chore(deps): update ⬆️ mise-packages

[renovate]

This PR contains the following updates:

Package	Update	Change	Pending
aqua:anthropics/claude-code	patch	2.1.181 → 2.1.183	2.1.186 (+1)
aqua:aquasecurity/trivy	patch	0.71.1 → 0.71.2
aqua:astral-sh/ruff	patch	0.15.17 → 0.15.18
aqua:astral-sh/uv	patch	0.11.21 → 0.11.22	0.11.23
github:janosmiko/lfk	patch	v0.14.11 → v0.14.12	v0.14.15 (+2)
github:max-sixty/worktrunk	minor	v0.59.0 → v0.60.0	v0.61.0

---

Release Notes

anthropics/claude-code (aqua:anthropics/claude-code)

v2.1.183

Compare Source

• Improved auto mode safety: destructive git commands (git reset --hard, git checkout -- ., git clean -fd, git stash drop) are now blocked when you didn't ask to discard local work, git commit --amend is blocked when the commit wasn't made by the agent this session, and terraform destroy/pulumi destroy/cdk destroy are blocked unless you asked for the specific stack
• Added a warning when the requested model is deprecated or automatically updated to a newer model, shown on stderr in print mode (-p) and now also covering models set in agent frontmatter
• Added attribution.sessionUrl setting to omit the claude.ai session link from commits and PRs in web and Remote Control sessions
• Added /config --help to list all available shorthand keys for /config key=value
• Changed /config toggle behavior: Enter and Space both change the selected setting, and Esc now saves and closes instead of reverting
• Removed the startup "setup issues" line under the logo — run /doctor to see configuration issues or use --debug
• Fixed thinking.disabled.display: Extra inputs are not permitted 400 errors on subagent spawns and session-title generation for affected configurations
• Fixed WebSearch returning empty results in subagents
• Fixed the terminal cursor being stranded above the prompt after navigating history in vim mode with the native cursor enabled
• Fixed fullscreen TUI corruption (statusline mid-screen, duplicated spinner rows, merged text) in Windows Terminal under heavy nested-subagent load
• Fixed turns silently completing with no visible output when the model returned only a thinking block; Claude now re-prompts once
• Fixed user-level skills appearing multiple times in slash-command autocomplete when multiple plugins are enabled
• Fixed MCP servers requiring authentication exposing auth-stub tools to the model in headless/SDK mode
• Fixed tmux teammate panes failing to launch when the shell has slow rc-file initialization, and keystrokes typed during agent spawn leaking into the new tmux pane instead of the leader prompt
• Fixed background tasks started by a teammate being killed when the teammate finishes a turn
• Fixed scheduled task and webhook trigger deliveries being treated as keyboard input; they now classify as task notifications and can no longer approve a pending action or set the session title in auto mode
• Fixed focus mode showing "Ran N PostToolUse hooks" timing lines under each response

aquasecurity/trivy (aqua:aquasecurity/trivy)

v0.71.2

Compare Source

Changelog

• 055a5c8 release: v0.71.2 [release/v0.71] (#​10871)
• 875328a fix(deps): bump alpine to 3.24.1 [backport: release/v0.71] (#​10870)
• 998f7b3 chore(deps): bump the common group with 4 updates [backport: release/v0.71] (#​10867)

astral-sh/ruff (aqua:astral-sh/ruff)

v0.15.18

Compare Source

Released on 2026-06-18.

Preview features

• Handle nested ruff:ignore comments (#​25791)
• Stop displaying severity in output (#​26050)
• Use human-readable names in CLI output (#​25937)
• Use human-readable names in LSP and playground diagnostics (#​26058)
• [pydocstyle] Prevent property docstrings starting with verbs (D421) (#​23775)
• [flake8-pyi] Extend PYI033 to Python files (#​26129)

Bug fixes

• Detect equivalent numeric mapping keys (#​26009)
• Detect mapping keys equivalent to booleans (#​25982)
• Detect repeated signed and complex dictionary keys (#​26007)

Rule changes

• [flake8-pyi] Rename PYI033 to legacy-type-comment (#​26131)

Performance

• Use ThinVec for call keywords (#​25999)
• Inline parser recovery context checks (#​26038)
• Match parser keywords as bytes (#​26037)
• Move value parsing out of lexing (#​25360)

Server

• Render subdiagnostics and secondary annotations as related information (#​26011)

Documentation

• Update fix availability for always-fixable rules (#​26091)
• [flake8-tidy-imports] Add fix safety section (TID252) (#​17491)

Parser

• Reject __debug__ lambda parameters (#​26022)
• Reject _ as a match-pattern target (#​25977)
• Reject multiple starred names in sequence patterns (#​25976)
• Reject parenthesized star imports (#​26021)
• Reject starred comprehension targets (#​26023)
• Reject unparenthesized generator expressions in class bases (#​25978)
• Reject yield expressions after commas (#​26024)
• Validate function type parameter default order (#​25981)

Playground

• Make diagnostic links clickable (#​26104)
• Use diagnostic tags (#​26105)

Contributors

• @​AlexWaygood
• @​ntBre
• @​gtkacz
• @​MichaReiser
• @​charliermarsh
• @​Kalmaegi

astral-sh/uv (aqua:astral-sh/uv)

v0.11.22

Compare Source

Released on 2026-06-18.

Enhancements

• Publish wheels before sdists in uv publish (#​19831)
• Add TY and RUFF env vars for providing paths for binaries used by uv format and uv check (#​19821)

Preview features

• Allow configuring preview features in uv.toml and pyproject.toml (#​18437)
• Update the lockfile during uv check --no-sync (#​19909)
• Add --script to uv check and uv metadata (#​19860)
• Report workspace-exclusive dependency groups in workspace metadata (#​19862)
• Support SARIF as a uv audit output (#​19872)

Performance

• Use a more deadlock-resistant concurrent hashmap in the resolver (#​19532)

Bug fixes

• Update string marker ordering semantics to match upstream clarified rules (#​19808)
• Reject extras that have the same normalized name (#​19871)
• Reject dependency group include-group entries that have additional fields (#​19866)
• Reject invalid UTF-8 URL credentials (#​19814)
• Validate that PEP 517 backend-paths exist when building sdists (#​19834)
• Validate that pylock.toml files do not have an unsupported a lock-version (#​19869)
• Validate that the environment satisfies the packages.requires-python of a pylock.toml (#​19868)
• Allow uv to be recursively invoked by PEP 517 build hooks (#​19879)
• Allow empty credentials.toml files (#​19815)
• Fix transparent Python upgrades in project environments (#​19890)
• Handle non-file editable URLs in uv pip list (#​19867)
• Fix incorrect output from uv tree --invert (#​19910)
• Fix environment locking of uv venv in a project (#​19837)
• Fix handling of workspace-exclusive dependency groups in uv tree (#​19905)

Documentation

• Archive the 0.10.x changelog (#​19813)

Other changes

• Mark more tests as requiring network for vendors that need to run tests offline (#​19819)

janosmiko/lfk (github:janosmiko/lfk)

v0.14.12

Compare Source

Features

• Log Top — live log aggregation view (top-style request analytics) (#​453) (fd79482)

max-sixty/worktrunk (github:max-sixty/worktrunk)

v0.60.0: 0.60.0

Compare Source

Release Notes

Improved

• Package installs complete branch and worktree names: A plain brew install worktrunk (or other package install) now tab-completes branch and worktree names, not just subcommands and flags. wt config shell completions <shell> emits a dynamic registration that calls the binary at completion time (the maintained clap_complete::env path), matching what gh, rustup, and kubectl ship. (#​3105, thanks @​bendrucker)

• wt step relocate moves dirty linked worktrees: Relocating a linked worktree with uncommitted or untracked changes no longer skips it. git worktree move carries those files along, so the dirty-skip was a worktrunk policy rather than a git limitation. The main worktree still skips when dirty (without --commit), since its relocation falls back to git checkout, which refuses to switch over a dirty tree. (#​3104, thanks @​lunaynx for reporting)

• --dry-run previews print to stdout: wt hook <type>, wt step relocate, wt step prune, wt step copy-ignored, and wt config shell install/uninstall now send their --dry-run preview to stdout (the command's answer) while narration stays on stderr. This matches wt list, git clean -n, and terraform plan, and keeps previews pageable and pipeable. (Breaking: scripts reading these previews from stderr should now read stdout) (#​3085)

• Picker gutter distinguishes local and remote branches: With --branches and --remotes, the wt switch picker marks each row's kind in the gutter: / for a local branch without a worktree and | for a remote branch, alongside the existing @/^/+ worktree glyphs. (#​3115)

• wt list --format=json gains structured repo metadata: JSON output adds repo (the local checkout's primary remote) and ci.repo (the repository ci.url targets, which differs for fork PRs) objects carrying host/owner/name/provider; the existing repo_url and ci.repo_url strings remain. The provider honors the configured [forge].platform on hosts that can't be auto-detected. (#​3021, thanks @​jeremy0dell)

• wt step eval --format=json: wt step eval gains a structured {name, template, result} JSON lane on stdout, the machine-readable analog of its -v view. Text mode is unchanged. (#​3106)

• --format=claude-code rejected where it never applied: wt list and wt config state get accepted --format=claude-code silently and treated it as table; the value only ever meant anything on wt list statusline. Both now fail fast with invalid value 'claude-code'. (Breaking: wt list --format=claude-code and wt config state get --format=claude-code now error) (#​3116)

Fixed

• cargo install worktrunk builds from crates.io: Installing from crates.io failed to compile with environment variable VERGEN_GIT_DESCRIBE not defined at compile time, because the package archive has no .git for the build script to read. The version lookup now falls back to the cargo package version when git-describe is unavailable. (#​3124, fixes #​3123, thanks @​kerrickstaley for reporting)

• Tab-completion works in repos with no commits: wt switch <TAB> and wt remove <TAB> returned nothing on a fresh git init repo, because the unborn default branch has no entry under refs/heads/. Completion now also draws on worktree branches, so the unborn main (and any wt switch --create branch on an empty repo) completes. (#​3097, closes #​3094)

• wt config state get ci-status --format=json honors [forge].platform: On a self-hosted host the parser can't recognize (Gitea, Azure DevOps, GitHub Enterprise on a generic domain), this path reported provider: "unknown" while wt list --format=json reported the configured provider. All structured-output paths now route the [forge].platform override through one accessor, so they stay consistent. (#​3120)

Documentation

• wt list --help example tables fit the terminal: The captured wt list example tables in --help chop to terminal width with a dimmed ellipsis (matching real wt list) instead of word-wrapping and shearing their columns; hand-authored command examples still wrap. (#​3125)

• /wt-switch-create cross-repo handling reworked: The Claude Code plugin command's skill reworks how it creates and enters a worktree in another repo, built around what the harness actually does (EnterWorktree re-roots within the current repo; a cd reaches another repo when it's in additionalDirectories). The procedure dropped from five steps to three. (#​3118)

• Help-text and docs refinements: --format help renders its values inline ([possible values: table, json]) instead of an expanded block; wt switch and wt step push help got smaller clarifications; and web-doc terminal blocks no longer wrap command-only lines. (#​3096, #​3108, #​3110, #​3112, #​3126)

Install worktrunk 0.60.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/max-sixty/worktrunk/releases/download/v0.60.0/worktrunk-installer.sh | sh && wt config shell install

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/max-sixty/worktrunk/releases/download/v0.60.0/worktrunk-installer.ps1 | iex"; git-wt config shell install

Install prebuilt binaries via Homebrew

brew install worktrunk && wt config shell install

Download worktrunk 0.60.0

File	Platform	Checksum
worktrunk-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
worktrunk-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
worktrunk-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
worktrunk-aarch64-unknown-linux-musl.tar.xz	ARM64 MUSL Linux	checksum
worktrunk-x86_64-unknown-linux-musl.tar.xz	x64 MUSL Linux	checksum

Install via Cargo

cargo install worktrunk && wt config shell install

Install via Winget (Windows)

winget install max-sixty.worktrunk && git-wt config shell install

Install via AUR (Arch Linux)

paru worktrunk-bin && wt config shell install

---

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

• Branch creation
  • Between 03:00 AM and 05:59 AM (* 3-5 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.