chore(deps): bump the all-dependencies group across 7 directories with 11 updates

[dependabot]

Bumps the all-dependencies group with 11 updates in the / directory:

Package	From	To
@mariozechner/pi-agent-core	0.70.5	0.73.1
@mariozechner/pi-ai	0.70.5	0.73.1
typebox	1.1.34	1.3.6
@biomejs/biome	2.4.13	2.5.3
@types/bun	1.3.13	1.3.14
typescript	6.0.3	7.0.2
yaml	2.8.3	2.9.0
@inquirer/prompts	8.4.2	8.5.2
google-auth-library	10.6.2	10.9.0
@google-cloud/logging	11.2.1	11.3.0
@larksuiteoapi/node-sdk	1.62.0	1.71.0

Bumps the all-dependencies group with 1 update in the /packages/bench directory: yaml.
Bumps the all-dependencies group with 4 updates in the /packages/cli directory: @mariozechner/pi-ai, yaml, @inquirer/prompts and google-auth-library.
Bumps the all-dependencies group with 1 update in the /packages/clients directory: @google-cloud/logging.
Bumps the all-dependencies group with 2 updates in the /packages/core directory: @mariozechner/pi-agent-core and @mariozechner/pi-ai.
Bumps the all-dependencies group with 1 update in the /packages/notify directory: @larksuiteoapi/node-sdk.
Bumps the all-dependencies group with 3 updates in the /packages/tools directory: @mariozechner/pi-agent-core, @mariozechner/pi-ai and typebox.

Updates @mariozechner/pi-agent-core from 0.70.5 to 0.73.1

Release notes

Sourced from @​mariozechner/pi-agent-core's releases.

v0.73.1

New Features

• Self-update support for the npm scope migration: pi update --self now supports the upcoming package rename from @mariozechner/pi-coding-agent to @earendil-works/pi-coding-agent. After the new package is published, existing global installs can update through the normal self-update flow; pi will uninstall the old global package and install the package name returned by the version check endpoint.
• Interactive OAuth login selection: OAuth providers can now present multiple login choices in /login, enabling provider-specific interactive authentication flows. See Providers.
• JSONC-style models.json parsing: models.json now allows comments and trailing commas, making custom provider and model configuration easier to maintain. See Providers and Custom Providers.

Added

• Added interactive login selection support so OAuth providers can present multiple login choices (#4190 by @​mitsuhiko).

Changed

• Changed pi update --self to honor the active package name returned by the Pi version check endpoint, defaulting to the current package when omitted and uninstalling the old global package before installing a renamed package.
• Changed extension loading to use upstream jiti 2.7 instead of the @mariozechner/jiti fork (#4244 by @​pi0).
• Changed models.json parsing to allow comments and trailing commas (#4162 by @​julien-c).

Fixed

• Fixed pi -p treating prompts that start with YAML frontmatter as extension flags instead of user messages (#4163).
• Fixed pending tool results not updating in the live TUI after toggling thinking block visibility while the tool is running (#4167).
• Fixed /copy reporting success on Linux without writing the clipboard on Wayland-only compositors (Hyprland, Niri, ...) by skipping the X11-only native addon on Linux and routing through wl-copy/xclip/xsel instead (#4177).
• Fixed HTML session exports to strip skill wrapper XML from rendered user messages (#4234 by @​aliou).
• Fixed OpenAI-compatible chat completion streams that interleave content and tool-call deltas in the same choice.
• Fixed OpenAI Codex OAuth refresh failures writing directly to stderr while the TUI is active (#4141).
• Fixed OpenAI Codex Responses requests to send a non-empty system prompt (#4184).
• Fixed Kimi For Coding model resolution for the Kimi K2 P6 alias (#4218).
• Fixed Kitty inline image redraws to stay within TUI-owned terminal regions and avoid writing below the active viewport.
• Fixed Kitty inline image rendering by letting the terminal allocate image ids and bounding parsed image ids to valid values.
• Fixed inline image capability detection to disable inline images in cmux terminals.

v0.73.0

New Features

• Xiaomi MiMo API billing and regional Token Plan providers - xiaomi now uses API billing, with separate xiaomi-token-plan-{cn,ams,sgp} providers. See https://github.com/badlogic/pi-mono/tree/HEAD/packages/agent/blob/HEAD/docs/providers.md#api-keys and https://github.com/badlogic/pi-mono/tree/HEAD/packages/agent/blob/HEAD/README.md#providers--models. (#4112 by @​Phoen1xCode)
• Incremental bash output streaming - Bash tool output now appears while commands run instead of only after completion. (#4145)
• Compact read rendering - Interactive read output for Pi docs, context files, and skills is collapsed by default and shows selected line ranges.

Breaking Changes

• Switched the built-in xiaomi provider from Token Plan AMS to Xiaomi's API billing endpoint, and renamed its /login display from "Xiaomi MiMo Token Plan" to "Xiaomi MiMo". XIAOMI_API_KEY now refers to the API billing key from platform.xiaomimimo.com. Users on Token Plan should switch to the appropriate xiaomi-token-plan-* provider and set the corresponding env var (#4112 by @​Phoen1xCode).

Added

• Added three Xiaomi MiMo Token Plan regional providers visible in /login: xiaomi-token-plan-cn (XIAOMI_TOKEN_PLAN_CN_API_KEY), xiaomi-token-plan-ams (XIAOMI_TOKEN_PLAN_AMS_API_KEY), xiaomi-token-plan-sgp (XIAOMI_TOKEN_PLAN_SGP_API_KEY). Each defaults to mimo-v2.5-pro (#4112 by @​Phoen1xCode).

Changed

... (truncated)

Changelog

Sourced from @​mariozechner/pi-agent-core's changelog.

[0.73.1] - 2026-05-07

[0.73.0] - 2026-05-04

[0.72.1] - 2026-05-02

Changed

• Changed the default agent transport to auto so providers can use their best available transport by default (#4083).

[0.72.0] - 2026-05-01

Added

• Added shouldStopAfterTurn to the low-level agent loop config for gracefully exiting after a completed turn before polling queued messages or starting another LLM call.

[0.71.1] - 2026-05-01

[0.71.0] - 2026-04-30

[0.70.6] - 2026-04-28

Commits

• 781152f Release v0.73.1
• 3c9c54d Add [Unreleased] section for next cycle
• dbcb473 Release v0.73.0
• 7268e9a Add [Unreleased] section for next cycle
• 036bde0 Release v0.72.1
• b8bb241 fix(ai): honor codex transport option
• e4163fe Add [Unreleased] section for next cycle
• 196226b Release v0.72.0
• 80f06d3 feat: add model thinking level metadata
• 73b7b2c feat(agent): add post-turn stop callback
• Additional commits viewable in compare view

Updates @mariozechner/pi-ai from 0.70.5 to 0.73.1

Release notes

Sourced from @​mariozechner/pi-ai's releases.

v0.73.1

New Features

• Self-update support for the npm scope migration: pi update --self now supports the upcoming package rename from @mariozechner/pi-coding-agent to @earendil-works/pi-coding-agent. After the new package is published, existing global installs can update through the normal self-update flow; pi will uninstall the old global package and install the package name returned by the version check endpoint.
• Interactive OAuth login selection: OAuth providers can now present multiple login choices in /login, enabling provider-specific interactive authentication flows. See Providers.
• JSONC-style models.json parsing: models.json now allows comments and trailing commas, making custom provider and model configuration easier to maintain. See Providers and Custom Providers.

Added

• Added interactive login selection support so OAuth providers can present multiple login choices (#4190 by @​mitsuhiko).

Changed

• Changed pi update --self to honor the active package name returned by the Pi version check endpoint, defaulting to the current package when omitted and uninstalling the old global package before installing a renamed package.
• Changed extension loading to use upstream jiti 2.7 instead of the @mariozechner/jiti fork (#4244 by @​pi0).
• Changed models.json parsing to allow comments and trailing commas (#4162 by @​julien-c).

Fixed

• Fixed pi -p treating prompts that start with YAML frontmatter as extension flags instead of user messages (#4163).
• Fixed pending tool results not updating in the live TUI after toggling thinking block visibility while the tool is running (#4167).
• Fixed /copy reporting success on Linux without writing the clipboard on Wayland-only compositors (Hyprland, Niri, ...) by skipping the X11-only native addon on Linux and routing through wl-copy/xclip/xsel instead (#4177).
• Fixed HTML session exports to strip skill wrapper XML from rendered user messages (#4234 by @​aliou).
• Fixed OpenAI-compatible chat completion streams that interleave content and tool-call deltas in the same choice.
• Fixed OpenAI Codex OAuth refresh failures writing directly to stderr while the TUI is active (#4141).
• Fixed OpenAI Codex Responses requests to send a non-empty system prompt (#4184).
• Fixed Kimi For Coding model resolution for the Kimi K2 P6 alias (#4218).
• Fixed Kitty inline image redraws to stay within TUI-owned terminal regions and avoid writing below the active viewport.
• Fixed Kitty inline image rendering by letting the terminal allocate image ids and bounding parsed image ids to valid values.
• Fixed inline image capability detection to disable inline images in cmux terminals.

v0.73.0

New Features

• Xiaomi MiMo API billing and regional Token Plan providers - xiaomi now uses API billing, with separate xiaomi-token-plan-{cn,ams,sgp} providers. See https://github.com/badlogic/pi-mono/tree/HEAD/packages/ai/blob/HEAD/docs/providers.md#api-keys and https://github.com/badlogic/pi-mono/tree/HEAD/packages/ai/blob/HEAD/README.md#providers--models. (#4112 by @​Phoen1xCode)
• Incremental bash output streaming - Bash tool output now appears while commands run instead of only after completion. (#4145)
• Compact read rendering - Interactive read output for Pi docs, context files, and skills is collapsed by default and shows selected line ranges.

Breaking Changes

• Switched the built-in xiaomi provider from Token Plan AMS to Xiaomi's API billing endpoint, and renamed its /login display from "Xiaomi MiMo Token Plan" to "Xiaomi MiMo". XIAOMI_API_KEY now refers to the API billing key from platform.xiaomimimo.com. Users on Token Plan should switch to the appropriate xiaomi-token-plan-* provider and set the corresponding env var (#4112 by @​Phoen1xCode).

Added

• Added three Xiaomi MiMo Token Plan regional providers visible in /login: xiaomi-token-plan-cn (XIAOMI_TOKEN_PLAN_CN_API_KEY), xiaomi-token-plan-ams (XIAOMI_TOKEN_PLAN_AMS_API_KEY), xiaomi-token-plan-sgp (XIAOMI_TOKEN_PLAN_SGP_API_KEY). Each defaults to mimo-v2.5-pro (#4112 by @​Phoen1xCode).

Changed

... (truncated)

Changelog

Sourced from @​mariozechner/pi-ai's changelog.

[0.73.1] - 2026-05-07

Added

• Added OAuth login flow metadata so clients can present interactive provider choices during login (#4190 by @​mitsuhiko).

Fixed

• Fixed OpenAI Responses reasoning text streaming for LM Studio and other compatible providers that emit response.reasoning_text.delta events (#4191 by @​yaanfpv).
• Fixed OpenAI Codex OAuth refresh failures writing directly to stderr while the TUI is active (#4141).
• Fixed OpenAI-compatible chat completion streams that interleave content and tool-call deltas in the same choice.
• Fixed the Kimi K2 P6 model alias to normalize to kimi-for-coding (#4218).
• Fixed OpenAI Codex Responses requests to send a non-empty system prompt (#4184).

[0.73.0] - 2026-05-04

Breaking Changes

• Switched the built-in xiaomi provider endpoint from Token Plan AMS (https://token-plan-ams.xiaomimimo.com/anthropic) to API billing (https://api.xiaomimimo.com/anthropic). XIAOMI_API_KEY now refers to the API billing key from platform.xiaomimimo.com. Users still on Token Plan must move to the appropriate xiaomi-token-plan-* provider and set the corresponding env var (#4112 by @​Phoen1xCode).

Added

• Added Xiaomi MiMo Token Plan regional providers with per-region env vars: xiaomi-token-plan-cn (XIAOMI_TOKEN_PLAN_CN_API_KEY), xiaomi-token-plan-ams (XIAOMI_TOKEN_PLAN_AMS_API_KEY), and xiaomi-token-plan-sgp (XIAOMI_TOKEN_PLAN_SGP_API_KEY) (#4112 by @​Phoen1xCode).
• Added registerSessionResourceCleanup() and cleanupSessionResources() so providers can register cleanup hooks for session-scoped resources.

Fixed

• Fixed generated OpenAI-compatible model metadata for Qwen 3.5/3.6 and MiniMax M2.7 to match models.dev and OpenCode Go (#4110 by @​jsynowiec).
• Fixed Bedrock Converse thinking effort mapping to preserve native xhigh for Claude Opus 4.7.
• Fixed OpenAI Codex Responses WebSocket transport to fall back to SSE when setup fails before streaming starts, and attach transport diagnostics to the assistant message (#4133).

[0.72.1] - 2026-05-02

[0.72.0] - 2026-05-01

Breaking Changes

• Replaced OpenAICompletionsCompat.reasoningEffortMap with top-level Model.thinkingLevelMap for model-specific thinking controls (#3208). Migration: move mappings from model.compat.reasoningEffortMap to model.thinkingLevelMap. See packages/ai/README.md#custom-models and packages/coding-agent/docs/models.md#thinking-level-map. Map values keep the same provider-specific string semantics, and null marks a pi thinking level unsupported. Example:

  // Before
  compat: { reasoningEffortMap: { high: "high", xhigh: "max" } }
  // After
  thinkingLevelMap: { minimal: null, low: null, medium: null, high: "high", xhigh: "max" }

• Removed supportsXhigh(). Migration: use getSupportedThinkingLevels(model).includes("xhigh") or clampThinkingLevel(model, requestedLevel) instead (#3208).

Added

• Added Xiaomi MiMo Token Plan provider (Anthropic-compatible) with XIAOMI_API_KEY authentication (#4005 by @​Phoen1xCode).

... (truncated)

Commits

• 781152f Release v0.73.1
• 7fa924b docs: audit unreleased changelog entries
• 9eb126e docs(ai): document interleaved stream events
• 6b27184 fix(ai): handle mixed chat completion deltas
• ace3fd7 fix(ai): normalize kimi k2p6 alias to kimi-for-coding closes #4218
• 3029836 fix(ai): stop Codex OAuth stderr writes
• 31f5c23 fix(ai): handle OpenAI Responses reasoning text deltas
• 15aa313 Closes #4184, codex needs a non-empty system prompt
• b5755fd feat(oauth): support interactive login selection (#4190)
• 3c9c54d Add [Unreleased] section for next cycle
• Additional commits viewable in compare view

Updates typebox from 1.1.34 to 1.3.6

Commits

• 41f0b1d Version 1.3.6 (#1649)
• 08d655e Fix (Guard): fast-path length checks miss variation selectors and combining m...
• 6b720a1 Version 1.3.5 (#1647)
• 4fcd7c3 Specification
• 92a8610 Version 1.3.4 (#1644)
• 21652dc Specification
• 55f720e Version 1.3.3 (#1643)
• b4d69bc Fix (Guard): Accept negative multiples of a fractional multipleOf (#1642)
• 400f6e0 Specification
• 1bc826e Version 1.3.2 (#1640)
• Additional commits viewable in compare view

Updates @biomejs/biome from 2.4.13 to 2.5.3

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.3

2.5.3

Patch Changes

• #10815 86613d5 Thanks @​WaterWhisperer! - Fixed a parser panic reported in #10708: Biome now recovers when unsupported CSS Modules @value rules or scoped @keyframes names end at EOF.

• #10534 da9b403 Thanks @​Mokto! - Fixed noUnusedVariables false positives in Svelte files: Svelte store subscriptions ($store references in templates now keep the underlying store binding from being flagged), and $bindable() props that are only written to in the script block (write-only is intentional for bindable props) are no longer reported as unused.

• #10827 098ba41 Thanks @​Aqu1bp! - Fixed #10698: The noUnsafeOptionalChaining rule now reports unsafe optional chains wrapped in TypeScript as, satisfies, type assertion, and instantiation expressions, such as new (value?.constructor as Constructor)().

• #10773 3c6513d Thanks @​otkrickey! - Fixed #10772: useVueValidVOn no longer reports a missing handler for v-on directives using a verb modifier (.stop / .prevent) without an expression, e.g. <div @click.stop></div>. The rule also accepts the arg-less object syntax <div v-on="$listeners"></div> instead of reporting a missing event name.

• #10721 d83c66b Thanks @​minseong0324! - Improved type-aware lint rule inference for built-in globals and indexed function calls. Biome now resolves Error(...), new Error(...), optional Error#stack, and calls through indexed function values such as handlers[0](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/0) more accurately.

• #10865 6450276 Thanks @​ematipico! - Fixed #10845. Biome Language Server no longer goes in deadlock when the scanner is enabled.

• #10853 93d8e53 Thanks @​Netail! - Fixed #10840: Astro shorthand attribute syntax is now correctly being parsed from embedded nodes.

• #10820 bba3092 Thanks @​JamBalaya56562! - Fixed #10619: noProcessEnv now also reports computed (bracket) member access. Previously only dot access was checked, so process["env"] and env["NODE_ENV"] (where env is imported from node:process) were missed. Both static and computed accesses are now reported.

• #10835 3447b2f Thanks @​dyc3! - Fixed #10824: useDomQuerySelector now supports an ignore option for receiver identifiers that should not be reported.

• #10875 b12e486 Thanks @​dyc3! - Fixed #10795: --profile-rules now reports timings for each plugin separately as plugin/<pluginName>, matching the naming used by plugin suppressions, instead of aggregating all plugins under a single plugin/plugin entry.

• #10877 d6bc447 Thanks @​ematipico! - Fixed biome-zed#164: Biome no longer inserts stray whitespace when format-on-type runs after closing delimiters such as ), ], and }.

• #10867 a21463e Thanks @​dyc3! - Fixed #10864: Biome no longer crashes when checking or linting HTML files with unquoted attribute values such as <textarea rows=4></textarea>.

What's Changed

• fix(useVueValidVOn): allow verb-modifier-only handlers and object syntax by @​otkrickey in biomejs/biome#10773
• fix(css_parser): recover CSS Modules syntax at EOF by @​WaterWhisperer in biomejs/biome#10815
• feat(fmt/yaml): sequence mapping by @​ematipico in biomejs/biome#10814
• fix(lint): handle TypeScript wrappers in unsafe optional chains by @​Aqu1bp in biomejs/biome#10827
• fix(lint): report computed member access in noProcessEnv by @​JamBalaya56562 in biomejs/biome#10820
• ci: ignore quick-xml RustSec advisories by @​JamBalaya56562 in biomejs/biome#10831
• perf(core): embedded ranges plumbing by @​ematipico in biomejs/biome#10836
• feat(md/fmt): more compatibility gains by @​ematipico in biomejs/biome#10833
• chore(xtask): migrate Error global type by @​minseong0324 in biomejs/biome#10721
• fix(lint): suppress false positives in noUnusedVariables for Svelte store subscriptions and $bindable() props by @​Mokto in biomejs/biome#10534
• refactor(md/parse): reduce emitted nodes by @​ematipico in biomejs/biome#10847
• feat(md/fmt): quotes, thematic breaks and link definition by @​ematipico in biomejs/biome#10844
• refactor(md/parse): parse HTML into one single node by @​ematipico in biomejs/biome#10848
• docs(noMissingVarFunction): list container-name in ignored properties by @​dfedoryshchev in biomejs/biome#10852
• refactor(md/parse): fold code content lines and indentation runs by @​ematipico in biomejs/biome#10851
• fix: astro shorthand syntax embedded nodes by @​Netail in biomejs/biome#10853
• chore(xtask): migrate disposable global types by @​minseong0324 in biomejs/biome#10841

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.3

Patch Changes

• #10815 86613d5 Thanks @​WaterWhisperer! - Fixed a parser panic reported in #10708: Biome now recovers when unsupported CSS Modules @value rules or scoped @keyframes names end at EOF.

• #10534 da9b403 Thanks @​Mokto! - Fixed noUnusedVariables false positives in Svelte files: Svelte store subscriptions ($store references in templates now keep the underlying store binding from being flagged), and $bindable() props that are only written to in the script block (write-only is intentional for bindable props) are no longer reported as unused.

• #10827 098ba41 Thanks @​Aqu1bp! - Fixed #10698: The noUnsafeOptionalChaining rule now reports unsafe optional chains wrapped in TypeScript as, satisfies, type assertion, and instantiation expressions, such as new (value?.constructor as Constructor)().

• #10773 3c6513d Thanks @​otkrickey! - Fixed #10772: useVueValidVOn no longer reports a missing handler for v-on directives using a verb modifier (.stop / .prevent) without an expression, e.g. <div @click.stop></div>. The rule also accepts the arg-less object syntax <div v-on="$listeners"></div> instead of reporting a missing event name.

• #10721 d83c66b Thanks @​minseong0324! - Improved type-aware lint rule inference for built-in globals and indexed function calls. Biome now resolves Error(...), new Error(...), optional Error#stack, and calls through indexed function values such as handlers[0](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/0) more accurately.

• #10865 6450276 Thanks @​ematipico! - Fixed #10845. Biome Language Server no longer goes in deadlock when the scanner is enabled.

• #10853 93d8e53 Thanks @​Netail! - Fixed #10840: Astro shorthand attribute syntax is now correctly being parsed from embedded nodes.

• #10820 bba3092 Thanks @​JamBalaya56562! - Fixed #10619: noProcessEnv now also reports computed (bracket) member access. Previously only dot access was checked, so process["env"] and env["NODE_ENV"] (where env is imported from node:process) were missed. Both static and computed accesses are now reported.

• #10835 3447b2f Thanks @​dyc3! - Fixed #10824: useDomQuerySelector now supports an ignore option for receiver identifiers that should not be reported.

• #10875 b12e486 Thanks @​dyc3! - Fixed #10795: --profile-rules now reports timings for each plugin separately as plugin/<pluginName>, matching the naming used by plugin suppressions, instead of aggregating all plugins under a single plugin/plugin entry.

• #10877 d6bc447 Thanks @​ematipico! - Fixed biome-zed#164: Biome no longer inserts stray whitespace when format-on-type runs after closing delimiters such as ), ], and }.

• #10867 a21463e Thanks @​dyc3! - Fixed #10864: Biome no longer crashes when checking or linting HTML files with unquoted attribute values such as <textarea rows=4></textarea>.

2.5.2

Patch Changes

• #10595 f458028 Thanks @​pkallos! - Added the option ignoreBooleanCoercion to useNullishCoalescing. When enabled, Biome ignores || and ||= used inside a Boolean() call, where coalescing on falsy values is intentional.

• #10798 4a32b63 Thanks @​pkallos! - Added the option ignorePrimitives to useNullishCoalescing. When enabled, Biome ignores ||, ||=, and ternary expressions whose non-nullish operands are all primitives the option opts out of. Use true to ignore all primitives, or an object selecting string, number, boolean, or bigint.

• #10545 f3d4c00 Thanks @​Mokto! - Added the new nursery rule noSvelteUnnecessaryStateWrap, which reports unnecessary $state() wrapping of classes from svelte/reactivity that are already reactive.

  <script>
  import { SvelteMap } from "svelte/reactivity";
  const map = $state(new SvelteMap()); // redundant
  </script>

• #10752 f62fb8b Thanks @​ematipico! - Fixed #10739. Now the rule useValidAutocomplete correctly flags the autoComplete attribute.

• #10796 f1b3ab2 Thanks @​ematipico! - Fixed #10768. Improved the performance of the Biome Language Server by cancelling certain in-flight operations when there are fast updates.

• #10719 aa649b5 Thanks @​minseong0324! - Fixed noMisleadingReturnType false positive on returns that use a widening type assertion: "a" as string is no longer reported as misleading. The rule now also reports a literal-pinning assertion such as false as false, matching the existing as const behavior.

... (truncated)

Commits

• 9e1999f chore: revert the revert
• 0b0fd8d chore: revert
• 0afa35a ci: release (#10817)
• 3447b2f feat(useDomQuerySelector): add ignore option (#10835)
• e649198 ci: release (#10747)
• 4a32b63 feat(lint): add ignorePrimitives option to useNullishCoalescing (#10798)
• f3d4c00 feat(js/nursery): add noSvelteNoUnnecessaryStateWrap rule (#10545)
• f458028 feat(lint): add ignoreBooleanCoercion option to useNullishCoalescing (#10595)
• ffe7d33 chore: revert
• 564d660 chore: revert
• Additional commits viewable in compare view

Updates @types/bun from 1.3.13 to 1.3.14

Commits

• See full diff in compare view

Updates typescript from 6.0.3 to 7.0.2

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

Updates yaml from 2.8.3 to 2.9.0

Release notes

Sourced from yaml's releases.

v2.9.0

The changes here are really only patches, but I'm releasing this as a minor version to note a small change to the documentation of parseDocument() and parseAllDocuments(): I've removed the claim that they'll "never throw".

It remains the case that practically all non-malicious inputs will be handled without emitting an error, but there is a decent chance that code paths remain where e.g. a RangeError due to call stack exhaustion can be triggered by malicious inputs. Up to now, I've considered these as security vulnerabilities, and in fact it's the only category of error for which yaml CVEs have been issued so far.

Starting from this release, I'll be considering such errors as bugs, but not vulnerabilities. I do welcome people and/or LLMs looking for them, but please report them as normal issues rather than suspected security vulnerabilities. This also applies to previously undiscovered bugs in earlier releases.

• fix: Avoid calling Array.prototype.push.apply() with large source array
• fix(lexer): Avoid recursive calls that may exhaust the call stack

v2.8.4

• Disable alias resolution with maxAliasCount:0 (#677)
• Handle invalid unicode escapes (e1a1a77)
• Apply minFractionDigits only to decimal strings (#676)

Commits

• ddb21b0 2.9.0
• 167365b docs: Clarify that not all errors can be avoided
• 6eca2a7 fix: Avoid calling Array.prototype.push.apply() with large source array
• 0543cd5 fix(lexer): Avoid recursive calls that may exhaust the call stack
• ccdf743 2.8.4
• f625789 fix: Disable alias resolution with maxAliasCount:0 (#677)
• e1a1a77 fix: Handle invalid unicode escapes
• a163ea0 style: Satify Prettier
• b2a5a6c fix: Apply minFractionDigits only to decimal strings (#676)
• 93c951b chore: Bump JSR version to v2.8.3 (#673)
• Additional commits viewable in compare view

Updates @inquirer/prompts from 8.4.2 to 8.5.2

Release notes

Sourced from @​inquirer/prompts's releases.

@​inquirer/prompts@​8.5.2

• Fix security warnings in external-editor

@​inquirer/prompts@​8.5.1

• Rolled back mute-stream dependency from v4 to v3 to undo breaking compatible engines.
• Added tooling to prevent regression of the above in the future. This surfaced our min engines already enforced a higher limit, so adjusted the explicit limits to match the current state.

@​inquirer/prompts@​8.5.0

• Feat: Read env variable INQUIRER_KEYBINDINGS to enable vim or emacs keybindings; making this a user preference instead of a library author preference. One caveat is doing so disable the search feature in the select prompt. Syntax: INQUIRER_KEYBINDINGS=vim,emacs.
• Fix: Line wraps would sometime cause the cursor to be mispositioned relative to the input.
• Chore: Bump dependencies.

@​inquirer/prompts@​8.4.3

• Fix: Windows rendering bug
• Fix: Preserve exact literal types in choices array (Typescript only)
• Fix: Allow input default value to be of type undefined (Typescript only)
• Bump dependencies

Commits

• bfd8710 chore: Publish new release
• 55cc5f3 feat: add reusable package lint CLI
• 3af9ed0 test(inquirer): capture prompt runner output
• 4381857 fix(@​inquirer/input): remove stale lint suppression
• 45df331 fix(@​inquirer/external-editor): harden editor temp files
• adef323 chore: limit CI token permissions
• b43359d chore: Publish new release
• 24ecae2 chore: fix yarn.lock
• b078d97 fix: validate package engine compatibility
• 3a49f9f chore(deps-dev): Bump oxfmt in the formatting group (#2143)
• Additional commits viewable in compare view

Updates google-auth-library from 10.6.2 to 10.9.0

Release notes

Sourced from google-auth-library's releases.

google-auth-library: v10.9.0

10.9.0 (2026-06-24)

Features

• auth: Regional access boundaries main merge (#8665) (76e6d3b)

Bug Fixes

• Correct repository URLs in core package.json files (#8722) (368f18e)

google-auth-library: v10.8.1

10.8.1 (2026-06-23)

Bug Fixes

• Strip trailing slashes from automatic GDCH audience (#8692) (4e4badf)

google-auth-library: v10.8.0

10.8.0 (2026-06-18)

Features

• Port GDCH credentials support to Node.js Auth SDK (#8301) (75f148c)

Bug Fixes

• Bump all node submodules (#8178) (9fd76ef)
• Change the copyright year for files in the pack...

  Description has been truncated