chore(deps): update ⬆️ mise-packages

[renovate]

This PR contains the following updates:

Package	Update	Change	Pending
aqua:anthropics/claude-code	patch	2.1.212 → 2.1.214	2.1.217 (+2)
aqua:sethvargo/ratchet	minor	0.11.4 → 0.12.0
aqua:terraform-linters/tflint	minor	0.63.1 → 0.64.0
aqua:vercel-labs/agent-browser	patch	0.32.1 → 0.32.2	0.32.3
github:janosmiko/lfk	patch	v0.15.9 → v0.15.10	v0.15.13 (+2)

Release notes are maintained in a PR comment by the renovate-release-notes-comment workflow.

---

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

• Branch creation
  • Between 03:00 AM and 05:59 AM (* 3-5 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[scottames-github-bot]

Renovate Release Notes

Generated from Renovate's update table by the renovate-release-notes-comment workflow.

Packages that cannot be summarized from GitHub releases are listed explicitly below.

anthropics/claude-code (aqua:anthropics/claude-code)

v2.1.214: v2.1.214

Compare Source

What's changed

• Fixed single-segment dir/** allow rules like Edit(src/**) auto-approving writes to nested dir/ directories anywhere in the tree instead of only <cwd>/dir
• Fixed a permission-check bypass affecting commands run in Windows PowerShell 5.1 sessions
• Fixed Bash permission checks to fail closed on file-descriptor redirect forms that bash parses differently than the permission analyzer
• Fixed Bash permission checks misjudging very long commands — commands over 10,000 characters now always prompt instead of running automatically
• Fixed Bash permission checks treating zsh variable subscripts and modifiers in [[ ]] comparisons as inert text — these commands now prompt for approval
• Fixed Bash permission checks to no longer auto-approve certain help and man commands that could run unsafe options, command substitutions, or backslash paths
• Fixed permission prompts on remote sessions that could proceed before the local confirmation dialog
• Added the EndConversation tool: Claude can end sessions with highly abusive users or jailbreak attempts, as on claude.ai since 2025 — see https://www.anthropic.com/research/end-subset-conversations
• Added a periodic progress heartbeat for long-running tool calls that previously went silent
• Added an ISO modified timestamp to memory file frontmatter
• Added message.uuid, client_request_id, and tool_source attributes to OpenTelemetry log events for message-level correlation and tool provenance
• Added CLAUDE_CODE_OTEL_CONTENT_MAX_LENGTH to configure the 60 KB truncation limit on OpenTelemetry content attributes
• Added reasoning effort to the subagentStatusLine payload, so custom agent rows can render model and effort
• Added permission prompts for docker commands (including the Podman docker shim) carrying daemon-redirect flags (--url, --connection, --identity, and Podman's remote mode) that previously ran without one
• Fixed a crash when a GrowthBook feature evaluates to null, and a bug where a malformed flag payload could wipe the cached feature flags
• Fixed Bash tool killing the Claude session when a pkill -f pattern accidentally matched the CLI's own process (Linux)
• Fixed unbounded memory growth when --settings points at a device file or multi-GB file; oversized (>2 MiB) settings files now fail at startup with a clear error
• Fixed streaming turns failing with "Socket is closed" behind corporate proxies on Windows
• Fixed stream-json output truncation at exit for slow-reading SDK/pipeline consumers; the exit drain now scales with queued bytes instead of a flat 2s cap
• Fixed scheduled tasks refusing their own configured prompt as untrusted input — the fired prompt is now delivered as the session's assigned task
• Fixed PowerShell tool commands hanging until timeout when a child process waited on standard input (Windows)
• Fixed Python scripts under the PowerShell tool crashing with UnicodeDecodeError when reading non-UTF-8 data from standard input (Windows)
• Fixed Python scripts run via the PowerShell tool crashing with UnicodeEncodeError on non-ASCII output, and PowerShell 7 error messages containing raw ANSI escape sequences (Windows)
• Fixed the PowerShell tool reporting where.exe, fc.exe, and diff.exe as errors when they return a valid negative answer (Windows)
• Fixed > and >> under the PowerShell tool on Windows PowerShell 5.1 writing UTF-16LE files that other tools couldn't read as UTF-8
• Fixed a displaced background daemon deleting its successor's control socket on shutdown, which made the next client kill the healthy replacement daemon
• Fixed background sessions parked with ← or /background and left idle keeping the background daemon and a worker process alive indefinitely
• Fixed completed background sessions being impossible to remove via claude rm or the agent view once the background service had gone idle
• Fixed background sessions dispatched from a non-git folder being impossible to delete from the agents view
• Fixed reopening a stopped background session failing to restore its saved conversation when an unreadable folder exists in the session store
• Fixed the Remote Control "session ready" push notification firing for sessions where Remote Control was not explicitly enabled
• Fixed /install-github-app and the /mcp settings menu being blocked in agent-view sessions — they're now refused only in background sessions with no terminal attached
• Fixed plugins enabled via the --settings CLI flag not loading (regression since v2.1.181)
• Fixed feature flags going stale in long-running sessions after the OAuth token rotates
• Fixed /ultrareview refusing to run in repos with no merge base — it now offers to review all tracked files
• Fixed claude update and claude doctor hanging silently, and the /status System diagnostics section going blank, when a shell-config path is a directory
• Fixed memory frontmatter values being silently truncated at an inline # when memory files are saved
• Fixed session cost and token telemetry double-counting on streams that emit multiple cumulative message_delta frames
• Fixed a spurious "check your network" warning that appeared while the advisor was thinking
• Fixed hooks with exit code 2 not blocking as documented when the hook's stdout JSON fails schema validation
• Fixed OTel log events emitted outside the turn's async context missing the interaction span's trace context
• Fixed MCP transient errors during prompts/resources refresh clearing the server's slash commands and resources
• Improved the claude rc workspace-trust error in the home directory to say trust there is never saved and to suggest running from a project directory
• Changed single-segment dir/** hook if: conditions to match only <cwd>/dir; write **/dir/** for any-depth matching. deny/ask permission rules keep their any-depth match.
• Changed file commands using -m/--magic-file or -f/--files-from to require permission instead of being auto-allowed as read-only
• Changed keep-alive connection pooling to disable after a stale-connection error, so retries open a fresh socket
• Changed SessionStart hooks to report source "fork" when a session begins as a fork instead of "resume"

sethvargo/ratchet (aqua:sethvargo/ratchet)

v0.12.0: v0.12.0

Compare Source

Changelog

• 27f7515b4648e179168f8f8ae2257636fdb03c48: Bump github.com/docker/cli from 28.3.0+incompatible to 29.2.0+incompatible in the go_modules group across 1 directory (chore(deps): update golang.org/x/exp digest to 9a3e603 #128) (@​dependabot[bot])
• c7c58082b6096c976e42dfcc1ddab83f97d61c28: fix: correct bounds out of range error (chore(deps): update aqua #130) (@​aaronhurt)
• 15bde13e63a9fe94f9abe1c2de94b7efe95da311: feat: support parallel step blocks in GitHub Actions workflows (chore(deps): update aqua #136) (@​frankkerschbaumer)
• 43c2f868adf316878296666232da1c8d2733f159: Allow non-semver and semver-like tags (chore(deps): update dependency antonmedv/fx to v31 #138) (@​n80fr1n60)
• e553d0154ce1d4655ca002fb451847e34e425710: Modernize to Go 1.25 and harden YAML parsing (chore(deps): update dependency twistedpair/google-cloud-sdk to v455 #139) (@​sethvargo)
• 4faa0c2e9b028c8f13dd1a0a456f63bbdf244db6: Skip container refs that contain CI variables (chore(deps): update aqua #140) (@​sethvargo)
• 9ca118155b0f79464185703a50da367e111107cd: Add opt-in bake delay for pin, update, and upgrade (chore(deps): update dependency aquaproj/aqua-renovate-config to v1.13.0 #141) (@​sethvargo)

terraform-linters/tflint (aqua:terraform-linters/tflint)

v0.64.0: v0.64.0

Compare Source

What's Changed

Enhancements

• cmd: include worker dir for no-range recursive issues by @​Zakharden in cmd: include worker dir for no-range recursive issues terraform-linters/tflint#2524
• config: add ignorable rule setting by @​Zakharden in config: add ignorable rule setting terraform-linters/tflint#2525
• formatter(junit): include range in testcase name by @​Zakharden in formatter(junit): include range in testcase name terraform-linters/tflint#2538

Bug Fixes

• plugin: fetch attestation bundles from bundle_url by @​Kunalbehbud in plugin: fetch attestation bundles from bundle_url terraform-linters/tflint#2593
  • Merged as plugin: fetch attestation bundles from bundle_url terraform-linters/tflint#2600

Chores

• Refactor formatter dispatch into format adapters by @​bendrucker in Refactor formatter dispatch into format adapters terraform-linters/tflint#2556
• Inline per-format print methods into their adapters by @​bendrucker in Inline per-format print methods into their adapters terraform-linters/tflint#2557
• build(deps): Bump docker/setup-buildx-action from 4.0.0 to 4.1.0 by @​dependabot[bot] in build(deps): Bump docker/setup-buildx-action from 4.0.0 to 4.1.0 terraform-linters/tflint#2559
• build(deps): Bump github.com/mattn/go-colorable from 0.1.14 to 0.1.15 by @​dependabot[bot] in build(deps): Bump github.com/mattn/go-colorable from 0.1.14 to 0.1.15 terraform-linters/tflint#2560
• build(deps): Bump golang from 1.26.3-alpine3.23 to 1.26.4-alpine3.23 by @​dependabot[bot] in build(deps): Bump golang from 1.26.3-alpine3.23 to 1.26.4-alpine3.23 terraform-linters/tflint#2558
• release: Set branch name for Homebrew tap by @​wata727 in release: Set branch name for Homebrew tap terraform-linters/tflint#2561
• Extract the shared runner-setup pipeline by @​bendrucker in Extract the shared runner-setup pipeline terraform-linters/tflint#2555
• formatter: guard diagnostics with no source range by @​bendrucker in formatter: guard diagnostics with no source range terraform-linters/tflint#2562
• docs: add Go install instructions to README by @​RoseSecurity in docs: add Go install instructions to README terraform-linters/tflint#2563
• build(deps): Bump actions/checkout from 6.0.2 to 6.0.3 by @​dependabot[bot] in build(deps): Bump actions/checkout from 6.0.2 to 6.0.3 terraform-linters/tflint#2565
• build(deps): Bump alpine from 3.23.4 to 3.24.0 by @​dependabot[bot] in build(deps): Bump alpine from 3.23.4 to 3.24.0 terraform-linters/tflint#2566
• build(deps): Bump the go-x group with 2 updates by @​dependabot[bot] in build(deps): Bump the go-x group with 2 updates terraform-linters/tflint#2567
• build(deps): Bump github.com/sigstore/sigstore-go from 1.1.4 to 1.2.0 by @​dependabot[bot] in build(deps): Bump github.com/sigstore/sigstore-go from 1.1.4 to 1.2.0 terraform-linters/tflint#2568
• fix(install): close download and zip readers by @​RoseSecurity in fix(install): close download and zip readers terraform-linters/tflint#2564
• build(deps): Bump alpine from 3.24.0 to 3.24.1 by @​dependabot[bot] in build(deps): Bump alpine from 3.24.0 to 3.24.1 terraform-linters/tflint#2570
• build(deps): Bump golang.org/x/net from 0.55.0 to 0.56.0 in the go-x group by @​dependabot[bot] in build(deps): Bump golang.org/x/net from 0.55.0 to 0.56.0 in the go-x group terraform-linters/tflint#2571
• build(deps): Bump github.com/sigstore/sigstore-go from 1.2.0 to 1.2.1 by @​dependabot[bot] in build(deps): Bump github.com/sigstore/sigstore-go from 1.2.0 to 1.2.1 terraform-linters/tflint#2572
• build(deps): Bump actions/checkout from 6.0.3 to 7.0.0 by @​dependabot[bot] in build(deps): Bump actions/checkout from 6.0.3 to 7.0.0 terraform-linters/tflint#2579
• build(deps): Bump actions/setup-go from 6.4.0 to 6.5.0 by @​dependabot[bot] in build(deps): Bump actions/setup-go from 6.4.0 to 6.5.0 terraform-linters/tflint#2580
• build(deps): Bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 by @​dependabot[bot] in build(deps): Bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 terraform-linters/tflint#2583
• build(deps): Bump goreleaser/goreleaser-action from 7.2.2 to 7.2.3 by @​dependabot[bot] in build(deps): Bump goreleaser/goreleaser-action from 7.2.2 to 7.2.3 terraform-linters/tflint#2582
• build(deps): Bump actions/attest from 4.1.0 to 4.1.1 by @​dependabot[bot] in build(deps): Bump actions/attest from 4.1.0 to 4.1.1 terraform-linters/tflint#2581
• build(deps): Bump docker/build-push-action from 7.2.0 to 7.3.0 by @​dependabot[bot] in build(deps): Bump docker/build-push-action from 7.2.0 to 7.3.0 terraform-linters/tflint#2584
• build(deps): Bump golang.org/x/text from 0.38.0 to 0.39.0 in the go-x group by @​dependabot[bot] in build(deps): Bump golang.org/x/text from 0.38.0 to 0.39.0 in the go-x group terraform-linters/tflint#2585
• build(deps): Bump github.com/sigstore/sigstore-go from 1.2.1 to 1.2.2 by @​dependabot[bot] in build(deps): Bump github.com/sigstore/sigstore-go from 1.2.1 to 1.2.2 terraform-linters/tflint#2588
• build(deps): Bump google.golang.org/grpc from 1.81.1 to 1.82.0 by @​dependabot[bot] in build(deps): Bump google.golang.org/grpc from 1.81.1 to 1.82.0 terraform-linters/tflint#2587

New Contributors

• @​Zakharden made their first contribution in cmd: include worker dir for no-range recursive issues terraform-linters/tflint#2524
• @​RoseSecurity made their first contribution in docs: add Go install instructions to README terraform-linters/tflint#2563
• @​Kunalbehbud made their first contribution in plugin: fetch attestation bundles from bundle_url terraform-linters/tflint#2593

Full Changelog: terraform-linters/tflint@v0.63.1...v0.64.0

vercel-labs/agent-browser (aqua:vercel-labs/agent-browser)

v0.32.2: v0.32.2

Compare Source

Improvements

• Updated eve extension packaging for eve 0.25.1, adopting the new source and dist extension manifest format, updating the eve example to stable AI SDK releases, and keeping extension tests aligned with eve's scoped config registry (#1570)

Contributors

• @​AndrewBarba

janosmiko/lfk (github:janosmiko/lfk)

v0.15.10: v0.15.10

Compare Source

0.15.10 (2026-07-17)

Features

• explorer: tint failed/pending rows by status (#540) (#543) (ea872db)

Bug Fixes

• explorer: clear quick filter when goto jumps between resource types (#541) (4222cbf)