chore(deps): update all dependencies

[gw0-bot]

This PR contains the following updates:

Package	Type	Update	Change
renovatebot/github-action	action	patch	v46.3.7 → v46.3.8
rtk-ai/rtk		minor	0.51.0 → 0.52.0
sickn33/agentic-awesome-skills		minor	19.3.0 → 19.5.0

---

Release Notes

renovatebot/github-action

v46.3.8

Compare Source

Documentation

• update references to renovatebot/github-action to v46.3.7 (a273844)

Miscellaneous Chores

• deps: update actions/setup-node action to v7.1.0 (6f17fe9)
• deps: update dependency @​types/node to v24.19.1 (15f0ee7)
• deps: update dependency globals to v17.13.0 (22f44b2)
• deps: update dependency typescript-eslint to v8.71.0 (4e1dc65)
• deps: update pnpm to v10.34.6 (c6c4e3c)

Build System

• deps: lock file maintenance (b35dbc9)

Continuous Integration

• deps: update ghcr.io/renovatebot/renovate docker tag to v44.134.1 (bb79b7a)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.135.0 (8e77cf4)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.137.0 (a44fc20)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.138.0 (b973134)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.139.0 (430b063)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.140.0 (8bc7704)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.141.0 (6181226)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.142.1 (6b62f26)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.143.0 (cc52bde)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.144.1 (1032cc2)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.145.1 (7cb03f9)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.145.3 (e0ac9d9)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.147.0 (750014e)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.148.0 (9b5e926)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.148.3 (d05a9c8)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.148.4 (d205fa1)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.148.6 (4c2ff13)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.149.0 (d8854cb)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.149.1 (85af5b5)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.149.2 (fdc3ae9)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.149.3 (a2327c1)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.150.1 (5b963ba)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.151.0 (96a197e)

rtk-ai/rtk

v0.52.0

Compare Source

Features

• hook/opencode: support OpenCode V2, Desktop, and Windows (#​3463, #​3326) (311ebcb)
• rewrite: read a quoted fish -c script as fish (4d2184c), closes #​2767
• rewrite: rewrite inner commands of a quoted fish -c wrapper (27a659f)

Bug Fixes

• ast-grep: route subcommands by the grammar ast-grep actually has (e0b2e85)
• ast-grep: route subcommands by the grammar ast-grep actually has (507422f)
• core: emit one trailing newline, not one on top of the output's own (be8d546)
• core: emit one trailing newline, not one on top of the output's own (5daca37)
• curl: forward stdin to curl so -d @​- bodies are not dropped (a4f444e)
• diff: report a one-operand call as a usage error with exit 2 (fixes #​4320) (1ed8c7c)
• discover: count sudo RTK_DISABLED=1 commands as bypass in analytics (4f9015f)
• discover: judge a bypassed segment as typed without the bypass (2d37b2d)
• discover: keep a trailing redirect when rewriting golangci-lint (aec5fa9)
• gain: report a missing hook on every view (7231fd2)
• gain: report a missing hook on every view, not just the default one with data (5019e9c)
• gh: drop rtk's own --, keep the user's (2b236d0)
• gh: keep a lone escaped flag behind the boundary too (6433b7d)
• gh: keep an escaped flag behind the boundary (0cc1eca)
• gh: restore -- over the whole subcommand region (99eac0f)
• gh: tokenize gh args instead of walking them by hand (e4f0509)
• gh: tokenize gh args instead of walking them by hand (3cbcb63)
• glab: tokenize glab args instead of walking them by hand (df39e33)
• go: drop non-JSON surfacing and pin failing-fuzz precedence (4daca6a)
• go: keep the final fuzz stats in the go test summary (c356374)
• hook: defer on a denied command inside a prefixed shell wrapper (ffa5651)
• hook: defer when a prefixed shell wrapper's script hits a deny rule (4d37aa8)
• hook: keep case terminators intact when rewriting (#​3197) (e12ca86)
• hook: keep case terminators intact when rewriting (#​3197) (5e92ea4)
• hook: match namespaced bash tool name in the Vibe hook (0eddb84)
• hook: match the Vibe bash tool name exactly (d47ef69)
• hooks/opencode: drop the rtk -prefix skip (60cc80c)
• hooks/opencode: honour RTK_DISABLED=1 (bedcc2c)
• hooks/opencode: judge only the rules OpenCode applies, and keep init honest (4775f69)
• hooks/opencode: probe for the subcommand, resolve from PATH, forward the agent (0037bf4)
• hooks/opencode: probe with rtk --version and require rtk >= 0.51.1 (a96d57e)
• hooks/opencode: read OpenCode 2.x's native permission rules (0c1cb3a)
• hooks/opencode: read OpenCode's rules the way OpenCode resolves them (286db6e)
• hooks/opencode: say which RTK_DISABLED is which (bf9fdee)
• hooks/opencode: skip commands that already invoke rtk (b7612eb)
• hooks: close three permission-gate holes in command segmentation (4932d16)
• hooks: close three permission-gate holes in command segmentation (3992e0a)
• hooks: judge OpenCode against its own permission rules (cf018af)
• hooks: judge OpenCode against its own permission rules (aaa8ad0)
• hooks: report a status to OpenCode only when the rewrite changes it (0857629)
• hooks: skip the OpenCode rewrite when it would change the verdict (4ddc78d)
• init/opencode: drop the floor helper the refactor orphaned (d222aa5)
• init/opencode: drop the legacy plugin, floor at 1.18.29 (9513636)
• init/opencode: leave the plugin alone on an OpenCode that cannot load it (f2701a7)
• init/opencode: serve OpenCode <= 1.3.3 a legacy plugin (8f365e9)
• init: fail closed on missing .claude dir and hoist OpenCode install (fixes #​4046) (b931928)
• jest: run the hook integrity check for rtk jest, and pin what vitest and jest spawn (58d2502)
• ls: match the ls the child will actually be (93166b9)
• ls: parse arguments through the tokenizer (e7a614c)
• ls: parse arguments through the tokenizer (ec96ab4)
• mvn: read goals through arg_tokenizer, not a dash scan (ef53d65)
• mvn: read goals through arg_tokenizer, not a dash scan (6f7de39)
• pipe: strip ANSI before pytest filter in pipe mode (404511d)
• pipe: strip ANSI before the pytest filter in pipe mode (8533612)
• pytest: strip ANSI inside filter_pytest_output (a249a90)
• rewrite: defer on fish's &| pipe inside a -c wrapper (3e1188d)
• rewrite: leave the pairs an ampersand opens to zsh, and strip grammar from an inner segment (b969c3a)
• rewrite: rewrite inner commands of quoted sh/bash/zsh -c wrappers (7cc2699), closes #​2767
• tests: isolate the glab tests' data and follow the blob hint's new text (a345ebf)
• tests: repair the tests broken by the #​4001 and #​4005 merges (eb225a1)
• tokenizer: derive the /flag guard from the attach axis (29b3e3f)
• tokenizer: pin the contracts the new presets rely on (cd9d7a6)
• tracking: count rtk uv rows as python in ecosystem mix (aaa2fba)
• tracking: store commands so they read back as the same words (dd9edb5)
• tracking: store commands so they read back as the same words (87d1b18)

sickn33/agentic-awesome-skills

v19.5.0

Compare Source

[19.5.0] - 2026-10-12 - "Design Systems, Token Discipline And Verified Sources"

Adds 10 reviewed skills for native iOS and frontend UI work, design-system documentation, screenshot-to-UI matching, UI state coverage, token-lean coding-agent habits, terse Cockney delivery, timestamped YouTube and podcast quote research, official statistics lookups, and a digest-pinned progressive-headshot studio; it also refreshes Jet Browser to v0.9.0 and ships the Core-first product homepage with guided discovery and collections. Ships 2,687 skills.

A catalog release for Claude Code, Cursor, Codex CLI, Gemini CLI, and related AI coding assistants. It includes the protected maintainer batch merged after 19.4.0, with existing installation interfaces preserved.

Start here

• Install: npx agentic-awesome-skills@19.5.0
• Choose your tool
• Best skills by tool
• Bundles
• Workflows

Added

• build-ui - a step-by-step UI workflow: read the project, follow the plan that fits the job (new screen, dashboard, polish, simplify, review), then render, fix and check again at phone and desktop widths. risk: safe, MIT, official source uxkin/agent.
• ios-screens - build iPhone screens that feel native: tab bars and navigation stacks, sheets and detents, safe areas, Dynamic Type, dark mode, permissions, paywalls and empty states, checked on small and large iPhones. risk: safe, MIT, official source uxkin/agent.
• write-design-md - write or update a project's DESIGN.md from the colors, type scale, spacing, shapes and components it really uses, with agent-facing rules so new screens match and near-duplicates are surfaced as open questions. risk: safe, MIT, official source uxkin/agent.
• ui-from-screenshot - turn a screenshot or mockup into matching UI built from the project's own components, compare the rendered result side by side with the image, and fix the differences. risk: safe, MIT, official source uxkin/agent.
• ui-states - design and build the states generated UI usually forgets: first use, empty, loading, partial, error, offline, validation, permission, success, long content and busy actions. risk: safe, MIT, official source uxkin/agent.
• arcmira-find-quotes - search indexed YouTube and podcast transcripts for quotes, speakers and clip boundaries, then cite the episode, date and timestamped source link through an existing authorized Arcmira connection. risk: safe, Apache-2.0, official source arcmira/mcp.
• tokenleak - token-lean working rules for coding agents: locate before reading, compute instead of reading data, bound command output, never re-read, batch independent calls, and prefer diffs over whole files, without trading away verification. risk: safe, MIT, official source Pazificateur69/tokenleak.
• cockney - a cheeky Cockney coding mode that returns terse replies and the smallest correct change, and switches back to plain English for security and destructive-action warnings. risk: safe, MIT, community source Kadajett/cockney.
• invokely-statistics - find official statistical figures, series, comparisons and place rankings through the Invokely MCP server and report each value with its indicator, period, unit and source citation. risk: safe, MIT, community source estevecastells/awesome-copilot.
• ai-headshot-studio - install and use the official AI Headshot Generator package, pinned by digest, for paid hosted work on the Beatra service, with self-update disabled before first use and an approval per paid call. risk: critical, MIT-0, official source beatra-ai/ai-headshot-generator-skill.

Changed

• jet-browser - refresh the skill to v0.9.0 (commit b086730): the published manifest now carries native linux/amd64 and linux/arm64 images, so the ARM guidance and every pinned source or release link were updated to the new tag. risk: safe is preserved.

Site and catalog

• Core is the product homepage, with guided discovery, skill collections, shared-shortlist review for team adoption and clearer information pages; informational routes are accepted by the SEO verifier and sitemap.

Credits

• @​UXKIN for build-ui, ios-screens, write-design-md, ui-from-screenshot and ui-states
• @​zealous1 for arcmira-find-quotes
• @​Pazificateur69 for tokenleak
• @​Kadajett for cockney
• @​estevecastells for invokely-statistics
• @​beatra-ai for ai-headshot-studio
• @​IRONICBo for the Jet Browser v0.9.0 refresh

v19.4.0: "Prompt Handoffs And Cost-Gated Scaling"

Compare Source

[19.4.0] - 2026-10-11 - "Prompt Handoffs And Cost-Gated Scaling"

Adds 2 reviewed skills for turning a rough request into a clear prompt for another agent and for proving a data/AI workflow end to end on a tiny sample before scaling; it also refreshes the Datacircle LinkedIn lookup skill with the Fetchin provider, corrects the OrcaPromptVault artifact wording, and ships guided discovery, collections and a Core overview on the hosted catalog. Ships 2,677 skills.

A catalog release for Claude Code, Cursor, Codex CLI, Gemini CLI, and related AI coding assistants. It includes the protected maintainer batch merged after 19.3.0, with existing installation interfaces preserved.

Start here

• Install: npx agentic-awesome-skills@19.4.0
• Choose your tool
• Best skills by tool
• Bundles
• Workflows

Added

• kernel-prompt - turn a rough request or draft into a clear, self-contained prompt for another agent: read the context it mentions, ask one round of decisions only the user can make, then return only the prompt and never perform the task it describes. risk: safe, MIT, community source codegiveness/kernel-prompt.
• skeleton-first - prove a data/AI/agent workflow end to end on the smallest input with the cheapest settings, look for cheap wins in the sample (duplicates, boilerplate, invalid inputs that are still billed), then scale in cost-gated rungs within a stated budget and keep a run log of cost and decisions. risk: safe, self-authored source.

Changed

• datacircle - add Fetchin as the third LinkedIn profile provider (price, limit, request, response and 404), use HarvestAPI or Fetchin past Up2Data's daily limit, correct Up2Data's per-profile price, and drop the retired get_invite_link MCP tool from the skill. risk: critical is preserved.
• glasser - add a source parameter to the maintained setup-instruction link so the provider can see which listings agents follow; the link target and installation-approval guidance are unchanged. risk: critical is preserved.
• system-prompt-lookup - correct the second artifact label to "captured off the wire or reported by the model itself", so a model's account of its own prompt is not presented as vendor-published material. risk: safe is preserved.

Site and catalog

• Guided discovery, skill collections and a Core overview on the hosted catalog, plus shared-shortlist review for team adoption and clearer information pages.

Credits

• @​codegiveness for kernel-prompt
• @​danhe6 for skeleton-first
• @​waynehamadi for the Datacircle Fetchin provider update
• @​glasserai for the Glasser setup-instruction link
• @​xizhuomengcontin for the OrcaPromptVault wording correction
• @​markqian for the openCanviz official source

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.