chore(deps): bump @inquirer/prompts from 7.10.1 to 8.5.2

[dependabot]

Bumps @inquirer/prompts from 7.10.1 to 8.5.2.

Release notes

Sourced from @​inquirer/prompts's releases.

@​inquirer/prompts@​8.5.2

• Fix security warnings in external-editor

@​inquirer/prompts@​8.5.1

• Rolled back mute-stream dependency from v4 to v3 to undo breaking compatible engines.
• Added tooling to prevent regression of the above in the future. This surfaced our min engines already enforced a higher limit, so adjusted the explicit limits to match the current state.

@​inquirer/prompts@​8.5.0

• Feat: Read env variable INQUIRER_KEYBINDINGS to enable vim or emacs keybindings; making this a user preference instead of a library author preference. One caveat is doing so disable the search feature in the select prompt. Syntax: INQUIRER_KEYBINDINGS=vim,emacs.
• Fix: Line wraps would sometime cause the cursor to be mispositioned relative to the input.
• Chore: Bump dependencies.

@​inquirer/prompts@​8.4.3

• Fix: Windows rendering bug
• Fix: Preserve exact literal types in choices array (Typescript only)
• Fix: Allow input default value to be of type undefined (Typescript only)
• Bump dependencies

@​inquirer/prompts@​8.4.2

• Fix: some Windows terminals would freeze and not react to keypresses.

@​inquirer/prompts@​8.4.1

• Improve expand prompt type inferrence.

@​inquirer/prompts@​8.4.0

• Feat: Added a loading message while validating editor prompt input.
• Type improvement: Better type inference with checkbox, search and expand prompts.
• Fix: editor prompt not always properly handling editor path on windows.

@​inquirer/prompts@​8.3.2

• Fix broken 8.3.1 release process.

@​inquirer/prompts@​8.3.1

• Bump dependencies

@​inquirer/prompts@​8.3.0

• Fix: Keypresses happening before a prompt is rendered are now ignored.
• Fix (checkbox): Element who're both checked and disabled are now always included in the returned array.
• Feat (select/checkbox): Cursor will now hover disabled options of the list; but they still cannot be interacted with. This prevents the cursor jumping ahead in ways that can be confusing.
• Feat: various new theme options to make all prompts content localizable.

Finally, see our new @inquirer/i18n package!

@​inquirer/prompts@​8.2.1

• chore: Switch wrap-ansi with fast-wrap-ansi

@​inquirer/prompts@​8.2.0

• feat(search): Add support for default.
• feat(rawlist): Add support for description of choices. That information is displayed under the list when the choice is highlighted.
• Bump dependencies

... (truncated)

Commits

• bfd8710 chore: Publish new release
• 55cc5f3 feat: add reusable package lint CLI
• 3af9ed0 test(inquirer): capture prompt runner output
• 4381857 fix(@​inquirer/input): remove stale lint suppression
• 45df331 fix(@​inquirer/external-editor): harden editor temp files
• adef323 chore: limit CI token permissions
• b43359d chore: Publish new release
• 24ecae2 chore: fix yarn.lock
• b078d97 fix: validate package engine compatibility
• 3a49f9f chore(deps-dev): Bump oxfmt in the formatting group (#2143)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[alfred-openspec]

This major bump does not compile: Inquirer 8 no longer accepts the instructions property used in src/commands/config.ts, so lint and tests fail on every platform. Please adapt the prompt implementation with focused compatibility coverage and update the Nix dependency hash.

[clay-good]

Code review — verdict: do not merge as-is; needs a code change first

This is the one genuinely broken PR in the dependabot batch. Every test job plus Lint & Type Check is failing, and it's a real API break, not flakiness.

The failure

@inquirer/prompts v8 removed the instructions option from checkbox:

src/commands/config.ts(587,13): error TS2353: Object literal may only specify known
properties, and 'instructions' does not exist in type '{ message: string; prefix?: ...

The call site is src/commands/config.ts:

const selectedWorkflows = await checkbox<string>({
  message: 'Select workflows to make available:',
  instructions: 'Space to toggle, Enter to confirm',   // <-- removed in v8
  pageSize: ALL_WORKFLOWS.length,
  theme: { icon: { checked: '[x]', unchecked: '[ ]' } },
  choices: ALL_WORKFLOWS.map(formatWorkflowChoice),
});

I confirmed this directly against the published package rather than inferring it from the error. @inquirer/prompts@8.5.2 bundles @inquirer/checkbox@5.2.1, and:

--- 'instructions' present in checkbox types?
NO — option removed
--- theme keys offered:
theme?: PartialDeep<Theme<CheckboxTheme>> | undefined

So customization moved under theme. Someone needs to decide the replacement — either drop the hint line, or re-express it through CheckboxTheme — and check the v8 migration notes for the intended equivalent. I deliberately haven't prescribed a specific replacement API because I haven't verified one end-to-end, and this is user-visible UX text in openspec config.

Assessment against the review criteria

1. Need: routine dependency maintenance. Legitimate but not urgent, and v7 is not known-vulnerable — Audit passes on main.
2. Works: no. Build fails; the package cannot be compiled, let alone shipped.
3. Breaking: it would be, if forced through. It also changes interactive UX in openspec config, so whatever replaces instructions needs an actual look at the rendered prompt, not just a green typecheck.
4. Scope: fine in principle.

Engine floors are OK, for the record — v8 requires >=23.5.0 || ^22.13.0 || ^20.17.0 and OpenSpec declares node >=20.19.0, which satisfies ^20.17.0. So this is purely the API break.

Recommendation

Either:

• Close this and let a human-authored PR do the v8 migration (dependabot can't write the theme replacement), or
• push the config.ts fix onto this branch.

Whichever route, it also needs the flake.nix pnpmDeps hash regenerated — CI already computed it:

sha256-bPw9Z5vfOzTQlRNQYwrqmHKiq+tONN6yZcphR5gMbTg=

Of the six dependabot PRs open right now, this is the only one with a substantive problem — the other four lockfile bumps just need the hash.

[clay-good]

Closing this — the v8 upgrade needs a code migration, not a version bump, so dependabot can't land it.

Two blockers, both verified against the published packages:

1. checkbox's instructions option was removed in v8, breaking src/commands/config.ts:587 (error TS2353). Every test job plus Lint & Type Check failed on this.
2. @inquirer/prompts@8 requires @inquirer/core@^11, but this repo depends on @inquirer/core@^10.3.2 directly — src/ui/welcome-screen.ts and src/prompts/searchable-multi-select.ts build custom prompts on its hooks API. Bumping only prompts would leave two copies of @inquirer/core in the tree, with custom prompts on v10 and bundled prompts on v11. That one wouldn't have been caught by a green typecheck.

Tracked properly in #1458 with the full checklist, including the Windows keypress regression risk in welcome-screen.ts that needs manual interactive testing.

Not urgent — Audit is green on main, so nothing is forcing v7 off.

@dependabot ignore this major version

[dependabot]

OK, I won't notify you about version 8.x.x again, unless you re-open this PR.