Skip to content

chore(deps): bump the dev-dependencies group across 1 directory with 4 updates - #282

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/dev-dependencies-8b977694f0
Open

chore(deps): bump the dev-dependencies group across 1 directory with 4 updates#282
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/dev-dependencies-8b977694f0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 17, 2026

Copy link
Copy Markdown
Contributor

Bumps the dev-dependencies group with 4 updates in the / directory: undici, @earendil-works/pi-coding-agent, @earendil-works/pi-tui and @types/node.

Updates undici from 8.9.0 to 8.10.2

Release notes

Sourced from undici's releases.

v8.10.2

⚠️ Security fixes

High severity

  • GHSA-vp8m-p9jh-q5pm: cache and deduplication interceptors could use caller-controlled request metadata instead of the authoritative dispatcher origin, enabling cross-origin cache poisoning and data disclosure. Undici now derives interceptor identities from the dispatcher origin and bypasses origin-dependent interceptors when no authoritative origin exists. Fixed by caf6194d.
  • GHSA-w293-vg96-wgc3: BalancedPool could drop function-valued connection options while cloning its configuration, including custom TLS certificate validation callbacks. Undici now preserves connect and legacy tls options when creating upstreams. Fixed by 8f5868fb.
  • GHSA-rfgv-xxqx-mfg5: a WebSocket server could select a subprotocol when none was requested, causing an uncaught TypeError that could terminate the process. Undici now rejects the handshake with protocol error 1002. Fixed by 66e12816.

Medium severity

  • GHSA-3wwx-pv8p-q78v: a malformed permessage-deflate payload exceeding the configured decompression limit could emit an unhandled zlib error and terminate the process. Undici now destroys the inflater after reaching the limit. Fixed by 4411a238.
  • GHSA-rx4f-c7p8-82vq: an unclean WebSocketStream close could create an unobserved rejected promise when its writable stream was locked, potentially terminating the process. Undici now propagates the failure through the retained writable stream controller. Fixed by 662d0ea6.
  • GHSA-2jfj-6hjv-fm6j: shared caches could store and replay responses containing Set-Cookie, disclosing one user's cookies to another caller. Undici now excludes these responses from shared caches, including existing entries and revalidation paths. Fixed by cb75bbb3.
  • GHSA-3xpg-4rpp-hhhm: the decompression interceptor did not bound decoded output, allowing compressed responses to consume excessive memory. Undici now limits every decompression stage to 64 MiB by default and supports a configurable maxSize. Fixed by 7aac7f12.
  • GHSA-pmjh-fq2x-6v4x: a terminal retry failure after response headers were exposed could orphan the original response body, causing consumers to hang indefinitely. Undici now propagates the terminal error to the exposed body. Fixed by e905b5b8.

Low severity

  • GHSA-8436-99hf-9mmv: cache interceptors could store and replay responses to unsafe HTTP methods such as POST or DELETE. Undici now restricts cache reads and writes to safe methods while preserving invalidation by successful unsafe requests. Fixed by 2be07bf9.
  • GHSA-2gqq-gqf2-x968: the dump interceptor could treat an oversized chunked response as successfully truncated when no Content-Length was present. Undici now enforces maxSize against received bytes and aborts oversized responses. Fixed by 6d583124.
  • GHSA-r53p-7pc4-xj5r: the retry interceptor could concatenate a resumed response with inconsistent framing into downstream output, enabling response splitting or corruption. Undici now validates Content-Range against the original response framing before resuming. Fixed by 0160a719.

What's Changed

New Contributors

... (truncated)

Commits
  • 5e541e0 Bumped v8.10.2 (#5771)
  • eb04cc3 fix(fetch): only send Sec-Fetch-Mode to potentially trustworthy URLs (#5738)
  • e905b5b fix(retry): settle exposed body on terminal failure
  • 0160a71 fix(retry): validate resumed response framing
  • 66e1281 fix(websocket): reject unrequested subprotocols
  • 7aac7f1 fix(decompress): limit decompressed response size
  • cb75bbb fix(cache): do not cache Set-Cookie in shared caches
  • 6d58312 fix(interceptor/dump): abort oversized chunked responses
  • 8f5868f fix: preserve BalancedPool connection options
  • 2be07bf fix(cache): reject unsafe method response caching
  • Additional commits viewable in compare view

Updates @earendil-works/pi-coding-agent from 0.83.0 to 0.85.1

Release notes

Sourced from @​earendil-works/pi-coding-agent's releases.

v0.85.1

New Features

  • GPT-6 Astra — Available through OpenAI API keys and OpenAI Codex subscriptions. See API Keys and OpenAI Codex.

Added

  • Added GPT-6 Astra for OpenAI API keys and OpenAI Codex subscriptions.
  • Added five-times-faster mouse wheel scrolling while holding Alt in fullscreen mode (#9166 by @​xl0).

Fixed

  • Fixed configurable save keybindings in the model and thinking selectors (#9149 by @​rwachtler).
  • Fixed SDK import failures caused by unintentionally publishing internal experimental code and dependencies in 0.85.0. The experimental client and experimental/plugin subpaths and server/client commands are now source-only through pi-test.sh; the supported local SDK and stdio RPC API are unchanged (#9132).
  • Fixed mouse hover changing selection and recentering autocomplete and settings lists, causing clicks to target a different item.
  • Fixed long prompt-cache requests for GPT-5.6+ Responses models to use prompt_cache_options.ttl: "30m" instead of prompt_cache_retention: "24h".

v0.85.0

New Features

  • Persistent Claude thinking effort — Supported Anthropic transports preserve per-turn effort and recover safely from signed-thinking mismatches. See Model Configuration.
  • Fullscreen transcript controls — Jump to the latest message from a scrolled transcript and use the embedded working indicator. See TUI Fullscreen Viewport.
  • Restorable in-memory sessions — Resume externally stored session entries through the SDK. See Session Management.

Added

  • Added SessionManager.inMemory() support for restoring externally managed session entries (#8980 by @​y-nk).
  • Added inherited OpenAI-compatible vllmPriority and supportsMaxOutputTokens model settings for vLLM scheduler priority and OpenAI Responses output-token limits (#9004 by @​AppleDannyClegg, #8941 by @​scturtle).
  • Added inherited LaTeX rendering for relational algebra join symbols (#9050 by @​haoqixu).
  • Added a clickable "Jump to latest message" label with the tui.altScreen.bottom shortcut to the fullscreen transcript while it is scrolled up (#9080 by @​rwachtler).

Changed

  • Moved the streaming working indicator into the default editor border and matched its default spinner and label to the thinking-level border color. Custom editors retain the standalone indicator unless they opt in to embedding it (#8799 by @​cristinaponcela).
  • Reduced inherited fullscreen transcript search latency on large transcripts by caching unchanged search results, indexing ASCII runs, and limiting highlight work to visible matches (#8800 by @​cristinaponcela).

Fixed

  • Fixed managed fd and ripgrep downloads on Linux musl systems (#9070 by @​Charlie0113-T).
  • Removed the unavailable inherited Grok Build 0.1 model from /model (#9093 by @​Jaaneek).
  • Fixed inherited provider streams emitting incompatible event sequences and custom tool-call deltas.
  • Restored the @earendil-works/pi-coding-agent/client compatibility entry point.
  • Fixed the inherited Qwen Token Plan Individual catalog to include Qwen3.8 Flash (#9021).
  • Fixed inherited OpenAI Codex SSE parsing to process terminal events that are not followed by a blank line (#9047).
  • Fixed inherited GitHub Copilot Claude Fable 5 requests so selected reasoning levels are sent (#8961).
  • Fixed inherited Baseten GLM-5.2 models incorrectly advertising image input support (#8293 by @​Panoplos).
  • Fixed skills being unavailable when Bash is the only enabled tool (#8552 by @​xl0).
  • Fixed concurrent session shares overwriting one another (#8613 by @​wutongyuonce).
  • Fixed image orientation detection skipping EXIF data after non-EXIF APP1 segments (#8616 by @​wutongyuonce).
  • Fixed imported sessions overwriting an existing session with the same filename (#8985 by @​wutongyuonce).

... (truncated)

Changelog

Sourced from @​earendil-works/pi-coding-agent's changelog.

[0.85.1] - 2026-09-05

New Features

  • GPT-6 Astra — Available through OpenAI API keys and OpenAI Codex subscriptions. See API Keys and OpenAI Codex.

Added

  • Added GPT-6 Astra for OpenAI API keys and OpenAI Codex subscriptions.
  • Added five-times-faster mouse wheel scrolling while holding Alt in fullscreen mode (#9166 by @​xl0).

Fixed

  • Fixed configurable save keybindings in the model and thinking selectors (#9149 by @​rwachtler).
  • Fixed SDK import failures caused by unintentionally publishing internal experimental code and dependencies in 0.85.0. The experimental client and experimental/plugin subpaths and server/client commands are now source-only through pi-test.sh; the supported local SDK and stdio RPC API are unchanged (#9132).
  • Fixed mouse hover changing selection and recentering autocomplete and settings lists, causing clicks to target a different item.
  • Fixed long prompt-cache requests for GPT-5.6+ Responses models to use prompt_cache_options.ttl: "30m" instead of prompt_cache_retention: "24h".

[0.85.0] - 2026-09-04

New Features

  • Persistent Claude thinking effort — Supported Anthropic transports preserve per-turn effort and recover safely from signed-thinking mismatches. See Model Configuration.
  • Fullscreen transcript controls — Jump to the latest message from a scrolled transcript and use the embedded working indicator. See TUI Fullscreen Viewport.
  • Restorable in-memory sessions — Resume externally stored session entries through the SDK. See Session Management.

Added

  • Added SessionManager.inMemory() support for restoring externally managed session entries (#8980 by @​y-nk).
  • Added inherited OpenAI-compatible vllmPriority and supportsMaxOutputTokens model settings for vLLM scheduler priority and OpenAI Responses output-token limits (#9004 by @​AppleDannyClegg, #8941 by @​scturtle).
  • Added inherited LaTeX rendering for relational algebra join symbols (#9050 by @​haoqixu).
  • Added a clickable "Jump to latest message" label with the tui.altScreen.bottom shortcut to the fullscreen transcript while it is scrolled up (#9080 by @​rwachtler).

Changed

  • Moved the streaming working indicator into the default editor border and matched its default spinner and label to the thinking-level border color. Custom editors retain the standalone indicator unless they opt in to embedding it (#8799 by @​cristinaponcela).
  • Reduced inherited fullscreen transcript search latency on large transcripts by caching unchanged search results, indexing ASCII runs, and limiting highlight work to visible matches (#8800 by @​cristinaponcela).

Fixed

  • Fixed managed fd and ripgrep downloads on Linux musl systems (#9070 by @​Charlie0113-T).
  • Removed the unavailable inherited Grok Build 0.1 model from /model (#9093 by @​Jaaneek).
  • Fixed inherited provider streams emitting incompatible event sequences and custom tool-call deltas.
  • Restored the @earendil-works/pi-coding-agent/client compatibility entry point.
  • Fixed the inherited Qwen Token Plan Individual catalog to include Qwen3.8 Flash (#9021).
  • Fixed inherited OpenAI Codex SSE parsing to process terminal events that are not followed by a blank line (#9047).
  • Fixed inherited GitHub Copilot Claude Fable 5 requests so selected reasoning levels are sent (#8961).
  • Fixed inherited Baseten GLM-5.2 models incorrectly advertising image input support (#8293 by @​Panoplos).
  • Fixed skills being unavailable when Bash is the only enabled tool (#8552 by @​xl0).
  • Fixed concurrent session shares overwriting one another (#8613 by @​wutongyuonce).

... (truncated)

Commits
  • d981de1 Release v0.85.1
  • cce6553 docs(tui): document Alt-wheel scrolling in unreleased changelogs
  • 082f757 fix(coding-agent): make footer debounce tests deterministic
  • 6f11c31 fix(coding-agent): assert source-only experimental package exports
  • 1a46b92 docs: audit changelogs for v0.85.1
  • 1382777 fix(coding-agent): keep remote harness dependencies development-only
  • 17de82d feat(ai): add GPT-6 Astra support
  • 92d8e2d fix(coding-agent): selector save keybindings (#9149)
  • 47236c8 docs(coding-agent): document running pi in Docker Sandboxes (#9077)
  • dd7e816 Add [Unreleased] section for next cycle
  • Additional commits viewable in compare view

Updates @earendil-works/pi-tui from 0.83.0 to 0.85.1

Release notes

Sourced from @​earendil-works/pi-tui's releases.

v0.85.1

New Features

  • GPT-6 Astra — Available through OpenAI API keys and OpenAI Codex subscriptions. See API Keys and OpenAI Codex.

Added

  • Added GPT-6 Astra for OpenAI API keys and OpenAI Codex subscriptions.
  • Added five-times-faster mouse wheel scrolling while holding Alt in fullscreen mode (#9166 by @​xl0).

Fixed

  • Fixed configurable save keybindings in the model and thinking selectors (#9149 by @​rwachtler).
  • Fixed SDK import failures caused by unintentionally publishing internal experimental code and dependencies in 0.85.0. The experimental client and experimental/plugin subpaths and server/client commands are now source-only through pi-test.sh; the supported local SDK and stdio RPC API are unchanged (#9132).
  • Fixed mouse hover changing selection and recentering autocomplete and settings lists, causing clicks to target a different item.
  • Fixed long prompt-cache requests for GPT-5.6+ Responses models to use prompt_cache_options.ttl: "30m" instead of prompt_cache_retention: "24h".

v0.85.0

New Features

  • Persistent Claude thinking effort — Supported Anthropic transports preserve per-turn effort and recover safely from signed-thinking mismatches. See Model Configuration.
  • Fullscreen transcript controls — Jump to the latest message from a scrolled transcript and use the embedded working indicator. See TUI Fullscreen Viewport.
  • Restorable in-memory sessions — Resume externally stored session entries through the SDK. See Session Management.

Added

  • Added SessionManager.inMemory() support for restoring externally managed session entries (#8980 by @​y-nk).
  • Added inherited OpenAI-compatible vllmPriority and supportsMaxOutputTokens model settings for vLLM scheduler priority and OpenAI Responses output-token limits (#9004 by @​AppleDannyClegg, #8941 by @​scturtle).
  • Added inherited LaTeX rendering for relational algebra join symbols (#9050 by @​haoqixu).
  • Added a clickable "Jump to latest message" label with the tui.altScreen.bottom shortcut to the fullscreen transcript while it is scrolled up (#9080 by @​rwachtler).

Changed

  • Moved the streaming working indicator into the default editor border and matched its default spinner and label to the thinking-level border color. Custom editors retain the standalone indicator unless they opt in to embedding it (#8799 by @​cristinaponcela).
  • Reduced inherited fullscreen transcript search latency on large transcripts by caching unchanged search results, indexing ASCII runs, and limiting highlight work to visible matches (#8800 by @​cristinaponcela).

Fixed

  • Fixed managed fd and ripgrep downloads on Linux musl systems (#9070 by @​Charlie0113-T).
  • Removed the unavailable inherited Grok Build 0.1 model from /model (#9093 by @​Jaaneek).
  • Fixed inherited provider streams emitting incompatible event sequences and custom tool-call deltas.
  • Restored the @earendil-works/pi-coding-agent/client compatibility entry point.
  • Fixed the inherited Qwen Token Plan Individual catalog to include Qwen3.8 Flash (#9021).
  • Fixed inherited OpenAI Codex SSE parsing to process terminal events that are not followed by a blank line (#9047).
  • Fixed inherited GitHub Copilot Claude Fable 5 requests so selected reasoning levels are sent (#8961).
  • Fixed inherited Baseten GLM-5.2 models incorrectly advertising image input support (#8293 by @​Panoplos).
  • Fixed skills being unavailable when Bash is the only enabled tool (#8552 by @​xl0).
  • Fixed concurrent session shares overwriting one another (#8613 by @​wutongyuonce).
  • Fixed image orientation detection skipping EXIF data after non-EXIF APP1 segments (#8616 by @​wutongyuonce).
  • Fixed imported sessions overwriting an existing session with the same filename (#8985 by @​wutongyuonce).

... (truncated)

Changelog

Sourced from @​earendil-works/pi-tui's changelog.

[0.85.1] - 2026-09-05

Added

  • Added five-times-faster mouse wheel scrolling while holding Alt in fullscreen mode (#9166 by @​xl0).

Fixed

  • Fixed mouse hover changing selection and recentering autocomplete and settings lists, causing clicks to target a different item.

[0.85.0] - 2026-09-04

Breaking Changes

  • Removed coding-agent environment-variable defaults from pi-tui. Applications must configure the hardware cursor and clear-on-shrink behavior through the renderer constructor and setClearOnShrink(). PI_DEBUG_REDRAW is now PI_TUI_DEBUG_REDRAW; debug and crash log filenames now use the pi-tui- prefix. When no log directory is supplied, redraw logging is disabled and crash dumps are written to the OS temp directory. (#8699 by @​geraschenko)

Added

  • Added a TuiAltScreen scrollToEndIndicator option that renders a clickable jump-to-end label on a follow-end primary scroll view while it is scrolled away from the end (#9080 by @​rwachtler).
  • Added LaTeX rendering for relational algebra join symbols (#9050 by @​haoqixu).

Changed

  • Changed the Loader animation and editor integration to support embedded working indicators (#8799 by @​cristinaponcela).
  • Reduced fullscreen transcript search latency on large transcripts by caching unchanged search results, indexing ASCII runs, and limiting highlight work to visible matches (#8800 by @​cristinaponcela).

Fixed

  • Fixed drag selection continuing over an editor.
  • Fixed terminal startup under restricted seccomp policies that reject the SIGWINCH self-signal (#8898 by @​bartlomiejkida).
  • Fixed Zed terminal image capability detection (#8828 by @​Perlence).

[0.84.4] - 2026-08-28

Added

  • Added environment and programmatic overrides for OSC 8 hyperlinks, inline image protocols, and truecolor terminal capabilities (#8665).
  • Added a TuiAltScreen copyOnSelect option plus helpers to detect and copy the active fullscreen text selection programmatically (#7720).

Changed

  • Changed fullscreen scrollbars to render muted thin tracks with contrasting proportional two-cell-minimum thumbs, preserve underlying backgrounds without inheriting foreground styles, reserve an unstyled column in always mode, reveal hidden auto tracks on pointer entry, expand the same-colored thumb on hover, and support track-click jumping in addition to thumb dragging.
  • Changed fullscreen transcript search to use a bordered, placeholder-based input with a muted result count, right-aligned clickable key-and-arrow buttons with configurable hover styling, and open-shortcut toggling.

Fixed

  • Fixed main-screen rendering crashing when image-heavy output exceeded V8's string length limit (#8028).
  • Fixed autocomplete ordering for nested results (#8669).
  • Fixed fullscreen double-click word selection splitting paths and kebab-case tokens on / and - (#7746).

... (truncated)

Commits
  • d981de1 Release v0.85.1
  • cce6553 docs(tui): document Alt-wheel scrolling in unreleased changelogs
  • ab9e6f8 feat(tui): accelerate Alt-modified wheel scrolling (#9166)
  • 9841914 fix(tui): keep list selection unchanged on mouse hover
  • dd7e816 Add [Unreleased] section for next cycle
  • 107d79f Release v0.85.0
  • 1148f79 docs: audit unreleased changelogs
  • 2d41163 fix(tui): make fullscreen transcript search scale linearly
  • 457ae8c feat(tui): alt mode scrollbar but prettier (#8801)
  • 7968053 feat(tui): add clickable jump-to-end indicator to fullscreen transcript
  • Additional commits viewable in compare view

Updates @types/node from 22.20.1 to 22.20.2

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the dev-dependencies group across 1 directory with …
4c61396 
…4 updates

Bumps the dev-dependencies group with 4 updates in the / directory: [undici](https://github.com/nodejs/undici), [@earendil-works/pi-coding-agent](https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent), [@earendil-works/pi-tui](https://github.com/earendil-works/pi/tree/HEAD/packages/tui) and [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node).


Updates `undici` from 8.9.0 to 8.10.2
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v8.9.0...v8.10.2)

Updates `@earendil-works/pi-coding-agent` from 0.83.0 to 0.85.1
- [Release notes](https://github.com/earendil-works/pi/releases)
- [Changelog](https://github.com/earendil-works/pi/blob/main/packages/coding-agent/CHANGELOG.md)
- [Commits](https://github.com/earendil-works/pi/commits/v0.85.1/packages/coding-agent)

Updates `@earendil-works/pi-tui` from 0.83.0 to 0.85.1
- [Release notes](https://github.com/earendil-works/pi/releases)
- [Changelog](https://github.com/earendil-works/pi/blob/main/packages/tui/CHANGELOG.md)
- [Commits](https://github.com/earendil-works/pi/commits/v0.85.1/packages/tui)

Updates `@types/node` from 22.20.1 to 22.20.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 8.10.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: "@earendil-works/pi-coding-agent"
  dependency-version: 0.85.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: "@earendil-works/pi-tui"
  dependency-version: 0.85.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: "@types/node"
  dependency-version: 22.20.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants