chore(deps): update all dependencies

[gw0-bot]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
@anthropic-ai/claude-code	2.1.260 → 2.1.263				patch
docker.io/oven/bun	1.4.1-slim → 1.4.2-slim			final	patch
https://github.com/AZidan/codemap	120d018 → e072687				digest
mvdan/sh	3.14.0 → 3.14.1				patch
renovatebot/github-action	v46.2.5 → v46.2.6			action	patch
rtk-ai/rtk	0.47.0 → 0.48.0				minor
sickn33/agentic-awesome-skills	16.7.0 → 16.9.1				minor

---

Release Notes

anthropics/claude-code (@​anthropic-ai/claude-code)

v2.1.263

Compare Source

• Bug fixes and reliability improvements

v2.1.261

Compare Source

• Added an "Organization policy" line to /status and claude doctor that says why your organization's policy could not be loaded, such as a proxy not passing the endpoint through
• Added bashOutputMaxChars and taskOutputMaxChars settings to raise how much command and background-task output Claude receives inline before it is saved to a file, up to 128K characters
• Added --append-subagent-system-prompt-file to read the subagent system prompt from a file, for prompts too large to pass on the command line
• Added /skill-doctor to show which loaded skills go unused and what they cost in context, so you can prune them
• Fixed typed or pasted characters occasionally landing out of order or being dropped during fast input or key repeat
• Fixed /add-dir <subdirectory> printing a false "couldn't be resolved" error when the working directory is on a /net automount
• Fixed the Bedrock setup wizard hanging when AWS or an AWS credential helper never responds (it now times out with a clear error), and its model checks failing behind a TLS-inspecting proxy
• Fixed cloud sessions discarding a plugin synced from claude.ai when managed settings force-enable it in enabledPlugins, then falling back to a marketplace clone that could fail
• Fixed being unable to delete the character immediately before an inline [Image #N] chip in the prompt input
• Fixed resuming a session losing hook output and other context around parallel tool calls, which changed the resumed request
• Fixed Remote Control showing a stale permission mode when a phone, browser, or claude.ai app attaches to a terminal session or after the mode changes in the terminal
• Fixed Remote Control sessions showing as still working (stuck spinner and Stop button) after stopping a turn from a connected phone or browser, or after a local slash command like /clear
• Fixed SDK and cloud sessions ignoring a Stop or interrupt sent just after the first prompt, before the turn had started; the turn now stops instead of running to completion
• Fixed Remote Control uploading a session pulled with /teleport into the connected session, which appeared appended to the original on phone and web
• Fixed Remote Control's inbound event stream failing behind TLS-inspecting corporate proxies on native Windows
• Fixed Remote Control sessions showing the default effort level on claude.ai when the effort comes from settings
• Fixed gcpAuthRefresh opening a browser at startup when the Google credential check was slow, even though the credential was still valid
• Fixed claude.ai connectors staying absent for the whole session when the startup connector fetch timed out — the CLI now retries in the background
• Fixed sustained high CPU usage when a background agent could not be resumed and its wake-up was retried in a tight loop
• Fixed feature flags gated to a newer version occasionally applying to an older Claude Code version running on the same machine
• Fixed /usage and the VS Code usage panel dropping a model-specific weekly limit row when the usage endpoint is rate limited or when opened right after startup
• Fixed claude -p --resume <file> adopting a malformed session ID recorded in the transcript; it now resumes under a fresh session ID instead
• Fixed the terminal progress indicator (iTerm2, Ghostty, ConEmu) showing the session as finished while a background workflow or agent was still running
• Fixed a rare layout glitch where a box could render with the wrong height after its container switched between row and column direction
• Fixed Claude apps gateway client IP when a trusted proxy appends a port to X-Forwarded-For; with an access list set, an unreadable entry now gets 403
• Fixed Claude apps gateway telling Claude Desktop to export OpenTelemetry as JSON even when the terminal CLI uses protobuf, so protobuf-only collectors rejected Desktop's data
• Fixed Desktop and web showing a session as busy while it only watches an artifact for updates
• Fixed Claude in Chrome file_upload failing with "paths: expected array, received undefined" in local Cowork sessions run from the Claude Desktop app
• Fixed SendMessage to an offline Remote Control session on another machine reading as delivered; the result now says delivery is queued until that machine reconnects
• Fixed plugin install hints from CLIs run in background Bash commands: they are now detected, and the raw <claude-code-hint> tag no longer leaks into the conversation
• Fixed in-process agent-team teammates re-sending their first-turn tool and skill announcements on the second turn, which changed the request prefix and missed the prompt cache
• Improved the /model picker and the VS Code model pill to show a model's name instead of its raw Bedrock, Vertex AI, or LLM gateway ID when Claude Code recognizes it
• Improved startup on Google Vertex AI when GOOGLE_APPLICATION_CREDENTIALS is set: API client creation no longer re-runs Google Cloud project discovery or spawns extra gcloud processes
• Improved streaming performance: already-rendered blocks are no longer re-checked by layout on each update
• Improved the dangerous-rm safety prompt to also catch rm -rf on positional parameters and inside double-quoted sh -c scripts
• Improved handling when the API sends no response headers: the retry now waits up to API_TIMEOUT_MS (10 minutes by default) instead of another 3 minutes, and the messages say what to change
• Changed a Claude apps gateway 403 on the managed settings load (at startup or after /login) to say Claude Code may not be enabled for the organization, instead of advising a new sign-in
• Changed machines whose managed settings pin forceLoginMethod: "gateway" to ignore a leftover API key or claude.ai login and ask for /login; Bedrock, Vertex AI, and Foundry sessions are unaffected
• Changed auto mode to treat a link that packs content into a public diagram renderer's URL as an upload to that site: no longer auto-approved unless you asked for it
• Changed the prompt's word-editing keys to match Bash: Ctrl+W deletes back to whitespace, Alt+F and Alt+D stop at word end, punctuation separates words; keybindingFlavor no longer has any effect
• Changed /context token counting to use a local estimate when the token-counting API is unavailable, instead of extra small-model requests
• [VSCode] Added a "Build a custom style" walkthrough to the Output styles menu that writes a custom output style file and lists it right away
• [VSCode] Added an Add server form and a Remove action to the MCP servers dialog, so MCP servers can be added and removed without leaving the IDE
• [VSCode] Added a hollow ring in the session list for sessions open in a terminal, another VS Code window, or Claude Desktop, so they no longer look closed
• [VSCode] Added a fold button to permission and question prompts so the conversation behind them can be read without dismissing them; the space beside the prompt now scrolls the conversation
• [VSCode] Added "Archive session" to the session list's right-click menu and gave Unarchive its own icon
• [VSCode] Fixed a session teleported from Claude Code on the web treating a question that was cut off when the cloud session shut down as declined
• [VSCode] Fixed the session tab's Rename box opening empty for a tab restored with the window; it now starts with the current name
• [VSCode] Fixed collapsed sections in the session list panel briefly showing expanded each time the panel loaded
• [VSCode] Fixed Focus view showing a tool call as still running after Claude had moved on, such as while a question waited for your answer
• [VSCode] Fixed the session list's active-row highlight going stale when an unfocused Claude tab's session ID is corrected
• [VSCode] Fixed Cmd/Ctrl+Shift+T reopen and deep-link opens placing the Claude tab outside the Claude editor group when a Claude tab has focus
• [VSCode] Fixed the session tab's "Add to group" putting a session opened from Claude Code on the Web in two groups; it now moves the entry the session list shows
• [VSCode] Fixed the model picker showing models an organization has since disabled until the window was reloaded twice
• [VSCode] Fixed a tab opened from the session list jumping back to that session, and a tab opened from a Web session restarting its teleport or staying empty, after VS Code reloads the tab's view
• [VSCode] Fixed /btw side-question history from earlier sessions being overwritten when a question is asked right after a window reload or while a settings file has errors
• [VSCode] Fixed the pending question card not reappearing after the Claude panel reloads when signed in with a Claude.ai or Console account
• [VSCode] Fixed claude.ai-only features staying visible in a window's other Claude panels after one panel picked up a third-party provider from a settings file
• [VSCode] Fixed the sign-in screen appearing despite the Disable Login Prompt setting when Claude Code reports no login or a request fails for lack of one
• [VSCode] Fixed the next queued permission prompt keeping text typed on the previous prompt and accepting an immediate second click
• [VSCode] Fixed install-plugin links opening the Claude sidebar without the install dialog in a window where only the session list had been shown
• [VSCode] Fixed the sidebar usage meter staying empty on a new window until the Account & usage dialog was opened, and a 0% usage limit being left out of the meter
• [VSCode] Fixed "Start new session in this group" losing the group after New conversation, and a missing unread dot for a session that finished before the sidebar's unread list loaded
• [VSCode] Fixed the editor tab badge showing unread during a running turn or missing on a tab opened from the session list, and "Add Session Tab to Group" doing nothing for an archived session
• [VSCode] Fixed "Enable Remote Control for all sessions" so flipping it also applies right away to sessions open in other VS Code windows
• [VSCode] Fixed the session list's Open filter for sessions continued from claude.ai whose tab was still recorded under the web session, and labeled the filter menu's sections for screen readers
• [VSCode] Changed the model picker to one flat list of every model, with rows kept for older model spellings listed last

oven-sh/bun (docker.io/oven/bun)

v1.4.2: Bun v1.4.2

To install Bun v1.4.2

curl -fsSL https://bun.sh/install | bash

# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.4.2:

bun upgrade

Read Bun v1.4.2's release notes on Bun's blog

Thanks to 3 contributors!

• @​dylan-conway
• @​jarred-sumner
• @​robobun

mvdan/sh (mvdan/sh)

v3.14.1

Compare Source

• syntax
  • Fix the indentation of heredocs nested inside command substitutions - #​1403
  • Keep literal tabs in <<- heredoc bodies rather than replacing them with spaces
  • Don't indent heredocs without dashes nested in <<- ones, whose output no longer parsed
  • Zsh: don't drop the prefix in short forms like $#"$foo" and $+"$foo" - #​1405
• interp
  • Fix the build on 32-bit FreeBSD and NetBSD
• expand
  • Don't let escaped characters such as \* act as glob metacharacters
• pattern
  • Treat unclosed extended operator groups like @(a as literals, avoiding a panic

Consider becoming a sponsor if you benefit from the work that went into this release!

Binaries built on go version go1.27.1 linux/amd64 with:

CGO_ENABLED=0 go build -trimpath -ldflags="-w -s"

renovatebot/github-action (renovatebot/github-action)

v46.2.6

Compare Source

Documentation

• update references to renovatebot/github-action to v46.2.5 (48ae7cc)

Miscellaneous Chores

• deps: update dependency lint-staged to v17.4.1 (d282d54)
• deps: update dependency typescript-eslint to v8.68.0 (#​1078) (a523046)
• deps: update pnpm/action-setup action to v6.1.0 (102d218)

Build System

• deps: lock file maintenance (3b757d0)

Continuous Integration

• deps: update ghcr.io/renovatebot/renovate docker tag to v44.52.1 (9984ec7)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.53.0 (faa6419)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.54.0 (2c96ef7)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.56.0 (dcb55da)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.56.1 (e2c9386)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.56.2 (913f400)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.56.3 (5e6fc58)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.57.2 (d469fc4)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.59.1 (66c7016)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.59.2 (ec50768)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.59.3 (31ef1b9)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.61.1 (d6e525c)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.61.3 (a2fa5a6)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.61.4 (d01e774)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.61.5 (d37ca4c)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.61.6 (0849a31)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.64.0 (e8a4545)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.64.1 (878ced9)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.65.0 (a2ab6bc)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.65.2 (3e5ee14)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.65.5 (6530be9)

rtk-ai/rtk (rtk-ai/rtk)

v0.48.0

Compare Source

Features

• add Bun and Deno runtime support (856c345)
• bun,deno: add Bun and Deno runtime support (36788f6)
• bun: route bun x to bunx tool filters (a9ef10f)
• runner: bun and deno test summaries (f4ac0cc)

Bug Fixes

• benchmark: skip find's disclosure note and tee pointer when counting names (c7fc40a)
• benchmark: skip find's disclosure note and tee pointer when counting names (d952a6b)
• bun,deno: address review feedback (55d2390)
• bun,deno: fix routing bugs, align with project conventions (2c52649)
• bun,deno: run via arg vectors, not shell (2416b8c)
• bun: add tee recovery to run_pkg/run_pm_ls (3b6d1e4)
• bun: filter combined stdout and stderr (b850696)
• bun: parse real pm ls tree output (4fb2c3a)
• bun: route pkg and pm ls through the core runner (0a7e992)
• bun: stop rejecting valid package specs (8f056b2)
• deno: route lint/check through core runner (d23e158)
• diff: don't report byte-different files as identical (4f3c9fe)
• discover: derive savings from passthrough status (e78427b)
• discover: log real hook decisions instead of guessing coverage retroactively (f57af35)
• discover: stop crediting passthrough subcommands (a3cca44)
• filters: reject unanchored TOML match_command at load (3522477)
• find: bound disclosure bookkeeping, disclose through a symlinked root, align the note with ls (68dc719)
• find: report a missing path like find does, and disclose hidden/gitignored matches (9cf048a)
• find: report a missing path like find does, and disclose hidden/gitignored matches (765b270), closes #​3851
• js: correct bun and deno filtering, routing, and accounting (9bee7a0)
• js: correct bun and deno runtime behavior (1173de0)
• js: keep each caller's behavior for a missing tool (6ff2571)
• js: run tools through the runner the user named (c7c1d96)
• rebase: clean up flat-layout stale files and fix i32 return types (afcad86)
• runner: anchor bun test summary extraction (9e2e4b6)
• runner: keep real diagnostics, drop test stdout (50bee30)
• runner: parse current deno test output format (65cd2f7)
• telemetry: distinguish "consent not given" from missing salt in status (#​1656) (5189bde)
• telemetry: distinguish "consent not given" from missing salt in status (#​1656) (ef363a4)
• telemetry: label the missing salt by the gate that actually fired (3a0ed92)
• telemetry: treat an empty RTK_TELEMETRY_URL as no endpoint (bb85017)

sickn33/agentic-awesome-skills (sickn33/agentic-awesome-skills)

v16.9.1

Compare Source

[16.9.1] - 2026-09-06 - "Security Fixes and Safer Local Files"

A corrective release for AAS users on Claude Code, Cursor, Codex CLI and Gemini CLI.
It distributes the dependency and local-file fixes integrated after 16.9.0,
without changing agent-owned skill selection or the 2,113-skill catalog.

Start here

• Install: npx agentic-awesome-skills@16.9.1
• Choose your tool
• Best skills by tool
• Bundles
• Workflows

Fixed

• Bind CLI JSON validation and bounded reads to the same file descriptor;
  reject file replacement, raced FIFOs and growth beyond the input budget.
• Preserve private local state and reject unsafe linked files in VideoDB,
  profile export and Instagram/NotebookLM configuration; avoid blocking on
  non-regular files during type inventory.
• Update Pillow, SoupSieve and setuptools requirements. Use manifest-local
  Python settings so Snyk resolves the supported dependency versions.
• Lock Telegram and WhatsApp Node templates to patched qs dependencies and
  synchronize the corresponding plugin copies.

Thanks to @​Beverly621 for the CLI JSON-read hardening in #​1398.

Validation scope

All 66 dependency findings in the reconciled Snyk group export were resolved,
including SpendWise findings addressed in its separate repository. Contextual
Code and license-policy findings remain visible; this release does not claim
zero static-analysis findings or Windows ACL verification.

v16.9.0: "From Agent Selection to Verified Installation"

Compare Source

[16.9.0] - 2026-09-06 - "From Agent Selection to Verified Installation"

Connects exact agent-selected skills to a reviewable installation command,
refreshes Specialized Plugins, and verifies the packed workflow on Linux
and Windows. The catalog contains 2,113 skills.

The coding agent remains responsible for project analysis and skill choice.
MCP and CLI expose the catalog, validate explicit selections and prepare plans
and installation previews; they do not choose skills for the project.

Start here:

• Install: npx agentic-awesome-skills@16.9.0
• AAS Core workflow
• Specialized Plugins
• Getting started

Added

• aas stack install-preview prepares a version-pinned direct-installer dry run
  from an explicit manifest, with POSIX and PowerShell quoting and no automatic
  execution or change to the selected IDs.
• Offline runtime auto-resolution when exactly one fully verified cached
  identity matches, with actionable errors for missing or ambiguous runtimes.
• Packed installation verification on Linux and Windows, including PowerShell 7
  and Windows PowerShell 5.1, exact payload comparison, repeat/prune behavior,
  unmanaged-file preservation, and moved-release and link-target rejection.
  Candidate publication metadata remains a fixture; native Windows app
  interaction is outside this verification.

Changed

• Refreshed all 21 Specialized Plugin definitions and starter prompts, with a
  shared source for the web catalog, complete membership and dynamic counts.
• Completed local support resources in Specialized Plugins and corrected
  worked examples, while preserving canonical skill IDs and mirrored bytes.
• Added exact-selection installation previews to the Workbench and preserved
  caller discovery constraints across review and handoff.
• Reconciled repository documentation with the protected maintenance,
  source-only contribution and release workflows.

Fixed

• MCP request correlation during overload and invalid requests, bounded error
  IDs, and silent handling of valid notifications.
• Archive and installer boundary checks, unsafe managed entries and browser
  review behavior around hostile or inconsistent input.
• Destination validation before installation-command preparation, including
  invalid filename characters and reserved names; direct installer failures
  return a concise error instead of an uncaught stack trace.
• Executable examples and limitations in linting, SQL, observability, security,
  Google Workspace and other Specialized Plugin procedures.

v16.8.0: . "Discover, Inspect, and Review Your Skills"

Compare Source

[16.8.0] - 2026-09-05 - "Discover, Inspect, and Review Your Skills"

Added public-web research and read-only skill auditing, goal-based catalog
discovery, and complete local bundle inspection. The published catalog
contains 2,113 skills.

This release helps Claude Code, Cursor, Codex CLI, Gemini CLI, Antigravity,
and related AI coding assistants find relevant procedures, inspect their
requirements, and review selection artifacts before use. Metadata and artifact
checks remain evidence about their stated scope, not guarantees of skill
effectiveness.

Start here:

• Install: npx agentic-awesome-skills@16.8.0
• parallel-search-mcp for public-web research
  through an existing, user-selected Parallel connection.
• skill-security-audit for reviewing third-party
  agent extensions before installation.
• Choose your tool
• Best skills by tool
• Bundles
• Workflows

Added

• Added parallel-search-mcp for public-web
  research through an existing Parallel connection, with explicit provider
  choice, anonymous-access limits, and data-sharing boundaries
  (#​1339).
• Added skill-security-audit for read-only
  review of third-party skills, MCP servers, connectors, and extensions before
  installation, distinguishing confirmed findings from unknowns
  (#​1353).
• Added optional outcome discovery in the catalog and Workbench: six task
  examples, explained word matches, explicit shortlist selection, and visible
  evidence gaps. Goals and imported artifacts stay in the browser.

Changed

• Two further reproducible worked cases for Workbench import QA and
  bundle-read security, with exact source inputs, native MCP selections,
  observed checks and historical CLI plans. Standalone workflow installations
  now include self-contained procedure cards and a validation-retry handoff.
• A consistent selection-to-use path linking local discovery, exact reviewed
  IDs, Core artifact review and supported direct installation, with a public
  distribution measurement.
• A scoped, content-fingerprint-bound review of 20 editorially prominent
  skills, with explicit compatibility mappings for eight duplicate groups and
  complete offline support files for their 17 existing IDs.
• Workbench import of selection evidence, a recorded MCP selection and CLI
  plan example, and optional local feedback preview/export. Imported data
  remains in page memory; artifact consistency does not certify skill
  suitability.
• Explicit all-term matching, required terms, normalized category facets and
  tag filters in Core search, with match explanations and factual evidence
  traces. The web catalog offers literal and explicit approximate modes,
  shareable search controls, and matching explanations while preserving
  catalog order.
• Local MCP bundle inspection through list_skill_files and
  read_skill_file, with catalog-bound paths and digests, bounded inert text
  reads, and explicit handling of links, binary files, missing payloads and
  older catalogs.
• Catalog shortlist comparison with declared risk, setup, plugin packaging,
  source, and license metadata; a previewable agent brief carries the selected
  IDs, catalog version, project goal, and target into agent-owned stack
  selection.
• Skill bundle links pinned to the catalog release and a Workbench guide from
  catalog selection to manifest and plan review.
• Completed missing date metadata, replaced truncated descriptions, added
  actionable examples, and split oversized procedures into bundled references
  while preserving canonical skill IDs.
• Refreshed web dependencies and migrated the web test toolchain and TypeScript
  checks.
• Regenerated canonical registries, offline Core data, tracked web assets,
  compatibility reports, marketplaces, editorial bundles, and Codex/Claude
  plugin distributions for 2,113 skills.

Fixed

• npm skill packages exclude generated Python bytecode and cache directories
  left by local tests, with a real pack-list regression and preserved
  source/support files.
• CLI native filesystem failures now return a bounded AAS error envelope
  instead of failing error-schema validation and exposing a stack trace.
• Installer retrieval now uses a release-verified partial/sparse checkout of
  complete canonical skills, reducing temporary worktree bytes by 70.9% in the
  recorded same-release comparison. Failed retrieval cleans its temporary
  source and leaves targets unchanged.
• Plan preview infers a sole manifest target and rejects a runtime with a
  different catalog identity. Source-only PR classification no longer treats
  an unchanged Git copy origin as a mutation; generated destinations and
  renames remain blocked.
• Replaced two empty session procedures with bounded optional helpers;
  corrected priority skill examples for authentication, MCP evaluation,
  analytics, refunds, caching, replanning and text diagnostics. Removed
  unsupported quality/marketing assurances and clarified version, permission
  and integration limits.
• MCP artifact requests can exceed the ordinary 4 KiB limit within the
  existing 256 KiB frame ceiling. Safely parsed size errors retain a bounded
  request ID, avoiding an uncorrelated error and client timeout; ordinary
  queries and unrelated metadata remain constrained.
• Workbench compares the project profile as well as manifest, catalog, target
  and selected IDs; changing an artifact clears stale consistency results
  while new digests are checked.
• Skill documentation links resolve bundled files against the same repository
  release; fragment links stay on the current skill page under the GitHub
  Pages base path. Outline and rendered heading IDs now agree for inline
  markup, duplicate headings, and non-English text.
• Workflow installation guidance uses explicit skill selection and a dry run;
  the shortlist appears before catalog results and handles clipboard failures
  with a selectable brief.
• Updated the web app's transitive qs dependency to its patched release.

Security and Reliability

• Parallel research requires an existing connection and explicit provider
  choice; queries and fetched URLs are shared with the selected service, and
  retrieved content remains untrusted evidence.
• Skill Security Audit inspects extension content without executing it or
  installing dependencies, and separates observed findings from unverified
  runtime behavior.
• Local MCP bundle reads stay catalog-bound, bounded, and inert. Selection
  evidence and artifact consistency do not certify a skill's suitability.
• Root and web dependency audits reported no known vulnerabilities during
  release verification; failed installer retrieval leaves targets unchanged.

Who should care

• Claude Code, Cursor, Codex CLI, and Gemini CLI users who want to discover
  skills for a concrete goal and inspect their complete support files.
• Teams comparing a shortlist and reviewing an agent-selected stack before
  installing the explicitly chosen skills.
• Researchers using Parallel for public-web search with clear data-sharing
  and anonymous-access limits.
• Maintainers reviewing third-party agent extensions before installation.

Validation

• Passed validation for 2,113 canonical skills, reference checks,
  documentation-security checks, warning-budget enforcement, repository tests,
  plugin and bundle checks, web tests and coverage, production build, and
  release preflight including npm package inspection.
• Verified the published tag and npm package against the released commit,
  successful CI and CodeQL, the exact-tag Pages deployment, live catalog data,
  and all 2,120 legacy/current redirect pairs.
• The two new skills received maintainer semantic review bound to their exact
  pull-request heads. The review gate reported manual-review-required; Tessl did not
  run a passing automated review.

Limitations

• Outcome discovery explains text matches; it does not establish which skills
  will work best for a project. Selection remains with the user and agent.
• Workbench checks artifact consistency. It does not execute the selected
  workflow or prove its effectiveness, and imported data remains in page memory.
• Bundle inspection does not execute scripts or fetch missing payloads;
  binary files, links, oversized files, and older catalogs have explicit read
  limits.
• Parallel availability, anonymous quotas, and search coverage depend on the
  external service. Static skill auditing cannot prove runtime safety or
  replace an independent security review.
• The measured 70.9% installer worktree reduction describes the recorded
  same-release comparison, not a universal performance guarantee.
• Existing MCP clients must reconnect or restart to load an updated runtime;
  changing their configuration does not update an already-running session.

Credits

• @​georgeatparallel for
  parallel-search-mcp in
  #​1339.
• @​liyangbing for skill-security-audit in
  #​1353, adapted
  from sandbaseai/awesome-workbuddy
  under CC0.

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.