chore(deps-dev): bump the dev-dependencies group with 4 updates

[dependabot]

Bumps the dev-dependencies group with 4 updates: @fission-ai/openspec, @types/node, fast-check and memfs.

Updates @fission-ai/openspec from 1.12.0 to 1.13.0

Release notes

Sourced from @​fission-ai/openspec's releases.

v1.13.0 - Apply warnings, safer archives

What's New in v1.13.0

Archive and the delta parser stop quietly changing or dropping what you wrote, and apply now tells you when a change has no specs.

New

• Apply flags a change with no delta specs - openspec instructions apply used to report a change as ready whenever its tasks existed, even with no spec deltas at all, which is the state openspec validate rejects. It now warns in both text and --json, and names both ways out: write the specs, or declare skip_specs: true.

Improved

• Explore finds your existing specs - Generated guidance never named openspec list --specs, so an agent asked to read the current specs enumerated in-flight changes instead and reported the step done against the wrong thing. Explore now lists the spec inventory beside the change list, and reads a capability with the store-aware command.
• Init and update name the workflows your profile left out - A /opsx: command that was never installed used to read as a broken setup. Both commands now say which workflows are missing and how to add them.
• Propose reads project context before planning - Context is loaded from the selected project or store root before any planning decision. In a directory with no OpenSpec root, propose stops without writing and offers to initialize rather than creating one silently.

Fixed

• Archive no longer edits your fenced code - A requirement documenting a sample with two or more blank lines in a row had that sample rewritten on every archive. Blank-line tidying is now fence-aware, which matters for YAML, Python, and expected-output fixtures.
• Removals and renames written with * or + now take effect - CommonMark allows all three bullet markers, but only - was read. A removal or rename written the other way matched nothing: validate passed, archive exited 0 reporting success, and the requirement stayed exactly as it was.
• Every delta section applies, not just one copy - A file with two ## ADDED Requirements sections silently kept one of them, so archive applied less than was written and moved the change to the archive anyway. You do not have to repeat a header deliberately to hit this: a delta documenting OpenSpec's own syntax inside a fenced example produces the duplicate on its own.
• Capabilities whose bullets wrap can be retired again - retire_capabilities refused any spec whose scenario bullets ran onto a second line, which is most of them in a repo that wraps prose at a column limit. Specs bulleted with + are covered too.
• Update repairs damaged command files - openspec update decided a tool was current from its skill files alone, so a hand-edited or truncated command file left it printing "All 1 tool(s) up to date" and repairing nothing. It now compares command-file content as well.

New Contributors

• @​dwin-gharibi made their first contribution in Fission-AI/OpenSpec#1800

Full Changelog: Fission-AI/OpenSpec@v1.12.0...v1.13.0

Changelog

Sourced from @​fission-ai/openspec's changelog.

1.13.0

Minor Changes

• #1783 8ba4ac1 Thanks @​clay-good! - Apply now says when a change has no delta specs. Apply gates on the schema's apply.requires alone, so a change whose tasks.md was written ahead of its specs read as ready to implement even though it had no spec deltas at all — the state openspec validate rejects. openspec instructions apply now reports that gap as a warning (text and --json), naming both ways out: write the specs, or declare skip_specs: true. Changes that have specs, declare skip_specs, or are still blocked on their own required artifacts are unaffected.

  A blocked apply also names the whole chain now, not just the first hop: a change holding only a proposal reported Missing artifacts: tasks while the specs that tasks depends on were missing too, which reads as an instruction to write the tracking file straight from the proposal. The full build order is reported as missingPrerequisites in --json. The remedies these messages give are CLI commands (openspec instructions <artifact> --change <name>) rather than the openspec-continue-change skill, which the core profile never installs.

Patch Changes

• #1798 aedf4d0 Thanks @​dwin-gharibi! - Stop archive rewriting the inside of fenced code blocks. The final assembly in buildUpdatedSpec collapsed runs of blank lines across the whole rebuilt document to tidy the seams between the slices it rejoins, but the pass was not fence-aware, so a requirement documenting a sample with two or more consecutive blank lines had that sample silently edited on archive, and edited again on every later archive. That matters wherever whitespace carries meaning: YAML block scalars, Python, expected-output fixtures, Markdown inside Markdown. Blank runs are now collapsed only outside fenced blocks, using the same buildCodeFenceMask every other structural pass in the module already used. Behavior outside fences is unchanged, including that only a truly empty line counts as blank, so a line of spaces is still never a collapse boundary. Fixes #1797.

• #1800 fadac3e Thanks @​dwin-gharibi! - Read a removal or rename written with * or + as the operation it is. CommonMark opens a bullet list with -, * or +, but the bullet form of ## REMOVED Requirements and the FROM:/TO: lines of ## RENAMED Requirements both hardcoded -, so either other marker matched nothing at all. The operation then silently never happened: openspec validate reported the change valid, openspec archive exited 0 with "Specs updated successfully", and the requirement that was supposed to be deleted or renamed stayed exactly as it was. The change archived as complete, leaving the spec quietly disagreeing with the delta that was meant to update it. Both forms now accept [-*+], the FROM:/TO: bullet stays optional, and the plain ### Requirement: header form is unchanged. Fixes #1799.

• #1802 8251763 Thanks @​dwin-gharibi! - Apply every delta section, not just one copy of each. A delta file that wrote the same header twice, two ## ADDED Requirements sections say, silently kept one of them: sections were collected into a record keyed by title, so a repeated title overwrote the earlier body, and the case-insensitive lookup returned only the first entry that folded to the target, so ## ADDED Requirements beside ## Added Requirements left the second unread. Every requirement under the discarded copy was gone before validation or the merge could see it, so openspec validate reported zero issues and openspec archive exited 0 having applied less than the author wrote, then moved the change to the archive with the live spec quietly diverging from what was reviewed. Sections are now kept as a list and every body whose title matches is read, each keeping its own line numbers so diagnostics still point at the right copy. Rename pairs are read per section, so a FROM: in one copy of the header can never pair with a TO: in another. An author does not have to repeat a header on purpose to hit this: a delta documenting OpenSpec's own syntax inside a fenced example produces the duplicate on its own. Fixes #1801.

• #1657 6d2dbe6 Thanks @​clay-good! - Load project context before proposal planning, using the selected project or store root and honoring config precedence and validation limits. When no root exists, stop without writing files and offer initialization instead of creating an implicit root.

• #1700 3915db7 Thanks @​clay-good! - Teach the generated guidance how to find and read a project's specs. openspec list --specs appeared in no generated skill, command, or artifact instruction, while openspec list --json (the in-flight change list) appeared throughout, so an agent asked to read the existing specs first enumerated changes instead and reported the step complete against the wrong object. The explore skill and command now list the spec inventory alongside the change list and say which is which, and the spec-driven proposal and specs instructions name the command where they ask for existing capabilities to be researched and for a delta's path to match an existing one. Both steps carry --store "<id>", and capabilities are read with openspec show "<spec-id>" --type spec --json --no-scenarios so the read resolves against the same root the listing came from. Fixes #1689.

  The filtered read is only an overview. Agents read relevant specs in full, including scenarios, before deciding what is already covered or what should change.

• #1779 3c6d318 Thanks @​clay-good! - openspec init and openspec update now name the workflows your profile left out and how to add them, so a command that was never installed no longer reads as a broken setup.

• #1808 d9e1a28 Thanks @​dwin-gharibi! - Stop openspec update reporting a tool up to date while a damaged command file sits on disk. The check read the generatedBy version marker in a tool's skill files alone, which proves only that the skill files came from this CLI and says nothing about the command files written beside them, so a hand-edited or truncated command file left update printing "All 1 tool(s) up to date" and repairing nothing; the file could be restored only by knowing to pass --force. A deleted command file was already detected, so the claim was false only for a damaged one. Update now also compares command-file content, using the comparison that already existed and was simply never consulted once a skill file supplied a version. Scoped to tools configured for both skills and commands, so the commands-only path is unchanged, and skipped when the delivery mode generates no commands for the tool. Fixes #1807.

• #1782 c170dc7 Thanks @​clay-good! - Fix retire_capabilities refusing any spec whose scenario bullets wrap onto a second line. The continuation line was counted as content the merge could not account for, which blocked the retirement and suppressed the hint that names the marker (#1780). A spec bulleted with + is covered too: naming only - and * as list markers reported every one of its scenario bullets as unaccounted content, so that capability could not be retired at all either.

Commits

• 9d4e597 Version Packages (#1822)
• e4e112d chore(deps): declare pnpm overrides only in pnpm-workspace.yaml (#1816)
• aedf4d0 fix(archive): preserve blank lines inside code fences (#1798)
• d9e1a28 fix(update): refresh generated files that drifted (#1808)
• 8251763 fix(parser): apply every delta section header (#1802)
• fadac3e fix(parser): accept all CommonMark list markers in deltas (#1800)
• 3915db7 fix(guidance): teach the spec-inventory verb to generated guidance (#1700)
• c170dc7 fix(archive): read a wrapped scenario bullet as one bullet (#1782)
• 8ba4ac1 fix(apply): warn when a change is ready to implement with no specs (#1783)
• 3c6d318 fix(init): name the workflows the profile left out (#1779)
• Additional commits viewable in compare view

Updates @types/node from 26.5.0 to 26.5.1

Commits

• See full diff in compare view

Updates fast-check from 4.9.0 to 4.10.0

Release notes

Sourced from fast-check's releases.

New plugin API and deprecations ahead of v5

[Code][Diff]

Features

• (PR#7216) Introduce a plugin API
• (PR#7221) Refine plugin API
• (PR#7222) Add ability to configure plugins globally
• (PR#7224) Add the beforeEach plugin to hook in life-cycle
• (PR#7227) Create an afterEach plugin
• (PR#7232) Deprecate life-cycle methods
• (PR#7235) Support teardown of beforeEach plugin
• (PR#7228) Add timeout plugin to stop long running predicates
• (PR#7237) Deprecate timeout from parameters
• (PR#7238) Pass a store to plugins
• (PR#7239) Add extra plugin's method called onAllRunsComplete
• (PR#7240) Deprecate reporter and asyncReporter from parameters
• (PR#7229) Add plugin to interrupt after time limit
• (PR#7245) Support failOnInterrupt on the plugin
• (PR#7230) Add plugins to drop runs on already covered cases
• (PR#7259) Add ability to decorate generate via Plugins
• (PR#7231) Add the unbiased plugin to generate without bias
• (PR#7260) Deprecate parameters superseded by plugins
• (PR#7261) Deprecate v5 removals

Fixes

• (PR#7225) Bug: Proper ordering between plugins
• (PR#7127) CI: Announce on Bluesky when drafting the release
• (PR#7217) CI: Dedupe packages for pnpm
• (PR#7137) Doc: Release note for 4.9.0
• (PR#7226) Doc: Fix admonition titles on the website
• (PR#7246) Doc: Add jkomyno as code contributor
• (PR#7251) Performance: Single timer for interruptAfterTimeLimit

---

Changelog

Sourced from fast-check's changelog.

4.10.0

New plugin API and deprecations ahead of v5 [Code][Diff]

Features

• (PR#7216) Introduce a plugin API
• (PR#7221) Refine plugin API
• (PR#7222) Add ability to configure plugins globally
• (PR#7224) Add the beforeEach plugin to hook in life-cycle
• (PR#7227) Create an afterEach plugin
• (PR#7232) Deprecate life-cycle methods
• (PR#7235) Support teardown of beforeEach plugin
• (PR#7228) Add timeout plugin to stop long running predicates
• (PR#7237) Deprecate timeout from parameters
• (PR#7238) Pass a store to plugins
• (PR#7239) Add extra plugin's method called onAllRunsComplete
• (PR#7240) Deprecate reporter and asyncReporter from parameters
• (PR#7229) Add plugin to interrupt after time limit
• (PR#7245) Support failOnInterrupt on the plugin
• (PR#7230) Add plugins to drop runs on already covered cases
• (PR#7259) Add ability to decorate generate via Plugins
• (PR#7231) Add the unbiased plugin to generate without bias
• (PR#7260) Deprecate parameters superseded by plugins
• (PR#7261) Deprecate v5 removals

Fixes

• (PR#7225) Bug: Proper ordering between plugins
• (PR#7127) CI: Announce on Bluesky when drafting the release
• (PR#7217) CI: Dedupe packages for pnpm
• (PR#7137) Doc: Release note for 4.9.0
• (PR#7226) Doc: Fix admonition titles on the website
• (PR#7246) Doc: Add jkomyno as code contributor
• (PR#7251) Performance: Single timer for interruptAfterTimeLimit

---

Commits

• 4fba17d 🔖 Update CHANGELOG.md for fast-check@4.10.0, @​fast-check/jest@​2.3.0, @​fast-ch...
• a433d8b ⬆️ Update dependency @​types/node to ^24.13.4 (#7263)
• 8470c46 ⬆️ Update dependency @​microsoft/api-extractor to ^7.59.1 (#7255)
• 5382221 🗑️ Deprecate v5 removals (#7261)
• 3cc3696 🗑️ Deprecate parameters superseded by plugins (#7260)
• a93374d ✨ Add the unbiased plugin to generate without bias (#7231)
• 0f1bf99 ✨ Add ability to decorate generate via Plugins (#7259)
• 917a447 ✨ Add plugins to drop runs on already covered cases (#7230)
• 32daf74 ⚡️ Single timer for interruptAfterTimeLimit (#7251)
• 485f337 👥 Add jkomyno as code contributor (#7246)
• Additional commits viewable in compare view

Updates memfs from 4.71.0 to 4.75.0

Release notes

Sourced from memfs's releases.

Release v4.75.0

What's Changed

• feat: 🎸 improve error formatting and normalization, dedupe validators by @​streamich in streamich/memfs#1291

Full Changelog: streamich/memfs@v4.74.0...v4.75.0

Release v4.74.0

What's Changed

• feat: 🎸 improve flags validation errors by @​streamich in streamich/memfs#1290

Full Changelog: streamich/memfs@v4.73.0...v4.74.0

Release v4.73.0

What's Changed

• feat: 🎸 improve read/write path by @​streamich in streamich/memfs#1289

Full Changelog: streamich/memfs@v4.72.2...v4.73.0

Release v4.72.2

What's Changed

• fix(memfs): resolve relative streams from virtual cwd by @​xianjianlf2 in streamich/memfs#1271

Full Changelog: streamich/memfs@v4.72.1...v4.72.2

Release v4.72.1

What's Changed

• fix(fs-node): finish BYOB file stream reads at EOF by @​xianjianlf2 in streamich/memfs#1285

Full Changelog: streamich/memfs@v4.72.0...v4.72.1

Release v4.72.0

What's Changed

• feat: 🎸 improve path validation errors by @​streamich in streamich/memfs#1288

Full Changelog: streamich/memfs@v4.71.1...v4.72.0

Release v4.71.1

What's Changed

• fix(fs-node): match Node directory iteration lifecycle by @​xianjianlf2 in streamich/memfs#1284

Full Changelog: streamich/memfs@v4.71.0...v4.71.1

Commits

• ee154d9 chore: release v4.75.0
• 348a32e Merge pull request #1291 from streamich/dedupe-errors
• 3c736f9 style: 💄 remove redundant constant
• e4053a7 feat: 🎸 improve error formatting and normalization, dedupe validators
• cf63bb7 chore: release v4.74.0
• 91354b9 Merge pull request #1290 from streamich/fix/arg-validation
• 6936f27 style: 💄 run Prettier
• 38ed5d6 Merge remote-tracking branch 'origin/master' into fix/arg-validation
• 491238d feat: 🎸 improve flags validation errors
• 2c6ae99 chore: release v4.73.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions