fix(deps): update patch updates

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@earendil-works/pi-agent-core (source)	0.84.0 → 0.84.1
@earendil-works/pi-ai (source)	0.84.0 → 0.84.1
@earendil-works/pi-coding-agent (source)	0.84.0 → 0.84.1
@earendil-works/pi-telemetry (source)	0.84.0 → 0.84.1
@whiskeysockets/baileys	7.0.0-rc13 → 7.0.0-rc14
esbuild	0.28.1 → 0.28.2
hono (source)	4.13.0 → 4.13.1
jose	6.2.4 → 6.2.8
mailparser	3.9.14 → 3.9.15
nodemailer (source)	9.0.1 → 9.0.5
nodemailer (source)	9.0.3 → 9.0.5
typebox	1.3.7 → 1.3.11
ws	8.21.1 → 8.21.3

---

Release Notes

earendil-works/pi (@​earendil-works/pi-agent-core)

v0.84.1

Compare Source

Added

• Added BeforeToolCallResult.terminate so blocked tool calls can participate in the existing batch early-termination rule (#​7715 by @​muyiyr).

Fixed

• Fixed Agent.reset() clearing transcript and runtime state during active runs; it now rejects until the agent is idle (#​7717 by @​wesleyzhangwq).

earendil-works/pi (@​earendil-works/pi-ai)

v0.84.1

Compare Source

Added

• Added Qwen Token Plan Individual as a built-in provider with its documented subscription model catalog and the shared international QWEN_TOKEN_PLAN_API_KEY (#​7659 by @​arasovic).

earendil-works/pi (@​earendil-works/pi-coding-agent)

v0.84.1

Compare Source

New Features

• Qwen Token Plan Individual — Use the built-in provider for models documented for Individual subscriptions. See API Keys.
• Authentication readiness checks — Use pi auth check to verify provider or model credentials, optionally emitting the resolved credential.
• Improved fullscreen interaction — Select words and paragraphs with multiple clicks and configure half-page transcript scrolling. See TUI Fullscreen Viewport.
• Terminating blocked tool calls — Extension tool_call handlers can stop all-terminating batches without another model call. See Tool Events.

Added

• Added Qwen Token Plan Individual as a built-in provider with its documented subscription model catalog and the shared international QWEN_TOKEN_PLAN_API_KEY. See API Keys (#​7659 by @​arasovic).
• Added pi auth check provider/model auth preflight with optional credential output (#​7152).
• Added terminate support to blocked extension tool_call events so all-terminating batches can skip the automatic follow-up model call. See Tool Events (#​7715 by @​muyiyr).
• Added inherited double-click word and whitespace selection, granularity-aware drag selection, and triple-click paragraph selection in fullscreen mode (#​7725, #​7733 by @​volsa).
• Added inherited unbound half-page transcript scrolling actions for fullscreen mode. See TUI Fullscreen Viewport (#​7735).

Changed

• Softened the bash tool's PI_* environment guideline in an attempt to reduce unnecessary inspection commands (#​7128).
• Reduced worst-case automatic terminal theme detection delay from 200 ms to 100 ms by probing color-scheme and background support concurrently.

Fixed

• Fixed Bun standalone binaries crashing on startup when the cwd contains a bunfig.toml with preload by compiling with --no-compile-autoload-bunfig (#​7685 by @​geril07).
• Fixed extension TUI method wrappers recursing indefinitely when delegating to the original method (#​7731).
• Fixed right-click not pasting clipboard text in fullscreen mode on Windows.
• Fixed inherited Agent.reset() clearing transcript and runtime state during active runs; it now rejects until the agent is idle (#​7717 by @​wesleyzhangwq).
• Fixed inherited LaTeX relation, multiplication, and named-operator spacing, and matrix composition with stacked fractions, operator limits, and adjacent matrices.
• Reduced inherited fullscreen mouse event volume under tmux, Zellij, and GNU Screen by using button-motion tracking instead of all-motion tracking.

earendil-works/pi (@​earendil-works/pi-telemetry)

v0.84.1

Compare Source

WhiskeySockets/Baileys (@​whiskeysockets/baileys)

v7.0.0-rc14

Compare Source

evanw/esbuild (esbuild)

v0.28.2

Compare Source

• Fix tree shaking bug due to TypeScript import alias (#​4507)

  This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

  import Base from './dep.js';
  import Alias = Base.SomeType;

• Fix CSS minification bug involving & (#​4497)

  This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

  /* Original code */
  .a .b {
    & .b:not(& .c) {
      color: red;
    }
  }
  
  /* Old output (with --minify) */
  .a .b{.b:not(& .c){color:red}}
  
  /* New output (with --minify) */
  .a .b{& .b:not(& .c){color:red}}

  This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

• Avoid overwriting input files without --allow-overwrite (#​4484)

  For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

  This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

• Fix incorrect code generated when using top-level await (#​4498)

  Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

• Fix a minification bug with lowered logical assignment operators (#​4508)

  This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

  // Original code
  function foo() {
    let x
    bar(x ||= {})
  }
  
  // Old output (with --minify-syntax --target=es6)
  function foo() {
    bar(void 0 || (x = {}));
  }
  
  // New output (with --minify-syntax --target=es6)
  function foo() {
    let x;
    bar(x || (x = {}));
  }

• Fix a potential deadlock when the JavaScript API is used incorrectly (#​4503, #​4506)

  The JavaScript API runs the native esbuild executable as a long-lived child process and communicates with it over stdin/stdout/stderr. Each API request is asynchronous and the executable stays open as long as it has work to do, which is as long as either stdin is still open (meaning there may be more API requests) or there are currently requests being processed.

  Previously esbuild's tracking of outstanding API requests missed decrementing a reference count in an edge case where esbuild's JavaScript API was used incorrectly and the API request returned an error. This could in some cases cause esbuild's native executable to exit with an error message about a deadlock. This release fixes the reference counting bug.

  This fix was submitted by @​ZuBB.

• Handle target collisions (#​4509)

  It's possible to specify the same target engine multiple times, such as with --target=chrome1,chrome99. This edge case wasn't anticipated and previously took the last version for the duplicated target engine instead of the minimum version (so chrome99 in this case instead of chrome1). With this release, esbuild will now pick the minimum version between all duplicated target engines.

• Force .mp3 files to use the audio/mpeg MIME type (#​4485)

  MIME type detection for esbuild's data URLs uses Go's built-in MIME type detection, which is based on the MIME sniffing standard. This works correctly for MP3 files that start with the byte sequence ID3, which is commonly the case. However, it's possible to construct valid MP3 files that do not start with ID3, and that perhaps Go's built-in MIME type detection doesn't implement the "Signature for MP3 without ID3" part of the algorithm. This results in some .mp3 files incorrectly using the application/octet-stream MIME type instead of audio/mpeg. With this release, esbuild will now always use the audio/mpeg MIME type for files ending in .mp3.

• Add a new TypeScript syntax warning

  TypeScript 7 turned some previously-valid TypeScript syntax into a syntax error because it was confusing. TypeScript 6 accepts 1 + 2 as number * 3 as valid syntax but confusingly converts it to (1 + 2) * 3 instead of the more intuitive conversion to 1 + (2 * 3). This syntax is now an error in TypeScript 7+. With this release, esbuild will now warn about the use of this syntax:

  ▲ [WARNING] Operator "*" should not directly follow a TypeScript type cast after the "+" operator [confusing-typescript-cast]
  
      example.ts:1:28:
        1 │ console.log(1 + 2 as number * 3)
          ╵                             ^
  
    This is a syntax error in newer versions of TypeScript because the type cast has unintuitive
    precedence in this case. Surround the inner expression in parentheses to silence this warning:
  
      example.ts:1:12:
        1 │ console.log(1 + 2 as number * 3)
          │             ~~~~~~~~~~~~~~~
          ╵             (             )

  See microsoft/TypeScript#63527 for more information.

• Add support for formatting errors for Visual Studio (#​4460)

  Visual Studio has a specific style that it expects log messages to be in for them to show up in the UI when esbuild is run as a custom build step. The current log style that esbuild uses doesn't conform to this specific style.

  With this release, esbuild has a new log style for Visual Studio (and other tools in the MSBuild ecosystem) that can be enabled with --log-style=visualstudio. Here is an example log message in this style:

  $ esbuild example.ts --log-style=visualstudio
  /Users/evan/dev/esbuild/example.ts(1,29): warning ES0010: Operator "*" should not directly follow a TypeScript type cast after the "+" operator
  

  This log style is also available via the JS and Go APIs, and can now be used with the existing formatMessages API.

• Fix a bug with CSS gamut mapping (#​4488)

  Due to a typo, the fallback colors generated for CSS colors outside of the sRGB gamut weren't correct. This release fixes the generated colors to use the intended algorithm.

  This fix was submitted by @​chatman-media.

honojs/hono (hono)

v4.13.1

Compare Source

panva/jose (jose)

v6.2.8

Compare Source

Fixes

• enforce a single recipient when decrypting dir and ECDH-ES (505c383)
• reject a non-string "alg" in EmbeddedJWK (714f870)

Refactor

• index the JWS and JWE registries without a wrapper (925f3bb)
• name the "alg" source in unsupported algorithm failures (1500459)

v6.2.7

Compare Source

Fixes

• require own JOSE properties for presence checks (90ab09c)

Refactor

• reduce bundle size (767d7f1)

v6.2.6

Compare Source

Fixes

• types: accept host CryptoKey declarations (b48a15b)

v6.2.5

Compare Source

Fixes

• compare claim values for falsy validation options (eb86956)
• forward key management parameters for a single JWE recipient (2d4f801)
• handle a zero-length JWE additional authenticated data (16ca398)
• reject a generateKeyPair crv option the algorithm does not imply (76364e9)
• reject an unencoded payload in the JWS Compact Serialization (01d053f)
• reject characters outside the Base64URL alphabet (0ebb971), references #​879
• reject duplicate "crit" values when producing (31d60e1)
• reject invalid UTF-8 in JOSE Headers and JWT Claims Sets (5df3fed)
• reject truncated ASN.1 key data (7a16c66)
• surface non-ASCII token segments as JOSE errors (194fe11)
• types: correct JWK and CryptoKey types (62a196d)
• types: correct key resolver and JWT header types (e95f8c4)
• validate the clockTolerance and currentDate options are finite (ab2f18d)

Documentation

• correct subpaths and API documentation (2daec38)
• document consumer-supplied type parameters (9e9f66c)
• stop claiming the JWK "use" parameter is used during import (47a07b2)
• update CHANGELOG.md (fc51bf5)

Refactor

• assert key shape and type from the entry (971057e)
• avoid 32-bit truncation of the AES-CBC-HMAC AAD bit length (1c8c6e9)
• correct swapped JWE unprotected header type error messages (894c498)
• describe each JWS algorithm once (7375028)
• discriminate a key once (0b59a69)
• fold single-consumer modules into their consumers (c2f0ca3)
• generate and import keys from the entry (da69b68)
• keep JWE out of the JWKS and embedded-JWK paths (241dd48)
• keep JWS and JWE out of each other's bundles (2a98564)
• parse a Protected Header in one place (30f72af)
• resolve the content encryption algorithm once (98b50ab)
• tighten key property checks (fe0dc3b)
• types: add discriminated JOSE error types (f7f764e)
• types: add JOSE identifier unions and JWK narrowing (2a20f49)
• types: improve key and result inference (cb25e77)
• types: trim published declaration comments (544f179)
• unify base64 decode errors (3a91833)
• validate each token once rather than once per layer (bbdae09)
• write each algorithm identifier once (73d83b5)

nodemailer/mailparser (mailparser)

v3.9.15

Compare Source

Bug Fixes

• update dependencies (@​zone-eu/mailsplit 5.4.15, libmime 5.4.2, nodemailer 9.0.5) (047379d)

nodemailer/nodemailer (nodemailer)

v9.0.5

Compare Source

Bug Fixes

• ci: retrigger the workflows dropped during the Actions outage (85d16c1)
• mailer: escape specials in List-* header comments (#​1842) (75913bb)
• mime-funcs: star the continuation key of a restarted parameter line (36bcf1a)
• mime-node: keep control chars out of header values and msg-id headers (15cf6d1)
• mime: encode DEL in header parameters and List-* comments (cf69430)
• mime: keep control chars out of the remaining header positions (5ed9d26)
• mime: normalize an address parsed out of a string as well (63685f7)
• mime: normalize an address so header and envelope agree (a9343b4)
• mime: stop a header key callback and the dkim tags from injecting (b7d772e)

v9.0.4

Compare Source

Bug Fixes

• mime-funcs: do not let an unpaired surrogate consume the next character (9797f7f)
• mime-funcs: keep any surrogate pair intact when chunking base64 mime words (#​1838) (5bd3a65)
• mime-funcs: percent encode unpaired surrogates in header parameter values (78f4aa2)
• mime-node: escape backslash and quote in the Content-Type name parameter (#​1837) (adcfc4f)
• mime: encode HT/CR/LF in header parameter values instead of quoting them (#​1840) (5bc9cab)

sinclairzx81/typebox (typebox)

v1.3.11

Compare Source

v1.3.10

Compare Source

v1.3.9

Compare Source

v1.3.8

Compare Source

websockets/ws (ws)

v8.21.3

Compare Source

Bug fixes

• The server now correctly rejects permessage-deflate offers if the incoming
  client_max_window_bits parameter value is smaller than its configured
  clientMaxWindowBits (e97a20e).

v8.21.2

Compare Source

Bug fixes

• Fixed a test for CITGM (2eb3be0).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

Scope: all 17 workspace projects
Progress: resolved 1, reused 0, downloaded 0, added 0
Progress: resolved 25, reused 0, downloaded 0, added 0
Progress: resolved 37, reused 0, downloaded 0, added 0
Progress: resolved 38, reused 0, downloaded 0, added 0
Progress: resolved 41, reused 0, downloaded 0, added 0
Progress: resolved 44, reused 0, downloaded 0, added 0
Progress: resolved 49, reused 0, downloaded 0, added 0
Progress: resolved 59, reused 0, downloaded 0, added 0
Progress: resolved 79, reused 0, downloaded 0, added 0
Progress: resolved 122, reused 0, downloaded 0, added 0
Progress: resolved 132, reused 0, downloaded 0, added 0
Progress: resolved 137, reused 0, downloaded 0, added 0
Progress: resolved 155, reused 0, downloaded 0, added 0
Progress: resolved 194, reused 0, downloaded 0, added 0
Progress: resolved 258, reused 0, downloaded 0, added 0
Progress: resolved 314, reused 0, downloaded 0, added 0
Progress: resolved 388, reused 0, downloaded 0, added 0
Progress: resolved 424, reused 0, downloaded 0, added 0
Progress: resolved 447, reused 0, downloaded 0, added 0
Progress: resolved 472, reused 0, downloaded 0, added 0
Progress: resolved 488, reused 0, downloaded 0, added 0
Progress: resolved 498, reused 0, downloaded 0, added 0
Progress: resolved 501, reused 0, downloaded 0, added 0
Progress: resolved 582, reused 0, downloaded 0, added 0
Progress: resolved 664, reused 0, downloaded 0, added 0
Progress: resolved 727, reused 0, downloaded 0, added 0
Progress: resolved 753, reused 0, downloaded 0, added 0
Progress: resolved 806, reused 0, downloaded 0, added 0
Progress: resolved 811, reused 0, downloaded 0, added 0
Progress: resolved 861, reused 0, downloaded 0, added 0
Progress: resolved 865, reused 0, downloaded 0, added 0
Progress: resolved 902, reused 0, downloaded 0, added 0
 WARN  Request took 16905ms: https://registry.npmjs.org/@typescript-eslint%2Fparser
Progress: resolved 970, reused 0, downloaded 0, added 0
 WARN  Request took 18520ms: https://registry.npmjs.org/@typescript-eslint%2Ftypescript-estree
Progress: resolved 1016, reused 0, downloaded 0, added 0
Progress: resolved 1073, reused 0, downloaded 0, added 0
 WARN  Request took 20694ms: https://registry.npmjs.org/@typescript-eslint%2Feslint-plugin
Progress: resolved 1125, reused 0, downloaded 0, added 0
Progress: resolved 1134, reused 0, downloaded 0, added 0
 WARN  Request took 15500ms: https://registry.npmjs.org/playwright
Progress: resolved 1140, reused 0, downloaded 0, added 0
Progress: resolved 1144, reused 0, downloaded 0, added 0
Progress: resolved 1152, reused 0, downloaded 0, added 0
 ERR_PNPM_UNUSED_PATCH  The following patches were not used: @earendil-works/pi-ai@0.84.0, @earendil-works/pi-coding-agent@0.84.0

Either remove them from "patchedDependencies" or update them to match packages in your dependencies.