chore(deps): bump the root-dependencies group across 1 directory with 11 updates by dependabot[bot] · Pull Request #97 · demetere/pi-hive

dependabot · 2026-08-03T05:17:42Z

Bumps the root-dependencies group with 11 updates in the / directory:

Package	From	To
@fission-ai/openspec	`1.6.0`	`1.7.0`
@earendil-works/pi-coding-agent	`0.80.7`	`0.83.0`
@eslint/js	`9.39.5`	`10.0.1`
@plannotator/pi-extension	`0.23.1`	`0.25.1`
@types/node	`22.20.1`	`26.1.2`
c8	`10.1.3`	`12.0.0`
eslint	`9.39.5`	`10.8.0`
eslint-plugin-react-refresh	`0.4.26`	`0.5.3`
globals	`16.5.0`	`17.8.0`
typescript	`5.9.3`	`7.0.2`
typescript-eslint	`8.64.0`	`8.65.0`

Updates @fission-ai/openspec from 1.6.0 to 1.7.0

Release notes

Sourced from @fission-ai/openspec's releases.

v1.7.0 - New tools, smarter updates

What's New in v1.7.0

Ninety merged PRs from nineteen contributors. New tools, sturdier archives, and a CLI that keeps itself fresh.

New

openspec update keeps you current - It now checks npm for a newer release and offers to run the upgrade for you. One less thing to remember.

Five new AI tools - Welcome ZCode, Hermes Agent, CodeArts Agent, and Kimi Code; Codex now runs skills-only. And if skills.sh is your thing, npx skills add Fission-AI/OpenSpec works too.

One default store for your whole machine - openspec config set defaultStore <id> and every repo without its own config resolves through it.

Changes without spec changes - Pure refactors and docs work can declare skip_specs: true and move straight through validate and archive.

Project context in every workflow - Schemas can carry per-operation guidance, and openspec instructions apply|archive serve it to your agent right when it needs it.

Improved

Slash commands, spelled the way your tool spells them - Generated content now matches each tool's registered command names across all 30+ supported tools.

Archives flow - Already-synced deltas glide through as no-ops, your authored ## Purpose carries into new specs, and dated names stay tidy on re-archive.

Multi-select prompts got proper checkboxes - [x] for multi-select, exactly as your fingers expect.

A welcome screen for everyone - Honors your OS Reduce Motion setting, --no-animation, and waits politely for Enter.

Nested spec folders everywhere - specs/<area>/<capability>/spec.md is first-class in validate, apply, archive, and view.

Fixed

Leaner, policy-friendly installs - Telemetry now sends its single event with a plain fetch, so installs are ~160 packages lighter and sail through supply-chain age policies like pnpm's minimumReleaseAge (#1390).

Completions everywhere you shell - fish gets true fish completions, PowerShell scripts parse cleanly, and Oh My Zsh installs land in your actual $ZSH.

Windows input flows smoothly - keystrokes register immediately after the welcome screen.

openspec feedback always delivers - your message reaches an issue or a ready-to-send link, whatever gh is up to.

Files from every editor parse - UTF-8 BOMs from Windows editors are handled transparently.

Change names with leading digits - 0001-add-auth is valid everywhere, matching the archive conventions.

Want every detail? All 79 changes are itemized in the CHANGELOG.

Thanks

Every PR in this release, big or small, made it better: @TabishB, @showms, @mc856, @hsusul, @xiaoquisme, @vishnujayvel, @taltas, @nmrtn, @mehdishahdoost, @jikkujoyce, @javigomez, @fyeeme, @c4patino, @benjymoses, @akeyz, @Lukk17, @HowardYan888, @CodeArtsAgent, @clay-good

New Contributors

@javigomez made their first contribution in Fission-AI/OpenSpec#1151

@akeyz made their first contribution in Fission-AI/OpenSpec#1208

@xiaoquisme made their first contribution in Fission-AI/OpenSpec#1292

@fyeeme made their first contribution in Fission-AI/OpenSpec#1209

@mc856 made their first contribution in Fission-AI/OpenSpec#1191

@CodeArtsAgent made their first contribution in Fission-AI/OpenSpec#1266

@showms made their first contribution in Fission-AI/OpenSpec#1283

@vishnujayvel made their first contribution in Fission-AI/OpenSpec#1391

@benjymoses made their first contribution in Fission-AI/OpenSpec#1299

@nmrtn made their first contribution in Fission-AI/OpenSpec#1109

@Lukk17 made their first contribution in Fission-AI/OpenSpec#1255

... (truncated)

Changelog

Sourced from @fission-ai/openspec's changelog.

1.7.0

Minor Changes
#1475 17af60c Thanks @clay-good! - Add CodeArts Agent skills support: openspec init --tools codeartsagent installs the workflow skills.

#1475 17af60c Thanks @clay-good! - Add Hermes Agent as a supported AI tool: openspec init --tools hermes installs the workflow skills (Hermes is skills-only and invokes them directly).

#1475 17af60c Thanks @clay-good! - Add ZCode as a supported AI tool: openspec init --tools zcode generates its skills and /opsx:* commands.

#1475 17af60c Thanks @clay-good! - Codex is now skills-only: workflows install as $openspec-* skills and previously managed custom prompts are retired (existing ones are cleaned up on update).

#1062 eac2973 Thanks @showms! - Add current project context and per-operation guidance to apply and archive workflows. Projects can configure operations.apply.guidance and operations.archive.guidance; openspec instructions apply returns apply inputs, and the new read-only openspec instructions archive surface returns archive inputs for the selected root.

Archive, bulk archive, and sync skills now load current archive inputs and specs artifact rules at execution time, fail before writes or moves when required instruction lookups fail, and reuse specs-rule snapshots during inline sync.

#1475 17af60c Thanks @clay-good! - Publish the workflow skills as static skills/<name>/SKILL.md files so npx skills add Fission-AI/OpenSpec works.

#1399 27b22ab Thanks @clay-good! - Add skip_specs: true change metadata for work with no spec-level behavior change (pure refactors, tooling, docs). openspec validate accepts a zero-delta change that declares the marker (honored only when the metadata parses under the shared change-metadata schema and names a schema that loads) and errors when the marker and delta specs are both present, the artifact graph no longer blocks tasks on spec files for such changes, openspec status renders the specs stage as explicitly skipped, and the propose/specs guidance points to the marker instead of contradicting the validator.

#1475 17af60c Thanks @clay-good! - Resolve symlinked schema directories so schemas shared via symlink (e.g. from a dotfiles repo) are discovered.
#1470 6295515 Thanks @clay-good! - openspec update now offers to upgrade the CLI when yours is behind the published one. Instruction files are generated by the installed CLI, so a stale install reported ✓ All 1 tool(s) up to date (v1.6.0) while the workflows added in newer releases were never written:
A newer OpenSpec CLI is available (v1.6.0 → v1.7.0).
  Running from: /usr/local/lib/node_modules/@fission-ai/openspec
? Upgrade to v1.7.0 now? (Y/n)
Say yes and it upgrades, confirms the new version is the one that answers, then re-runs the update so the new workflows arrive in the same command. Say no and it prints the command matching how you installed OpenSpec, and updates with what you have. Nothing happens to your machine that you did not agree to: the offer appears only in an interactive terminal and only where npm install -g would help, and the check is skipped in CI or when OPENSPEC_NO_UPDATE_CHECK, DO_NOT_TRACK=1, or OPENSPEC_TELEMETRY=0 is set.

See CLI reference → openspec update for the per-install-method behavior and every opt-out.
Patch Changes

#1404 a84ae70 Thanks @clay-good! - Generated skills for tools without a command adapter (Kimi Code, Mistral Vibe, Hermes, ForgeCode, CodeArts) no longer reference /opsx:* commands that were never generated: skill cross-references, the init getting-started hint, and the profile-migration message now use each tool's documented skill invocation (Kimi Code: /skill:openspec-*; others: /openspec-*), and Codex — skills-invocable with no slash surface — gets a syntax-neutral hint that names the skill. Selections that mix invocation syntaxes print one labeled hint per distinct form, so every advertised instruction is usable by the tool it names. When delivery: commands would generate nothing for a selected tool, init prints a configuration correction naming that tool, even when other tools did get commands or skills. The committed skills.sh distribution is regenerated with skill references (default /openspec-* form, as that channel installs skills only).

#1363 5199f41 Thanks @clay-good! - ### Features

One default store for every repo on your machine — openspec config set defaultStore <id> sets a machine-level fallback root: any command run outside a planning root, with no --store flag and no project store: pointer, resolves to that store. It sits at the bottom of the precedence list, so --store, a local root, and a project pointer all still win. The root banner and JSON root block report the distinct provenance source: "global_default", so users and tooling can tell a machine-wide default from a repo's own pointer. A stale id degrades to the underlying store error with a fix that names openspec config unset defaultStore.

#1435 6a5171e Thanks @clay-good! - openspec new change now accepts numeric-prefixed names like 100-add-feature or 00001-add-auth, useful for ordering or tiering changes. Change names now use the same kebab-case grammar as store ids and change metadata (a leading digit is allowed); archive already treated date-prefixed names as a supported convention. Uppercase, spaces, underscores, and leading/trailing or consecutive hyphens are still rejected, and every previously valid name stays valid.

#1425 040a869 Thanks @clay-good! - Compare config key guards literally instead of through a helper.

setNestedValue and deleteNestedValue rejected prototype-reaching key segments through a helper that did a Set lookup. That is correct, but static analysis could not follow it, so CodeQL kept reporting prototype-pollution on the very assignments the guard protects. The segments are now compared literally in the same function, still checked across the whole path before anything is written. Behavior is unchanged for every input, verified against the previous implementation across 400,000 generated cases.

#1431 6a4f0d7 Thanks @clay-good! - A delta spec that introduces a brand-new capability can now open with a ## Purpose, and openspec archive uses it as the Purpose of the main spec it creates instead of writing the TBD - created by archiving change <name>. Update Purpose after archive. placeholder over it. The specs artifact instruction, its example, the delta template and the openspec-sync-specs skill all tell authors and agents to write one, so the CLI and agent-driven sync paths produce the same main spec.

... (truncated)

Commits

4e16790 Version Packages (#1380)
8731290 fix(telemetry): send the usage event directly instead of via posthog-node (#1...
17af60c fix(archive): make the scenario-drift check fence-aware, plus release-audit f...
1637856 feat(adapters): follow the Windsurf rename to Devin Desktop (#1167)
9a937cb fix(adapters): reference slash commands by the names each tool registers (#1471)
10fa39b fix(update): refresh command files for tools configured without skills (#1442)
6295515 feat(update): offer to upgrade a stale CLI during openspec update (#1470)
ec6cbb4 docs: add anvil to Community Schemas table (#1469)
fc886af fix(templates): auto-select the only active change instead of always promptin...
fb19699 fix(adapters): escape YAML frontmatter values consistently across all command...
Additional commits viewable in compare view

Updates @earendil-works/pi-coding-agent from 0.80.7 to 0.83.0

Release notes

Sourced from @earendil-works/pi-coding-agent's releases.

v0.83.0

New Features

Credential export for external clients — pi auth print-api-key and pi auth print-bearer-token export configured credentials with automatic OAuth refresh and minimum-validity enforcement.

Headless OpenRouter sign-in — Complete /login over SSH by pasting the redirect URL or authorization code when the loopback callback is unavailable. See OpenRouter.

Claude Opus 5 on GitHub Copilot — Use Claude Opus 5 through GitHub Copilot with adaptive thinking and a 1M context window. See GitHub Copilot.

Breaking Changes

Upgraded bundled TypeBox aliases to 1.3.7, removing deprecated APIs including Type.Base, Type.Awaited, Type.Promise, Type.AsyncIterator, Type.Iterator, Type.Options, and Value.Mutate, while fixing compiled validation of nullable array tool arguments. Extensions using removed APIs must migrate to supported TypeBox APIs. See Package Dependencies (#7243 by @petrroll).

Added

Added pi auth print-api-key and pi auth print-bearer-token commands for exporting configured credentials to external clients, including automatic OAuth refresh and configurable minimum token validity (#7168).

Exposed the session's resolved model scope as ctx.scopedModels to extensions. See Extension Context (#7191 by @pungggi, #7215).

Added inherited per-request fetch injection for supported text and image provider transports.

Added the inherited "pending" stop reason for partial streaming messages. See Custom Provider Stream Pattern (#7151 by @lucasmeijer).

Added inherited raw provider stop reasons across Google, Anthropic, Amazon Bedrock, Mistral, and OpenAI streams; unmapped terminal reasons now surface as provider errors instead of successful stops (#7272).

Added manual redirect URL and authorization-code entry to OpenRouter login for remote and headless environments. See OpenRouter (#7114 by @rgarcia).

Added inherited Claude Opus 5 support for GitHub Copilot with adaptive thinking and a 1M context window. See GitHub Copilot (#7158 by @jay-aye-see-kay).

Changed

Changed inherited OAuth credential resolution to refresh tokens with less than five minutes of validity remaining instead of waiting until expiration (#7168).

Fixed

Added a status line when the tool output expansion is toggled (#7180).

Fixed file-backed SYSTEM.md and APPEND_SYSTEM.md prompts being omitted from the interactive startup context listing. See System Prompt Files (#7096).

Fixed context files loading twice when a linked Git worktree is nested under its main repository. See Context Files (#7221 by @arajkumar).

Fixed llama.cpp streamed responses reporting zero token usage and leaving session context accounting empty. See llama.cpp (#7258 by @SteveImmanuel).

Fixed session replacement and committed tree navigation during an active response to abort and persist the outgoing turn instead of leaving dangling tool calls. See Sessions (#7022 by @tmustier).

Fixed failed Git package installs leaving partial directories that blocked clean retries. See Install and Manage (#7210 by @haoqixu).

Fixed the /model selector retaining a stale selection while filtering instead of highlighting the top match (#7211 by @christianbasch).

Fixed direct RPC bash commands bypassing extension user_bash handlers. See User Bash Events (#7214).

Fixed skills, prompts, and themes losing package source metadata after extensions reload resources. See Resource Events (#6968).

Fixed cancellation of concurrently running user bash commands so every active command is aborted (#7103 by @yzhg1983).

Fixed duplicate messages appearing when extensions switch sessions during interactive startup (#7110 by @yzhg1983).

Fixed inherited Qwen Token Plan reasoning models to send their service-specific thinking controls and supported reasoning-effort levels (#6951, #6998).

Fixed inherited Z.AI output limits being sent through an unsupported parameter. See Providers (#7174 by @HyeokjaeLee).

Fixed explicitly configured Amazon Bedrock profiles being overridden by ambient AWS access keys. See Amazon Bedrock (#7176 by @christianbasch).

Fixed inherited image fallback paths overflowing narrow terminals, shortened home-directory paths, and made absolute paths clickable when terminal hyperlinks are available (#7262).

Fixed inherited OpenAI-compatible tool calls losing their function arguments when malformed deltas also contain an empty custom object (#7288 by @sunnyyoung).

v0.82.1

New Features

Claude Opus 5 — Available on Anthropic and Amazon Bedrock with adaptive thinking (including xhigh), inference profiles, and prompt caching. See Providers.

Anthropic gateway bearer auth — ANTHROPIC_AUTH_TOKEN authenticates against Anthropic-compatible gateways that require Authorization: Bearer, including compaction and branch summaries. See Environment Variables or Auth File.

Faster, more resilient model catalogs — pi.dev catalogs revalidate with If-None-Match so unchanged providers answer with an empty 304, and llama.cpp models stay listed across restarts. See llama.cpp.

... (truncated)

Changelog

Sourced from @earendil-works/pi-coding-agent's changelog.

[0.83.0] - 2026-07-29

New Features

Credential export for external clients — pi auth print-api-key and pi auth print-bearer-token export configured credentials with automatic OAuth refresh and minimum-validity enforcement.

Headless OpenRouter sign-in — Complete /login over SSH by pasting the redirect URL or authorization code when the loopback callback is unavailable. See OpenRouter.

Claude Opus 5 on GitHub Copilot — Use Claude Opus 5 through GitHub Copilot with adaptive thinking and a 1M context window. See GitHub Copilot.

Breaking Changes

Upgraded bundled TypeBox aliases to 1.3.7, removing deprecated APIs including Type.Base, Type.Awaited, Type.Promise, Type.AsyncIterator, Type.Iterator, Type.Options, and Value.Mutate, while fixing compiled validation of nullable array tool arguments. Extensions using removed APIs must migrate to supported TypeBox APIs. See Package Dependencies (#7243 by @petrroll).

Added

Added pi auth print-api-key and pi auth print-bearer-token commands for exporting configured credentials to external clients, including automatic OAuth refresh and configurable minimum token validity (#7168).

Exposed the session's resolved model scope as ctx.scopedModels to extensions. See Extension Context (#7191 by @pungggi, #7215).

Added inherited per-request fetch injection for supported text and image provider transports.

Added the inherited "pending" stop reason for partial streaming messages. See Custom Provider Stream Pattern (#7151 by @lucasmeijer).

Added inherited raw provider stop reasons across Google, Anthropic, Amazon Bedrock, Mistral, and OpenAI streams; unmapped terminal reasons now surface as provider errors instead of successful stops (#7272).

Added manual redirect URL and authorization-code entry to OpenRouter login for remote and headless environments. See OpenRouter (#7114 by @rgarcia).

Added inherited Claude Opus 5 support for GitHub Copilot with adaptive thinking and a 1M context window. See GitHub Copilot (#7158 by @jay-aye-see-kay).

Changed

Changed inherited OAuth credential resolution to refresh tokens with less than five minutes of validity remaining instead of waiting until expiration (#7168).

Fixed

Added a status line when the tool output expansion is toggled (#7180).

Fixed file-backed SYSTEM.md and APPEND_SYSTEM.md prompts being omitted from the interactive startup context listing. See System Prompt Files (#7096).

Fixed context files loading twice when a linked Git worktree is nested under its main repository. See Context Files (#7221 by @arajkumar).

Fixed llama.cpp streamed responses reporting zero token usage and leaving session context accounting empty. See llama.cpp (#7258 by @SteveImmanuel).

Fixed session replacement and committed tree navigation during an active response to abort and persist the outgoing turn instead of leaving dangling tool calls. See Sessions (#7022 by @tmustier).

Fixed failed Git package installs leaving partial directories that blocked clean retries. See Install and Manage (#7210 by @haoqixu).

Fixed the /model selector retaining a stale selection while filtering instead of highlighting the top match (#7211 by @christianbasch).

Fixed direct RPC bash commands bypassing extension user_bash handlers. See User Bash Events (#7214).

Fixed skills, prompts, and themes losing package source metadata after extensions reload resources. See Resource Events (#6968).

Fixed cancellation of concurrently running user bash commands so every active command is aborted (#7103 by @yzhg1983).

Fixed duplicate messages appearing when extensions switch sessions during interactive startup (#7110 by @yzhg1983).

Fixed inherited Qwen Token Plan reasoning models to send their service-specific thinking controls and supported reasoning-effort levels (#6951, #6998).

Fixed inherited Z.AI output limits being sent through an unsupported parameter. See Providers (#7174 by @HyeokjaeLee).

Fixed explicitly configured Amazon Bedrock profiles being overridden by ambient AWS access keys. See Amazon Bedrock (#7176 by @christianbasch).

Fixed inherited image fallback paths overflowing narrow terminals, shortened home-directory paths, and made absolute paths clickable when terminal hyperlinks are available (#7262).

Fixed inherited OpenAI-compatible tool calls losing their function arguments when malformed deltas also contain an empty custom object (#7288 by @sunnyyoung).

[0.82.1] - 2026-07-25

New Features

Claude Opus 5 — Available on Anthropic and Amazon Bedrock with adaptive thinking (including xhigh), inference profiles, and prompt caching. See Providers.

... (truncated)

Commits

845d6ff Release v0.83.0
f0499a6 docs: audit changelogs since v0.82.1
bff5ab7 fix(coding-agent): show system prompt files in startup context (#7266)
cced6a2 fix(coding-agent): stop loading AGENTS.md twice in nested git worktrees (#7221)
f9476a6 fix(ai): update TypeBox nullable array validation (#7243)
0c32e83 fix(coding-agent): enable streaming usage for llama.cpp provider (#7258)
47ca25f Revert "fix(coding-agent): build-check-test (#7206)"
0d008b7 fix(coding-agent): show tool expansion status
f145195 fix(coding-agent): build-check-test (#7206)
cefa40e ***WIP it's a PoC *** fix(coding-agent): guard tree navigation during respons...
Additional commits viewable in compare view

Updates @eslint/js from 9.39.5 to 10.0.1

Release notes

Sourced from @eslint/js's releases.

v10.0.1

Bug Fixes

c87d5bd fix: update eslint (#20531) (renovate[bot])

d841001 fix: update minimatch to 10.2.1 to address security vulnerabilities (#20519) (루밀LuMir)

04c2147 fix: update error message for unused suppressions (#20496) (fnx)

38b089c fix: update dependency @eslint/config-array to ^0.23.1 (#20484) (renovate[bot])

Documentation

5b3dbce docs: add AI acknowledgement section to templates (#20431) (루밀LuMir)

6f23076 docs: toggle nav in no-JS mode (#20476) (Tanuj Kanti)

b69cfb3 docs: Update README (GitHub Actions Bot)

Chores

e5c281f chore: updates for v9.39.3 release (Jenkins)

8c3832a chore: update @typescript-eslint/parser to ^8.56.0 (#20514) (Milos Djermanovic)

8330d23 test: add tests for config-api (#20493) (Milos Djermanovic)

37d6e91 chore: remove eslint v10 prereleases from eslint-config-eslint deps (#20494) (Milos Djermanovic)

da7cd0e refactor: cleanup error message templates (#20479) (Francesco Trotta)

84fb885 chore: package.json update for @eslint/js release (Jenkins)

1f66734 chore: add eslint to peerDependencies of @eslint/js (#20467) (Milos Djermanovic)

v10.0.0

Breaking Changes

f9e54f4 feat!: estimate rule-tester failure location (#20420) (ST-DDT)

a176319 feat!: replace chalk with styleText and add color to ResultsMeta (#20227) (루밀LuMir)

c7046e6 feat!: enable JSX reference tracking (#20152) (Pixel998)

fa31a60 feat!: add name to configs (#20015) (Kirk Waiblinger)

3383e7e fix!: remove deprecated SourceCode methods (#20137) (Pixel998)

501abd0 feat!: update dependency minimatch to v10 (#20246) (renovate[bot])

ca4d3b4 fix!: stricter rule tester assertions for valid test cases (#20125) (唯然)

96512a6 fix!: Remove deprecated rule context methods (#20086) (Nicholas C. Zakas)

c69fdac feat!: remove eslintrc support (#20037) (Francesco Trotta)

208b5cc feat!: Use ScopeManager#addGlobals() (#20132) (Milos Djermanovic)

a2ee188 fix!: add uniqueItems: true in no-invalid-regexp option (#20155) (Tanuj Kanti)

a89059d feat!: Program range span entire source text (#20133) (Pixel998)

39a6424 fix!: assert 'text' is a string across all RuleFixer methods (#20082) (Pixel998)

f28fbf8 fix!: Deprecate "always" and "as-needed" options of the radix rule (#20223) (Milos Djermanovic)

aa3fb2b fix!: tighten func-names schema (#20119) (Pixel998)

f6c0ed0 feat!: report eslint-env comments as errors (#20128) (Francesco Trotta)

4bf739f fix!: remove deprecated LintMessage#nodeType and TestCaseError#type (#20096) (Pixel998)

523c076 feat!: drop support for jiti < 2.2.0 (#20016) (michael faith)

454a292 feat!: update eslint:recommended configuration (#20210) (Pixel998)

4f880ee feat!: remove v10_* and inactive unstable_* flags (#20225) (sethamus)

f18115c feat!: no-shadow-restricted-names report globalThis by default (#20027) (sethamus)

c6358c3 feat!: Require Node.js ^20.19.0 || ^22.13.0 || >=24 (#20160) (Milos Djermanovic)

Features

bff9091 feat: handle Array.fromAsync in array-callback-return (#20457) (Francesco Trotta)

290c594 feat: add self to no-implied-eval rule (#20468) (sethamus)

43677de feat: fix handling of function and class expression names in no-shadow (#20432) (Milos Djermanovic)

... (truncated)

Commits

84fb885 chore: package.json update for @eslint/js release
1f66734 chore: add eslint to peerDependencies of @eslint/js (#20467)
f3fbc2f chore: set @eslint/js version to 10.0.0 to skip releasing it (#20466)
b4b3127 chore: package.json update for @eslint/js release
0b14059 chore: package.json update for @eslint/js release
fa31a60 feat!: add name to configs (#20015)
1e2cad5 chore: package.json update for @eslint/js release
454a292 feat!: update eslint:recommended configuration (#20210)
c6358c3 feat!: Require Node.js ^20.19.0 || ^22.13.0 || >=24 (#20160)
See full diff in compare view

Updates @plannotator/pi-extension from 0.23.1 to 0.25.1

Release notes

Sourced from @plannotator/pi-extension's releases.

v0.25.1

Follow @plannotator on X for updates

Release Highlights

v0.25.0 Vim keyboard controls, Approve with Notes, scriptable annotate gates, persistent Guided Reviews, memory and file-watching hardening

v0.24.2 Annotate YAML/JSON/TOML config files, XDG data directory support, Codex model catalog update, Cursor sandbox escape hatch

v0.24.1 Annotate accepts parent-relative ../ file paths

v0.24.0 PR/MR artifact gallery, GitButler review support, port ranges, expanded comment editor, OpenCode + Pi fixes

v0.23.1 Startup no longer hangs on large or slow directory trees, Ask AI input stays visible after long responses

v0.23.0 Plan approval fix for Claude Code 2.1.199+, annotate mode version diff, binary-only --minimal install, reviews post without attribution

v0.22.0 Git-status "All changes" default review view, Commits panel with per-commit diffs, Guided Review, Pi + GitHub Copilot CLI review engines

v0.21.4 Markdown math rendering, PR Overview panel with annotatable description and comments, agent instructions in code review, media parsing fixes

v0.21.3 File comments in code review, unified click-to-highlight comments, VS Code clipboard/keyboard bridge, Codex Ask AI on app-server transport, CLI subcommand help

v0.21.2 Custom reviews as Agent Skills, Cursor + OpenCode review engines, whole-file/general findings, deleted-annotation fix, Codex Ask AI outside git repos

v0.21.1 Annotate-last blank-page fix on multi-message sessions

What's New in v0.25.1

Eight pull requests landed since v0.25.0, six of them from community members, and four authors made their first contribution. The release stops code review from launching Codex when you never asked for it, teaches plannotator last which conversation you are actually in, adds Claude Opus 5 to the model pickers, and mirrors approved plan checklists into editable pi-todos. Two fixes came out of pre-release QA rather than a report.

Opening a review no longer launches Codex

Constructing the AI runtime ran Codex model discovery immediately, which meant that simply opening a code review spawned a codex app-server process. Users who had Codex installed but never intended to use it got a stray process, and on macOS the launch could raise a Gatekeeper prompt in front of a review they were trying to read.

Discovery is now deferred until a Codex session actually starts, or until you explicitly select Codex in the provider picker. Selecting Codex activates it and refreshes the model list on that gesture, so the real catalog and per-model reasoning-effort options still appear before you pick anything. Saved model preferences are left alone rather than being overwritten by a placeholder.

Authored by @rNoz in #1145, closing #1144

plannotator last follows the live conversation

Two separate bugs made plannotator last annotate the wrong message.

In Claude Code, /rewind does not remove anything from the session transcript. It re-parents the next message to an earlier point and leaves everything after that orphaned in the file forever. Reading the file bottom-up therefore offered messages that were no longer part of the conversation. The message picker now walks...
Description has been truncated

… 11 updates Bumps the root-dependencies group with 11 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@fission-ai/openspec](https://github.com/Fission-AI/OpenSpec) | `1.6.0` | `1.7.0` | | [@earendil-works/pi-coding-agent](https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent) | `0.80.7` | `0.83.0` | | [@eslint/js](https://github.com/eslint/eslint/tree/HEAD/packages/js) | `9.39.5` | `10.0.1` | | [@plannotator/pi-extension](https://github.com/backnotprop/plannotator/tree/HEAD/apps/pi-extension) | `0.23.1` | `0.25.1` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `22.20.1` | `26.1.2` | | [c8](https://github.com/bcoe/c8) | `10.1.3` | `12.0.0` | | [eslint](https://github.com/eslint/eslint) | `9.39.5` | `10.8.0` | | [eslint-plugin-react-refresh](https://github.com/ArnaudBarre/eslint-plugin-react-refresh) | `0.4.26` | `0.5.3` | | [globals](https://github.com/sindresorhus/globals) | `16.5.0` | `17.8.0` | | [typescript](https://github.com/microsoft/TypeScript) | `5.9.3` | `7.0.2` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.64.0` | `8.65.0` | Updates `@fission-ai/openspec` from 1.6.0 to 1.7.0 - [Release notes](https://github.com/Fission-AI/OpenSpec/releases) - [Changelog](https://github.com/Fission-AI/OpenSpec/blob/main/CHANGELOG.md) - [Commits](Fission-AI/OpenSpec@v1.6.0...v1.7.0) Updates `@earendil-works/pi-coding-agent` from 0.80.7 to 0.83.0 - [Release notes](https://github.com/earendil-works/pi/releases) - [Changelog](https://github.com/earendil-works/pi/blob/main/packages/coding-agent/CHANGELOG.md) - [Commits](https://github.com/earendil-works/pi/commits/v0.83.0/packages/coding-agent) Updates `@eslint/js` from 9.39.5 to 10.0.1 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](https://github.com/eslint/eslint/commits/v10.0.1/packages/js) Updates `@plannotator/pi-extension` from 0.23.1 to 0.25.1 - [Release notes](https://github.com/backnotprop/plannotator/releases) - [Commits](https://github.com/backnotprop/plannotator/commits/v0.25.1/apps/pi-extension) Updates `@types/node` from 22.20.1 to 26.1.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `c8` from 10.1.3 to 12.0.0 - [Release notes](https://github.com/bcoe/c8/releases) - [Changelog](https://github.com/bcoe/c8/blob/main/CHANGELOG.md) - [Commits](bcoe/c8@v10.1.3...v12.0.0) Updates `eslint` from 9.39.5 to 10.8.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v9.39.5...v10.8.0) Updates `eslint-plugin-react-refresh` from 0.4.26 to 0.5.3 - [Release notes](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/releases) - [Changelog](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/blob/main/CHANGELOG.md) - [Commits](ArnaudBarre/eslint-plugin-react-refresh@v0.4.26...v0.5.3) Updates `globals` from 16.5.0 to 17.8.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](sindresorhus/globals@v16.5.0...v17.8.0) Updates `typescript` from 5.9.3 to 7.0.2 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](https://github.com/microsoft/TypeScript/commits) Updates `typescript-eslint` from 8.64.0 to 8.65.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.65.0/packages/typescript-eslint) --- updated-dependencies: - dependency-name: "@fission-ai/openspec" dependency-version: 1.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: root-dependencies - dependency-name: "@earendil-works/pi-coding-agent" dependency-version: 0.83.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: root-dependencies - dependency-name: "@eslint/js" dependency-version: 10.0.1 dependency-type: direct:development update-type: version-update:semver-major dependency-group: root-dependencies - dependency-name: "@plannotator/pi-extension" dependency-version: 0.25.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: root-dependencies - dependency-name: "@types/node" dependency-version: 26.1.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: root-dependencies - dependency-name: c8 dependency-version: 12.0.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: root-dependencies - dependency-name: eslint dependency-version: 10.8.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: root-dependencies - dependency-name: eslint-plugin-react-refresh dependency-version: 0.5.3 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: root-dependencies - dependency-name: globals dependency-version: 17.8.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: root-dependencies - dependency-name: typescript dependency-version: 7.0.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: root-dependencies - dependency-name: typescript-eslint dependency-version: 8.65.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: root-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-08-10T05:24:31Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 3, 2026

dependabot Bot closed this Aug 10, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/root-dependencies-f13160876a branch August 10, 2026 05:24

Navigation Menu

chore(deps): bump the root-dependencies group across 1 directory with 11 updates - #97

chore(deps): bump the root-dependencies group across 1 directory with 11 updates#97
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/root-dependencies-f13160876a

dependabot Bot commented on behalf of github Aug 3, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Aug 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Release	Highlights
v0.25.0	Vim keyboard controls, Approve with Notes, scriptable annotate gates, persistent Guided Reviews, memory and file-watching hardening
v0.24.2	Annotate YAML/JSON/TOML config files, XDG data directory support, Codex model catalog update, Cursor sandbox escape hatch
v0.24.1	Annotate accepts parent-relative `../` file paths
v0.24.0	PR/MR artifact gallery, GitButler review support, port ranges, expanded comment editor, OpenCode + Pi fixes
v0.23.1	Startup no longer hangs on large or slow directory trees, Ask AI input stays visible after long responses
v0.23.0	Plan approval fix for Claude Code 2.1.199+, annotate mode version diff, binary-only `--minimal` install, reviews post without attribution
v0.22.0	Git-status "All changes" default review view, Commits panel with per-commit diffs, Guided Review, Pi + GitHub Copilot CLI review engines
v0.21.4	Markdown math rendering, PR Overview panel with annotatable description and comments, agent instructions in code review, media parsing fixes
v0.21.3	File comments in code review, unified click-to-highlight comments, VS Code clipboard/keyboard bridge, Codex Ask AI on app-server transport, CLI subcommand help
v0.21.2	Custom reviews as Agent Skills, Cursor + OpenCode review engines, whole-file/general findings, deleted-annotation fix, Codex Ask AI outside git repos
v0.21.1	Annotate-last blank-page fix on multi-message sessions

Conversation

dependabot Bot commented on behalf of github Aug 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.7.0 - New tools, smarter updates

What's New in v1.7.0

New

Improved

Fixed

Thanks

New Contributors

1.7.0

Minor Changes

Patch Changes

v0.83.0

New Features

Breaking Changes

Added

Changed

Fixed

v0.82.1

New Features

[0.83.0] - 2026-07-29

New Features

Breaking Changes

Added

Changed

Fixed

[0.82.1] - 2026-07-25

New Features

v10.0.1

Bug Fixes

Documentation

Chores

v10.0.0

Breaking Changes

Features

v0.25.1

What's New in v0.25.1

Opening a review no longer launches Codex

plannotator last follows the live conversation

Uh oh!

dependabot Bot commented on behalf of github Aug 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Aug 3, 2026 •

edited

Loading

`plannotator last` follows the live conversation