@lousy-agents/cli 5.15.3 → 5.15.5

package/api/copilot-with-fastify/package.json

@@ -28,16 +28,16 @@
         "zod": "4.4.3"
     },
     "devDependencies": {
-        "@biomejs/biome": "2.4.16",
-        "@lousy-agents/mcp": "5.15.2",
+        "@biomejs/biome": "2.5.0",
+        "@lousy-agents/mcp": "5.15.4",
         "@modelcontextprotocol/server-sequential-thinking": "2025.12.18",
-        "@testcontainers/postgresql": "12.0.1",
-        "@types/node": "24.13.1",
-        "@upstash/context7-mcp": "3.1.0",
+        "@testcontainers/postgresql": "12.0.3",
+        "@types/node": "24.13.2",
+        "@upstash/context7-mcp": "3.2.1",
         "chance": "1.1.13",
-        "testcontainers": "12.0.1",
+        "testcontainers": "12.0.3",
         "tsx": "4.22.4",
         "typescript": "6.0.3",
-        "vitest": "4.1.8"
+        "vitest": "4.1.9"
     }
 }

package/cli/copilot-with-citty/.devcontainer/devcontainer.json

@@ -3,14 +3,14 @@
     "image": "mcr.microsoft.com/devcontainers/base:ubuntu-24.04@sha256:4bcb1b466771b1ba1ea110e2a27daea2f6093f9527fb75ee59703ec89b5561cb",
     "features": {
         "ghcr.io/devcontainers/features/node:1.7.1": {
-            "version": "24.16.0"
+            "version": "24.17.0"
         },
         "ghcr.io/devcontainers/features/github-cli:1.1.0": {
             "version": "latest"
         },
         "ghcr.io/devcontainers/features/copilot-cli:1.0.0": {},
         "ghcr.io/anthropics/devcontainer-features/claude-code:1": {
-            "version": "v2.1.170"
+            "version": "v2.1.181"
         },
         "ghcr.io/rocker-org/devcontainer-features/apt-packages:1.0.2": {
             "packages": "yamllint, shellcheck",

package/cli/copilot-with-citty/.github/workflows/ci.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
@@ -33,7 +33,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
@@ -52,7 +52,7 @@ jobs:
     needs: [lint, test]
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0

package/cli/copilot-with-citty/.nvmrc

@@ -1 +1 @@
-24.16.0
+24.17.0

package/cli/copilot-with-citty/biome.template.json

@@ -1,6 +1,6 @@
 {
     "root": true,
-    "$schema": "https://biomejs.dev/schemas/2.4.16/schema.json",
+    "$schema": "https://biomejs.dev/schemas/2.5.0/schema.json",
     "vcs": {
         "enabled": true,
         "clientKind": "git",

package/cli/copilot-with-citty/package.json

@@ -19,14 +19,14 @@
         "zod": "4.4.3"
     },
     "devDependencies": {
-        "@biomejs/biome": "2.4.16",
-        "@lousy-agents/mcp": "5.15.2",
+        "@biomejs/biome": "2.5.0",
+        "@lousy-agents/mcp": "5.15.4",
         "@modelcontextprotocol/server-sequential-thinking": "2025.12.18",
-        "@types/node": "24.13.1",
-        "@upstash/context7-mcp": "3.1.0",
+        "@types/node": "24.13.2",
+        "@upstash/context7-mcp": "3.2.1",
         "chance": "1.1.13",
         "tsx": "4.22.4",
         "typescript": "6.0.3",
-        "vitest": "4.1.8"
+        "vitest": "4.1.9"
     }
 }

package/dist/index.js

@@ -2990,7 +2990,7 @@ exports.basename = (path, { windows } = {}) => {
 
 
 },
-8634(__unused_rspack_module, __unused_rspack___webpack_exports__, __webpack_require__) {
+455(__unused_rspack_module, __unused_rspack___webpack_exports__, __webpack_require__) {
 // NAMESPACE OBJECT: ../../node_modules/micromark/lib/constructs.js
 var constructs_namespaceObject = {};
 __webpack_require__.r(constructs_namespaceObject);
@@ -3157,6 +3157,7 @@ function hasNonEmptyString(value) {
 
 
 
+
 const NOT_FOUND_CODES = new Set(["ENOENT", "ENOTDIR"]);
 const SYMLINK_OPEN_CODES = new Set(["ELOOP", "EINVAL", "ENOTSUP"]);
 const POSIX_SEPARATOR_CHAR_CODE = 0x2f;
@@ -3356,6 +3357,29 @@ function directory_guard_createNearestExistingSyncDirectoryGuard(rootReal, targe
     return directory_guard_createSyncDirectoryGuard(root);
 }
 
+;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/fsync.js
+
+
+async function syncDirectoryBestEffort(dirPath) {
+    if (process.platform === "win32") {
+        return;
+    }
+    let handle;
+    try {
+        const flags = external_node_fs_.constants.O_RDONLY |
+            ("O_DIRECTORY" in external_node_fs_.constants ? external_node_fs_.constants.O_DIRECTORY : 0) |
+            ("O_NOFOLLOW" in external_node_fs_.constants ? external_node_fs_.constants.O_NOFOLLOW : 0);
+        handle = await promises_.open(dirPath, flags);
+        await handle.sync();
+    }
+    catch {
+        // Some filesystems reject directory handles; keep the write usable there.
+    }
+    finally {
+        await handle?.close().catch(() => undefined);
+    }
+}
+
 ;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/guarded-mkdir.js
 
 
@@ -4454,6 +4478,7 @@ async function runPinnedPathHelper(params) {
 
 
 
+
 function pinned_write_byteLength(input, encoding) {
     return typeof input === "string"
         ? Buffer.byteLength(input, encoding ?? "utf8")
@@ -4646,11 +4671,13 @@ async function runPinnedWriteFallback(params) {
             throw new errors_FsSafeError("path-mismatch", "fallback temp path changed during write");
         }
         const expectedTempStat = tempStat;
+        await handle.sync();
         await handle.close().catch(() => undefined);
         handle = undefined;
         await withAsyncDirectoryGuards([parentGuard], async () => {
             await promises_.rename(tempPath, targetPath);
             renamed = true;
+            await syncDirectoryBestEffort(parentPath);
             targetStat = await promises_.lstat(targetPath);
             if (targetStat.isSymbolicLink() || !file_identity_sameFileIdentity(targetStat, expectedTempStat)) {
                 throw new errors_FsSafeError("path-mismatch", "fallback target changed during write");
@@ -5324,6 +5351,197 @@ function path_policy_shortPath(value) {
     return value;
 }
 
+// EXTERNAL MODULE: external "node:url"
+var external_node_url_ = __webpack_require__(3136);
+;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/local-file-access.js
+
+
+
+const ENCODED_FILE_URL_SEPARATOR_RE = /%(?:2f|5c)/i;
+function isLocalFileUrlHost(hostname) {
+    const normalized = normalizeLowercaseStringOrEmpty(hostname);
+    return normalized === "" || normalized === "localhost";
+}
+function hasEncodedFileUrlSeparator(pathname) {
+    return ENCODED_FILE_URL_SEPARATOR_RE.test(pathname);
+}
+function isWindowsNetworkPath(filePath, platform = process.platform) {
+    if (platform !== "win32") {
+        return false;
+    }
+    const normalized = filePath.replace(/\//g, "\\");
+    return normalized.startsWith("\\\\?\\UNC\\") || normalized.startsWith("\\\\");
+}
+function isWindowsDriveLetterPath(filePath, platform = process.platform) {
+    return platform === "win32" && /^[A-Za-z]:[\\/]/.test(filePath);
+}
+function assertNoWindowsNetworkPath(filePath, label = "Path") {
+    if (isWindowsNetworkPath(filePath)) {
+        throw new Error(`${label} cannot use Windows network paths: ${filePath}`);
+    }
+}
+function safeFileURLToPath(fileUrl) {
+    let parsed;
+    try {
+        parsed = new external_node_url_.URL(fileUrl);
+    }
+    catch {
+        throw new Error(`Invalid file:// URL: ${fileUrl}`);
+    }
+    if (parsed.protocol !== "file:") {
+        throw new Error(`Invalid file:// URL: ${fileUrl}`);
+    }
+    if (!isLocalFileUrlHost(parsed.hostname)) {
+        throw new Error(`file:// URLs with remote hosts are not allowed: ${fileUrl}`);
+    }
+    if (hasEncodedFileUrlSeparator(parsed.pathname)) {
+        throw new Error(`file:// URLs cannot encode path separators: ${fileUrl}`);
+    }
+    const filePath = (0,external_node_url_.fileURLToPath)(parsed);
+    assertNoWindowsNetworkPath(filePath, "Local file URL");
+    return filePath;
+}
+function trySafeFileURLToPath(fileUrl) {
+    try {
+        return safeFileURLToPath(fileUrl);
+    }
+    catch {
+        return undefined;
+    }
+}
+function basenameFromMediaSource(source) {
+    if (!source) {
+        return undefined;
+    }
+    if (source.startsWith("file://")) {
+        const filePath = trySafeFileURLToPath(source);
+        return filePath ? path.basename(filePath) || undefined : undefined;
+    }
+    if (/^https?:\/\//i.test(source)) {
+        try {
+            return path.basename(new URL(source).pathname) || undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return path.basename(source) || undefined;
+}
+
+;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/device-path.js
+
+
+
+const POSIX_BLOCKED_DEVICE_PATHS = new Set([
+    "/dev/zero",
+    "/dev/random",
+    "/dev/urandom",
+    "/dev/full",
+    "/dev/stdin",
+    "/dev/stdout",
+    "/dev/stderr",
+    "/dev/tty",
+    "/dev/console",
+]);
+const WINDOWS_RESERVED_DEVICE_NAMES = new Set([
+    "CON",
+    "PRN",
+    "AUX",
+    "NUL",
+    "CLOCK$",
+    "CONIN$",
+    "CONOUT$",
+    "COM1",
+    "COM2",
+    "COM3",
+    "COM4",
+    "COM5",
+    "COM6",
+    "COM7",
+    "COM8",
+    "COM9",
+    "COM¹",
+    "COM²",
+    "COM³",
+    "LPT1",
+    "LPT2",
+    "LPT3",
+    "LPT4",
+    "LPT5",
+    "LPT6",
+    "LPT7",
+    "LPT8",
+    "LPT9",
+    "LPT¹",
+    "LPT²",
+    "LPT³",
+]);
+function candidateReadPaths(filePath) {
+    if (!filePath.startsWith("file://")) {
+        return [filePath];
+    }
+    const parsed = trySafeFileURLToPath(filePath);
+    return parsed === undefined ? [filePath] : [filePath, parsed];
+}
+function normalizePosixPath(filePath, cwd) {
+    if (external_node_path_.posix.isAbsolute(filePath)) {
+        return external_node_path_.posix.normalize(filePath);
+    }
+    const base = cwd && external_node_path_.posix.isAbsolute(cwd) ? cwd : process.cwd();
+    return external_node_path_.posix.resolve(base, filePath);
+}
+function matchPosixDeviceReadPath(filePath, cwd) {
+    const normalized = normalizePosixPath(filePath, cwd);
+    if (POSIX_BLOCKED_DEVICE_PATHS.has(normalized)) {
+        return { path: normalized, reason: "posix-device" };
+    }
+    if (normalized === "/dev/fd" || normalized.startsWith("/dev/fd/")) {
+        return { path: normalized, reason: "posix-fd" };
+    }
+    if (/^\/proc\/(?:self|thread-self|\d+)\/fd(?:\/|$)/.test(normalized)) {
+        return { path: normalized, reason: "posix-fd" };
+    }
+    return undefined;
+}
+function normalizeWindowsDeviceBaseName(filePath) {
+    const normalized = filePath.replace(/\//g, "\\").replace(/[\\]+$/g, "");
+    const lastSegment = normalized.split("\\").filter(Boolean).at(-1) ?? normalized;
+    const withoutStream = lastSegment.split(":")[0] ?? lastSegment;
+    const withoutTrailingIgnoredChars = withoutStream.replace(/[ .]+$/g, "");
+    return (withoutTrailingIgnoredChars.split(".")[0] ?? withoutTrailingIgnoredChars).toUpperCase();
+}
+function matchWindowsDeviceReadPath(filePath) {
+    const normalized = filePath.replace(/\//g, "\\");
+    if (/^\\\\\.\\/.test(normalized) || /^\\\\\?\\GLOBALROOT\\Device\\/i.test(normalized)) {
+        return { path: normalized, reason: "windows-device" };
+    }
+    const baseName = normalizeWindowsDeviceBaseName(filePath);
+    if (WINDOWS_RESERVED_DEVICE_NAMES.has(baseName)) {
+        return { path: normalized, reason: "windows-device" };
+    }
+    return undefined;
+}
+function matchUnsafeDeviceReadPath(filePath, options = {}) {
+    const platform = options.platform ?? process.platform;
+    for (const candidate of candidateReadPaths(filePath)) {
+        const match = platform === "win32"
+            ? matchWindowsDeviceReadPath(candidate)
+            : matchPosixDeviceReadPath(candidate, options.cwd);
+        if (match) {
+            return match;
+        }
+    }
+    return undefined;
+}
+function isUnsafeDeviceReadPath(filePath, options) {
+    return matchUnsafeDeviceReadPath(filePath, options) !== undefined;
+}
+function assertNoUnsafeDeviceReadPath(filePath, options) {
+    if (matchUnsafeDeviceReadPath(filePath, options)) {
+        throw new errors_FsSafeError("device-path", `file reads from unsafe device paths are not allowed: ${filePath}`);
+    }
+}
+
 ;// CONCATENATED MODULE: ../../node_modules/@openclaw/fs-safe/dist/read-opened-file.js
 
 async function read_opened_file_readOpenedFileSafely(params) {
@@ -5675,6 +5893,7 @@ async function serializePathWrite(key, run) {
 
 
 
+
 
 
 function logWarn(message) {
@@ -5700,20 +5919,16 @@ const OPEN_APPEND_CREATE_FLAGS = external_node_fs_.constants.O_RDWR |
     external_node_fs_.constants.O_EXCL |
     (SUPPORTS_NOFOLLOW ? external_node_fs_.constants.O_NOFOLLOW : 0);
 const DEFAULT_ROOT_MAX_BYTES = 16 * 1024 * 1024;
-function closeHandleForDispose(handle) {
-    return handle.close().catch(() => undefined);
-}
 function openResult(params) {
     return {
         handle: params.handle,
         realPath: params.realPath,
         stat: params.stat,
-        [Symbol.asyncDispose]: async () => {
-            await closeHandleForDispose(params.handle);
-        },
+        [Symbol.asyncDispose]: () => params.handle.close().catch(() => undefined),
     };
 }
 async function openVerifiedLocalFile(filePath, options) {
+    assertNoUnsafeDeviceReadPath(filePath);
     const fsSafeTestHooks = getFsSafeTestHooks();
     // Reject directories before opening so we never surface EISDIR to callers (e.g. tool
     // results that get sent to messaging channels). See openclaw/openclaw#31186.
@@ -6238,9 +6453,7 @@ async function openWritableFileInRoot(root, params) {
             createdForWrite,
             realPath,
             stat,
-            [Symbol.asyncDispose]: async () => {
-                await closeHandleForDispose(handle);
-            },
+            [Symbol.asyncDispose]: () => handle.close().catch(() => undefined),
         };
     }
     catch (err) {
@@ -6277,10 +6490,15 @@ async function appendFileInRoot(root, params) {
         }
         if (typeof params.data === "string") {
             await target.handle.appendFile(`${prefix}${params.data}`, params.encoding ?? "utf8");
-            return;
         }
-        const payload = prefix.length > 0 ? Buffer.concat([Buffer.from(prefix, "utf8"), params.data]) : params.data;
-        await target.handle.appendFile(payload);
+        else {
+            const payload = prefix.length > 0 ? Buffer.concat([Buffer.from(prefix, "utf8"), params.data]) : params.data;
+            await target.handle.appendFile(payload);
+        }
+        await target.handle.sync();
+        if (target.createdForWrite) {
+            await syncDirectoryBestEffort(external_node_path_.dirname(target.realPath));
+        }
     }
     finally {
         await target.handle.close().catch(() => { });
@@ -6337,42 +6555,45 @@ async function writeFileInRoot(root, params) {
     }
     const pinned = await resolvePinnedWriteTargetInRoot(root, params.relativePath, params.mode, params.denyMutations);
     await serializePathWrite(pinned.targetPath, async () => {
-        let identity;
-        try {
-            identity = await runPinnedWriteHelper({
-                rootPath: pinned.rootReal,
-                relativeParentPath: pinned.relativeParentPath,
-                basename: pinned.basename,
-                mkdir: params.mkdir !== false,
-                mode: params.mode ?? pinned.mode,
-                overwrite: params.overwrite,
-                input: {
-                    kind: "buffer",
-                    data: params.data,
-                    encoding: params.encoding,
-                },
-            });
-        }
-        catch (error) {
-            if (params.overwrite === false && isAlreadyExistsError(error)) {
-                throw new errors_FsSafeError("already-exists", "file already exists", {
-                    cause: error instanceof Error ? error : undefined,
-                });
-            }
-            throw normalizePinnedWriteError(error);
-        }
-        try {
-            await verifyAtomicWriteResult({
-                root,
-                targetPath: pinned.targetPath,
-                expectedIdentity: identity,
+        await commitPinnedWriteInRoot(root, pinned, params);
+    });
+}
+async function commitPinnedWriteInRoot(root, pinned, params) {
+    let identity;
+    try {
+        identity = await runPinnedWriteHelper({
+            rootPath: pinned.rootReal,
+            relativeParentPath: pinned.relativeParentPath,
+            basename: pinned.basename,
+            mkdir: params.mkdir !== false,
+            mode: params.mode ?? pinned.mode,
+            overwrite: params.overwrite,
+            input: {
+                kind: "buffer",
+                data: params.data,
+                encoding: params.encoding,
+            },
+        });
+    }
+    catch (error) {
+        if (params.overwrite === false && isAlreadyExistsError(error)) {
+            throw new errors_FsSafeError("already-exists", "file already exists", {
+                cause: error instanceof Error ? error : undefined,
             });
         }
-        catch (err) {
-            emitWriteBoundaryWarning(`post-write verification failed: ${String(err)}`);
-            throw err;
-        }
-    });
+        throw normalizePinnedWriteError(error);
+    }
+    try {
+        await verifyAtomicWriteResult({
+            root,
+            targetPath: pinned.targetPath,
+            expectedIdentity: identity,
+        });
+    }
+    catch (err) {
+        emitWriteBoundaryWarning(`post-write verification failed: ${String(err)}`);
+        throw err;
+    }
 }
 async function copyFileInRoot(root, params) {
     assertValidRootRelativePath(params.relativePath);
@@ -7537,7 +7758,7 @@ const regexes_base64 = /^$|^(?:[0-9a-zA-Z+/]{4})*(?:(?:[0-9a-zA-Z+/]{2}==)|(?:[0
 const regexes_base64url = /^[A-Za-z0-9_-]*$/;
 // based on https://stackoverflow.com/questions/106179/regular-expression-to-match-dns-hostname-or-ip-address
 // export const hostname: RegExp = /^([a-zA-Z0-9-]+\.)*[a-zA-Z0-9-]+$/;
-const hostname = /^(?=.{1,253}\.?$)[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[-0-9a-zA-Z]{0,61}[0-9a-zA-Z])?)*\.?$/;
+const regexes_hostname = /^(?=.{1,253}\.?$)[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[-0-9a-zA-Z]{0,61}[0-9a-zA-Z])?)*\.?$/;
 const domain = /^([a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$/;
 const httpProtocol = /^https?$/;
 // https://blog.stevenlevithan.com/archives/validate-phone-number#r4-3 (regex sans spaces)
@@ -18465,8 +18686,6 @@ const pathe_M_eThtNZ_path = (/* unused pure expression or super */ null && ({
 
 // EXTERNAL MODULE: ../../node_modules/dotenv/lib/main.js
 var lib_main = __webpack_require__(5599);
-// EXTERNAL MODULE: external "node:url"
-var external_node_url_ = __webpack_require__(3136);
 // EXTERNAL MODULE: external "node:assert"
 var external_node_assert_ = __webpack_require__(4589);
 // EXTERNAL MODULE: external "node:v8"
@@ -59381,4 +59600,4 @@ if (installedChunkData !== 0) { // 0 means "already installed".'
 // module factories are used so entry inlining is disabled
 // startup
 // Load entry module and return exports
-var __webpack_exports__ = __webpack_require__(8634);
+var __webpack_exports__ = __webpack_require__(455);

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@lousy-agents/cli",
-    "version": "5.15.3",
+    "version": "5.15.5",
     "description": "CLI scaffolding tool that sets up projects with structure, instructions, and feedback loops for AI coding assistants",
     "type": "module",
     "repository": {

package/ui/copilot-with-react/.devcontainer/devcontainer.json

@@ -3,14 +3,14 @@
     "image": "mcr.microsoft.com/devcontainers/base:ubuntu-24.04@sha256:4bcb1b466771b1ba1ea110e2a27daea2f6093f9527fb75ee59703ec89b5561cb",
     "features": {
         "ghcr.io/devcontainers/features/node:1.7.1": {
-            "version": "24.16.0"
+            "version": "24.17.0"
         },
         "ghcr.io/devcontainers/features/github-cli:1.1.0": {
             "version": "latest"
         },
         "ghcr.io/devcontainers/features/copilot-cli:1.0.0": {},
         "ghcr.io/anthropics/devcontainer-features/claude-code:1": {
-            "version": "v2.1.170"
+            "version": "v2.1.181"
         },
         "ghcr.io/rocker-org/devcontainer-features/apt-packages:1.0.2": {
             "packages": "libnss3, libnspr4, libatk1.0-0t64, libatk-bridge2.0-0t64, libcups2t64, libdrm2, libdbus-1-3, libatspi2.0-0t64, libxcomposite1, libxdamage1, libxfixes3, libxrandr2, libgbm1, libxkbcommon0, libasound2t64, yamllint, shellcheck",

package/ui/copilot-with-react/.github/workflows/ci.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
@@ -33,7 +33,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
@@ -52,7 +52,7 @@ jobs:
     needs: [lint, test]
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0

package/ui/copilot-with-react/.nvmrc

@@ -1 +1 @@
-24.16.0
+24.17.0

package/ui/copilot-with-react/biome.template.json

@@ -1,6 +1,6 @@
 {
     "root": true,
-    "$schema": "https://biomejs.dev/schemas/2.4.16/schema.json",
+    "$schema": "https://biomejs.dev/schemas/2.5.0/schema.json",
     "vcs": {
         "enabled": true,
         "clientKind": "git",

package/ui/copilot-with-react/package.json

@@ -14,31 +14,31 @@
     },
     "dependencies": {
         "@emotion/server": "11.11.0",
-        "@mui/material": "9.1.0",
-        "@mui/material-nextjs": "9.1.0",
+        "@mui/material": "9.1.1",
+        "@mui/material-nextjs": "9.1.1",
         "next": "16.2.9",
         "react": "19.2.7",
         "react-dom": "19.2.7"
     },
     "devDependencies": {
-        "@biomejs/biome": "2.4.16",
+        "@biomejs/biome": "2.5.0",
         "@eslint/eslintrc": "3.3.5",
-        "@lousy-agents/mcp": "5.15.2",
+        "@lousy-agents/mcp": "5.15.4",
         "@modelcontextprotocol/server-sequential-thinking": "2025.12.18",
         "@testing-library/jest-dom": "6.9.1",
         "@testing-library/react": "16.3.2",
-        "@types/node": "24.13.1",
+        "@types/node": "24.13.2",
         "@types/react": "19.2.17",
         "@types/react-dom": "19.2.3",
-        "@upstash/context7-mcp": "3.1.0",
+        "@upstash/context7-mcp": "3.2.1",
         "@vitejs/plugin-react": "6.0.2",
-        "@vitest/ui": "4.1.8",
-        "eslint": "10.4.1",
+        "@vitest/ui": "4.1.9",
+        "eslint": "10.5.0",
         "eslint-config-next": "16.2.9",
-        "happy-dom": "20.10.2",
+        "happy-dom": "20.10.6",
         "jsdom": "29.1.1",
         "typescript": "6.0.3",
-        "vitest": "4.1.8",
+        "vitest": "4.1.9",
         "whatwg-fetch": "3.6.20"
     }
 }