chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending	Age	Confidence
awscli	tools	patch	2.36.31 → 2.36.32	2.36.38 (+5)
fnox	tools	patch	1.34.0 → 1.34.1
npm:@openai/codex (source)	tools	minor	0.149.1 → 0.150.0	0.152.1 (+3)
npm:agent-browser (source)	tools	patch	0.35.0 → 0.35.1	0.36.0 (+1)
vercel (source)	tools	minor	59.5.0 → 59.6.2	59.11.2 (+5)

---

Release Notes

aws/aws-cli (awscli)

v2.36.32

Compare Source

jdx/fnox (fnox)

v1.34.1: : Safer profiles, exports, and macOS binaries

Compare Source

A patch release focused on safety and correctness: unknown profiles now fail loudly instead of silently falling back to defaults, dotenv exports survive Docker Compose interpolation, interactive daemon cache misses regain access to your terminal, and macOS release binaries are now notarized.

Fixed

• Unknown profiles are rejected (#​741) -- @​jdx. An active profile that has neither a [profiles.<name>] table nor a matching fnox.<name>.toml overlay now errors (listing the available profiles) instead of silently falling back to top-level secrets, which could leak defaults on a typo. Shell integration (hook-env) also refuses unknown profiles. Creating new profiles via set, import, and provider add still works.

• Dotenv export preserves dollar signs (#​746) -- @​jdx. Secrets containing $ are now emitted in single quotes so Docker Compose no longer interpolates them, falling back to double quotes with \$ escaping when needed. Dotenv import was aligned to match: it reassembles multiline single-quoted values, unescapes \', and treats \$ in double quotes as a literal dollar sign.

• Interactive daemon cache misses resolve in the foreground (#​743) -- @​jdx. When the daemon misses its cache for an interactive client, the missing keys are now resolved in the foreground so PIN, touch, browser, and auth-command prompts reach the invoking terminal; resolved values are then sent back to the daemon for reuse. Non-interactive callers continue to resolve daemon-side and never prompt.

• age batch decryption prompts once (#​755) -- @​jdx. fnox sync now wraps a single random key with age per batch and encrypts each secret under it, so age (and hardware-backed plugins) only prompt once per sync instead of once per secret. Existing sync caches remain readable, and re-running fnox sync migrates them to the batched format.

Security

• Hardened secret injection boundaries (#​763) -- @​jdx. Secret names must now be valid environment identifiers (^[A-Za-z_][A-Za-z0-9_]*$), enforced when loading, validating, running set, and import, with shell emitters quoting names defensively across Bash, Zsh, Fish, and PowerShell. exec and MCP exec now strip ambient FNOX_AGE_KEY and FNOX_AGE_KEY_FILE before spawning child processes while still injecting explicitly configured secrets.

Changed

• macOS release binaries are now notarized (#​764) -- @​jdx. The signed macOS binary is submitted to Apple's notary service and built with a hardened runtime, so downloads (which carry the quarantine bit) no longer hit the Gatekeeper "cannot be verified" dialog.

Documentation

• Generated CLI configuration docs now HTML-encode angle brackets so placeholders like <path> render correctly instead of being parsed as Vue elements (#​739) -- @​jdx.
• Sync docs now call out the golden path and hardware-backed decryption (#​748) -- @​jdx.

Full Changelog: jdx/fnox@v1.34.0...v1.34.1

💚 Sponsor fnox

fnox is maintained by @​jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise, aube, hk, and more. Keeping fnox secure, maintained, and free is funded by sponsors.

If fnox is handling secrets or config for you or your team, please consider sponsoring at jdx.dev. Sponsorships are what let fnox stay independent and the project keep moving.

vercel-labs/agent-browser (npm:agent-browser)

v0.35.1

Compare Source

Bug Fixes

• Fixed Windows ARM64 launcher selection to prefer a native ARM64 executable when present and fall back to the published x64 executable through Windows emulation when it is not (#​1725)
• Fixed stream URL tracking to emit active main-frame URL updates for full-document, History API, and fragment navigation, while rebinding correctly after active-tab changes and ignoring child-frame or background-tab navigation (#​1682)
• Fixed snapshot diff element references by resetting ref numbering for each diff, invalidating refs across URL navigations, and preserving the previous refs when a diff fails (#​1719)

Improvements

• Updated Rust dependencies to rustls-webpki 0.103.13 and quinn-proto 0.11.17 (#​1723, #​1720)

Contributors

• @​ctate
• @​Railly
• @​Angelmmiguel
• @​anupamme
• @​nexxusbruno-ship-it

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.