fix(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@earendil-works/pi-coding-agent (source)	0.87.0 → 0.87.1
@​steipete/summarize	0.22.0 → 0.23.0
mcporter	0.13.13 → 0.14.0

---

Release Notes

earendil-works/pi (@​earendil-works/pi-coding-agent)

v0.87.1

Compare Source

New Features

• Latest frontier models — Use Claude Opus 5.5, GPT-6 Sol, and GPT-6 Luna through supported providers, including GitHub Copilot. See Choose a Model.
• Grok 4.7 by default for xAI — New xAI sessions now default to Grok 4.7. See Provider Authentication.

Added

• Added inherited Claude Opus 5.5, GPT-6 Sol, and GPT-6 Luna support for GitHub Copilot.
• Added inherited GPT-6 Sol and GPT-6 Luna support for OpenAI API keys and OpenAI Codex subscriptions.
• Added inherited Claude Opus 5.5 support for Anthropic with adaptive thinking and a 1M context window.

Changed

• Changed the default xAI model to Grok 4.7.

Fixed

• Fixed split-turn compaction summaries being refused by Claude Fable 5.1 by clearly separating the conversation and using continuation-oriented instructions (#​9908 by @​davidbrai).
• Fixed missing or invalid --mode values being silently ignored instead of reporting an error and exiting with a nonzero status (#​9045).
• Fixed inherited image-only user messages being rejected by some OpenAI-compatible providers because they included an empty text part (#​9797).
• Fixed inherited Anthropic OAuth requests reporting an outdated Claude Code version.

openclaw/mcporter (mcporter)

v0.14.0

Compare Source

Highlights: OAuth consent scopes are configurable, generated TypeScript clients preserve complete tool arguments, and cancellation, local state, and generated-code handling are safer.

• Keep server-controlled descriptions and metadata inside generated comments, preventing comment terminators or line breaks from becoming executable client code.
• Refresh runtime validation, generated-CLI bundling, and development tooling while preserving Node 24 support and the 48-hour dependency release-age policy.
• Cancel uncached discovery connections on list timeout or runtime close, retire late setup results before completing cleanup, and reject superseded callers without stale connection metadata. Thanks @​SebTardif (#​383).
• Emit strict-compatible object-argument clients that forward every tool argument and return CallResult, including tools with reserved property names or named output schemas; preserve proxy defaults and validation. Thanks @​nathanvale (#​378, #​379).
• Avoid repeated warnings for already-ignored uint32 and uint64 output-schema annotations while preserving schema metadata, dialect handling, and validation. Thanks @​0xCUB3 (#​377).
• Reject non-object --persist destinations and invalid mcpServers containers with clear errors, preserving the existing file instead of silently losing the new server or replacing invalid data. Thanks @​SebTardif (#​387).
• Preserve the saved tool timeout when regenerating a CLI with --from, unless --timeout explicitly overrides it. Thanks @​SebTardif (#​384).
• Bound --tail-log reads to the last MiB of regular files, reject special files without blocking even if the path changes during opening, and avoid padding short reads. Thanks @​SebTardif (#​388).
• Materialize Chrome compatibility preloads in private, unique directories with exclusive file creation, preventing shared-temp symlink overwrites and cleaning up with the transport. Thanks @​SebTardif (#​386).
• Retry transient Windows file-lock release failures without replaying the protected operation or deleting a successor's lock, while keeping permanent failures visible.
• Discover Claude Desktop's actual config filename and Cursor's default Linux user config, and honor redirected Windows APPDATA locations for both clients. Thanks @​SebTardif (#​382).
• Verify private Windows daemon and Chrome handoff directories without requiring administrator elevation, while preserving owner and access restrictions. Thanks @​yegetables for the report (#​380).
• Resolve the daemon process inventory through PATH, allowing retirement and migration on NixOS and other systems without /bin/ps. Thanks @​tsln1998 (#​381).
• Honor cancellation during HTTP/1.1 request preparation so an already-cancelled MCP request is never sent after body serialization.
• Report asynchronous recording failures without unhandled rejections and always close the underlying MCP transport when recording writes fail.
• Accept narrowly normalized loopback redirects from fresh OAuth registrations, including Fastmail's portless localhost response, while preserving the actual callback and stale-client safeguards. Thanks @​mikegreiling for the report (#​354).
• Add per-server oauthRequestedScope and config add --oauth-requested-scope to control OAuth consent scopes across authorization and reauthorization without changing default scope negotiation. Thanks @​ronyrus for the report (#​356).
• Start OAuth on an initial unauthenticated HTTP challenge instead of treating missing credentials as a failed refresh; reuse credentials that another flow saved before retrying.

Verification: npm, registry tarball, native assets, and browser Gatekeeper proof. npm integrity: sha512-R60nKyUcW65WawhVjoESC0HeNibsf+1iqpX0wHPX9P60AFX/DYCBlhS7pDYcuWzeGYqYfZG2Xf5jWWkM74d/+A==.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.