fix(deps): update all non-major dependencies (patch) - #1955
Conversation
|
|
You do not have enough credits to review this pull request. Please purchase more credits to continue. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates several dependencies across the project. Specifically, it bumps @oh-my-pi/pi-coding-agent and @oh-my-pi/pi-natives to version 16.0.11 in package.json and bun.lock. Additionally, it updates ruff to >=0.15.18 and fastapi[standard] to >=0.137.2 in pyproject.toml. There are no review comments, and I have no feedback to provide.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
|
Warning Review limit reached
Next review available in: 38 minutes Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable usage-based reviews in Billing to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please see our Fair Usage Limits Policy for further information, and refer to the rate limits docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (1)
📝 WalkthroughWalkthroughVersion constraints were updated in ChangesDependency and workflow version updates
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Mesa DescriptionTL;DRUpdates non-major Python and Node.js dependencies to their latest patch versions, including What changed?
Description generated by Mesa. Update settings |
2eb5943 to
8190cc4
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pyproject.toml`:
- Line 18: Ruff is only pinned in the dependency group, but the independent
install/run paths still float. Update the Ruff references in the Python workflow
and the Makefile lint target alongside the pyproject dependency so `python.yml`
and the local `ruff` invocation use the same fixed version. Use the existing
Ruff install/run entries in those locations to keep all entrypoints aligned.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: ff71b275-a6f2-4c95-bb56-918154750b5b
⛔ Files ignored due to path filters (1)
bun.lockis excluded by!**/*.lock
📒 Files selected for processing (2)
package.jsonpyproject.toml
🚧 Files skipped from review as they are similar to previous changes (1)
- package.json
| "mistral-vibe>=2.17.1", | ||
| "nvitop>=1.7.0", | ||
| "ruff>=0.15.17", | ||
| "ruff>=0.15.18", |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
rg -n -C2 --glob 'pyproject.toml' --glob 'Makefile' --glob '.github/workflows/*.yml' '\bruff\b|uv pip install --system ruff|uv run --with ruff'Repository: shunkakinoki/dotfiles
Length of output: 159
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '--- pyproject.toml ---\n'
nl -ba pyproject.toml | sed -n '1,120p'
printf '\n--- Makefile Ruff references ---\n'
rg -n -C2 '\bruff\b|uv run --with ruff|uv pip install --system ruff' Makefile
printf '\n--- GitHub workflow Ruff references ---\n'
rg -n -C2 '\bruff\b|uv run --with ruff|uv pip install --system ruff' .github/workflows/python.yml
printf '\n--- dependency-groups/tools references in repository ---\n'
rg -n -C2 'dependency-groups|tools' pyproject.toml .github/workflows/python.yml MakefileRepository: shunkakinoki/dotfiles
Length of output: 250
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- pyproject.toml ---'
nl -ba pyproject.toml | sed -n '1,120p'
printf '\n%s\n' '--- Makefile Ruff references ---'
rg -n -C2 '\bruff\b|uv run --with ruff|uv pip install --system ruff' Makefile
printf '\n%s\n' '--- GitHub workflow Ruff references ---'
rg -n -C2 '\bruff\b|uv run --with ruff|uv pip install --system ruff' .github/workflows/python.yml
printf '\n%s\n' '--- dependency-groups/tools references in repository ---'
rg -n -C2 'dependency-groups|tools' pyproject.toml .github/workflows/python.yml MakefileRepository: shunkakinoki/dotfiles
Length of output: 222
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- pyproject.toml ---'
awk '{printf "%5d %s\n", NR, $0}' pyproject.toml | sed -n '1,120p'
printf '\n%s\n' '--- Makefile Ruff references ---'
rg -n -C2 '\bruff\b|uv run --with ruff|uv pip install --system ruff' Makefile
printf '\n%s\n' '--- GitHub workflow Ruff references ---'
rg -n -C2 '\bruff\b|uv run --with ruff|uv pip install --system ruff' .github/workflows/python.yml
printf '\n%s\n' '--- dependency-groups/tools references in repository ---'
rg -n -C2 'dependency-groups|tools' pyproject.toml .github/workflows/python.yml MakefileRepository: shunkakinoki/dotfiles
Length of output: 3221
Pin Ruff in the active entrypoints too. pyproject.toml:18 only updates the dependency group; .github/workflows/python.yml:42-47 and Makefile:1304-1307 install/run Ruff independently, so CI and the local lint target will keep floating. If the goal is a single Ruff version, update those commands as well.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pyproject.toml` at line 18, Ruff is only pinned in the dependency group, but
the independent install/run paths still float. Update the Ruff references in the
Python workflow and the Makefile lint target alongside the pyproject dependency
so `python.yml` and the local `ruff` invocation use the same fixed version. Use
the existing Ruff install/run entries in those locations to keep all entrypoints
aligned.
Signed-off-by:
8190cc4 to
f600038
Compare
# Conflicts: # bun.lock # package.json
2 participants
This PR contains the following updates:
^16.1.7→^16.1.1316.1.23(+9)^16.1.7→^16.1.1316.1.23(+9)^0.15.0→^0.15.1v46.1.15→v46.1.16v46.1.17>=0.15.17→>=0.15.180.15.20(+1)Release Notes
can1357/oh-my-pi (@oh-my-pi/pi-coding-agent)
v16.1.13Compare Source
@oh-my-pi/pi-ai
Added
Changed
Record<string, unknown>andunknownfor tool resultsFixed
ig_...item IDs, preventing follow-up requests from failing with404 Item with id ... not found. (#3225)/login fireworksrejecting validfw_…keys withFireworks API key validation failed (500): Error listing deployed models. The validator pinged/inference/v1/models, which Fireworks serves from the per-account deployment registry and 500s for accounts without active deployments. Login now hits the static control-planeList Modelscatalog (GET /v1/accounts/fireworks/models?filter=supports_serverless=true&pageSize=1) — the same endpoint discovery already uses — so authentication no longer depends on the caller's deployment state. (#3219)@oh-my-pi/pi-catalog
Added
@oh-my-pi/snapcompact
Fixed
What's Changed
Full Changelog: can1357/oh-my-pi@v16.1.12...v16.1.13
v16.1.12Compare Source
Changed
Fixed
Invalid 'input[N].content[].image_url'. Expected a base64-encoded data URL ... but got an invalid base64-encoded value. The obfuscator deep-walked every string in the outbound request — including inline image base64 and opaque provider replay/signature fields — so a configured secret that happened to be a substring of the base64 (or of an ordinary word likeresponse) injected#HASH#placeholders mid-payload. Obfuscation is now opt-in and fully typed: only user messages, tool-result messages, and user-attributed developer messages (@filementions) are redacted; system prompts and tool schemas pass through untouched; image bytes and signature/encrypted-reasoning fields are never rewritten; and tool-call arguments are the only JSON walked. Configured plain secrets and regex matches shorter than 8 characters are now ignored to stop false matches on short words.task.isolation.{mode,merge,commits},task.eager,task.batch,task.maxConcurrency,task.maxRecursionDepth,task.disabledAgents,task.agentModelOverrides,memory.backend,memories.enabled,advisor.{enabled,subagents,syncBacklog,immuneTurns}, plus the RPC-onlyasync.{enabled,maxJobs}andbash.autoBackground.{enabled,thresholdMs}.applyDefaultSettingOverridesre-asserted the schema default as a runtime override after settings load, regressing theisConfigured()guard added for #2598 and ignoring every explicit value the embedder, project,--configoverlay, or global config had set. The guard is restored, so the host default now only fills holes (#3207).v16.1.11Compare Source
Added
tab.waitForSelectorfor more robust element-wait behaviortab.waitForNavigationto monitor and await page transitionsChanged
Fixed
input_image.image_url; Codex-bound images now stay in PNG/JPEG-compatible formats./modelthinking picker labeling the OpenAI GPT-5.5 top effort asmaxinstead of the catalog-declaredxhigh(#3194).smolmodel (and billing whatever provider held the resolved API key — OpenRouter in the reporter's case) when the user had explicitly configured a localproviders.tinyModel:generateSessionTitleraced local against online with a 10s timeout and fired the online request immediately whenever the local worker returnednull(unknown key, model not downloaded, transformers.js failure). Now an explicit local-model choice is honored end-to-end — on local failure the session is left untitled with alogger.warninstead of billing the smol fallback (#3187)environmentis accepted as the OpenCode env key, and argument lists are omitted when empty. (#3180)writehidden undertools.discoveryMode: "all", which made the agent attempt to create the plan file viaeditand stall. Plan-mode entry now force-activateswritewhenever the registry built it, matching thewrite+editinstructions in the plan-mode prompt (#3165)editandpatchtool writes bypassing the ACP client's open buffer when Zed (or another ACP client) advertises thefs.writeTextFilecapability: all three write-mode tools (edit,patch,replace) now route through the client bridge when it is available, so the editor's TypeScript diagnostics panel updates immediately instead of requiring a workspace reload.app.message.followUpchord (Ctrl+Q or Ctrl+Enter), matching the main prompt editor and any user remap ofapp.message.followUp(#2118).pi.sendMessage({ display: true })rendering the custom message twice when fired from asession_startextension handler (or any other non-streaming dispatch before the initial transcript render).ExtensionUiController.#applyCustomMessageDisplayrebuilt the chat from the freshly-persisted session entry, andmain.ts's subsequentrenderInitialMessages(undefined, { preserveExistingChat: true })then both re-rendered from session entries AND re-appended the preserved chat children — duplicating the message. The rebuild now waits untilrenderInitialMessageshas completed at least once (tracked viaInteractiveModeContext.initialChatRendered); after that, post-init extension sends still rebuild as before so messages fromtool_result/agent_end/ etc. surface immediately (#1955)..jj/repo/present, no colocated.git/).task/worktree.ts#getRepoRootpreviously threw a generic "Git repository not found" for isolated subagent setup, andautoresearch/git.ts#ensureAutoresearchBranchreturned a soft "Not in a git repository" warning that let/autoresearchproceed with no branch isolation or auto-commits. Both paths now detect a pure jj workspace via the newjj.isPureJjRepohelper and surface an actionable Jujutsu-specific error pointing atjj git init --colocate. Colocated jj-git (both.jj/and.git/at the same root) and plain Git checkouts behave exactly as before (#1935).autothinking mode being silently dropped when a session is resumed (--continue/--resume/in-app switch). The session log persisted only the resolved per-turn effort, not theautoselector, so resume froze the session at the last concrete level and never reclassified again. The log now records the configured selector (autovs concrete) alongside the resolved effort, so resumedautosessions stay in auto (shown as pending until the next turn reclassifies) and manual concrete pins still restore as concrete — including a pin whose level matches the effortautohad just resolved to..some providers emit for tool-call-only or thinking-only turns — into[role: assistant]\n.\n[assistant:end]blocks that polluted the bank, wasted retain tokens, and degraded recall.prepareRetentionTranscript,extractMessages, andflattenMessagesForRecallnow require at least one letter or digit per message via a sharedhasSubstantiveContentpredicate (#1806)./resumerendering forked child sessions without a fork tag, making them indistinguishable from their parent when titles match (#1792).v16.1.10Compare Source
Added
tab.ariaSnapshot(selector?)to the browser tool for Playwright-format ARIA-tree YAMLtab.ref("e5")and support foraria-ref=e5selectors in alltabaction methodsChanged
writeandfindtools essential so they are always available initially (survivingtools.discoveryMode === "all"hiding) to ensure instructions to write/find files are immediately executable (#3165)Fixed
$ …,Write: …, an empty args tree) even after the tool finished: the pending card was created while arguments streamed, but when the closing full-argumentsmessage_updatenever arrived (smooth-streaming disabled leaving the throttled arguments stale, an owned-dialect projector, or a superseded/aborted turn that still ran the call) nothing re-applied the final args.tool_execution_start— the one event every execution path emits with validated full arguments right before the result — now reconciles them onto the existing pending card and cancels any in-flight reveal so a late tick can't re-truncate the body.v16.1.9Compare Source
Added
/dumpChanged
WebGL,Worker,IFrame,Screen, andAudioAPIs to evade detectiontoStringpatching to register native function sources for improved fingerprint protectionFixed
omp listandomp removesilently starting an interactive agent session (forwarding the bare verb to the model as a prompt) instead of surfacing the realomp plugin list/omp plugin uninstall <name>commands (#2935)method, so a server-originatedworkspace/configurationpull whose id collided with an in-flight request was swallowed as a bogus response, leaving the pull unanswered and the server wedged. The reader now routes any message carrying amethodas a server request before id-matching (#3001)omp --approval-mode=yolo acpand other global option flags placed before a subcommand being rewritten tolaunchwith the subcommand swallowed as prompt text; the CLI resolver now skips leading global flags (using the launch parser's value-consumption contract) and dispatches the real subcommand with the flags applied, so ACP mode honors the configured approval policy. (#2970)/mcp enableand/mcp disablereconnecting unrelated MCP servers by scoping toggle reconnect/disconnect work to the named server. (#3157)Removed
/debug dump-next-requestcommandv16.1.8Compare Source
Added
/btwanswers so users can copy the visible side-answer text before branching or dismissing the panel.Changed
SnapcompactInlineand SDK session context building to support asynchronous rendering/btw,/omfg, and IRC auto-replies) to forward the main turn's tool catalog to preserve the prompt-cache layout, while injecting a reminder to suppress tool usage and discarding any generated tool calls./btw,/tan,/omfg,/memory,/rename, and/moveto save the typed command text to TUI prompt history so they can be recalled with the up arrow./modelfor role model assignment. (#2952)new Promise((resolve, reject) => ...)inAsyncDrainwithPromise.withResolvers()per the repo's promise-construction conventionFixed
EventControllertests where a missingsettingsproperty in theInteractiveModeContextmock object led to calling.geton undefined when streaming tool-call args.rewindtoolrewindtool output and temporary assistant side-channel data polluting the prompt cachereadagainst a SQLite table with many columns (e.g. 33) rendering every cell as an ellipsis and chopping the right edge. The ASCII table shrinker bottomed out atMIN_COLUMN_WIDTH=1so every multi-char cell collapsed to…, and the final line truncation then cut off the right side. The renderer now bumps the per-column floor to 3 and falls back to a verticalcolumn: valueblock layout per row when the column count exceeds the horizontal width budget. (#3107)skill://,local://,memory://, andvault://directory paths so read lists them and search/find can walk their backing directories. (#3116)__omp_worker_tiny_inferencefor the same failed model, and blocked the unsupported Qwen3 1.7B ONNX memory model before load. (#3132)/joinfailing withtimed out waiting for the host's welcomeon collab sessions whose existing transcript was more than a few MB. The host now sends a smallwelcomeframe (header + state + agents +entryCount) followed by a train ofsnapshot-chunkframes (SNAPSHOT_CHUNK_BYTES = 512 KB), and the guest accumulates them under a per-chunk progress timeout that resets on each chunk arrival. The first welcome lands well under one second on the default relay, so the guest's 30s first-welcome budget is no longer spent transferring the snapshot. Requires the newCOLLAB_PROTO = 2on both sides; older hosts/guests are rejected with the existing protocol-mismatch error. (#3144)embed()now caps each input atMNEMOPI_EMBEDDING_MAX_INPUT_CHARS(default 8192 chars) and clips with a head/tail split so a long multi-turnMnemopiSessionState.retainMessagestranscript can't make llama.cpp's/embeddingsserver reject the request withrequest (N tokens) exceeds the available context sizeand silently drop vector recall for that memory. The head/tail clip keeps both the opening setup and the most recent turns so later episodes don't collapse onto the same prefix vector (#3126)./goalcontinuation turns that end with a successfulyieldskipping threshold auto-compaction while the active goal remains overcompaction.thresholdTokens. (#3146)/resumeandomp --resumeno longer auto-switch to the "all projects" picker when the current folder has no sessions. The picker now stays scoped to the cwd and surfaces the existing "No sessions in current folder. Press Tab to view all." hint, so users in an empty project never see other projects' session history without asking. (#3099)/todo exportand/todo importin ACP/text and TUI modes to resolve paths from the active session cwd, accept quoted paths with spaces, and report invalid path schemes without crashing.buildSystemPrompthelper to render caller-provided tools instead of falling back to the default prompt inventory, and to keep no-tools-map skills visible whenreadis available through the fallback./omfgsaved-state copy to advertiseEsc dismissafter saving and registering the rule live.getModel/getModelsfrom the@oh-my-pi/pi-aipackage root failing to load, by restoring them as compatibility aliases for@oh-my-pi/pi-catalog'sgetBundledModel/getBundledModels. The rootStringEnumcompatibility shim also accepts TypeScript enum objects in addition to value arrays (#2907).blockers in plan mode (e.g. "don't write a plan file") because it only saw a 120-char truncation of the injected plan-mode rules, which cut off atNEVER create, edit, or delete files — excep…and hid the "except the single plan file" carve-out. The advisor delta now expands the primary agent's constraint context (plan-mode-context,plan-mode-reference) verbatim inside an XML-escaped<primary-context>wrapper instead of a one-liner, andAdvisorRuntimededupes the re-injected prompts so an unchanged copy collapses to a marker rather than re-feeding the full rules every turn.before_provider_requestextension shrinks the outgoing request below the real stored conversation (e.g. a context-compression proxy such as Headroom, or an aggressive obfuscator). The provider then reports deflated prompt tokens, so the threshold check never fired and the stored history grew unbounded until it overflowed the context window and could no longer be compacted at all. The compaction decision (both the pre-prompt and post-response paths) now floors the provider-reported context tokens by the agent's own local estimate of the stored conversation, so on-wire compression can no longer hide a too-large history from the auto-compactor. Context display and cost accounting still use the exact provider usage; only the compaction trigger takes the floor.MNEMOPI_PROACTIVE_LINKINGenvironment variable, unlike the siblingmnemopi.polyphonicRecall/mnemopi.enhancedRecallsettings: added amnemopi.proactiveLinkingconfig.yml setting (off by default,/settings→ Memory → Mnemopi) that ingests new memories into the episodic graph as they are stored, linking them to related entities and memories;MNEMOPI_PROACTIVE_LINKINGstill overrides the configured value when set (#2440).renovatebot/github-action (renovatebot/github-action)
v46.1.16Compare Source
Documentation
Miscellaneous Chores
Build System
Continuous Integration
astral-sh/ruff (ruff)
v0.15.18Compare Source
Released on 2026-06-18.
Preview features
ruff:ignorecomments (#25791)pydocstyle] Prevent property docstrings starting with verbs (D421) (#23775)flake8-pyi] ExtendPYI033to Python files (#26129)Bug fixes
Rule changes
flake8-pyi] RenamePYI033tolegacy-type-comment(#26131)Performance
ThinVecfor call keywords (#25999)Server
Documentation
flake8-tidy-imports] Add fix safety section (TID252) (#17491)Parser
__debug__lambda parameters (#26022)_as a match-pattern target (#25977)yieldexpressions after commas (#26024)Playground
Contributors
Configuration
📅 Schedule: (in timezone UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate.