deps: Dependabot batch #615-#623 (except #619)

.github/workflows/ci.yml

@@ -19,7 +19,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
         with:
           fetch-depth: 0
-      - uses: jdx/mise-action@82a612c5ab8bcda7cc5db6b7e81a8e7584c3dc6e # v5
+      - uses: jdx/mise-action@6612f0ef07ed2a736cd1e00a94a065522dd41195 # v5
         with:
           minimum_release_age: 0s
       - run: bun install --frozen-lockfile
@@ -97,7 +97,7 @@ jobs:
             shard: 1/1
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
-      - uses: jdx/mise-action@82a612c5ab8bcda7cc5db6b7e81a8e7584c3dc6e # v5
+      - uses: jdx/mise-action@6612f0ef07ed2a736cd1e00a94a065522dd41195 # v5
         with:
           minimum_release_age: 0s
       - run: bun install --frozen-lockfile
@@ -143,7 +143,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
-      - uses: jdx/mise-action@82a612c5ab8bcda7cc5db6b7e81a8e7584c3dc6e # v5
+      - uses: jdx/mise-action@6612f0ef07ed2a736cd1e00a94a065522dd41195 # v5
         with:
           minimum_release_age: 0s
       - run: bun install --frozen-lockfile
@@ -167,7 +167,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
         with:
           fetch-depth: 0
-      - uses: jdx/mise-action@82a612c5ab8bcda7cc5db6b7e81a8e7584c3dc6e # v5
+      - uses: jdx/mise-action@6612f0ef07ed2a736cd1e00a94a065522dd41195 # v5
         with:
           minimum_release_age: 0s
       - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8

.github/workflows/release.yaml

@@ -98,7 +98,7 @@ jobs:
         run: bun run test:pi-host
 
       - name: Install OpenCode CLI for e2e
-        run: npm install -g opencode-ai@1.17.13
+        run: npm install -g opencode-ai@1.19.5
 
       - name: E2E tests
         run: bun run test:e2e

package.json

@@ -28,20 +28,20 @@
     "prepublishOnly": "bun run build"
   },
   "devDependencies": {
-    "@babel/parser": "8.0.8",
-    "@biomejs/biome": "2.6.3",
+    "@babel/parser": "8.0.10",
+    "@biomejs/biome": "2.6.4",
     "@earendil-works/pi-agent-core": "1.4.0",
     "@earendil-works/pi-ai": "1.4.0",
     "@earendil-works/pi-coding-agent": "1.4.0",
     "@earendil-works/pi-tui": "1.4.0",
-    "@opencode-ai/plugin": "1.19.4",
+    "@opencode-ai/plugin": "1.19.5",
     "@tsconfig/bun": "1.0.11",
     "@types/bun": "1.4.4",
     "dedent": "^1.7.2",
     "jsonc-parser": "^3.3.1",
     "lefthook": "2.2.2",
     "miniflare": "^4.20260730.0",
-    "opencode-ai": "1.19.4",
+    "opencode-ai": "1.19.5",
     "pi-coding-agent-1": "npm:@earendil-works/[email protected]",
     "typescript": "7.0.2"
   }

packages/e2e-tests/fixtures/opencode1-config-deps/package.json

@@ -1,5 +1,5 @@
 {
   "dependencies": {
-    "@opencode-ai/plugin": "1.19.4"
+    "@opencode-ai/plugin": "1.19.5"
   }
 }

packages/e2e-tests/package.json

@@ -8,6 +8,6 @@
   },
   "dependencies": {
     "@cortexkit/subc-client": "^0.22.10",
-    "@opencode-ai/sdk": "1.19.4"
+    "@opencode-ai/sdk": "1.19.5"
   }
 }

packages/e2e-tests/src/opencode-runner.ts

@@ -893,7 +893,7 @@ async function isDirectory(path: string) {
 }
 
 /**
- * OpenCode 1.19.4 installs its plugin SDK in each config directory it finds.
+ * OpenCode 1.19.5 installs its plugin SDK in each config directory it finds.
  * Include the XDG and explicit config directories, HOME/.opencode if it exists,
  * and every existing .opencode directory from the project up to the fixture's
  * temporary root. Reject paths outside that root before copying dependencies

packages/e2e-tests/tests/native-process-fixture.test.ts

@@ -435,7 +435,7 @@ const configDepsInstalled = await lstat(
   () => false,
 )
 
-/** The check OpenCode 1.19.4 makes before skipping its own install (npm.ts Npm.install). */
+/** The check OpenCode 1.19.5 makes before skipping its own install (npm.ts Npm.install). */
 async function opencodeWouldSkipInstall(dir: string) {
   if (!(await exists(join(dir, 'node_modules')))) return false
   const manifest = JSON.parse(await readFile(join(dir, 'package.json'), 'utf8'))
@@ -485,7 +485,7 @@ describe('OpenCode config-directory dependency fixture', () => {
             'utf8',
           ),
         )
-        expect(plugin.version).toBe('1.19.4')
+        expect(plugin.version).toBe('1.19.5')
         expect(
           (
             await lstat(
@@ -506,7 +506,7 @@ describe('OpenCode config-directory dependency fixture', () => {
               'utf8',
             ),
           ).version,
-        ).toBe('1.19.4')
+        ).toBe('1.19.5')
       }
     }),
   )

packages/opencode/package.json

@@ -81,14 +81,14 @@
     "@cortexkit/claustrum-client": "0.13.0",
     "@cortexkit/private-files": "0.2.2",
     "@cortexkit/subc-client": "^0.22.10",
-    "@opentui/core": "0.7.0",
-    "@opentui/solid": "0.7.0",
+    "@opentui/core": "0.8.1",
+    "@opentui/solid": "0.8.1",
     "jsonc-parser": "^3.3.1",
-    "solid-js": "1.9.12",
+    "solid-js": "1.9.18",
     "xxhash-wasm": "^1.1.0"
   },
   "devDependencies": {
-    "@ai-sdk/anthropic": "4.0.88",
-    "@opencode/plugin": "2.2.0"
+    "@ai-sdk/anthropic": "4.0.94",
+    "@opencode/plugin": "2.2.5"
   }
 }

packages/opencode/scripts/check-bundle-globals.test.ts

@@ -693,7 +693,7 @@ async function opencode1WouldSkipInstall(dir: string) {
   )
 }
 
-// The genuine npm-installed OC1 1.19.4 SDK tree the process E2E suite uses.
+// The genuine npm-installed OC1 1.19.5 SDK tree the process E2E suite uses.
 // Its committed manifest and lockfile are always present; the runner must
 // provision node_modules from that lockfile before this suite runs.
 const genuineConfigDeps = resolve(
@@ -813,7 +813,7 @@ test('captured OC1 seeding gives every config directory and the plugin cache a c
       layout.project,
       layout.env,
       captured.PACKAGE,
-      { fixture: genuineConfigDeps, version: '1.19.4' },
+      { fixture: genuineConfigDeps, version: '1.19.5' },
     )
     expect([...targets].sort()).toEqual(
       layout.configDirectories.map((directory) => resolve(directory)).sort(),
@@ -832,7 +832,7 @@ test('captured OC1 seeding gives every config directory and the plugin cache a c
       const manifest = JSON.parse(
         await readFile(join(sdk, 'package.json'), 'utf8'),
       )
-      expect(manifest.version).toBe('1.19.4')
+      expect(manifest.version).toBe('1.19.5')
       expect(
         (await lstat(join(sdk, manifest.exports['.'].import))).size,
       ).toBeGreaterThan(0)
@@ -849,7 +849,7 @@ test('captured OC1 seeding gives every config directory and the plugin cache a c
     expect(cacheLinks.length).toBeGreaterThan(0)
     expectLinksOwnedBy(cache, cacheLinks)
     expect(await captured.hostBootstrapReport(layout.env)).toContain(
-      'config plugin SDK: 1.19.4',
+      'config plugin SDK: 1.19.5',
     )
   })
 })
@@ -858,10 +858,8 @@ test('captured OC1 seeding refuses an SDK tree from another OC1 version before c
   const captured = await captureOc1Bootstrap()
   await fixture(async (root) => {
     const layout = await oc1Layout(root, captured.PACKAGE)
-    // The committed fixture holds the SDK for OpenCode 1.19.4. The OC1 host in
-    // opencode2-e2e.test.ts is pinned to 1.18.31, so seeding must refuse an SDK
-    // tree from another version rather than silently pair the host with
-    // another version's plugin SDK.
+    // An older host must not silently reuse the committed SDK fixture for
+    // OpenCode 1.19.5. Keep a different version here to exercise that refusal.
     await expect(
       captured.seedOc1Bootstrap(
         root,
@@ -870,7 +868,7 @@ test('captured OC1 seeding refuses an SDK tree from another OC1 version before c
         captured.PACKAGE,
         { fixture: genuineConfigDeps, version: '1.18.31' },
       ),
-    ).rejects.toThrow('the config dependency fixture declares 1.19.4')
+    ).rejects.toThrow('the config dependency fixture declares 1.19.5')
     for (const directory of layout.configDirectories) {
       expect(await present(join(directory, 'node_modules'))).toBe(false)
       expect(await opencode1WouldSkipInstall(directory)).toBe(false)
@@ -893,7 +891,7 @@ test('captured OC1 seeding refuses a manifest and lockfile without the installed
         layout.project,
         layout.env,
         captured.PACKAGE,
-        { fixture: incomplete, version: '1.19.4' },
+        { fixture: incomplete, version: '1.19.5' },
       ),
     ).rejects.toThrow('has no npm-installed node_modules')
     for (const directory of layout.configDirectories)

packages/opencode/scripts/smoke-tui-pack-install.ts

@@ -34,8 +34,8 @@ const hostRuntimeFixtures: [
   HostRuntimeFixture,
 ] = [
   {
-    id: 'opencode-1-19-4',
-    label: 'OpenCode 1.19.4 OpenTUI/Solid library pair',
+    id: 'opencode-1-19-5',
+    label: 'OpenCode 1.19.5 OpenTUI/Solid library pair',
     core: '0.4.5',
     keymap: '0.4.5',
     solid: '0.4.5',

packages/opencode/src/tests/opencode2-e2e.test.ts

@@ -350,7 +350,7 @@ async function seed(
 }
 
 /**
- * OpenCode 1.18.31 prepares two dependency trees before it loads plugins and
+ * OpenCode 1 prepares two dependency trees before it loads plugins and
  * sends the model request, and installs either one from the npm registry
  * when it is missing. The scenario's proxy blocks the registry, and npm's
  * retry backoff can outlast the 60-second host deadline, so the host never

packages/opencode/src/tests/support/packed-host-versions.ts

@@ -1,4 +1,4 @@
 export const packedHostVersions = {
-  oc1: '1.18.31',
+  oc1: '1.19.5',
   oc2: '2.0.22',
 } as const