chore(deps): update all non-major dependencies (patch) by shunkakinoki · Pull Request #2000 · shunkakinoki/dotfiles

shunkakinoki · 2026-07-06T04:27:26Z

This PR contains the following updates:

Package	Change	Type	Update	Pending
croniter	`>=6.2.2,<7` → `>=6.2.3,<7`	dependency-groups	patch
fastapi (changelog)	`>=0.138.0` → `>=0.138.2`	dependency-groups	patch
mistral-vibe	`>=2.18.0` → `>=2.18.4`	dependency-groups	patch
renovatebot/github-action	`v46.1.16` → `v46.1.17`	action	patch	`v46.1.18`
ruff (source, changelog)	`>=0.15.18` → `>=0.15.20`	dependency-groups	patch	`0.15.21`

Release Notes

pallets-eco/croniter (croniter)

`v6.2.3`

Compare Source

Features and Improvements

- Fix quadratic expansion of comma-separated range lists for a large speed-up on expressions with many ranges. [1d79fc6, #&#8203;231, @&#8203;alhudz]

Bugfixes
~~~~~~~~
- Reject a zero step (e.g. ``5-5/0``) in equal and reversed cron ranges instead of silently accepting it. [ab27767, #&#8203;232, @&#8203;alhudz]
- Fix ``expand_from_start_time`` month low-bound off-by-one so stepped month ranges start on the correct month. [f329964, #&#8203;235, @&#8203;alhudz]

Packaging
~~~~~~~~~
- Fix zizmor-reported security findings in GitHub Actions workflows. [ed19f94, #&#8203;230]
- Bump pinned build and CI dependencies via dependabot.
- Upgrade locked development and build dependencies (``uv lock --upgrade``).

6.2.2 (2026-03-15)
------------------

Packaging
~~~~~~~~~
- Switch build backend from ``flit_core`` to ``hatchling`` with pinned dependencies. [4cce160]
- Add PEP 639 license expression (``license = "MIT"``) to project metadata. [4cce160]
- Pin all GitHub Actions to SHA hashes across CI workflows. [4cce160]
- Add dependabot for automated dependency updates. [4cce160]
- Add zizmor workflow for CI security scanning. [4cce160]

6.2.1 (2026-03-15)
------------------

Bugfixes
~~~~~~~~
- Fix ``get_prev`` skipping Feb 29 on leap years for day-of-month expressions. [441a0b5, #&#8203;203, @&#8203;Souls-R]

Packaging
~~~~~~~~~
- Add ``License :: OSI Approved :: MIT License`` classifier. [270cbbc, @&#8203;cdheiser]

6.2.0 (2026-03-14)
------------------

Features and Improvements

Add support for W (nearest weekday) in the day-of-month field. [c79d88a]
Add precision_in_seconds parameter to match() and match_range() to allow overriding the default matching precision. [7415d1e, #58]
Add strict parameter to is_valid() and expand() for cross-field validation of impossible day/month combinations. [0352d48, #199]

Bugfixes

- Fix memory leak by removing ``EXPRESSIONS`` global dict cache. [6ebfe56, @&#8203;Souls-R]

Testing and Documentation

Document day_or and implement_cron_bug parameters for day-of-month/day-of-week interaction. [289bf73, #75]
Document precision_in_seconds parameter and default precision behavior for match(). [7415d1e, #58]

fastapi/fastapi (fastapi)

`v0.138.2`

Compare Source

Refactors

♻️ Make app.frontend() return 404 for methods other than GET or HEAD with no static file matches. PR #15863 by @tiangolo.

Internal

🔧 Update sponsors: remove Stainless. PR #15862 by @tiangolo.
♻️ Refactor how sponsors data is handled for banners. PR #15852 by @tiangolo.

`v0.138.1`

Compare Source

Refactors

♻️ Refactor Library Skills, make info easier to find for agents. PR #15841 by @tiangolo.

Internal

👷 Simplify pull request workflow triggers. PR #15836 by @tiangolo.
👷 Update issue-manager to 0.7.1. PR #15833 by @tiangolo.
⬆️ Update issue-manager to 0.7.0. PR #15831 by @tiangolo.
🔧 Update sponsors: Add TestMu again. PR #15830 by @tiangolo.
🔒️ Update zizmor workflow security checks. PR #15820 by @tiangolo.
⬆ Bump pydantic-settings from 2.14.1 to 2.14.2. PR #15799 by @dependabot[bot].

mistralai/mistral-vibe (mistral-vibe)

`v2.18.4`

Compare Source

Changed

Whole-line content now shown in the edit diff
Declined or skipped tool calls now render as a muted square
Auto-approve now works in lean mode

Fixed

Session resume with --continue now matches the resolved working directory
Long tool call titles now wrap instead of being cropped
Duplicate mcp_servers names in config are now rejected
MarkupError crash when a tool error contained square brackets
Teleport now uses the matched GitHub remote
Raw compaction user messages are now preserved
ACP now honors default_agent on new and resumed sessions
Ambiguous teleport session creates are now retried

`v2.18.3`

Compare Source

Added

j/k navigation in selectable lists across the TUI (questions, theme picker, rewind, voice, MCP panels)
ask_confirmation_on_exit config option to prompt before quitting
Project-level .vibe/config.toml now persists config option changes

Changed

Consistent styling and casing for keyboard shortcut hints across the TUI
ask_user_question now supports more than 4 options and questions

Fixed

No longer prompts to log in for disabled MCP servers
Teleport diff no longer mutates the real git index

`v2.18.1`

Compare Source

Added

/mcp add slash command for adding OAuth MCP servers
Petit chat animation idle pauses

Changed

Bare exit synonyms (exit, quit, :q, :quit) now treated as slash commands instead of prompts

Fixed

MCP OAuth login crash when keyring backend is un-loadable

renovatebot/github-action (renovatebot/github-action)

`v46.1.17`

Compare Source

Documentation

update references to renovatebot/github-action to v46.1.16 (fe5fe9b)

Miscellaneous Chores

deps: update actions/cache action to v5.1.0 (68d0678)
deps: update dependency lint-staged to v17.0.8 (3596cfc)
deps: update linters (db46956)
deps: update node.js to v24.18.0 (8e54d20)
deps: update pnpm to v10.34.4 (d1252f8)

Build System

deps: lock file maintenance (732b1ba)

Continuous Integration

deps: update ghcr.io/renovatebot/renovate docker tag to v43.234.1 (9eec991)
deps: update ghcr.io/renovatebot/renovate docker tag to v43.235.0 (25a2109)
deps: update ghcr.io/renovatebot/renovate docker tag to v43.235.1 (0b81c4e)
deps: update ghcr.io/renovatebot/renovate docker tag to v43.235.2 (b9dd808)
deps: update ghcr.io/renovatebot/renovate docker tag to v43.236.0 (a637622)
deps: update ghcr.io/renovatebot/renovate docker tag to v43.237.0 (27d53a3)
deps: update ghcr.io/renovatebot/renovate docker tag to v43.237.1 (a51e52e)
deps: update ghcr.io/renovatebot/renovate docker tag to v43.239.0 (d472559)
deps: update ghcr.io/renovatebot/renovate docker tag to v43.240.0 (2738a4c)
deps: update ghcr.io/renovatebot/renovate docker tag to v43.241.1 (61f9c07)
deps: update ghcr.io/renovatebot/renovate docker tag to v43.241.5 (fc1a7e3)
deps: update ghcr.io/renovatebot/renovate docker tag to v43.242.0 (279d0b5)
deps: update ghcr.io/renovatebot/renovate docker tag to v43.242.1 (aca194e)
deps: update ghcr.io/renovatebot/renovate docker tag to v43.242.2 (747d234)
deps: update ghcr.io/renovatebot/renovate docker tag to v43.243.0 (cd474ba)
deps: update ghcr.io/renovatebot/renovate docker tag to v43.243.1 (90faa1a)
deps: update ghcr.io/renovatebot/renovate docker tag to v43.243.2 (16cb7c4)
deps: update ghcr.io/renovatebot/renovate docker tag to v43.244.1 (6edf840)
deps: update ghcr.io/renovatebot/renovate docker tag to v43.244.3 (f463e40)
deps: update ghcr.io/renovatebot/renovate docker tag to v43.244.4 (759a191)
deps: update ghcr.io/renovatebot/renovate docker tag to v43.245.0 (7625a0a)
deps: update ghcr.io/renovatebot/renovate docker tag to v43.246.0 (0400fab)
deps: update ghcr.io/renovatebot/renovate docker tag to v43.246.1 (1837166)

astral-sh/ruff (ruff)

`v0.15.20`

Compare Source

Released on 2026-06-25.

Preview features

Allow human-readable names in rule selectors (#25887)
Emit a warning instead of an error for unknown rule selectors (#26113)
Match noqa shebang handling in ruff:ignore comments (#26286)
[ruff] Remove pytest-fixture-autouse (RUF076) (#26240, #26371)

Documentation

Add versioning sections to custom crate READMEs (#26317)
Update ruff_python_parser README for crates.io (#26315)
[perflint] Clarify that PERF402 applies to any iterable (#26242)

Contributors

`v0.15.19`

Compare Source

Released on 2026-06-23.

Preview features

Support human-readable names when hovering suppression comments and in code actions (#26114)

Bug fixes

Fall back to default settings when editor-only settings are invalid (#26244)
Fix panic when inserting text at a notebook cell boundary (#26111)

Rule changes

[pylint] Update fix suggestions for __floor__, __trunc__, __length_hint__, and __matmul__ variants (PLC2801) (#26239)

Performance

Avoid allocating when parsing single string literals (#26200)
Avoid reallocating singleton call arguments (#26223)
Lazily create source files for lint diagnostics (#26226)
Optimize formatter text width and indentation (#26236)
Reserve capacity for builtin bindings (#26229)
Skip repeated-key checks for singleton dictionaries (#26228)
Use ArrayVec for qualified name segments (#26224)

Documentation

[flake8-pyi] Note that PYI051 is an opinionated stylistic rule (#26179)
[pyupgrade] Clarify UP029 as a Python 2 compatibility rule (#26243)

Other changes

Publish Ruff crates to crates.io (#26271)

Contributors

Configuration

📅 Schedule: (in timezone UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

indent-zero · 2026-07-06T04:27:29Z

PR Summary

Renovate PR rebased again onto a newer main. The effective diff against the current base is now 2 files / 4 hunks \u2014 no package.json / bun.lock changes this time, so the previously-reported @openai/codex-<platform> alias regression is no longer present (main moved to @openai/codex@0.144.0 with correctly-formed per-platform aliases, and this push does not touch npm deps). Effect on the system is a slightly newer pinned Renovate action for the next scheduled run and slightly higher Python-tool minimums the next time users run uv tool install / uv pip install the hermes group.\n\n- Bump pinned renovatebot/github-action v46.1.16 \u2192 v46.1.17 in .github/workflows/renovate.yml.\n- Bump pyproject.toml tool floors: mistral-vibe >=2.18.0 \u2192 >=2.18.4, ruff >=0.15.18 \u2192 >=0.15.20.\n- Bump pyproject.toml hermes floors: croniter >=6.2.2,<7 \u2192 >=6.2.3,<7 (new in this push) and fastapi[standard] >=0.138.0 \u2192 >=0.138.2.

Issues

All clear! No issues remaining. 🎉

2 issues already resolved

@openai/codex runtime/platform-package version drift: package.json bumps "@openai/codex" to ^0.142.3 (Bun resolves it to 0.142.5 in bun.lock), but the platform-specific optional deps are still pinned via npm: aliases to @openai/codex@0.142.5-<platform>. This works today only because the caret happens to resolve to 0.142.5; when Renovate next bumps the top-level above 0.142.5 without also bumping the aliased optional deps, users will get a top-level CLI that doesn't match its native binary. Consider aligning the top-level range and the npm: aliases in the same commit (or letting Renovate group them) so the drift cannot silently widen. (fixed by commit d4824e6)
@openai/codex-<platform> optional-dep aliases were rewritten from npm:@openai/codex@0.142.5-<platform> (the real per-platform native tarballs, gated by os/cpu) to npm:@openai/codex@0.142.5 (the platform-agnostic JS meta package that is already the top-level @openai/codex: ^0.142.5 dep). All six aliases now resolve to the same meta package, defeating their platform-selection purpose and adding a 36-entry @openai/codex-<parent>/@openai/codex-<platform> cross-product to bun.lock (~120 extra lines). Installs still succeed (the real tarballs are pulled in transitively via the meta package's own optionalDependencies), but the six aliases now provide no value beyond the top-level dep. Renovate has known trouble with npm:@pkg@<semver>-<suffix> alias specifiers — either revert the six aliases and add a Renovate packageRules entry that pins them, or drop the six @openai/codex-<platform> entries entirely since the top-level @openai/codex dep already declares all six as its own optionalDependencies. (fixed by commit f80a22e)

CI Checks

All CI checks passing on commit f80a22e. Previous cycles' nix-darwin / e2e-run (macOS) vector-0.56.0 build failure and the spec/npm_globals_spec.sh treefmt drift are both cleared on this rebased head.

cursor · 2026-07-06T04:27:29Z

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

coderabbitai · 2026-07-06T04:27:34Z

Warning

Review limit reached

@shunkakinoki, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 59 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: a237d1ee-f3d6-4d13-a021-94ca461aeffb

📥 Commits

Reviewing files that changed from the base of the PR and between 14cc80d and f80a22e.

📒 Files selected for processing (2)

.github/workflows/renovate.yml
pyproject.toml

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch renovate/patch-all-minor-patch

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

gemini-code-assist

Code Review

This pull request updates various package dependencies across package.json, bun.lock, and pyproject.toml. Notable updates include bumps for @anthropic-ai/claude-code, @github/copilot, @openai/codex, ruff, and fastapi. There are no review comments, so I have no feedback to provide.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

cubic-dev-ai

No issues found across 4 files

_{Re-trigger cubic}

cursor · 2026-07-07T04:20:42Z

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

cursor · 2026-07-08T04:03:45Z

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

mesa-dot-dev · 2026-07-08T04:04:08Z

Mesa Description

TL;DR

Updates various project dependencies to their latest patch versions, including Python packages, platform-specific Node dependencies, and GitHub Actions.

What changed?

.github/workflows/renovate.yml: Updated renovatebot/github-action from v46.1.16 to v46.1.17.
pyproject.toml: Bumped minimum versions for fastapi, mistral-vibe, and ruff.
package.json: Aligned platform-specific @openai/codex optional dependencies to target base version 0.142.5.
bun.lock: Regenerated lockfile to ensure reproducible Bun builds with updated dependencies.

^{Description generated by Mesa. Update settings}

cursor · 2026-07-09T04:20:32Z

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

Signed-off-by:

cursor · 2026-07-10T04:21:13Z

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

shunkakinoki enabled auto-merge (squash) July 6, 2026 04:27

gemini-code-assist Bot reviewed Jul 6, 2026

View reviewed changes

indent-zero Bot reviewed Jul 6, 2026

View reviewed changes

Comment thread package.json Outdated

cubic-dev-ai Bot reviewed Jul 6, 2026

View reviewed changes

shunkakinoki force-pushed the renovate/patch-all-minor-patch branch from 81017b9 to d4824e6 Compare July 7, 2026 04:20

shunkakinoki changed the title ~~fix(deps): update all non-major dependencies (patch)~~ chore(deps): update all non-major dependencies (patch) Jul 7, 2026

shunkakinoki force-pushed the renovate/patch-all-minor-patch branch from d4824e6 to 525a05d Compare July 8, 2026 04:03

indent-zero Bot reviewed Jul 8, 2026

View reviewed changes

Comment thread package.json Outdated

shunkakinoki force-pushed the renovate/patch-all-minor-patch branch from 525a05d to 6c38f21 Compare July 9, 2026 04:20

chore(deps): update all non-major dependencies

f80a22e

Signed-off-by:

shunkakinoki force-pushed the renovate/patch-all-minor-patch branch from 6c38f21 to f80a22e Compare July 10, 2026 04:21

shunkakinoki merged commit 1af62bb into main Jul 10, 2026
38 checks passed

shunkakinoki deleted the renovate/patch-all-minor-patch branch July 10, 2026 16:58

Navigation Menu

chore(deps): update all non-major dependencies (patch) - #2000

chore(deps): update all non-major dependencies (patch)#2000
shunkakinoki merged 1 commit into
mainfrom
renovate/patch-all-minor-patch

shunkakinoki commented Jul 6, 2026 •

edited

Loading

Uh oh!

indent-zero Bot commented Jul 6, 2026 •

edited

Loading

Uh oh!

cursor Bot commented Jul 6, 2026

Uh oh!

coderabbitai Bot commented Jul 6, 2026 •

edited

Loading

Review limit reached

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

cursor Bot commented Jul 7, 2026

Uh oh!

cursor Bot commented Jul 8, 2026

Uh oh!

mesa-dot-dev Bot commented Jul 8, 2026 •

edited

Loading

Uh oh!

Uh oh!

cursor Bot commented Jul 9, 2026

Uh oh!

cursor Bot commented Jul 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

shunkakinoki commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Refactors

Internal

Refactors

Internal

Changed

Fixed

Added

Changed

Fixed

Added

Changed

Fixed

Documentation

Miscellaneous Chores

Build System

Continuous Integration

Preview features

Documentation

Contributors

Preview features

Bug fixes

Rule changes

Performance

Documentation

Other changes

Contributors

Configuration

Uh oh!

indent-zero Bot commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot commented Jul 6, 2026

Uh oh!

coderabbitai Bot commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot commented Jul 7, 2026

Uh oh!

cursor Bot commented Jul 8, 2026

Uh oh!

mesa-dot-dev Bot commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Mesa Description

TL;DR

What changed?

Uh oh!

Uh oh!

cursor Bot commented Jul 9, 2026

Uh oh!

cursor Bot commented Jul 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

shunkakinoki commented Jul 6, 2026 •

edited

Loading

indent-zero Bot commented Jul 6, 2026 •

edited

Loading

coderabbitai Bot commented Jul 6, 2026 •

edited

Loading

mesa-dot-dev Bot commented Jul 8, 2026 •

edited

Loading