build(deps-dev): bump the npm-dependencies group with 3 updates

[dependabot]

Bumps the npm-dependencies group with 3 updates: @changesets/cli, @earendil-works/pi-coding-agent and @types/node.

Updates @changesets/cli from 2.31.1 to 3.0.0

Release notes

Sourced from @​changesets/cli's releases.

@​changesets/cli@​3.0.0

Major Changes

• #2128 7113c01 Thanks @​Andarist! - Renamed the changeset tag command to changeset git-tag.

• #2074 3599e47 Thanks @​bluwy! - Set supported package manager versions in "engines" field, including npm >=10.9.0, pnpm >=10.0.0, and yarn >=4.5.2.

• #1860 92b1c1b Thanks @​mixelburg! - changeset version now exits with code 1 when there are no unreleased changesets, instead of silently exiting with code 0.

  This makes it easier to detect when a version step is a no-op — for example, to prevent accidentally publishing packages with incorrect version tags when using --snapshot mode.

• #1482 df424a4 Thanks @​Andarist! - Bumped supported Node versions to ^22.11 || ^24 || >=26

• #1994 062530b Thanks @​bluwy! - The prettier option in .changeset/config.json has been removed in favor of format. format supports "auto", "prettier", "oxfmt", "deno", and "dprint", and false disables formatting. If you previously used prettier: false, migrate to format: false or remove the option to use automatic formatter detection.

• #2190 96b65ee Thanks @​bluwy! - Move versioned prerelease changesets to .changeset/pre/ folder instead of accumulating in the root and tracking the versioned changeset ids in the .changeset/pre.json file. Existing pre.json will auto-migrate to this new structure on the next run of changeset version or when calling changeset status.

  This change allows easier management of versioned prerelease changesets (for the final stable release) and current queued changesets (for the next prerelease). Changesets in .changeset/pre/ can be edited or deleted depending if it's still relevant for the final stable release of a package. There's no need to synchronize the changeset ids in pre.json if certain changesets are deleted.

• #2145 f5887ff Thanks @​Andarist! - Removed Yarn Classic support

• #2097 8c88f6a Thanks @​Andarist! - Packages with only prerelease versions published will now be published with the prerelease tag in the prerelease mode if the target registry doesn't auto-assign latest tag. npm registry itself does that and such packages will continue to be released with latest tag (and not with the configured prerelease tag).

• #1879 c76b232 Thanks @​beeequeue! - Removed warning messages about using v1 configs. They will now be silently ignored.

• #1655 db46911 Thanks @​bluwy! - Update @manypkg/get-packages which drops support for detecting packages in Bolt monorepos and adds support for npm monorepos

• #1651 e1df862 Thanks @​bluwy! - Remove support for the --sinceMaster flag for changeset status. Use --since=master or --since=main instead.

• #2117 813bbf3 Thanks @​bluwy! - Remove the pre.json initialVersions property and handling as it's unused internally

• #1961 07278a7 Thanks @​beeequeue! - CommitFunctions can now be both sync and async, and the defaultCommitFunctions are now sync.

• #1482 df424a4 Thanks @​Andarist! - From now on this package is going to be published as ES module.

• #1652 a0b5326 Thanks @​bluwy! - Remove support for the deprecated ___experimentalUnsafeOptions_WILL_CHANGE_IN_PATCH.useCalculatedVersionForSnapshots config. The snapshot.useCalculatedVersion config should be used instead.

• #2186 3910adf Thanks @​Andarist! - Private packages are no longer versioned by default. Set privatePackages to true to opt into versioning and tagging them, or set privatePackages.version to true to version them without tagging.

• #1879 c76b232 Thanks @​beeequeue! - Migrated from enquirer + @inquirer/launch-editor to @clack/prompts + launch-editor.

  This means the CLI flows will have minor changes, but they are largely the same.

  This change also fixes various issues related to enquirer like cancelling prompts crashing the CLI.

• #2090 3aae903 Thanks @​beeequeue! - Peer dependencies now bump packages that depend on them by patch instead of major.

  This means a peer dependency update is no longer assumed (forced) to be a breaking change.

  If the dependent package is not compatible with the peer's new release you should manually add a major changeset describing why and how to migrate.

... (truncated)

Changelog

Sourced from @​changesets/cli's changelog.

3.0.0

Major Changes

• #2128 7113c01 Thanks @​Andarist! - Renamed the changeset tag command to changeset git-tag.

• #2074 3599e47 Thanks @​bluwy! - Set supported package manager versions in "engines" field, including npm >=10.9.0, pnpm >=10.0.0, and yarn >=4.5.2.

• #1860 92b1c1b Thanks @​mixelburg! - changeset version now exits with code 1 when there are no unreleased changesets, instead of silently exiting with code 0.

  This makes it easier to detect when a version step is a no-op — for example, to prevent accidentally publishing packages with incorrect version tags when using --snapshot mode.

• #1482 df424a4 Thanks @​Andarist! - Bumped supported Node versions to ^22.11 || ^24 || >=26

• #1994 062530b Thanks @​bluwy! - The prettier option in .changeset/config.json has been removed in favor of format. format supports "auto", "prettier", "oxfmt", "deno", and "dprint", and false disables formatting. If you previously used prettier: false, migrate to format: false or remove the option to use automatic formatter detection.

• #2190 96b65ee Thanks @​bluwy! - Move versioned prerelease changesets to .changeset/pre/ folder instead of accumulating in the root and tracking the versioned changeset ids in the .changeset/pre.json file. Existing pre.json will auto-migrate to this new structure on the next run of changeset version or when calling changeset status.

  This change allows easier management of versioned prerelease changesets (for the final stable release) and current queued changesets (for the next prerelease). Changesets in .changeset/pre/ can be edited or deleted depending if it's still relevant for the final stable release of a package. There's no need to synchronize the changeset ids in pre.json if certain changesets are deleted.

• #2145 f5887ff Thanks @​Andarist! - Removed Yarn Classic support

• #2097 8c88f6a Thanks @​Andarist! - Packages with only prerelease versions published will now be published with the prerelease tag in the prerelease mode if the target registry doesn't auto-assign latest tag. npm registry itself does that and such packages will continue to be released with latest tag (and not with the configured prerelease tag).

• #1879 c76b232 Thanks @​beeequeue! - Removed warning messages about using v1 configs. They will now be silently ignored.

• #1655 db46911 Thanks @​bluwy! - Update @manypkg/get-packages which drops support for detecting packages in Bolt monorepos and adds support for npm monorepos

• #1651 e1df862 Thanks @​bluwy! - Remove support for the --sinceMaster flag for changeset status. Use --since=master or --since=main instead.

• #2117 813bbf3 Thanks @​bluwy! - Remove the pre.json initialVersions property and handling as it's unused internally

• #1961 07278a7 Thanks @​beeequeue! - CommitFunctions can now be both sync and async, and the defaultCommitFunctions are now sync.

• #1482 df424a4 Thanks @​Andarist! - From now on this package is going to be published as ES module.

• #1652 a0b5326 Thanks @​bluwy! - Remove support for the deprecated ___experimentalUnsafeOptions_WILL_CHANGE_IN_PATCH.useCalculatedVersionForSnapshots config. The snapshot.useCalculatedVersion config should be used instead.

• #2186 3910adf Thanks @​Andarist! - Private packages are no longer versioned by default. Set privatePackages to true to opt into versioning and tagging them, or set privatePackages.version to true to version them without tagging.

• #1879 c76b232 Thanks @​beeequeue! - Migrated from enquirer + @inquirer/launch-editor to @clack/prompts + launch-editor.

  This means the CLI flows will have minor changes, but they are largely the same.

  This change also fixes various issues related to enquirer like cancelling prompts crashing the CLI.

• #2090 3aae903 Thanks @​beeequeue! - Peer dependencies now bump packages that depend on them by patch instead of major.

  This means a peer dependency update is no longer assumed (forced) to be a breaking change.

... (truncated)

Commits

• f442221 Version Packages (#2235)
• e3facad Version Packages (next) (#2228)
• c98af4c Do not bump ignored independent packages when exiting pre mode (#2092)
• 496ca21 Build(deps-dev): Bump the development-dependencies group with 6 updates (#2225)
• d1053ac Build(deps): Bump the production-dependencies group across 1 directory with 2...
• 68ea6ec Fix linked and fixed glob patterns expansion (#2222)
• c1b6f8c fix missing coloring of name (#2218)
• a53d1f8 Remove old atlaskit changelogs (#2217)
• 7bcb2d2 Build(deps-dev): Bump the development-dependencies group across 1 directory w...
• baa658d Version Packages (next) (#2192)
• Additional commits viewable in compare view

Updates @earendil-works/pi-coding-agent from 0.83.0 to 0.84.1

Release notes

Sourced from @​earendil-works/pi-coding-agent's releases.

v0.84.1

New Features

• Qwen Token Plan Individual — Use the built-in provider for models documented for Individual subscriptions. See API Keys.
• Authentication readiness checks — Use pi auth check to verify provider or model credentials, optionally emitting the resolved credential.
• Improved fullscreen interaction — Select words and paragraphs with multiple clicks and configure half-page transcript scrolling. See TUI Fullscreen Viewport.
• Terminating blocked tool calls — Extension tool_call handlers can stop all-terminating batches without another model call. See Tool Events.

Added

• Added Qwen Token Plan Individual as a built-in provider with its documented subscription model catalog and the shared international QWEN_TOKEN_PLAN_API_KEY. See API Keys (#7659 by @​arasovic).
• Added pi auth check provider/model auth preflight with optional credential output (#7152).
• Added terminate support to blocked extension tool_call events so all-terminating batches can skip the automatic follow-up model call. See Tool Events (#7715 by @​muyiyr).
• Added inherited double-click word and whitespace selection, granularity-aware drag selection, and triple-click paragraph selection in fullscreen mode (#7725, #7733 by @​volsa).
• Added inherited unbound half-page transcript scrolling actions for fullscreen mode. See TUI Fullscreen Viewport (#7735).

Changed

• Softened the bash tool's PI_* environment guideline in an attempt to reduce unnecessary inspection commands (#7128).
• Reduced worst-case automatic terminal theme detection delay from 200 ms to 100 ms by probing color-scheme and background support concurrently.

Fixed

• Fixed Bun standalone binaries crashing on startup when the cwd contains a bunfig.toml with preload by compiling with --no-compile-autoload-bunfig (#7685 by @​geril07).
• Fixed extension TUI method wrappers recursing indefinitely when delegating to the original method (#7731).
• Fixed right-click not pasting clipboard text in fullscreen mode on Windows.
• Fixed inherited Agent.reset() clearing transcript and runtime state during active runs; it now rejects until the agent is idle (#7717 by @​wesleyzhangwq).
• Fixed inherited LaTeX relation, multiplication, and named-operator spacing, and matrix composition with stacked fractions, operator limits, and adjacent matrices.
• Reduced inherited fullscreen mouse event volume under tmux, Zellij, and GNU Screen by using button-motion tracking instead of all-motion tracking.

v0.84.0

New Features

• Fullscreen TUI mode — Switch between regular and fullscreen modes at runtime, with a sticky editor and footer, independently scrollable transcript, and draggable scrollbars. See UI & Display.
• Mermaid and LaTeX rendering — Render Mermaid diagrams and terminal-friendly Unicode math in interactive transcripts. See Markdown settings and TUI Markdown.
• Per-directory context overrides — Use AGENTS.override.md to replace context files for a specific directory. See Context Files.
• Advanced custom model sampling — Configure arbitrary OpenAI-compatible samplingParams and opt-in vLLM thinking_token_budget values. See Sampling Parameters.
• Baseten provider — Use built-in Baseten authentication and model support. See API Keys.

Breaking Changes

• Renamed the inherited pi-ai ModelsStreamTransforms interface to ModelsRequestTransforms because its header transformation now applies to all authenticated provider requests.

• Changed JSON and RPC message_update events to emit only assistantMessageEvent deltas, removing the cumulative message and assistantMessageEvent.partial fields that caused quadratic output growth. Clients that need partial messages must assemble deltas between message_start and message_end; the latter remains authoritative (#7290).

• ModelRegistry.getApiKeyAndHeaders() now returns ProviderHeaders with string | null values and preserves null header-deletion markers. Extensions that inspect returned headers must handle null; extensions forwarding them to pi-ai streams should pass them through unchanged. This prevents placeholder OpenAI credentials from being sent through Cloudflare AI Gateway (#7030).

• Changed ModelRegistry.refresh() to accept ModelsRefreshOptions and return ModelsRefreshResult instead of discarding cancellation and provider errors.

• Changed ModelRuntime.setRuntimeApiKey() to accept auth cancellation options rather than catalog refresh options. Call refresh({ providers: [providerId], signal }) separately when remote freshness is required.

• Required config-form extension OAuth refreshToken(credentials, signal) callbacks to accept and honor a concrete abort signal.

• Replaced dynamic provider refresh context store access with the read-only context.stored snapshot and generation-checked context.publish() transaction.

  Providers built with createProvider({ fetchModels }): no catalog-publication migration is required. Before and after, return the fetched models and register the resulting provider; createProvider() owns restoration, persistence, and in-memory publication.

... (truncated)

Changelog

Sourced from @​earendil-works/pi-coding-agent's changelog.

[0.84.1] - 2026-08-07

New Features

• Qwen Token Plan Individual — Use the built-in provider for models documented for Individual subscriptions. See API Keys.
• Authentication readiness checks — Use pi auth check to verify provider or model credentials, optionally emitting the resolved credential.
• Improved fullscreen interaction — Select words and paragraphs with multiple clicks and configure half-page transcript scrolling. See TUI Fullscreen Viewport.
• Terminating blocked tool calls — Extension tool_call handlers can stop all-terminating batches without another model call. See Tool Events.

Added

• Added Qwen Token Plan Individual as a built-in provider with its documented subscription model catalog and the shared international QWEN_TOKEN_PLAN_API_KEY. See API Keys (#7659 by @​arasovic).
• Added pi auth check provider/model auth preflight with optional credential output (#7152).
• Added terminate support to blocked extension tool_call events so all-terminating batches can skip the automatic follow-up model call. See Tool Events (#7715 by @​muyiyr).
• Added inherited double-click word and whitespace selection, granularity-aware drag selection, and triple-click paragraph selection in fullscreen mode (#7725, #7733 by @​volsa).
• Added inherited unbound half-page transcript scrolling actions for fullscreen mode. See TUI Fullscreen Viewport (#7735).

Changed

• Softened the bash tool's PI_* environment guideline in an attempt to reduce unnecessary inspection commands (#7128).
• Reduced worst-case automatic terminal theme detection delay from 200 ms to 100 ms by probing color-scheme and background support concurrently.

Fixed

• Fixed Bun standalone binaries crashing on startup when the cwd contains a bunfig.toml with preload by compiling with --no-compile-autoload-bunfig (#7685 by @​geril07).
• Fixed extension TUI method wrappers recursing indefinitely when delegating to the original method (#7731).
• Fixed right-click not pasting clipboard text in fullscreen mode on Windows.
• Fixed inherited Agent.reset() clearing transcript and runtime state during active runs; it now rejects until the agent is idle (#7717 by @​wesleyzhangwq).
• Fixed inherited LaTeX relation, multiplication, and named-operator spacing, and matrix composition with stacked fractions, operator limits, and adjacent matrices.
• Reduced inherited fullscreen mouse event volume under tmux, Zellij, and GNU Screen by using button-motion tracking instead of all-motion tracking.

[0.84.0] - 2026-08-06

New Features

• Fullscreen TUI mode — Switch between regular and fullscreen modes at runtime, with a sticky editor and footer, independently scrollable transcript, and draggable scrollbars. See UI & Display.
• Mermaid and LaTeX rendering — Render Mermaid diagrams and terminal-friendly Unicode math in interactive transcripts. See Markdown settings and TUI Markdown.
• Per-directory context overrides — Use AGENTS.override.md to replace context files for a specific directory. See Context Files.
• Advanced custom model sampling — Configure arbitrary OpenAI-compatible samplingParams and opt-in vLLM thinking_token_budget values. See Sampling Parameters.
• Baseten provider — Use built-in Baseten authentication and model support. See API Keys.

Breaking Changes

• Renamed the inherited pi-ai ModelsStreamTransforms interface to ModelsRequestTransforms because its header transformation now applies to all authenticated provider requests.
• Changed JSON and RPC message_update events to emit only assistantMessageEvent deltas, removing the cumulative message and assistantMessageEvent.partial fields that caused quadratic output growth. Clients that need partial messages must assemble deltas between message_start and message_end; the latter remains authoritative (#7290).
• ModelRegistry.getApiKeyAndHeaders() now returns ProviderHeaders with string | null values and preserves null header-deletion markers. Extensions that inspect returned headers must handle null; extensions forwarding them to pi-ai streams should pass them through unchanged. This prevents placeholder OpenAI credentials from being sent through Cloudflare AI Gateway (#7030).
• Changed ModelRegistry.refresh() to accept ModelsRefreshOptions and return ModelsRefreshResult instead of discarding cancellation and provider errors.
• Changed ModelRuntime.setRuntimeApiKey() to accept auth cancellation options rather than catalog refresh options. Call refresh({ providers: [providerId], signal }) separately when remote freshness is required.
• Required config-form extension OAuth refreshToken(credentials, signal) callbacks to accept and honor a concrete abort signal.
• Replaced dynamic provider refresh context store access with the read-only context.stored snapshot and generation-checked context.publish() transaction.

... (truncated)

Commits

• 53fa77c Release v0.84.1
• 6ba4d23 docs: audit changelogs since v0.84.0
• 666d897 fix(coding-agent): preserve TUI wrapper routing (closes #7731)
• 7cb2a51 fix(coding-agent): reduce automatic theme detection delay
• 4688e4f docs(coding-agent): reconcile keybinding behavior (#7729)
• 4e64de6 fix(coding-agent): soften PI environment guideline
• c96bfac fix(coding-agent): support Windows fullscreen right-click paste
• a3e93ec feat(tui): add half-page transcript scrolling
• 6fb2d76 feat(coding-agent): add configurable Harness factory (#7686)
• a261366 feat(coding-agent): add auth preflight
• Additional commits viewable in compare view

Updates @types/node from 26.1.2 to 26.2.0

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.