chore(deps): update dependencies and development tools

.agents/skills/commit-messages/SKILL.md

@@ -36,13 +36,13 @@ When asked to prepare a pull request locally, write its title followed by its bo
 - **`feat`**: A new feature
 - **`fix`**: A bug fix
 - **`refactor`**: Code refactoring without changing functionality
-- **`chore`**: Maintenance tasks, dependency updates, configuration changes
+- **`chore`**: Maintenance tasks, dependency updates (`chore(deps)`), configuration changes
 - **`test`**: Adding or updating tests
 - **`ci`**: CI/CD configuration changes
 - **`docs`**: Documentation changes
 - **`style`**: Code style changes (formatting, whitespace)
 - **`perf`**: Performance improvements
-- **`build`**: Build system or dependency changes
+- **`build`**: Build system and bundling changes, not dependency updates
 
 ## Scope
 

.devcontainer/Dockerfile

@@ -1,8 +1,8 @@
 FROM mcr.microsoft.com/devcontainers/javascript-node:26-bookworm
 
 ARG BUSY_OCTOPUS_VERSION=0.1.4
-ARG CLAUDE_CODE_VERSION=2.1.287
-ARG CODEX_VERSION=0.159.3
+ARG CLAUDE_CODE_VERSION=2.1.309
+ARG CODEX_VERSION=0.164.0
 
 RUN apt-get update \
   && apt-get install --yes --no-install-recommends \

.devcontainer/devcontainer.json

@@ -52,7 +52,7 @@
   "dockerComposeFile": ["compose.yml", "compose.worktree.gen.local.yml"],
   "features": {
     "ghcr.io/devcontainers/features/github-cli:1.1.3": {
-      "version": "2.102.0"
+      "version": "2.103.0"
     }
   },
   "initializeCommand": ".devcontainer/initializeCommand.sh",

.github/workflows/publish.yml

@@ -79,7 +79,7 @@ jobs:
 
       - name: Upload release artifacts
         id: artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: busy-octopus-${{ steps.package.outputs.version }}
           path: |
@@ -112,7 +112,7 @@ jobs:
     timeout-minutes: 3
     environment: release
     env:
-      NPM_VERSION: 11.19.1
+      NPM_VERSION: 11.21.1
     permissions:
       contents: read
       id-token: write
@@ -138,7 +138,7 @@ jobs:
         run: test "$(pnpm --silent dlx "npm@$NPM_VERSION" --version)" = "$NPM_VERSION"
 
       - name: Download release artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.package.outputs.artifact-id }}
           path: artifacts
@@ -220,7 +220,7 @@ jobs:
         run: pnpm install --frozen-lockfile --ignore-scripts
 
       - name: Download release artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.package.outputs.artifact-id }}
           path: artifacts
@@ -339,7 +339,7 @@ jobs:
         run: test "$RELEASE_ENABLED" = true
 
       - name: Download release artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.package.outputs.artifact-id }}
           path: artifacts

.github/workflows/release-candidate.yml

@@ -44,7 +44,7 @@ jobs:
         run: echo "version=$(node --print "require('./package.json').version")" >> "$GITHUB_OUTPUT"
 
       - name: Upload release candidate
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: busy-octopus-${{ steps.package.outputs.version }}-${{ github.sha }}
           path: |

.github/workflows/security.yml

@@ -32,7 +32,7 @@ jobs:
         run: pnpm audit --prod --audit-level high
 
       - name: Scan repository history for secrets
-        uses: trufflesecurity/trufflehog@4dd8831c5f12599465d4d45c3c447b4018a34c85 # v3.97.9
+        uses: trufflesecurity/trufflehog@c85580b712841eda4c53bc28fc6ace6100e8c16c # v3.99.4
         with:
           extra_args: --results=verified,unknown
-          version: 3.97.9
+          version: 3.99.4

package.json

@@ -87,7 +87,7 @@
     "assets/icon.png",
     "dist"
   ],
-  "packageManager": "pnpm@12.8.1",
+  "packageManager": "pnpm@12.15.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/mindedtech/busy-octopus.git"
@@ -126,7 +126,7 @@
     "@biomejs/biome": "2.5.15",
     "@types/chai": "5.2.3",
     "@types/mocha": "10.0.10",
-    "@types/node": "22.20.4",
+    "@types/node": "22.20.5",
     "@types/sinon": "22.0.0",
     "@types/vscode": "1.137.0",
     "@vscode/test-cli": "0.0.15",
@@ -135,15 +135,15 @@
     "chai": "6.3.0",
     "esbuild": "0.28.2",
     "fflate": "0.8.3",
-    "knip": "6.39.0",
+    "knip": "6.42.1",
     "sinon": "22.1.0",
     "typescript": "7.0.2",
-    "vite": "8.3.2",
-    "vitest": "5.0.3"
+    "vite": "8.3.5",
+    "vitest": "5.0.5"
   },
   "dependencies": {
     "@commander-js/extra-typings": "15.0.0",
     "commander": "15.0.0",
-    "zod": "4.6.5"
+    "zod": "4.6.7"
   }
 }