[deps] dependency sweep (Oct 26 2026): 7 trivial bumps opened as PR #349, obsidian.nvim refactor + fzf-lua/#343 staleness flagged #350

Scheduled dependency check against the current nvim-pack-lock.json (last full sweep: #344/#342, Oct 5; last audit: #347, Oct 12). Cross-checked every pin via git ls-remote <src> HEAD against the recorded rev, then read the full commit range for anything that showed drift.

Trivial bumps — opened as PR #349

async.nvim, gitsigns.nvim, mini.nvim, nvim-treesitter, tinted-vim, tree-sitter-d2, vimtex — all drift in this set is bugfixes, automated data/parser refreshes, docs, or the plugin's own dev-tooling deps, with no conventional-commit ! markers and nothing touching a code path this config exercises. See #349 for the per-plugin commit breakdown.

Needs a deliberate look before bumping — not included in #349

obsidian.nvim — non-trivial actions.lua refactor in the drift range

Pinned 4eec5b13 → upstream 0986cf17, 5 commits. Two are substantive:

• c25aa3d feat(action): normal mode link and link_new and better link api (#953) — 284-line change across lua/obsidian/actions.lua, lua/obsidian/api.lua, lua/obsidian/commands/init.lua, described by its own PR as "refactor: better link API".
• 03e7925 feat: render Markdown note embeds (#1010) — new embed-rendering feature.

Neither carries a ! marker, and this config's obsidian.setup() call (lua/config/plugin_config.lua:402-427) only sets legacy_commands, ui.enable, workspaces, and daily_notes — no custom actions/keymaps that the actions.lua refactor would touch. Likely safe, but "refactor: better link API" is exactly the kind of change that's worth running :Obsidian link commands against once before bumping, rather than taking on faith. Recommend a follow-up PR once that's been smoke-tested.

fzf-lua / nvim-lspconfig — already mid-flight in #343, which has partially gone stale

• nvim-lspconfig: master's current pin (77b7432d) is now identical to upstream HEAD. [deps] bump fzf-lua, nvim-lspconfig pins: additive/docs-only #343's nvim-lspconfig bump (targeting 910f0c4d, itself ahead of the pin [deps] bump fzf-lua, nvim-lspconfig pins: additive/docs-only #343 branched from) is moot — something else already carried this pin forward past [deps] bump fzf-lua, nvim-lspconfig pins: additive/docs-only #343's target.
• fzf-lua: master's pin (5dca84ef) is still behind [deps] bump fzf-lua, nvim-lspconfig pins: additive/docs-only #343's target (c5e1465b), which is itself now behind current upstream HEAD (5b88d6f0) by 5 more bugfix-only commits (Windows git-position capture, action field-index capture, history-index mapping, treesitter region guard).

Not opening a competing branch for the same pin while #343 is open. Recommend rebasing #343 onto current master (which will likely drop its nvim-lspconfig hunk to a no-op) and, while rebasing, picking up fzf-lua's 5 newer commits too.

Checked, no drift

blink.lib, conform.nvim, d2.vim, dark-theme, diffview.nvim, eldritch, fugitive.vim (verified via the github.com/tpope/vim-fugitive mirror — tpope.io is blocked from this environment, same workaround as #344), fx.nvim, guh.nvim, noice.nvim, nui.nvim, nvim-lint, nvim-treesitter-textobjects, plenary.nvim, poimandres.nvim, quicker.nvim, refactoring.nvim, render-markdown.nvim, rose-pine, snacks.nvim, sneaks.vim, solarized-osaka.nvim, tiny-inline-diagnostic.nvim, tokyonight all have pinned rev == current upstream tip.

Intentionally pinned old, drift expected (no action, per #271/#344)

blink.cmp (pinned to exact release 1.10.0, upstream HEAD is deep into unreleased v2 development with breaking commits — tracking issue already covers this), fff.nvim (pinned to exact release 0.9.4 "breaks frequently" per plugins.lua:17, upstream HEAD is many releases ahead).

Neovim core

Latest stable tag is v0.12.6 (bumped from v0.12.5, already covered by #330). Diffed the two tags: the only notable patch is a backported netrw NetrwBookHistSave() code-injection fix (vim-patch:9.2.0495) — already included in the v0.12.6 binary itself, nothing in this config's Lua to change. Scanned nightly master (last ~200 commits) for anything new since #347 (Oct 12): nothing additional actionable turned up beyond what #330/#318/#342/#335/#334/#325/#311/#310/#283 already track. Also grepped lua/ and init.lua for common deprecated-API patterns (vim.loop, vim.lsp.buf_get_clients, vim.tbl_islist, nvim_buf_set_option, vim.lsp.start_client, etc.) — none found.

🤖 Generated with Claude Code

https://claude.ai/code/session_017S2hK7WgoBBKTgCHQ919AZ