fix(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
@commitlint/cli (source)	^21.2.2 → ^21.2.3			devDependencies	patch
@commitlint/config-conventional (source)	^21.2.2 → ^21.2.3			devDependencies	patch
@commitlint/types (source)	^21.2.0 → ^21.2.3			devDependencies	patch
aqua:jdx/usage	6.9.1 → 6.10.0			tools	minor
pi-web-access	0.29.0 → 0.30.0			dependencies	minor

---

Release Notes

conventional-changelog/commitlint (@​commitlint/cli)

v21.2.3

Compare Source

Bug Fixes

• lint: trim trailing whitespace off the message handed to ignore matchers (#​4960) (a6f279b)

conventional-changelog/commitlint (@​commitlint/config-conventional)

v21.2.3

Compare Source

Bug Fixes

• rules: report the case that matched in case rule failure messages (#​4962) (9f5f7bc)

conventional-changelog/commitlint (@​commitlint/types)

v21.2.3

Compare Source

Bug Fixes

• types: correct breaking-change-exclamation-mark rule config type (#​4954) (66f0ffb)
• update vitest monorepo to v5 (#​4992) (91fb534), closes vitest-dev/vitest#10222 vitest-dev/vitest#10460 vitest-dev/vitest#10449

jdx/usage (aqua:jdx/usage)

v6.10.0

Compare Source

🚀 Features

• (go) generate explicitly typed CLI fields by @​zeitlinger in #​1441
• (help) mark the default subcommand and opt in to appending its page by @​lu-zero in #​1424
• (parse) render Go help and version requests by @​zeitlinger in #​1439
• (spec) expand environment variables in include paths by @​jdx in #​1446

🐛 Bug Fixes

• (cli) migrate to rmcp 3.4 server config by @​jdx in #​1448
• (complete) preserve the full Go help-topic command chain by @​zeitlinger in #​1440
• (help) drop repeated global flags from the appended default-subcommand page by @​lu-zero in #​1436
• (parse) suggest -- when a refused flag could have been a value by @​jdx in #​1430
• (parse) return help and version requests from generated Go parsers by @​zeitlinger in #​1437
• (spec) give a string-parsed spec its source by @​jdx in #​1443
• (spec) log include resolution at debug level by @​jdx in #​1444

🛡️ Security

• (deps) update dependency aube to latest by @​renovate[bot] in #​1433
• (deps) update node.js to 24 by @​renovate[bot] in #​1434
• stop clipping the GitHub star count in the nav overflow menu by @​jdx in #​1429
• add entire trail runners by @​jdx in #​1445

🔍 Other Changes

• remove entire and codex agent hooks by @​jdx in 5a9da44
• refresh aube-lock workflow pin by @​jdx in #​1447

📦️ Dependency Updates

• bump mbx to 1.11.1 by @​jdx in 8f406f0
• update dependency github:jdx/tak to v0.0.10 by @​renovate[bot] in #​1431
• update dependency cargo-binstall to v1.23.0 by @​renovate[bot] in #​1432
• update dependency hk to latest by @​renovate[bot] in #​1435

nicobailon/pi-web-access (pi-web-access)

v0.30.0

Compare Source

Highlights

• Start installed copies of Pi Web Access much faster with a precompiled bundle.
• Use standalone OpenAI search or reuse an existing Pi provider URL without duplicating gateway configuration.
• Control which search providers and fetch modes are available.
• Search Google through the new explicit Serply provider.
• Get more reliable proxy handling, OpenCode requests, PDF answers, source checks, and stored-content retrieval.

Added

• Added opt-in openaiUseProviderBaseUrl to reuse a selected Pi provider's URL and credentials for OpenAI search. An explicit openaiResponsesUrl still takes precedence.
• Added opt-in openaiUseAlphaSearch for standalone OpenAI search, with source limits, recency filtering, allowed-domain filtering, and normal provider fallback. Existing Responses search remains the default. Thanks to @​ZacharyQin for PR #​420.
• Added fetch.defaultMode and fetch.allowedModes for choosing the default fetch_content mode and disabling unwanted modes. Thanks to @​Slooz for #​395.
• Added webSearch.allowedProviders to restrict providers consistently across search, source checks, routing, aggregation, schemas, and Curator. Thanks to @​Slooz for #​396.
• Added an explicit-only Serply Google Search provider with domain filtering, recency filtering, routing, and Curator support. Configure it with serplyApiKey or SERPLY_API_KEY. Thanks to Serply vendor @​googio for PR #​386.

Changed

• Published packages now load a precompiled bundle for faster startup, while source checkouts continue loading TypeScript directly. Thanks to @​Yisus423 for issue #​418 and PR #​419.
• Fresh installs now use the silent none web search workflow by default. Explicit and configured Curator or summary workflows are unchanged. Thanks to @​ducaoya for issue #​416.

Fixed

• Preserve legacy ~/.pi/web-search.json configuration when ~/.pi/agent/web-search.json is absent in default environments without XDG_CONFIG_HOME. Thanks to @​fancyboi999 for issue #​411.
• List Crawl4AI in the README provider summary and the package description, which both still omitted it after the provider shipped in 0.29.0. Thanks to @​bergheim for PR #​382.
• Removed the unconditional global fetch replacement during extension initialization; proxy transport is now installed lazily when a proxied web-tool operation runs. Thanks to @​AdrianJ20 for issue #​388.
• Send OpenCode session attribution headers when generating summaries, preventing configured opencode and opencode-go summary models from silently falling through to another candidate. Thanks to @​damozhang for issue #​385.
• Send the x-opencode-session / x-opencode-client attribution headers when fetch_content answer mode uses an opencode or opencode-go model. The answer path dispatches through the model registry, which bypasses the attribution headers Pi merges in the main agent loop, so those requests were rejected with 400 MissingSessionID. Thanks to @​MrSerious0 for PR #​381.
• Pass extracted PDF Markdown to fetch_content answer mode instead of the saved-file notice, while preserving readable-mode file output and stored-content retrieval. Thanks to @​MDGChamomile for PR #​390.
• Prevent malformed fetch_content auth, mode, or proxy parameters from breaking tool-call rendering while preserving strict execution validation. Thanks to @​tekumara for issue #​387.
• Clarified that a negative fetch_content answer-mode result means the answer was not found in the extracted content, rather than asserting that it is absent from the whole page. Thanks to @​Slooz for issue #​394.
• Stop inferring claim support or contradiction from unrelated lexical markers in source_check; retrieved passages now require manual semantic review. Thanks to @​wayenchan for issue #​383.
• Return bounded get_search_content excerpts instead of dropping oversized merged match ranges, using compact query IDs to reserve representative ranges when discovered spans fit the output budget. Thanks to @​MDGChamomile for PR #​391.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.