chore(deps): update dependency @fission-ai/openspec to v1.14.3

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@fission-ai/openspec	1.14.1 → 1.14.3

---

Release Notes

Fission-AI/OpenSpec (@​fission-ai/openspec)

v1.14.3

Compare Source

Patch Changes

• #​2101 87a69a2 Thanks @​clay-good! - ### Bug Fixes

  • A capability's spec.md may be a symlink to a file elsewhere in the project — list --specs, show, validate and archive no longer refuse openspec/specs/<capability>/spec.md when it links to the file the project keeps somewhere else, such as beside the product documentation it belongs to. A link that resolves outside the project is still refused.

• #​2103 e33245d Thanks @​surlymochan! - ### Bug Fixes

  • Installing OpenSpec no longer pulls in the unpatched braces package, so a consumer audit does not report GHSA-vfj7-8cjw-p6xm through this package. A generates brace pattern that nests deeply, or expands to more than 1024 paths, is now rejected with a clear message instead of crashing openspec status with a stack overflow or an out-of-memory error.

• #​2104 276d015 Thanks @​CRYPTONIKAV! - Keep glob artifact paths inside the change directory in the propose, ff-change and continue-change workflows

• #​2108 5251f2e Thanks @​clay-good! - Stop openspec validate --all hanging on a zero-width TTY. Some hosts hand the
  process a terminal that reports columns === 0 — a pty inherited from a
  pre-commit runner such as lefthook, or script -qec. ora computes how many
  lines to erase as ceil(width / columns), so zero columns makes that count
  Infinity and the clear loop never ends: the command burned a core and wrote
  hundreds of megabytes of cursor escapes without finishing. The spinner is now
  skipped when nothing can be drawn, and validate falls back to its plain output.
  OPEN_SPEC_INTERACTIVE=0 and CI now disable the spinner too, the same way
  --no-interactive already did.

• #​2110 c9a8ade Thanks @​clay-good! - Preview the built docs site with a first-party static server instead of serve.
  pnpm start in website/ now runs scripts/preview.mjs, a dependency-free
  server that resolves routes in a Next static export (it does not apply
  out/_redirects). This
  drops the serve dev dependency whose transitive tree kept publishing
  advisories (brace-expansion x3, fast-uri, compression) that had to be pinned by
  hand even though none of that code ever reached the published site.

v1.14.2

Compare Source

Patch Changes

• #​2052 90c95c2 Thanks @​drakeo338! - ### Bug Fixes

  • Archive accepts openspec/, openspec/changes or openspec/specs as a symlink — openspec archive no longer refuses a project-owned symlink that points to another directory, such as a shared docs repository. An archive/ directory that resolves outside the changes directory is still refused.

• #​2061 7acf282 Thanks @​clay-good! - ### Bug Fixes

  • Guard against deeply nested brace patterns — An artifact generates or apply.tracks pattern that nests braces or parentheses more than 16 levels deep is now rejected with a clear error before glob matching, so a schema cannot overflow the stack through the unpatched braces advisory GHSA-vfj7-8cjw-p6xm.

• #​2086 9cb5ba8 Thanks @​clay-good! - ### Bug Fixes

  • Explore no longer offers to write default-schema files under a custom schema — The explore workflow's "where to capture" table and example offers now say they describe the default spec-driven schema. With another schema, the agent captures each insight in an artifact that schema defines, names it in the offer, and never creates a file such as design.md that the schema does not have.

• #​2064 76d49a1 Thanks @​ryandemelo! - Shell Tab completion is faster. openspec __complete, which the completion scripts run on every Tab press, now loads 48 modules instead of 344 when completing changes or specs, and no longer records usage, so a press never waits on the telemetry request and can't use up the first-run telemetry notice where nobody sees it. Completion output is unchanged.

• #​2083 3fea2a9 Thanks @​clay-good! - The update workflow now states the glob new-file exception at both places that state the scope rule (step 2 and the guardrails), not only where the rule is restated. It said to edit only the concrete files in existingOutputPaths, while the file step 4 creates to fill a gap under a partly written glob artifact is by definition not in that list, so an agent applying the blanket rule refused the operation the flow exists to perform.

• #​2083 3fea2a9 Thanks @​clay-good! - The verify workflow now reads a REMOVED requirement's baseline from the main spec before searching the codebase for it. A REMOVED delta block carries only the requirement name plus its Reason and Migration notes, so the search started from the heading alone - and because finding nothing is the passing result for a removal, an implementation written in different vocabulary read as a clean removal. When the baseline cannot be recovered from the main spec or that file's history - including a baseline that only restates its own title - Spec Coverage is now reported as not verified for that entry and the search is skipped, instead of passing.

• #​2054 1bce87f Thanks @​runsonmypc! - openspec validate and openspec archive now warn when a delta spec holds text archive does not carry into the main spec: a ## section other than Purpose and the four delta sections, text above the first ## header, or prose before the first requirement in ADDED or MODIFIED. That text was dropped without notice before. Like other validation warnings, these fail openspec validate --strict. What archive carries is unchanged.

• #​2063 e0a2f00 Thanks @​gkinter! - Keys in a change's .openspec.yaml that start with a lowercase x- (for example x-goal: G-12 or x-jiraKey) are now treated as your own extension metadata: OpenSpec no longer reports them as unknown, so openspec validate --strict passes on a change that carries them. Any other unrecognized key, including X-Tracker or a bare x-, is still reported.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.