build(deps): bump the production-dependencies group across 1 directory with 12 updates

[dependabot]

Bumps the production-dependencies group with 12 updates in the / directory:

Package	From	To
@ant-design/icons	6.3.2	6.3.4
@fission-ai/openspec	1.11.0	1.13.1
@inquirer/ansi	2.0.7	2.0.8
@inquirer/core	12.0.1	12.0.3
@inquirer/figures	2.0.8	2.0.9
@inquirer/prompts	8.7.0	8.7.2
@inquirer/type	4.1.0	4.1.1
antd	6.6.2	6.6.4
dompurify	3.4.14	3.4.15
marked	18.0.11	18.0.13
mermaid	11.17.2	12.0.0
yaml	2.9.0	2.9.1

Updates @ant-design/icons from 6.3.2 to 6.3.4

Commits

• See full diff in compare view

Updates @fission-ai/openspec from 1.11.0 to 1.13.1

Release notes

Sourced from @​fission-ai/openspec's releases.

v1.13.1 - Hardened CLI, safer archives

What's New in v1.13.1

This release makes OpenSpec safer to run in repositories you have not reviewed yet, and makes archive, validation, and the agent workflows more predictable.

Improved

• Security hardening - OpenSpec is safer in a freshly cloned repository. A config.yaml value can no longer inject directives into agent instructions, crafted files can no longer hang openspec update or openspec archive, and a repository's .npmrc can no longer redirect the update check.
• Next step in openspec status - Status now ends with a Next: line naming the exact command that moves the change forward, so resuming a change no longer means knowing the workflow by heart.
• Profile-aware skills - Generated skills and commands name only the workflows your profile installs, and they match natural phrasing such as "openspec propose" or "do an openspec apply".
• Project check - Workflows confirm the project has run openspec init before writing anything, and never create an openspec/ folder as a side effect.
• Explore and update workflows - Explore names /opsx:propose and /opsx:apply at every handoff and treats your explicit request to capture a change as confirmation. /opsx:update drafts its revisions first and writes only after you confirm.
• Artifact templates - Generated proposal, spec, design, and tasks files open with a top-level heading, so markdownlint no longer flags every artifact.
• Tool picker - The vendor-neutral target is listed as "Other / Universal" and can be found by searching for terms like universal, generic, or custom.
• Nix - The flake package now ships bash, zsh, and fish completions.

Fixed

• Archive - Archive refuses a requirement name that differs from an existing one only in case, a RENAMED section whose FROM: and TO: lines do not pair up, and a delta file it would never read. Bulk archive checks every target before writing any spec, and agent-driven archive and sync create the main spec for a new capability.
• Validation - openspec validate reports requirements written outside a delta section, rejects a scenario with no body, warns when tracked tasks have no checkboxes, and checks a schema's apply.requires against its artifacts.
• Task progress - Tasks under +, 1., and 1) list markers now count, and an unrecognized marker such as [~] counts as unfinished, so ✓ Complete no longer hides open work.
• Spec parsing - Requirement headings with a closing ### sequence resolve correctly, and openspec show --json --deltas-only reports exactly the deltas archive applies.
• Changes and lists - A change nested inside a namespace folder is reported instead of silently misread, and one dangling symlink no longer breaks openspec list.
• Stores - openspec store remove no longer deletes a store nested inside the one being removed, a store named specs or changes no longer becomes the planning root, and store setup --no-init-git works inside an existing Git repository.
• Configuration - A global config file with a syntax error is left untouched instead of being overwritten, openspec config edit supports an EDITOR with arguments such as code --wait, and DO_NOT_TRACK=true now disables telemetry.
• Setup and completions - Legacy cleanup keeps your own files in old command folders, and uninstalling bash completions restores .bashrc byte for byte.

New Contributors

• @​choi138 made their first contribution in Fission-AI/OpenSpec#1829

Full Changelog: Fission-AI/OpenSpec@v1.13.0...v1.13.1

v1.13.0 - Apply warnings, safer archives

What's New in v1.13.0

Archive and the delta parser stop quietly changing or dropping what you wrote, and apply now tells you when a change has no specs.

New

• Apply flags a change with no delta specs - openspec instructions apply used to report a change as ready whenever its tasks existed, even with no spec deltas at all, which is the state openspec validate rejects. It now warns in both text and --json, and names both ways out: write the specs, or declare skip_specs: true.

Improved

• Explore finds your existing specs - Generated guidance never named openspec list --specs, so an agent asked to read the current specs enumerated in-flight changes instead and reported the step done against the wrong thing. Explore now lists the spec inventory beside the change list, and reads a capability with the store-aware command.
• Init and update name the workflows your profile left out - A /opsx: command that was never installed used to read as a broken setup. Both commands now say which workflows are missing and how to add them.
• Propose reads project context before planning - Context is loaded from the selected project or store root before any planning decision. In a directory with no OpenSpec root, propose stops without writing and offers to initialize rather than creating one silently.

Fixed

... (truncated)

Changelog

Sourced from @​fission-ai/openspec's changelog.

1.13.1

Patch Changes

• #1864 767d63c Thanks @​dwin-gharibi! - Stop archive adding a second copy of an existing requirement under a name that differs only in case or spacing. ADDED and the RENAMED target compared requirement names exactly, while REMOVED and the RENAMED source already treated a case or whitespace variant as a mistyped header, so an ADDED late fees beside an existing Late Fees, or a rename to LATE FEES, archived cleanly and left two contradicting requirements in the main spec, which validate then accepted. Both now refuse with an error naming the existing requirement, in the same form REMOVED already used. The exact-duplicate error is unchanged, a case-only rename of a requirement to its own name still works, and a variant of a requirement the same delta removes or renames away is still allowed, because ADDED is checked against the spec as it stands after the earlier operations, as the exact check already was.

• #1872 72bf760 Thanks @​dwin-gharibi! - Make openspec completion uninstall bash hand .bashrc back exactly as completion install bash found it. Install adds the OpenSpec block at the top of the file followed by a blank separator line; uninstall removed the block but kept that blank line at the top, then stripped every trailing blank line and wrote the file back without its final newline. The byte count happened to come out unchanged, but the next tool to append to .bashrc with >> (the nvm, conda and rustup installers all do) merged its first line into the user's last line and broke both. Uninstall now also drops the separator line install added when the block sits at the top of the file, and leaves the rest untouched: the final newline, trailing blank lines and CRLF line endings all survive the round trip. A block the user moved elsewhere in the file is still removed, and the zsh, fish and PowerShell installers are unchanged.

• #1829 e67ac47 Thanks @​choi138! - Fix bulk archive nesting a change inside an existing archive target. The workflow now checks every archive target before it writes any main spec, the same order openspec archive uses. A change whose target already exists, or that shares a target with another selected change, is reported as failed and is never synced or moved, while the rest of the batch continues. The check runs again just before each move.

• #1878 2ef6fbd Thanks @​dwin-gharibi! - Let openspec config edit run an EDITOR or VISUAL that carries arguments. The whole value was passed to spawn as the program name, so common settings such as code --wait, subl -w or emacsclient -t failed with spawn code --wait ENOENT, and because that error was never caught the command died with a raw Node stack trace. The value is now split into a program and its arguments, honoring quoted paths with spaces, and the config path is appended as its own argument. No shell is involved, so shell metacharacters in the value are passed through literally. On Windows, .cmd shims such as code.cmd are found. A value that is itself the absolute path of an existing file is still run as-is, so an unquoted editor path containing spaces keeps working. An editor that cannot be started, exits non-zero or is killed is now reported as a one-line error naming the editor, with an install hint when the program was not found, and the command exits 1 instead of throwing. EDITOR still takes precedence over VISUAL, and the file is still validated after the editor closes.

• #1773 11a9691 Thanks @​clay-good! - Stop dropping checkbox lines whose marker the task parser does not recognise. A tasks.md whose remaining work used a marker other than [ ]/[x]/[X], for example - [~] 1.2 Deferred, reported ✓ Complete in openspec list/status and archived with no incomplete-task warning, because unmatched lines counted toward neither the numerator nor the denominator. An empty [] and a padded [ x] were lost the same way. Only a box holding x or X means done (https://github.com/Fission-AI/OpenSpec/blob/main/spacing inside the brackets is ignored, so [ x] is done), and every other marker now reads as unfinished, across progress, the apply task list, archive's gate and validate's task-numbering check. The archive, bulk-archive and verify workflows now tell agents the same rule, so a hand-counted tally cannot disagree with the CLI, and the tasks instruction in the spec-driven schema states it where agents author the file. Markdown link bullets stay out of the count: - [Some doc](./doc.md) and the one-character - [A](https://example.com) are not tasks.

• #1701 92fb72d Thanks @​clay-good! - Agent-driven archive and sync workflows now create a missing main spec from ADDED requirements instead of treating it as already synced. They block sync rather than inventing MODIFIED or RENAMED requirements or writing an empty spec for a REMOVED-only delta, while preserving the user's explicit choice to archive without syncing. A REMOVED-only delta with retire_capabilities: true remains already synced when its main spec is gone. Fixes #1222 and #1264.

• #1804 a5bf5c6 Thanks @​dwin-gharibi! - Say so when a requirement in a delta sits outside every delta section. A well-formed ### Requirement: block written under ## Notes, under a misspelled header such as ## Add Requirements, or above the first ## header was dropped with no diagnostic: openspec validate reported the change valid and openspec archive exited 0 without applying it. openspec validate now reports each one as a WARNING naming the section and line, and archive prints the same warning. Nothing else changes: the block is still not applied, the verdict stays valid outside --strict, and requirements shown inside a code fence are not reported. Fixes #1803.

• #1832 4c369e0 Thanks @​clay-good! - Resolve the contradiction that left explore mode's capture branch without a governing rule. Explore states twice that the agent must ask a direct yes/no question and wait for confirmation in a separate user message before its first write-capable action, naming openspec new change as an example, while the capture branch tells the agent to transition "seamlessly" into running openspec new change and creating artifacts with no confirmation step. Both readings were defensible from the text, so the same "capture this as a change" request either wrote .openspec.yaml plus several artifacts immediately or stopped and asked, depending on which passage the agent weighed, which made the #1715 guarantee unenforceable in the one explore path that writes files. An explicit capture request is now stated to be that confirmation, covering the change and the artifacts the request names and nothing else. The guardrail keeps its teeth for the case #1715 actually reported: when the agent is the one proposing the capture, or when the work would go beyond the requested scope, it still asks first, and answers to design or clarifying questions are still never consent to write. Both explore delivery surfaces and the committed skill carry the same wording. Fixes #1828.

• #1788 62106f4 Thanks @​clay-good! - Name the workflow where explore hands off. Explore mode refuses to implement, but every place it said what to do instead described the next step as prose ("create a change proposal") without naming the workflow that does it: the refusal itself, the "flow into a proposal" ending, the closing summary, and the do-not-implement guardrail. Its seamless capture path was worse: it scaffolded a change, wrote artifacts, and then said nothing at all about what came next. With no named exit, agents finished the discovery questions and started writing code, which is the failure reported through GitHub Copilot in #869, and which the docs already promised would not happen ("when the picture is clear, it hands off to /opsx:propose").

  The explore skill and command now name /opsx:propose at all four prose handoffs, and the capture path ends by naming /opsx:propose for the remaining planning artifacts and /opsx:apply for implementation, with an explicit note that capturing artifacts is not permission to implement them. The references are written in the canonical /opsx:<id> form so each tool renders the invocation it actually registers (/openspec-propose for skills-only delivery, /opsx-propose, /opsx:propose, or @opsx-propose for command surfaces). The handoffs follow the installed workflow set: a custom profile without propose or apply gets explore's own capture path and the openspec instructions apply CLI instead of a command it never installed. Fixes #869.

• #1787 9827762 Thanks @​clay-good! - ### Bug Fixes

  • Generated skills and commands no longer adopt a project that never ran openspec init. Every workflow now checks root from openspec list --json before its first write, and "root": null means the project is not set up. What happens next depends on how the workflow was reached. A skill the agent picked on its own drops OpenSpec and answers the request normally, without asking about setup. A workflow the user asked for by name, or ran as a slash command, stops and asks whether to initialize the project, target a store, or handle the request without OpenSpec. A project whose openspec/config.yaml names a store this machine cannot resolve (not registered, or a malformed store: line) is not mistaken for an uninitialized one: the workflow stops and shows the store error. Neither path lets openspec new change create openspec/ in the current directory as a side effect. Skill descriptions now name OpenSpec so hosts stop offering these workflows in unrelated repositories. openspec new change also says when it had to create the root itself, so a directory that was never set up no longer picks up an openspec/ directory in silence (human output only; --json is unchanged).

• #1902 eb03b9e Thanks @​clay-good! - Harden the CLI against repositories you have cloned but not yet read (#1835).

  • A config.yaml value can no longer close the project context block and inject its own directives into the instructions an agent receives.
  • A crafted delta or skill file no longer stalls openspec update or openspec archive with catastrophic regex backtracking.
  • A repository's .npmrc can no longer point the update check at a cleartext or attacker-controlled registry; a rejected registry now disables the check instead of falling back.
  • openspec update now notices a generated SKILL.md that was edited by hand and restores it, instead of reporting every tool as up to date.
  • DO_NOT_TRACK=true and other common spellings of an opt-out now turn telemetry off, and nothing is sent until the first-run notice has been shown.
  • Shell-completion installs quote directory paths safely, git probes run with bounded time and output, and dependencies are cleared of known advisories.

• #1874 388d344 Thanks @​dwin-gharibi! - Stop legacy cleanup deleting the user's own files. The six pre-skills tools that kept their commands in a <tool>/commands/openspec/ folder (Claude Code, CodeBuddy, Qoder, Lingma, Crush and Gemini CLI) had that whole folder removed recursively whenever it existed, so a command the user kept there, such as a team review checklist, was deleted along with OpenSpec's files, and the summary named only the folder. Because openspec init cleans up automatically when there is no TTY, an agent or CI running plain openspec init did this without --force and without a prompt, and openspec update --force did the same. Cleanup now deletes only the files OpenSpec wrote there: proposal, apply and archive files that still carry the OpenSpec markers every legacy command was generated with, so a same-named file the user wrote is kept. It never follows a symlinked command folder, removes the folder only once nothing else is left in it, and lists each thing it kept. A folder holding nothing OpenSpec wrote is no longer reported as legacy at all. A folder holding only OpenSpec's files, or nothing, is still removed exactly as before, with the same summary line.

• #1866 8146be5 Thanks @​dwin-gharibi! - Stop one unresolvable file from breaking openspec list. To sort changes by recency, list stats every file inside each change, and any entry it could not stat failed the whole command: a dangling symlink, such as the .#tasks.md lock Emacs keeps beside every file with unsaved edits, or a symlink loop made list exit 1 and list --json report "changes": [], so agents discovering work through it saw no changes at all. An entry that no longer resolves (removed mid-walk, a dangling symlink, or a loop) is now skipped when computing a change's last-modified time. Valid symlinks are dated as before, and any other error, such as a permission failure, still fails the listing.

• #1849 09a999b Thanks @​clay-good! - Report a change directory nested in a namespace folder instead of silently listing the folder around it as a change. Specs can be nested by domain (specs/mobile/tutorial-videos/spec.md), so it looks reasonable to lay changes out the same way, but a change is only ever a directory directly under changes/: changes/mobile/refresh-token/ left the real change invisible while mobile was reported as a task-less change everywhere. openspec archive mobile then moved the unfinished change into the archive under the namespace's name and applied none of its deltas. openspec list now marks the folder not a change and names the nested directories and a flat alternative, openspec show, openspec status --change and openspec status --all say the same instead of reporting a missing proposal or a full artifact plan, openspec validate reports it instead of "must have at least one delta", openspec list --json carries a warnings entry, and openspec archive refuses the folder outright. Detection looks up to three directory levels below changes/, which covers every namespace layout seen in practice; a change buried deeper than that behaves as it did before. Fixes #1846.

• #1902 eb03b9e Thanks @​clay-good! - Install shell completions with the Nix flake package (#1785). The package now ships bash, zsh and fish completions in their standard share/ locations, so Nix users get tab completion without running openspec completion install against their home directory.

• #1775 626269e Thanks @​clay-good! - Generated skills and commands no longer point at workflows the active profile does not install. On the default core profile, the update workflow told agents to hand off to /opsx:continue for missing artifacts and to /opsx:new for a change of intent, neither of which core generates. Every cross-workflow handoff is now decided at generation time against the installed workflow set, and renders a concrete CLI fallback (openspec status, openspec instructions, openspec archive) when the workflow it would name is absent, rather than relying on a runtime availability check the agent had to perform. The onboarding tutorial's command tables are likewise built from the workflows you actually have.

  Also folds in #1735, which fixed the same issue (#1734) by removing the optional handoffs outright. The CLI's own runtime instructions no longer name the openspec-continue-change skill either, since those strings are chosen at run time and cannot be resolved against a profile; and the blocked-state fallback now carries the full CLI recovery (select the next ready artifact from openspec status, read its rules with openspec instructions, keep the selected --store) rather than a one-line pointer.

• #1870 e01ed07 Thanks @​dwin-gharibi! - Stop archiving a change whose delta was written somewhere archive never reads. validate and archive read a change's deltas only from specs/<capability-path>/spec.md, but the spec-driven artifact graph counts any markdown file under specs/ as the specs being written, so a delta at specs/user-auth.md, or in a second file beside a capability's spec.md, was reported done by status and ready by instructions apply with no warning, rejected by validate only as "no deltas found", and then archived with exit 0 and nothing merged into openspec/specs/. A markdown file that carries delta sections but is not a capability's spec.md is now a validation error naming the file and the spec.md its requirements belong in; archive runs that validation and refuses the change instead of archiving it unmerged, and instructions apply lists each such file in its warnings. --no-validate still archives as before, a change with no spec files still archives, and notes without delta sections under specs/ are not affected.

... (truncated)

Commits

• 634c557 Version Packages (#1896)
• eb03b9e chore(changeset): track #1835 security hardening and #1785 nix completions (#...
• 3312af4 fix(templates): open generated artifacts with a top-level heading (#1777)
• 5f5914e fix(skills): match natural "openspec <verb>" phrasing to its workflow (#1852)
• 9827762 fix(skills): stop workflows from adopting a project that never ran init (#1787)
• 11a9691 fix(tasks): count unrecognised checkbox markers as not done (#1773)
• 62106f4 fix(explore): name the propose workflow at every handoff (#1788)
• e67ac47 fix(bulk-archive): check the archive target before moving changeRoot (#1829)
• 605d9e7 fix(config): leave an unparseable global config untouched (#1876)
• 626269e fix(templates): stop generated skills naming workflows the profile omits (#1775)
• Additional commits viewable in compare view

Updates @inquirer/ansi from 2.0.7 to 2.0.8

Release notes

Sourced from @​inquirer/ansi's releases.

@​inquirer/figures@​2.0.8

No source changes. Bumped to keep in lockstep with the @inquirer/* release train.

Commits

• 5748bd9 chore: Publish new release
• 269ae73 fix: pin @​inquirer/type exactly in published manifests
• 927d6dd fix(@​inquirer/testing): keep keypress simulation working under TERM=dumb
• 2d813b1 chore(deps): Bump @​humanfs/node from 0.16.6 to 0.16.8 (#2245)
• 7affbc9 chore(deps-dev): Bump turbo from 2.10.9 to 2.10.11 in the build group (#2243)
• 56db989 chore(deps-dev): Bump oxfmt in the formatting group (#2242)
• 8e6bc3c chore(deps-dev): Bump the linting group with 2 updates (#2241)
• 427b7a1 chore(deps-dev): Bump the testing group with 3 updates (#2240)
• 51ac389 chore: Publish new release
• 0f1718e feat(@​inquirer/password): add ctrl+t toggle to reveal password
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​inquirer/ansi since your current version.

Updates @inquirer/core from 12.0.1 to 12.0.3

Release notes

Sourced from @​inquirer/core's releases.

@​inquirer/core@​12.0.3

What's new

• Fixed a race where keystrokes batched in the same tick as the key that settled a prompt could still reach useKeypress handlers after the prompt was done, cancelled, or aborted. Hook effects are now cleared in the synchronous settlement path (#2255, closes #1816).
• Prompts created with an already-aborted signal now run the terminal cleanup (restore the cursor, close the readline interface, end the output stream) instead of leaking them (#2255).

Commits

• cbdb34b chore: Publish new release
• 8340d2d fix(@​inquirer/core): clear hook effects before settling prompts
• 2475e07 test(@​inquirer/core): cover hook cleanup error semantics
• 15cd8d3 fix(confirm): ignore surrounding whitespace in answers
• 9cb0da6 chore(deps): Bump github/codeql-action/analyze from 4.37.7 to 4.37.9
• 1c750bc chore(deps-dev): Bump the build group with 3 updates (#2251)
• 81f1525 chore(deps-dev): Bump @​types/node in the types group (#2252)
• 7c27f26 chore(deps-dev): Bump oxfmt in the formatting group (#2249)
• 6119088 chore(deps): Bump github/codeql-action/init from 4.37.7 to 4.37.9 (#2250)
• 0d167c0 chore(deps-dev): Bump the linting group with 4 updates (#2248)
• Additional commits viewable in compare view

Updates @inquirer/figures from 2.0.8 to 2.0.9

Commits

• 5748bd9 chore: Publish new release
• 269ae73 fix: pin @​inquirer/type exactly in published manifests
• 927d6dd fix(@​inquirer/testing): keep keypress simulation working under TERM=dumb
• 2d813b1 chore(deps): Bump @​humanfs/node from 0.16.6 to 0.16.8 (#2245)
• 7affbc9 chore(deps-dev): Bump turbo from 2.10.9 to 2.10.11 in the build group (#2243)
• 56db989 chore(deps-dev): Bump oxfmt in the formatting group (#2242)
• 8e6bc3c chore(deps-dev): Bump the linting group with 2 updates (#2241)
• 427b7a1 chore(deps-dev): Bump the testing group with 3 updates (#2240)
• 51ac389 chore: Publish new release
• 0f1718e feat(@​inquirer/password): add ctrl+t toggle to reveal password
• Additional commits viewable in compare view

Updates @inquirer/prompts from 8.7.0 to 8.7.2

Release notes

Sourced from @​inquirer/prompts's releases.

@​inquirer/prompts@​8.7.2

What's new

• Fixed a race where keystrokes batched in the same tick as the key that settled a prompt could still reach keypress handlers after the prompt was done, cancelled, or aborted (@inquirer/core, #2255, closes #1816).
• confirm() now trims surrounding whitespace from answers before matching yes/no keywords (@inquirer/confirm, #2254).

Included

• @inquirer/checkbox@^5.2.5
• @inquirer/confirm@^6.3.2
• @inquirer/editor@^5.3.3
• @inquirer/expand@^5.1.5
• @inquirer/input@^5.1.6
• @inquirer/number@^4.2.3
• @inquirer/password@^5.2.2
• @inquirer/rawlist@^5.3.5
• @inquirer/search@^4.3.3
• @inquirer/select@^5.2.5

@​inquirer/prompts@​8.7.1

What's new

• All bundled prompts now pin @inquirer/type to an exact version in their published manifests. Since these type definitions leak into consumers' tsc runs, a semver range on the types-only dependency could break downstream TypeScript builds without any change to Inquirer.js itself (#2247, fixes #2244).

Included

• @inquirer/checkbox@^5.2.4
• @inquirer/confirm@^6.3.1
• @inquirer/editor@^5.3.2
• @inquirer/expand@^5.1.4
• @inquirer/input@^5.1.5
• @inquirer/number@^4.2.2
• @inquirer/password@^5.2.1
• @inquirer/rawlist@^5.3.4
• @inquirer/search@^4.3.2
• @inquirer/select@^5.2.4

Commits

• cbdb34b chore: Publish new release
• 8340d2d fix(@​inquirer/core): clear hook effects before settling prompts
• 2475e07 test(@​inquirer/core): cover hook cleanup error semantics
• 15cd8d3 fix(confirm): ignore surrounding whitespace in answers
• 9cb0da6 chore(deps): Bump github/codeql-action/analyze from 4.37.7 to 4.37.9
• 1c750bc chore(deps-dev): Bump the build group with 3 updates (#2251)
• 81f1525 chore(deps-dev): Bump @​types/node in the types group (#2252)
• 7c27f26 chore(deps-dev): Bump oxfmt in the formatting group (#2249)
• 6119088 chore(deps): Bump github/codeql-action/init from 4.37.7 to 4.37.9 (#2250)
• 0d167c0 chore(deps-dev): Bump the linting group with 4 updates (#2248)
• Additional commits viewable in compare view

Updates @inquirer/type from 4.1.0 to 4.1.1

Commits

• 5748bd9 chore: Publish new release
• 269ae73 fix: pin @​inquirer/type exactly in published manifests
• 927d6dd fix(@​inquirer/testing): keep keypress simulation working under TERM=dumb
• 2d813b1 chore(deps): Bump @​humanfs/node from 0.16.6 to 0.16.8 (#2245)
• 7affbc9 chore(deps-dev): Bump turbo from 2.10.9 to 2.10.11 in the build group (#2243)
• 56db989 chore(deps-dev): Bump oxfmt in the formatting group (#2242)
• 8e6bc3c chore(deps-dev): Bump the linting group with 2 updates (#2241)
• 427b7a1 chore(deps-dev): Bump the testing group with 3 updates (#2240)
• See full diff in compare view

Updates antd from 6.6.2 to 6.6.4

Release notes

Sourced from antd's releases.

6.6.4

• 🗑 Deprecate legacy Avatar GroupProps, BackTop and FloatButton BackTopProps, Input GroupProps, Mentions OptionProps, and Select OptionProps types in favor of GetProps or option-derived types. #58949 @​li-jia-nan
• 🐞 Fix AutoComplete missing classNames.clear and styles.clear semantic customizations for the clear button. #59245 @​lazerg
• Table
  • 🐞 Fix Table filteredValue being ignored when responsive columns are hidden. #59198 @​QDyanbing
  • 🐞 Fix Table ignoring pagination.classNames and pagination.styles semantic customizations. #59267 @​QDyanbing
  • 🐞 Fix Table virtual cell content not being vertically centered. #59260 @​QDyanbing
• Modal
  • 🐞 Fix Modal okText and cancelText falling back to default text for falsy ReactNode values. #59254 @​QDyanbing
  • 🐞 Fix Modal not triggering onCancel when cancelButtonProps.onClick is provided. #59255 @​QDyanbing
• ColorPicker
  • 🐞 Fix ColorPicker clear control remaining interactive and showing hover styles when disabled. #59164 @​dogledogle
  • 🐞 Fix ColorPicker modifying presets and crashing when preset items are frozen. #59272 @​QDyanbing
• 🐞 Fix Splitter panel sizes exceeding their min and max constraints when the container resizes. #59084 @​QDyanbing
• 🐞 Fix Segmented selected item text color lagging behind the thumb animation when custom itemSelectedBg and itemSelectedColor tokens are used. #59046 @​EmilyyyLiu
• 🐞 Fix Transfer restoring stale selections after dataSource item key types change. #59166 @​QDyanbing
• 🐞 Fix FloatButton.Group menu flickering when moving the pointer from the trigger to the menu with trigger="hover". #59246 @​QDyanbing
• 🐞 Fix Form vertical Form.Item controls shrinking inside horizontal layouts. #59263 @​QDyanbing
• 🐞 Fix Tabs more dropdown ignoring styles.popup.root. #59221 @​giaBaoJS
• 🐞 Fix ConfigProvider failing to inherit zeroRuntime in nested themes when inherit is false. #59250 @​QDyanbing

---

• 🗑 废弃 Avatar GroupProps、BackTop 和 FloatButton BackTopProps、Input GroupProps、Mentions OptionProps 与 Select OptionProps 旧类型，建议改用 GetProps 或从选项推导的类型。#58949 @​li-jia-nan
• 🐞 修复 AutoComplete 缺失清除按钮 classNames.clear 和 styles.clear 语义化配置的问题。#59245 @​lazerg
• Table
  • 🐞 修复 Table 响应式列隐藏后 filteredValue 失效的问题。#59198 @​QDyanbing
  • 🐞 修复 Table 忽略 pagination.classNames 和 pagination.styles 语义化配置的问题。#59267 @​QDyanbing
  • 🐞 修复 Table 虚拟滚动单元格内容未垂直居中的问题。#59260 @​QDyanbing
• Modal
  • 🐞 修复 Modal 的 okText 和 cancelText 为假值 ReactNode 时被默认文案覆盖的问题。#59254 @​QDyanbing
  • 🐞 修复 Modal 配置 cancelButtonProps.onClick 时不触发 onCancel 的问题。#59255 @​QDyanbing
• ColorPicker
  • 🐞 修复 ColorPicker 禁用时清除控件仍可交互并显示悬浮样式的问题。#59164 @​dogledogle
  • 🐞 修复 ColorPicker 修改 presets 并在预设项被冻结时崩溃的问题。#59272 @​QDyanbing
• 🐞 修复 Splitter 容器尺寸变化时面板尺寸超出 min 和 max 约束的问题。#59084 @​QDyanbing
• 🐞 修复 Segmented 使用自定义 itemSelectedBg 和 itemSelectedColor Token 时，选中项文字颜色滞后于滑块动画的问题。#59046 @​EmilyyyLiu
• 🐞 修复 Transfer 的 dataSource 项 key 类型变化后恢复旧选中状态的问题。#59166 @​QDyanbing
• 🐞 修复 FloatButton.Group 使用 trigger="hover" 时鼠标从触发按钮移向菜单出现闪烁的问题。#59246 @​QDyanbing
• 🐞 修复 Form 在水平布局中嵌套的垂直 Form.Item 控件高度被压缩的问题。#59263 @​QDyanbing
• 🐞 修复 Tabs 折叠下拉菜单未应用 styles.popup.root 的问题。#59221 @​giaBaoJS
• 🐞 修复 ConfigProvider 在嵌套主题中 inherit 为 false 时未继承 zeroRuntime 的问题。#59250 @​QDyanbing

6.6.3

• 🐞 Fix DatePicker and TimePicker rendering issues when prefix, suffixIcon, allowClear.clearIcon, or the value returned by renderExtraFooter is 0. #59212 react-component/picker#1009 @​github-actions @​QDyanbing
• 🐞 Fix Modal and Drawer mask click closing behavior when reusing a mask configuration object. #59233 @​giaBaoJS
• 🤖 Fix Select, AutoComplete, Cascader, and TreeSelect popupRender types to accept ReactElement and return ReactNode. #59207 @​QDyanbing
• DatePicker
  • 🇩🇪 Fix DatePicker using incorrect default date and date-time formats with the German locale, using DD.MM.YYYY and DD.MM.YYYY HH:mm:ss respectively. #59151 @​nrps9909
  • 🐞 Fix DatePicker popup closing unexpectedly when navigating to the month boundary set by minDate or maxDate. #59212 react-component/picker#1012 @​github-actions @​zombieJ
  • 🐞 Fix DatePicker.RangePicker losing the pending date selection highlight when hovering over another date with showTime enabled. #59212 react-component/picker#1010 @​github-actions @​zombieJ
  • 🌐 Add missing DatePicker year, quarter, month, week, and range placeholders in 32 locales. #59219 @​stop1love1

... (truncated)

Changelog

Sourced from antd's changelog.

6.6.4

2026-09-14

• 🗑 Deprecate legacy Avatar GroupProps, BackTop and FloatButton BackTopProps, Input GroupProps, Mentions OptionProps, and Select OptionProps types in favor of GetProps or option-derived types. #58949 @​li-jia-nan
• 🐞 Fix AutoComplete missing classNames.clear and styles.clear semantic customizations for the clear button. #59245 @​lazerg
• Table
  • 🐞 Fix Table filteredValue being ignored when responsive columns are hidden. #59198 @​QDyanbing
  • 🐞 Fix Table ignoring pagination.classNames and pagination.styles semantic customizations. #59267 @​QDyanbing
  • 🐞 Fix Table virtual cell content not being vertically centered. #59260 @​QDyanbing
• Modal
  • 🐞 Fix Modal okText and cancelText falling back to default text for falsy ReactNode values.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 6f925188-2632-491b-aa3a-964a99d3db03

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

👋 Thanks for opening your first PR to Comet, @dependabot[bot].

Before review, please make sure the PR title follows Conventional Commits, for example fix: handle project-scope init, and that the checklist in the PR template is up to date.

🧪 The most useful local checks are:

pnpm build
pnpm lint
pnpm format:check
pnpm test

🧰 If your change touches assets/skills/comet/scripts/, please also check script portability across macOS, Linux, and Windows Git Bash. Avoid sed -i, support both sha256sum and shasum -a 256, and guard optional grep pipelines with || true.

✨ We appreciate the contribution and will take a look as soon as we can.

[github-actions]

PR template needs attention

Please update this PR to match the current .github/PULL_REQUEST_TEMPLATE.md:

• Missing template section: ## ✨ Summary
• Missing template section: ## 🎯 Scope
• Missing template section: ## 🧪 Testing
• Missing template section: ## ✅ Checklist
• Missing template section: ## 👀 Notes for Reviewers
• Missing template item: CLI commands (init, status, doctor, update)
• Missing template item: Core installer / platform detection
• Missing template item: Comet skills (assets/skills/, assets/skills-zh/)
• Missing template item: Comet shell scripts (assets/skills/comet/scripts/)
• Missing template item: Tests / CI
• Missing template item: Documentation / changelog
• Missing template item: Other:
• Missing template item: pnpm build
• Missing template item: pnpm lint
• Missing template item: pnpm run lint:architecture
• Missing template item: pnpm format:check
• Missing template item: pnpm test
• Missing template item: pnpm test -- test/domains/comet-classic/comet-scripts.test.ts
• Missing template item: Not run:
• Missing template item: PR title follows Conventional Commits, for example fix: handle project-scope init
• Missing template item: User-facing behavior is documented in README.md, README-zh.md, or CONTRIBUTING.md
• Missing template item: CHANGELOG.md is updated when behavior changes
• Missing template item: Skill changes were made in Chinese first when applicable, then synced to English
• Missing template item: New scripts are included in assets/manifest.json and relevant tests
• Missing template item: Shell scripts remain portable across macOS, Linux, and Windows Git Bash
• Missing template item: No unrelated generated files or local artifacts are included
• Checklist item is not checked: PR title follows Conventional Commits, for example fix: handle project-scope init
• Checklist item is not checked: User-facing behavior is documented in README.md, README-zh.md, or CONTRIBUTING.md
• Checklist item is not checked: CHANGELOG.md is updated when behavior changes
• Checklist item is not checked: Skill changes were made in Chinese first when applicable, then synced to English
• Checklist item is not checked: New scripts are included in assets/manifest.json and relevant tests
• Checklist item is not checked: Shell scripts remain portable across macOS, Linux, and Windows Git Bash
• Checklist item is not checked: No unrelated generated files or local artifacts are included