Skip to content

chore(deps): update ⬆️ aqua-packages - #627

Merged
renovate[bot] merged 2 commits into
mainfrom
renovate/aqua-packages
Dec 5, 2025
Merged

chore(deps): update ⬆️ aqua-packages#627
renovate[bot] merged 2 commits into
mainfrom
renovate/aqua-packages

Conversation

@renovate

@renovate renovate Bot commented Dec 5, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note: This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Update Change
aquaproj/aqua-registry minor v4.442.0 -> v4.444.0
charmbracelet/crush minor v0.19.4 -> v0.21.0
golangci/golangci-lint minor v2.6.2 -> v2.7.1
leg100/pug patch v0.6.2 -> v0.6.5
nushell/nushell patch 0.109.0 -> 0.109.1
openai/codex minor v0.63.0 -> v0.65.0
sharkdp/bat patch v0.26.0 -> v0.26.1
smallstep/certificates minor v0.28.4 -> v0.29.0
smallstep/cli minor v0.28.7 -> v0.29.0
sst/opencode patch v1.0.125 -> v1.0.133
tofuutils/tenv minor v4.8.3 -> v4.9.0
twpayne/chezmoi minor v2.67.1 -> v2.68.0

Release Notes

aquaproj/aqua-registry (aquaproj/aqua-registry)

v4.444.0

Compare Source

Issues | Pull Requests | aquaproj/aqua-registry@v4.443.0...v4.444.0

🎉 New Packages

#​45144 steveyegge/beads - Beads - A memory upgrade for your coding agent @​fdr
#​45145 square/certigo - A utility to examine and validate certificates in a variety of formats @​kyontan
#​45147 skanehira/ghost - Simple background process manager for Unix systems @​k-kuroguro

Fixes

#​45192 ninja-build/ninja: Ignore invalid versions release-*

v4.443.0

Compare Source

Issues | Pull Requests | aquaproj/aqua-registry@v4.442.1...v4.443.0

🎉 New Packages

#​45127 quarto-dev/quarto-cli: Open-source scientific and technical publishing system built on Pandoc
#​45075 Kitware/CMake: CMake is a cross-platform, open-source build system generator

Security

#​45091 evilmartians/lefthook: configure GitHub artifact attestations @​scop

v4.442.1

Compare Source

Issues | Pull Requests | aquaproj/aqua-registry@v4.442.0...v4.442.1

Fixes

#​45065 danielfoehrKn/kubeswitch: Support linux/arm64 @​chancez
#​45041 apache/spark: Configure checksum @​benberryallwood
#​44919 apache/spark: Change asset URLs to archive distribution directory @​benberryallwood
#​44916 apache/jena: Filter out non-jena git tags @​risu729
#​44903 orf/gping: Configure version_prefix @​risu729
#​45035 Support updatecli v0.111.0

charmbracelet/crush (charmbracelet/crush)

v0.21.0

Compare Source

Parallel tool calls, better GLM, and a hot, new prompt

This a great release with a bunch of nice things. Let's get into it!

Let’s do everything at the same time

Waiting for stuff sucks. Now Crush can run parallel tool calls to shred through tasks. Let's get to work!

GLM is short for Great Large Model

There are lots of Crush users using GLM-4.6! We did a series of optimizations in this release to improve the general experience for that family of models. Enjoy and let us know how it works for you.

Prompt improvements

We tuned the system prompt to work better across models in general. See a model misbehaving? Let us know.

There's more good stuff coming. Stay tuned!

xoxo,
💘 Charm

Changelog

New!
Fixed
Other stuff
Verifying the artifacts

First, download the checksums.txt file and the checksums.txt.sigstore.json file files, for example, with wget:

wget 'https://github.com/charmbracelet/crush/releases/download/v0.21.0/checksums.txt'
wget 'https://github.com/charmbracelet/crush/releases/download/v0.21.0/checksums.txt.sigstore.json'

Then, verify it using cosign:

cosign verify-blob \
  --certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --bundle 'checksums.txt.sigstore.json' \
  ./checksums.txt

If the output is Verified OK, you can safely use it to verify the checksums of other artifacts you downloaded from the release using sha256sum:

sha256sum --ignore-missing -c checksums.txt

Done! You artifacts are now verified!

The Charm logo

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

v0.20.1

Compare Source

crush login claude

A few people had trouble authenticating with Claude Code Max when running Crush via SSH, tmux, etc. because it's not always possible to copy the URL to the clipboard or open the browser. We added a crush login claude command so you can do it via the CLI instead of the TUI.

Verifying the artifacts

First, download the checksums.txt file and the checksums.txt.sigstore.json file files, for example, with wget:

wget 'https://github.com/charmbracelet/crush/releases/download/v0.20.1/checksums.txt'
wget 'https://github.com/charmbracelet/crush/releases/download/v0.20.1/checksums.txt.sigstore.json'

Then, verify it using cosign:

cosign verify-blob \
  --certificate-identity 'https://github.com/charmbracelet/meta/.github/workflows/goreleaser.yml@refs/heads/main' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --bundle 'checksums.txt.sigstore.json' \
  ./checksums.txt

If the output is Verified OK, you can safely use it to verify the checksums of other artifacts you downloaded from the release using sha256sum:

sha256sum --ignore-missing -c checksums.txt

Done! You artifacts are now verified!

The Charm logo

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

golangci/golangci-lint (golangci/golangci-lint)

v2.7.1

Compare Source

Released on 2025-12-04

  1. Linter bug fixes
    • modernize: disable stringscut analyzer

v2.7.0

Compare Source

  1. Bug fixes
    • fix: clone args used by custom command
  2. Linters new features or changes
    • no-sprintf-host-port: from 0.2.0 to 0.3.1 (ignore string literals without a colon)
    • unqueryvet: from 1.2.1 to 1.3.0 (handles const and var declarations)
    • revive: from 1.12.0 to 1.13.0 (new option: enable-default-rules, new rules: forbidden-call-in-wg-go, unnecessary-if, inefficient-map-lookup)
    • modernize: from 0.38.0 to 0.39.0 (new analyzers: plusbuild, stringscut)
  3. Linters bug fixes
    • perfsprint: from 0.10.0 to 0.10.1
    • wrapcheck: from 2.11.0 to 2.12.0
    • godoc-lint: from 0.10.1 to 0.10.2
  4. Misc.
    • Add some flags to the custom command
  5. Documentation
    • docs: split changelog v1 and v2
leg100/pug (leg100/pug)

v0.6.5

Compare Source

Bug Fixes
  • goreleaser config schema change (b63417e)

v0.6.4

Compare Source

Miscellaneous

v0.6.3

Compare Source

Bug Fixes
  • age not updating when task updates (5f3bb72)
  • allow selected task list item to be unselected (367c968)
  • costs integration test overwriting envs (a6d0777)
  • remove annoying debug statements from cliconfig (77c55b1)
  • select all not working on task list (09eb4f4)
Miscellaneous
nushell/nushell (nushell/nushell)

v0.109.1

Compare Source

This is the 0.109.1 release of Nushell. You can learn more about this release here: https://www.nushell.sh/blog/2025-12-02-nushell_v0_109_1.html

For convenience, we are providing full builds for Windows, Linux, and macOS. Be sure you have the requirements to enable all capabilities: https://www.nushell.sh/book/installation.html#dependencies

This release was made possible by PR contributions from @​hustcer, @​KaiSforza

openai/codex (openai/codex)

v0.65.0: 0.65.0

Compare Source

Highlights
  • Codex Max as default (#​7566): Codex Max is now the default model, and a TUI panic related to async-in-sync code was fixed.
  • Better resume UX (#​7302, #​7303): Added a /resume slash command and improved resume performance so picking work back up is snappier.
  • Tooltips & tips UX (#​7557, #​7440): Tips/tooltips are rendered via markdown with a bold “Tip” label and richer Codex tooltips across the app.
  • TUI quality-of-life (#​7530, #​7448, #​7514, #​7461): TUI gets Ctrl‑P/N navigation, screen-line-capped shell output, restored Windows clipboard image paste, and a refactor for cleaner layout.
  • History and context hygiene (#​6242, #​7483, #​7545, #​7431, #​7483): history.jsonl is trimmed by history.max_bytes, common junk dirs (incl. pycache) are ignored by default, and paste placeholders stay distinct.

PRs Merged

  • use markdown for rendering tips #​7557 @​[Jeremy Rose]
  • Migrate codex max #​7566 @​[Ahmed Ibrahim]
  • Remove test from #​7481 that doesn't add much value #​7558 @​[Eric Traut]
  • [app-server] make file_path for config optional #​7560 @​[Celia Chen]
  • Migrate model family to models manager #​7565 @​[Ahmed Ibrahim]
  • Migrate tui to use models manager #​7555 @​[Ahmed Ibrahim]
  • Introduce ModelsManager and migrate app-server to use it. #​7552 @​[Ahmed Ibrahim]
  • fix: wrap long exec lines in transcript overlay #​7481 @​[muyuanjin]
  • fix: Features should be immutable over the lifetime of a session/thread #​7540 @​[Michael Bolin]
  • feat: Support listing and selecting skills via $ or /skills #​7506 @​[xl-openai]
  • [app-server] fix: add thread_id to turn/plan/updated #​7553 @​[Owen Lin]
  • feat(tui): map Ctrl-P/N to arrow navigation in textarea #​7530 @​[Aofei Sheng]
  • fix(tui): limit user shell output by screen lines #​7448 @​[muyuanjin]
  • Migrate model preset #​7542 @​[Ahmed Ibrahim]
  • fix: main #​7546 @​[jif-oai]
  • feat: add pycache to excluded directories #​7545 @​[jif-oai]
  • chore: update unified exec sandboxing detection #​7541 @​[jif-oai]
  • add slash resume #​7302 @​[Ahmed Ibrahim]
  • chore: conversation_id -> thread_id in app-server feedback/upload #​7538 @​[Owen Lin]
  • chore: delete unused TodoList item from app-server #​7537 @​[Owen Lin]
  • chore: update app-server README #​7510 @​[Owen Lin]
  • chore: remove bun env var detect #​7534 @​[Shijie Rao]
  • feat: support list mcp servers in app server #​7505 @​[Shijie Rao]
  • seatbelt: allow openpty() #​7507 @​[Jeremy Rose]
  • feat: codex tool tips #​7440 @​[jif-oai]
  • feat: retroactive image placeholder to prevent poisoning #​6774 @​[jif-oai]
  • feat: model warning in case of apply patch #​7494 @​[jif-oai]
  • fix(tui) Support image paste from clipboard on native Windows #​7514 @​[Dylan Hurd]
  • fix(unified_exec): use platform default shell when unified_exec shell… #​7486 @​[Robby He]
  • Update device code auth strings. #​7498 @​[Matthew Zeng]
  • fix: inline function marked as dead code #​7508 @​[Michael Bolin]
  • improve resume performance #​7303 @​[Ahmed Ibrahim]
  • fix: path resolution bug in npx #​7134 @​[Michael Bolin]
  • Ensure duplicate-length paste placeholders stay distinct #​7431 @​[Joshua Sutton]
  • feat: support --version flag for @​openai/codex-shell-tool-mcp #​7504 @​[Michael Bolin]
  • refactor: tui.rs extract several pieces #​7461 @​[Josh McKinney]
  • chore: make create_approval_requirement_for_command an async fn #​7501 @​[Michael Bolin]
  • Trim history.jsonl when history.max_bytes is set #​6242 @​[liam]
  • fix: remove serde(flatten) annotation for TurnError #​7499 @​[Owen Lin]
  • persisting credits if new snapshot does not contain credit info #​7490 @​[zhao-oai]
  • fix: drop lock once it is no longer needed #​7500 @​[Michael Bolin]
  • execpolicy helpers #​7032 @​[zhao-oai]
  • Show token used when context window is unknown #​7497 @​[Ahmed Ibrahim]
  • Use non-blocking mutex #​7467 @​[Ahmed Ibrahim]
  • Fix: track only untracked paths in ghost snapshots #​7470 @​[lionel-oai]
  • feat: ignore standard directories #​7483 @​[jif-oai]
  • fix: add ts number annotations for app-server v2 types #​7492 @​[Owen Lin]
  • feat: intercept apply_patch for unified_exec #​7446 @​[jif-oai]
  • chore: remove mention of experimental/unstable from app-server README #​7474 @​[Owen Lin]
  • Add request logging back #​7471 @​[pakrym-oai]
  • feat: add one off commands to app-server v2 #​7452 @​[jif-oai]
  • feat: add warning message for the model #​7445 @​[jif-oai]
  • chore: review everywhere #​7444 @​[jif-oai]
  • feat: alias compaction #​7442 @​[jif-oai]
  • feat: experimental support for skills.md #​7412 @​[Thibault Sottiaux]

v0.64.0: 0.64.0

Compare Source

Features

  • Threads and turns now include git info, current working directory, CLI version, source metadata, and propagate thread and turn IDs on every item and error. They emit new notifications for diffs, plan updates, token-usage changes, and compaction events. File-change items provide output deltas, and ImageView items render images inline.
  • Review flow is enhanced with a detached review mode, explicit enter and exit events, review thread IDs, and review history remains visible after rollout filtering changes.
  • Execution gains an experimental “exp” model, unified exec pruning to limit session bloat, per-run custom environment injection, policy-approved command bypass, and Windows protections that flag risky browser or URL launches. History lookup now works on Windows and WSL, and model selection honors use_model.
  • Safety defaults improve via consolidated world-writable scanning and workspace-write enforcement of read-only .git directories. Sandbox assessment and approval flows align with trust policies.
  • MCP and shell tooling add shell-tool MCP login support, explicit capability declaration, sandbox awareness, publication to npm, and MCP elicitations. The rmcp client is upgraded to 0.10.0 for modern notifications.
  • Observability increases as command items expose process IDs and threads and turns emit token-usage and compaction events. Feedback metadata captures source information.
  • Tooling and ops gain follow-up v2 in the app-server test client, new config management utilities, and refreshed approvals documentation and quickstart placement.

Bug fixes

  • PowerShell apply_patch parsing is corrected, and apply_patch tests now cover shell_command behavior.
  • Sandbox assessment regression is fixed, policy-approved commands are honored, dangerous-command checks are tightened on Windows, and workspace-write enforces .git read-only.
  • MCP startup tolerates missing type fields, stream error messages are clarified, and rmcp nix output hash issues are resolved.
  • Delegate cancellation no longer hangs unified exec, early-exit sessions are cleaned up, and duplicate “waited” renderings are suppressed.
  • recent_commits with limit zero now returns zero, and the NetBSD process-hardening build is unblocked.
  • Review rollout filtering is disabled so history shows, approval presets respect workspace-write, /approvals trust detection is corrected, and sandbox command assessment edge cases are fixed.
  • Compaction accounts for encrypted reasoning, handles token budgets accurately, and emits reliable token-usage and compaction events.
  • TTY stdin is required, WSL clipboard paths are normalized, and stale conversations are dropped on /new to avoid conflicts.
  • Custom prompt expansion with large pastes is fixed, example-config mistakes are corrected, and relative links and streamable_shell references are cleaned up. Upgrade messaging is corrected.
  • Windows sandbox treats <workspace_root>/.git as read-only, and risky browser launches are flagged before execution.
  • CLA allowlist now includes dependabot variants, and enterprises can skip upgrade checks and messages.
  • Flaky tests are stabilized, session recycling is improved, and rollout session initialization surfaces errors for diagnosis.

Maintenance

  • Security and CI add cargo-audit and cargo-deny. GitHub Actions are updated to checkout v6 and upload-artifact v5. macOS 13 builds are dropped. A flaky Ubuntu variant is skipped. The next_minor_version script now resets the patch number correctly.
  • Dependencies are updated: libc 0.2.177, webbrowser 1.0.6, regex 1.12.2, toml_edit 0.23.5, arboard 3.6.1, serde_with 3.16.1, image 0.25.9, reqwest 0.12.24, tracing 0.1.43, and rmcp 0.10.0.
  • Documentation is refreshed: approvals and config guidance, codex max and xhigh defaults, example-config fixes, CLA guidance, and removal of streamable_shell references.

PRs Merged

Full Changelog: openai/codex@rust-v0.63.0...rust-v0.64.0

sharkdp/bat (sharkdp/bat)

v0.26.1

Compare Source

Features

Bugfixes

  • Fix hang when using --list-themes with an explicit pager, see #​3457 (@​abhinavcool42)
  • Fix negative values of N not being parsed in <N:M> line ranges without = flag value separator, see #​3442 (@​lmmx)
  • Fix broken Docker syntax preventing use of custom assets, see #​3476 (@​keith-hall)
  • Fix decorations being applied unexpectedly when piping. Now only line numbers explicitly required on the command line should be applied in auto decorations mode for cat compatibility. See #​3496 (@​keith-hall)
  • Fix diagnostics attempting to find the version of an executable named builtin when builtin pager is used. See #​3498 (@​keith-hall)
  • --help now correctly reads the config file for theme information etc. See #​3507 (@​keith-hall)

Other

Syntaxes

Themes

bat as a library

smallstep/certificates (smallstep/certificates)

v0.29.0: Step CA v0.29.0 (25-12-03)

Compare Source

Official Release Artifacts

Linux
OSX Darwin
Windows

For more builds across platforms and architectures, see the Assets section below.
And for packaged versions (Docker, k8s, Homebrew), see our installation docs.

Don't see the artifact you need? Open an issue here.

Signatures and Checksums

step-ca uses sigstore/cosign for signing and verifying release artifacts.

Below is an example using cosign to verify a release artifact:

cosign verify-blob \
  --certificate step-ca_darwin_0.29.0_amd64.tar.gz.pem \
  --signature step-ca_darwin_0.29.0_amd64.tar.gz.sig \
  --certificate-identity-regexp "https://github\.com/smallstep/workflows/.*" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  step-ca_darwin_0.29.0_amd64.tar.gz

The checksums.txt file (in the Assets section below) contains a checksum for every artifact in the release.

Changelog

  • 992ff69 Merge pull request #​2491 from smallstep/mariano/update
  • 9d79c59 Merge branch 'master' into mariano/update
  • 8e76e29 Disable govulncheck until go 1.25.5 is available in github actions (#​2490)
  • 1011f5f Improve validation in authorization path
  • 48ed3a5 Changelog updates for preparing for v0.29.0 (#​2488)
  • 008e6ae Merge pull request #​2487 from smallstep/dependabot/github_actions/softprops/action-gh-release-2.5.0
  • 895e8c6 Bump softprops/action-gh-release from 2.4.2 to 2.5.0
  • 930e8fc Merge pull request #​2477 from smallstep/dependabot/go_modules/golang.org/x/crypto-0.45.0
  • d753789 Bump golang.org/x/crypto from 0.44.0 to 0.45.0
  • 07fa345 Merge pull request #​2481 from smallstep/dependabot/go_modules/github.com/newrelic/go-agent/v3-3.42.0
  • 2d6b359 Bump github.com/newrelic/go-agent/v3 from 3.41.0 to 3.42.0
  • b15aea5 Merge pull request #​2482 from smallstep/dependabot/go_modules/google.golang.org/grpc-1.77.0
  • 562fb7d Merge pull request #​2483 from smallstep/dependabot/go_modules/github.com/coreos/go-oidc/v3-3.17.0
  • 0b1ac14 Bump github.com/coreos/go-oidc/v3 from 3.16.0 to 3.17.0
  • bbbe61e Bump google.golang.org/grpc from 1.76.0 to 1.77.0
  • 2746cd0 Merge pull request #​2474 from smallstep/dependabot/go_modules/golang.org/x/net-0.47.0
  • 5e8fa9e Bump golang.org/x/net from 0.46.0 to 0.47.0
  • 1bd9854 Merge pull request #​2472 from smallstep/dependabot/go_modules/google.golang.org/api-0.256.0
  • d37d1cb Bump google.golang.org/api from 0.255.0 to 0.256.0
  • 1cf5fd4 Merge pull request #​2471 from smallstep/dependabot/go_modules/golang.org/x/crypto-0.44.0
  • 6315e2c Merge pull request #​2473 from smallstep/dependabot/go_modules/github.com/google/go-tpm-0.9.7
  • 0f77bf6 Bump github.com/google/go-tpm from 0.9.6 to 0.9.7
  • d722add Bump golang.org/x/crypto from 0.43.0 to 0.44.0
  • b5e8734 Merge pull request #​2463 from provokateurin/feat/sd_notify
  • ae73098 Merge pull request #​2468 from smallstep/herman/upgrade-safecast-v2
  • c39ef92 Update to v2 of `github.com/c

Configuration

📅 Schedule: Branch creation - "after 4pm on thursday" in timezone America/Los_Angeles, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies label Dec 5, 2025
@renovate
renovate Bot requested a review from scottames as a code owner December 5, 2025 03:35
@renovate
renovate Bot enabled auto-merge (squash) December 5, 2025 03:35
@renovate
renovate Bot force-pushed the renovate/aqua-packages branch from 18c76c1 to d932ffa Compare December 5, 2025 04:35
@renovate
renovate Bot merged commit 20916a3 into main Dec 5, 2025
5 checks passed
@renovate
renovate Bot deleted the renovate/aqua-packages branch December 5, 2025 04:38
@scottames-github-bot scottames-github-bot Bot mentioned this pull request Oct 2, 2026
Merged
1 task
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@renovate-approve renovate-approve[bot] renovate-approve[bot] approved these changes
@scottames scottames Awaiting requested review from scottames scottames is a code owner

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants