed GitLab merge request artifacts in #​1228, their first contribution, and stuck with it through a security-focused review round on the URL rewrite.
  • @​ashish921998 made the skill reference menu real for screen reader users in #​1316, their first contribution.
  • Rustan (@​acewhocares on X) test-drove Call Flow in Safari and reported the Lens scroll behavior that #​1338 fixes, hours after trying the feature.

Full Changelog: backnotprop/plannotator@v0.27.3...v0.27.4

QuintinShaw/pi-dynamic-workflows (@​quintinshaw/pi-dynamic-workflows)

v3.6.0

Compare Source

What's Changed

New Contributors

Full Changelog: QuintinShaw/pi-dynamic-workflows@v3.5.1...v3.6.0

nicobailon/pi-mcp-adapter (pi-mcp-adapter)

v2.26.0

Compare Source

Added
  • Added per-server requestHeadersCommand support for deriving fail-closed HTTP headers from the exact outbound request on every Streamable HTTP or SSE call. Thanks @​kgreen18 for PR #​353.
  • Added settings.warnOnLargeDirectTools to suppress the advisory for 75 or more resolved direct tools. Thanks @​Roshvan for issue #​358.
Changed
  • Refined request-header command result handling types without changing runtime behavior.
Fixed
  • Matched adapter-owned config and state paths to the host agent directory when Pi is rebranded, including its environment override and config directory. Thanks @​mindplay-dk for issue #​356.
  • Avoided O(tools²) cross-server tool-name collision scans at startup by skipping collision candidates when selectors are absent and sharing one indexed candidate set when includeTools or excludeTools is configured. Thanks @​mjlbach for PR #​357 and @​cataldoc for issue #​354.
nicobailon/pi-subagents (pi-subagents)

v0.50.0

Compare Source

Added
  • Add optional Orca progress tabs with bounded, sanitized mirrors for native Pi and external CLI children. Thanks to @​hyein-cbio for #​1080.
  • Show caller-owned external jobs in FleetView through a bounded push/cache API, without polling or exposing managed controls. Thanks to @​ssyram for #​1083.
  • Add a bounded current-status snapshot for async runs in RPC surfaces, without replaying terminal history. Thanks to @​yanqianglu for #​1078.
  • Add an optional foregroundDetachShortcut binding and show it in the running single-subagent card, so foreground work can be moved to the background without editing package source. Thanks to @​Lewis-E for #​1097.
Changed
  • Clarify retained-child resumability and native supervisor coordination guidance. Thanks to @​ELA718 for #​1126.
  • Clarify that completed retained writers should use resume, while steer with mode: "follow_up" only queues text for the next revival (#​1104).
  • Treat oracle/advisor consultation prompts as supervisor-backed dialogue when material unknowns remain (#​1102).
  • Show explicit resumable and not-resumable states, with fallback guidance, in retained child listings (#​1101).
  • Reduce reload work for large async histories by indexing the async result inbox by session, observer, and tool-call id instead of scanning every old result file. Stale terminal active markers now age out, and replay cleanup scans run less often.
Fixed
  • Keep Orca progress tabs from treating write-stream backpressure as mirror truncation.
  • Stop advertising an output-<index>.log artifact in run transcripts when that file was never written, so workflow runs no longer point at a path that cannot exist. Thanks to @​lbijeau for #​1124.
  • Keep FleetView working when a session file path is longer than a short identity, instead of failing external-job inspection on every poll. Thanks to @​albertgwo for #​1121 and @​Don-Yin for #​1122.
  • Keep structured single-child runs from overriding output paths in the task, while preserving explicit and agent-configured outputs. Thanks to @​pasemes for #​1119.
  • Keep no-edit confirmations guarded after later changes retract a prior implementation (#​1115).
  • Remove the native generic intercom compatibility fallback from supervisor coordination while preserving contact_supervisor, subagent_supervisor, and external intercom providers. Thanks to @​jaudiger for #​1107.
  • Report an actionable project-settings override when duplicate ambient Pi extensions prevent a child from starting (#​1114).
  • Keep the FleetView overlay refreshed while open and count active leaf agents in the compact summary. Thanks to @​Don-Yin for #​1108.
  • Keep user-requested foreground detaches from showing supervisor-response recovery guidance. Thanks to @​Lewis-E for #​1109.
  • Reject configured subagent models that are not in the active host model registry before spawning a child, instead of forwarding an invalid --model argument to Pi. Thanks to @​DresvyanskiyDenis for #​1093.
  • Start Herdr inspector and project pane commands with a shell-safe executable token, including paths that need quoting in Nushell. Thanks to @​Rival for #​1092.
  • Stop agentContract.version from using an enum on an integer, which Gemini's function-calling schema subset rejects. Integer bounds express the same constraint and are valid everywhere. Thanks to @​MarcusNeufeldt for #​1095.
  • Show supervisor-detached workflow children as paused and needing attention instead of failed while preserving recovery guidance (#​1096).
  • Show workflow-owned foreground children and recursive nested runs as a bounded tree in FleetView. Thanks to @​expoli for #​1086.
  • Warn once, instead of on every heartbeat, when a long-running workflow child outlives its mission record. Thanks to @​albertgwo for #​1079.
  • Keep deleted-schedule timers from exiting Pi and re-arm recurring schedules after unexpected timer fire failures. Thanks to @​albertgwo for #​1084.
  • Count native await use of runs.run, runs.all, and launch-containing Promise combinators as consumed without allowing fire-and-forget launches. Thanks to @​kebinzhi for #​1082.
sinclairzx81/typebox (typebox)

v1.3.15

Compare Source

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot changed the title fix(deps): update dependency pi-mcp-adapter to v2.26.0 fix(deps): update pi extension dependency closure Aug 15, 2026
@renovate
renovate Bot force-pushed the renovate/pi-extension-dependency-closure branch 6 times, most recently from 4263417 to d1b4daf Compare August 17, 2026 21:29
@renovate
renovate Bot force-pushed the renovate/pi-extension-dependency-closure branch from d1b4daf to 91724ac Compare August 18, 2026 00:36
@soodoh

soodoh commented Aug 18, 2026

Copy link
Copy Markdown
Owner

Consolidated into main in 746af61, including the Bun package-manager migration, dependency updates, refreshed lockfiles, and follow-up compatibility fixes.

@soodoh soodoh closed this Aug 18, 2026
@renovate
renovate Bot deleted the renovate/pi-extension-dependency-closure branch August 18, 2026 01:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@soodoh