chore(deps): bump the minor-and-patch group across 1 directory with 6 updates

[dependabot]

Bumps the minor-and-patch group with 6 updates in the / directory:

Package	From	To
@earendil-works/pi-agent-core	0.75.5	0.79.1
@earendil-works/pi-ai	0.75.5	0.79.1
@biomejs/biome	2.4.13	2.4.16
@opentelemetry/sdk-node	0.217.0	0.218.0
@json-render/react	0.18.0	0.19.0
@tanstack/react-pacer	0.22.0	0.22.1

Updates @earendil-works/pi-agent-core from 0.75.5 to 0.79.1

Release notes

Sourced from @​earendil-works/pi-agent-core's releases.

v0.79.1

New Features

• Claude Fable 5 - Claude Fable 5 is now available on the Anthropic and Amazon Bedrock providers, with adaptive thinking and xhigh effort support.
• Prompt template defaults - Prompt templates can use default positional arguments such as ${1:-7} for optional values. See Prompt Template Arguments.
• Configurable project trust defaults - defaultProjectTrust lets users choose whether unresolved project trust asks, always trusts, or never trusts by default, and extensions can inspect effective trust decisions. See Project Trust and ctx.isProjectTrusted().
• Natural extension autocomplete triggers - Extension autocomplete providers can declare trigger characters such as # or $ so suggestions open without slash-command prefixes. See Autocomplete Providers.

Added

• Added default-value expansion for prompt template positional arguments, e.g. ${1:-7} (#5553 by @​dannote).
• Added areExperimentalFeaturesEnabled feature guard to allow users to opt in to early features (#5547 by @​vegarsti).
• Added ctx.isProjectTrusted() for extensions to observe the effective project trust decision, including temporary trust decisions (#5523).
• Added a global defaultProjectTrust setting to choose whether unresolved project trust asks, always trusts, or never trusts by default.
• Added extension autocomplete trigger character support for ctx.ui.addAutocompleteProvider() wrappers (#4703).
• Added Claude Fable 5 model support inherited from @earendil-works/pi-ai for the Anthropic and Amazon Bedrock providers, with adaptive thinking and xhigh effort support.

Fixed

• Fixed inherited Amazon Bedrock inference profile ARN region resolution to prefer the ARN's embedded region over AWS_REGION (#5527 by @​AJM10565).
• Fixed inherited IME hardware cursor positioning while slash-command autocomplete is visible (#5283 by @​smoosex).
• Fixed inherited z.ai thinking-off requests to send the provider's thinking: { type: "disabled" } compatibility parameter (#5330).
• Fixed inherited OpenCode completions model metadata to send explicit maxTokens as max_tokens (#5331).
• Fixed inherited Moonshot Kimi thinking-off requests to send the provider's thinking: { type: "disabled" } compatibility parameter (#5531).
• Fixed inherited Azure OpenAI Responses requests to disable server-side response storage (#5530).
• Fixed inherited Azure GPT-5.4 and GPT-5.5 context window metadata to 1,050,000 tokens, matching Azure Foundry deployments instead of OpenAI's 272k limit (#5559).
• Fixed inherited OpenAI and Azure GPT-5 Pro maxTokens metadata to 128,000, correcting an upstream value that duplicated the input sub-limit as the output limit (#5559).
• Fixed inherited prompt history navigation to restore the current draft when returning from history browsing (#5494).
• Fixed inherited wrapping for mixed Latin and CJK text so unspaced CJK runs can break at grapheme boundaries without leaving large trailing gaps (#5495).
• Fixed extension OAuth login prompts to keep previous submitted prompt rows stable instead of mirroring the active input value (#5433).
• Fixed /reload to apply updated steeringMode and followUpMode settings to the current session (#5377).
• Fixed invalid models.json syntax to skip startup config migrations and report the normal file-path-aware models error instead of a raw JSON parse stack trace (#5418).
• Fixed GitHub release notes and interactive changelog links to resolve package-relative documentation URLs correctly (#5516).
• Fixed CLI help and version output, including plain redirected --help/--version output and simplified list/config help text.
• Fixed /new from ephemeral sessions to keep the new session ephemeral instead of persisting it by default (#5045).
• Clarified custom model docs that name and modelOverrides.name do not replace model IDs in the footer or primary model lists (#4841).

v0.79.0

New Features

• Project trust for local inputs - Pi now asks before loading project-local settings, resources, instructions, and packages, with saved decisions and --approve / --no-approve controls for non-interactive modes. See Project Trust.
• Extension-controlled trust decisions - Global and CLI extensions can handle project_trust, decide, remember, or defer project trust before project-local resources load. See project_trust.
• Cache-hit visibility in the footer - The interactive footer now shows the latest prompt cache hit rate (CH). See Interactive Mode.
• Richer SDK and RPC extension surfaces - Public exports now include RPC extension UI request/response types and package asset path helpers. See Extension UI Protocol and SDK Exports.

Added

• Added a project_trust extension event so global and CLI extensions can decide or defer project trust during startup and runtime cwd switches.
• Added project trust gating for project-local settings, resources, instructions, and packages (#5332).

... (truncated)

Changelog

Sourced from @​earendil-works/pi-agent-core's changelog.

[0.79.1] - 2026-06-09

[0.79.0] - 2026-06-08

Fixed

• Fixed the compaction summarization system prompt to use neutral AI assistant wording for non-coding agents (#5401).

[0.78.1] - 2026-06-04

[0.78.0] - 2026-05-29

[0.77.0] - 2026-05-28

Breaking Changes

• Renamed agent harness model_select and thinking_level_select events to model_update and thinking_level_update.

Added

• Added agent harness tool registry APIs, tools_update events, branch-scoped active-tool persistence, and duplicate tool validation.

[0.76.0] - 2026-05-27

Fixed

• Fixed context token estimates to count user image attachments consistently with tool result images (#4983).

Commits

• 28df940 Release v0.79.1
• 2edd6b4 Add [Unreleased] section for next cycle
• c10fb95 Release v0.79.0
• 8c6c8a4 fix(agent): neutralize compaction summarization prompt
• ca66adf Add [Unreleased] section for next cycle
• 592c34c Release v0.78.1
• dbb9911 Add [Unreleased] section for next cycle
• 0897f17 Release v0.78.0
• 93600d8 fix(release): align package repository metadata
• abf07d0 Add [Unreleased] section for next cycle
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​earendil-works/pi-agent-core since your current version.

Updates @earendil-works/pi-ai from 0.75.5 to 0.79.1

Release notes

Sourced from @​earendil-works/pi-ai's releases.

v0.79.1

New Features

• Claude Fable 5 - Claude Fable 5 is now available on the Anthropic and Amazon Bedrock providers, with adaptive thinking and xhigh effort support.
• Prompt template defaults - Prompt templates can use default positional arguments such as ${1:-7} for optional values. See Prompt Template Arguments.
• Configurable project trust defaults - defaultProjectTrust lets users choose whether unresolved project trust asks, always trusts, or never trusts by default, and extensions can inspect effective trust decisions. See Project Trust and ctx.isProjectTrusted().
• Natural extension autocomplete triggers - Extension autocomplete providers can declare trigger characters such as # or $ so suggestions open without slash-command prefixes. See Autocomplete Providers.

Added

• Added default-value expansion for prompt template positional arguments, e.g. ${1:-7} (#5553 by @​dannote).
• Added areExperimentalFeaturesEnabled feature guard to allow users to opt in to early features (#5547 by @​vegarsti).
• Added ctx.isProjectTrusted() for extensions to observe the effective project trust decision, including temporary trust decisions (#5523).
• Added a global defaultProjectTrust setting to choose whether unresolved project trust asks, always trusts, or never trusts by default.
• Added extension autocomplete trigger character support for ctx.ui.addAutocompleteProvider() wrappers (#4703).
• Added Claude Fable 5 model support inherited from @earendil-works/pi-ai for the Anthropic and Amazon Bedrock providers, with adaptive thinking and xhigh effort support.

Fixed

• Fixed inherited Amazon Bedrock inference profile ARN region resolution to prefer the ARN's embedded region over AWS_REGION (#5527 by @​AJM10565).
• Fixed inherited IME hardware cursor positioning while slash-command autocomplete is visible (#5283 by @​smoosex).
• Fixed inherited z.ai thinking-off requests to send the provider's thinking: { type: "disabled" } compatibility parameter (#5330).
• Fixed inherited OpenCode completions model metadata to send explicit maxTokens as max_tokens (#5331).
• Fixed inherited Moonshot Kimi thinking-off requests to send the provider's thinking: { type: "disabled" } compatibility parameter (#5531).
• Fixed inherited Azure OpenAI Responses requests to disable server-side response storage (#5530).
• Fixed inherited Azure GPT-5.4 and GPT-5.5 context window metadata to 1,050,000 tokens, matching Azure Foundry deployments instead of OpenAI's 272k limit (#5559).
• Fixed inherited OpenAI and Azure GPT-5 Pro maxTokens metadata to 128,000, correcting an upstream value that duplicated the input sub-limit as the output limit (#5559).
• Fixed inherited prompt history navigation to restore the current draft when returning from history browsing (#5494).
• Fixed inherited wrapping for mixed Latin and CJK text so unspaced CJK runs can break at grapheme boundaries without leaving large trailing gaps (#5495).
• Fixed extension OAuth login prompts to keep previous submitted prompt rows stable instead of mirroring the active input value (#5433).
• Fixed /reload to apply updated steeringMode and followUpMode settings to the current session (#5377).
• Fixed invalid models.json syntax to skip startup config migrations and report the normal file-path-aware models error instead of a raw JSON parse stack trace (#5418).
• Fixed GitHub release notes and interactive changelog links to resolve package-relative documentation URLs correctly (#5516).
• Fixed CLI help and version output, including plain redirected --help/--version output and simplified list/config help text.
• Fixed /new from ephemeral sessions to keep the new session ephemeral instead of persisting it by default (#5045).
• Clarified custom model docs that name and modelOverrides.name do not replace model IDs in the footer or primary model lists (#4841).

v0.79.0

New Features

• Project trust for local inputs - Pi now asks before loading project-local settings, resources, instructions, and packages, with saved decisions and --approve / --no-approve controls for non-interactive modes. See Project Trust.
• Extension-controlled trust decisions - Global and CLI extensions can handle project_trust, decide, remember, or defer project trust before project-local resources load. See project_trust.
• Cache-hit visibility in the footer - The interactive footer now shows the latest prompt cache hit rate (CH). See Interactive Mode.
• Richer SDK and RPC extension surfaces - Public exports now include RPC extension UI request/response types and package asset path helpers. See Extension UI Protocol and SDK Exports.

Added

• Added a project_trust extension event so global and CLI extensions can decide or defer project trust during startup and runtime cwd switches.
• Added project trust gating for project-local settings, resources, instructions, and packages (#5332).

... (truncated)

Changelog

Sourced from @​earendil-works/pi-ai's changelog.

[0.79.1] - 2026-06-09

Added

• Added Claude Fable 5 to Anthropic and Amazon Bedrock model metadata, with adaptive thinking and xhigh effort support.

Fixed

• Fixed Amazon Bedrock inference profile ARN region resolution to prefer the ARN's embedded region over AWS_REGION (#5527 by @​AJM10565).
• Fixed z.ai thinking-off requests to send the provider's thinking: { type: "disabled" } compatibility parameter (#5330).
• Fixed OpenCode completions model metadata to send explicit maxTokens as max_tokens (#5331).
• Fixed Moonshot Kimi thinking-off requests to send the provider's thinking: { type: "disabled" } compatibility parameter (#5531).
• Fixed Azure OpenAI Responses requests to disable server-side response storage (#5530).
• Fixed Azure GPT-5.4 and GPT-5.5 context window metadata to 1,050,000 tokens, matching Azure Foundry deployments instead of OpenAI's 272k limit (#5559).
• Fixed OpenAI and Azure GPT-5 Pro maxTokens metadata to 128,000, correcting an upstream value that duplicated the 272,000 input sub-limit as the output limit (#5559).

[0.79.0] - 2026-06-08

Fixed

• Fixed OpenAI Responses custom providers to honor compat.supportsDeveloperRole: false for reasoning models (#5456).
• Fixed OpenRouter routing preferences on OpenAI-compatible custom providers to send compat.openRouterRouting even when baseUrl does not point directly at OpenRouter (#5347).

[0.78.1] - 2026-06-04

Added

• Added Ant Ling as a built-in OpenAI-compatible provider with Ling 2.6 and Ring 2.6 models.
• Added MiniMax-M3 model to the minimax and minimax-cn direct providers, and removed the hardcoded context-window override that was masking models.dev values (#5313).
• Added NVIDIA NIM as a built-in OpenAI-compatible provider, exposing public NIM models that support tool use.

Fixed

• Fixed Amazon Bedrock requests to replace blank required user/tool-result text with a placeholder and skip blank replay text blocks (#4975).
• Fixed Anthropic Claude Opus 4.7+ requests to suppress deprecated temperature parameters (#5251 by @​yzhg1983).
• Fixed OpenAI GPT-5.5 generated metadata to omit unsupported minimal thinking (#5243).
• Fixed OpenRouter Kimi K2.6 thinking replay and preserved developer-role instructions for OpenRouter OpenAI and Anthropic models (#5309).
• Fixed OpenRouter reasoning instruction requests to preserve the system role when required (#5221 by @​PriNova).
• Restored the NVIDIA Qwen 3.5 122B NIM model.

[0.78.0] - 2026-05-29

Breaking Changes

• Changed direct provider stream functions to require explicit options.apiKey; top-level stream*/complete* helpers still resolve built-in environment auth.

Added

• Added custom Amazon Bedrock request header support via StreamOptions.headers, excluding reserved AWS signing headers (#5178 by @​stephanmck).

... (truncated)

Commits

• 28df940 Release v0.79.1
• 4d9f9f4 fix(ai): regenerate image models for upstream Riverflow rename
• 66f432c fix(ai): regenerate models for Claude Fable 5 and Azure metadata overrides
• 6b5923f fix(ai): correct Azure gpt-5.4/5.5 context window and gpt-5-pro maxTokens
• 5a9d72e feat(ai): add Claude Fable 5 metadata
• a0c2465 docs: audit unreleased changelogs
• 3d02d1d fix(ai): map OpenCode max tokens
• 64b51ef fix(ai): use z.ai thinking payload
• 84cdd02 fix(ai): disable Azure OpenAI response storage
• 2326d5c fix(ai): disable Moonshot thinking when requested
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​earendil-works/pi-ai since your current version.

Updates @biomejs/biome from 2.4.13 to 2.4.16

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.4.16

2.4.16

Patch Changes

• #10329 ef764d5 Thanks @​Conaclos! - Fixed an issue where diagnostics showed an incorrect location in Astro files.

• #10363 50aa415 Thanks @​dyc3! - Fixed HTML formatting for a case where comments could cause the formatter to split up a closing tag, which would cause the resulting HTML to be syntactically invalid.

  Input:

  <span
    ><!-- 1
  --><span>a</span
    ><!-- 2
  --><span>b</span
    ><!-- 3
  --></span>

  Output:

    <span
  	  ><!-- 1
  - --> <span>a</span<!-- 2
  - --> ><span>b</span><!-- 3
  + --><span>a</span><!-- 2
  + --><span>b</span><!-- 3
    --></span
    >

• #10465 0c718da Thanks @​dfedoryshchev! - Fixed diagnostics emitted by the noUntrustedLicenses rule.

• #10358 05c2617 Thanks @​dyc3! - Fixed #10356: biome rage --linter now displays rules enabled through linter domains in the enabled rules list.

• #10300 950247c Thanks @​dyc3! - Fixed #10265: Svelte function bindings such as bind:value={get, set} are now parsed more precisely, so noCommaOperator won't emit false positives for that syntax anymore.

• #9786 e71f584 Thanks @​MeGaNeKoS! - Fixed #8480: useDestructuring now provides variableDeclarator and assignmentExpression options to control which contexts enforce destructuring, matching ESLint's prefer-destructuring configuration. Both default to {array: true, object: true}. The diagnostic for object destructuring in assignment expressions now instructs users to wrap the assignment in parentheses.

• #10425 1948b72 Thanks @​sjh9714! - Fixed #10244: The useOptionalChain rule now detects negated guard inequality chains like !foo || foo.bar !== "x".

• #10442 001f94f Thanks @​ematipico! - Fixed #10411: noMisusedPromises no longer causes a stack overflow when a nested function returns an object with shorthand properties that shadow destructured variables from an outer scope.

• #10318 9b1577f Thanks @​dyc3! - Added support for formatter.trailingCommas in overrides. This option was previously available in the top-level formatter configuration but missing from formatter overrides.

• #10319 2e37709 Thanks @​dyc3! - Fixed Vue and Svelte formatting for standalone interpolations in inline elements. Biome now preserves existing newlines in cases like:

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.4.16

Patch Changes

• #10329 ef764d5 Thanks @​Conaclos! - Fixed an issue where diagnostics showed an incorrect location in Astro files.

• #10363 50aa415 Thanks @​dyc3! - Fixed HTML formatting for a case where comments could cause the formatter to split up a closing tag, which would cause the resulting HTML to be syntactically invalid.

  Input:

  <span
    ><!-- 1
  --><span>a</span
    ><!-- 2
  --><span>b</span
    ><!-- 3
  --></span>

  Output:

    <span
  	  ><!-- 1
  - --> <span>a</span<!-- 2
  - --> ><span>b</span><!-- 3
  + --><span>a</span><!-- 2
  + --><span>b</span><!-- 3
    --></span
    >

• #10465 0c718da Thanks @​dfedoryshchev! - Fixed diagnostics emitted by the noUntrustedLicenses rule.

• #10358 05c2617 Thanks @​dyc3! - Fixed #10356: biome rage --linter now displays rules enabled through linter domains in the enabled rules list.

• #10300 950247c Thanks @​dyc3! - Fixed #10265: Svelte function bindings such as bind:value={get, set} are now parsed more precisely, so noCommaOperator won't emit false positives for that syntax anymore.

• #9786 e71f584 Thanks @​MeGaNeKoS! - Fixed #8480: useDestructuring now provides variableDeclarator and assignmentExpression options to control which contexts enforce destructuring, matching ESLint's prefer-destructuring configuration. Both default to {array: true, object: true}. The diagnostic for object destructuring in assignment expressions now instructs users to wrap the assignment in parentheses.

• #10425 1948b72 Thanks @​sjh9714! - Fixed #10244: The useOptionalChain rule now detects negated guard inequality chains like !foo || foo.bar !== "x".

• #10442 001f94f Thanks @​ematipico! - Fixed #10411: noMisusedPromises no longer causes a stack overflow when a nested function returns an object with shorthand properties that shadow destructured variables from an outer scope.

• #10318 9b1577f Thanks @​dyc3! - Added support for formatter.trailingCommas in overrides. This option was previously available in the top-level formatter configuration but missing from formatter overrides.

• #10319 2e37709 Thanks @​dyc3! - Fixed Vue and Svelte formatting for standalone interpolations in inline elements. Biome now preserves existing newlines in cases like:

... (truncated)

Commits

• 5f4ea56 ci: release (#10326)
• de2a33c fix(core): regression in emitted types (#10478)
• d835303 docs: remove redundant default phrase in useConsistentObjectDefinitions rul...
• 4f1aaf2 fix: incorrect build when using build or test (#10426)
• dc73b6b refactor: make plugins opt-in via feature gate (#10418)
• e71f584 feat(useDestructuring): add options for assignment/declaration and improve di...
• 9b1577f fix(config): support trailingCommas in overrides (#10318)
• 9dd3271 ci: release (#10210)
• 7b8d4e1 feat(lint/html/vue): add useVueValidVFor (#10195)
• ba3480e feat(lint/js): add useTestHooksInOrder (#9394)
• Additional commits viewable in compare view

Updates @opentelemetry/sdk-node from 0.217.0 to 0.218.0

Release notes

Sourced from @​opentelemetry/sdk-node's releases.

experimental/v0.218.0

0.218.0

🚀 Features

• feat(otlp-transformer): replace protobufjs metrics serialization with custom implementation #6625 @​pichlermarc
• feat(configuration): show all config validation errors, if there are multiple #6683 @​trentm
• feat(sdk-node): allow startNodeSDK() without an arg #6688 @​trentm

🏠 Internal

• refactor(sdk-logs): alias LoggerProviderConfig to LoggerProviderOptions #6691 @​david-luna
• refactor(sdk-logs): use Logger.enabled() within Logger.emit() implementation #6680 @​david-luna

Commits

• 06ad0ea chore: prepare next release (#6703)
• 38ca257 feat(otlp-transformer): replace protobufjs metrics serialization with custom ...
• 013c600 chore: prepare next release (#6699)
• b7a0c63 feat(semantic-conventions): update semantic conventions to v1.41.1 (#6695)
• 774143b chore(renovate): add minimumReleaseAge to config (#6697)
• e0dafe0 fix(otlp-exporter-base): remove brackets from IPv6 hostname in HTTP transport...
• f804c93 chore(deps): update github/codeql-action digest to 68bde55 (#6682)
• 95e48e7 refactor(sdk-logs): alias LoggerProviderConfig to LoggerProviderOptions (...
• 907b627 feat(sdk-node): allow startNodeSDK() without an arg (#6688)
• 0d15261 docs: Add SIG meeting info and welcoming language (#6689)
• Additional commits viewable in compare view

Updates @json-render/react from 0.18.0 to 0.19.0

Changelog

Sourced from @​json-render/react's changelog.

0.19.0

New Features

• Custom directives API — @json-render/core now supports custom directives via defineDirective, letting you declare new JSON shapes (like $format, $math) that resolve to computed values at render time. Directives compose naturally — nest $format over $math over $state and they resolve inside-out. All four renderers (React, Vue, Svelte, Solid) have built-in directive resolution (#279)
• @json-render/directives — New package shipping seven ready-made directives: $format (date, currency, number, percent via Intl), $math (add, subtract, multiply, divide, mod, min, max, round, floor, ceil, abs), $concat, $count, $truncate, $pluralize, and $join. Also exports createI18nDirective for $t translation keys with {{param}} interpolation, and standardDirectives for one-line registration (#279)

Improvements

• Example READMEs — Added documentation to the chat, dashboard, game-engine, and no-ai examples (#277)

Contributors

• @​ctate

Commits

• 838ee7b prepare v0.19.0 (#282)
• 714c38f feat: add custom directives API and @​json-render/directives package (#279)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​json-render/react since your current version.

Updates @tanstack/react-pacer from 0.22.0 to 0.22.1

Release notes

Sourced from @​tanstack/react-pacer's releases.

@​tanstack/react-pacer@​0.22.1

Patch Changes

• Allow standalone devtools panels to render without required TanStack Devtools props. (#216)

• Updated dependencies [47d02e2]:

  • @​tanstack/pacer@​0.21.1

Changelog

Sourced from @​tanstack/react-pacer's changelog.

0.22.1

Patch Changes

• Allow standalone devtools panels to render without required TanStack Devtools props. (#216)

• Updated dependencies [47d02e2]:

  • @​tanstack/pacer@​0.21.1

Commits

• a894009 ci: Version Packages (#217)
• 47d02e2 chore: dep upgrades (#216)
• d3e3e27 chore(deps): update all non-major dependencies (#210)
• 8428657 chore(deps): update all non-major dependencies (#204)
• See full diff in compare view

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
dashboard	Error		Jun 12, 2026 9:41pm
databuddy-status	Ready	Preview, Comment	Jun 12, 2026 9:41pm
documentation	Ready	Preview, Comment	Jun 12, 2026 9:41pm

[unkey-deploy]

The latest updates on your projects. Learn more about Unkey Deploy

Name	Status	Preview	Inspect	Updated (UTC)
api (preview)	Failed	Visit Preview	Inspect	Jun 12, 2026 9:40pm

[socket-security]

No dependency changes detected. Learn more about Socket for GitHub.

👍 No dependency changes detected in pull request