[dependabot]

Bumps undici to 6.29.1 and updates ancestor dependencies undici and @earendil-works/pi-coding-agent. These dependencies need to be updated together.

Updates undici from 6.28.0 to 6.29.1

Release notes

Sourced from undici's releases.

v6.29.1

Security fixes

High severity

Denial of service via TLS 1.2 certificate-changing renegotiation

CVE-2026-87018 · GHSA-qrxm-fqhp-jwvm

A malicious or compromised HTTPS server could crash the Node.js process by initiating TLS 1.2 renegotiation and presenting a different, CA-trusted certificate whose hostname did not match the requested host. The resulting socket error reached an assertion in undici's HTTP/1.1 and HTTP/2 connection handling. This release handles post-connect certificate errors without terminating the process.

TLS certificate validation bypass through dropped Agent options

CVE-2026-109383 · GHSA-2m5v-pch6-74hx

Agent used a JSON-based clone for constructor options, which silently removed function-valued TLS options such as checkServerIdentity. Applications relying on custom certificate or public-key verification could therefore accept a certificate that the callback was intended to reject. This release preserves TLS options when creating per-origin dispatchers.

Denial of service through excessive Content-Encoding values

CVE-2026-109869 · GHSA-xjj6-f33q-929c

A malicious HTTP server could crash the Node.js process by returning more than five content codings and closing the connection before sending the body. Although fetch() rejected the response, an error from an orphaned internal stream could remain unhandled. This release validates the content-encoding chain before creating the body stream and aborts oversized chains safely.

Medium severity

Denial of service through unbounded EventSource parser state

CVE-2026-109924 · GHSA-4qv8-2p9j-2685

A malicious Server-Sent Events endpoint could exhaust process memory by sending many tiny data: fields without completing an event, or by splitting an unfinished line across many chunks. This release bounds retained EventSource parser state, including field counts, buffered chunks, unfinished-line length, and retained field data.

Denial of service through unbounded automatic WebSocket PONG buffering

CVE-2026-109932 · GHSA-9fm3-97px-rjf6

A malicious WebSocket server could exhaust process memory by flooding the client with PING frames while not reading the automatic PONG responses. undici previously ignored socket backpressure and allowed the outbound queue to grow without bound. This release pauses frame parsing when PONG writes encounter backpressure and resumes after the socket drains.

What's Changed

• [v6.x] fix(fetch): fix aborting Streams (#3754) by @​mrityunjay-pandey in nodejs/undici#6000

Full Changelog: nodejs/undici@v6.29.0...v6.29.1

v6.29.0

What's Changed

• [v6.x] fix(retry): settle exposed body on terminal failure by @​mcollina in nodejs/undici#5778
• Backport upgrade diagnostics lifecycle fixes to v6.x by @​BridgeAR in nodejs/undici#5833
• test: synchronize the issue-3356 body timeout by @​BridgeAR in nodejs/undici#5834

... (truncated)

Commits

• 8c57f6c [Release] v6.29.1 (#6023)
• 39f93e1 fix(websocket): bound automatic PONG writes under backpressure
• c43b23f fix(eventsource): bound retained SSE parser state
• 1325a87 fix(fetch): abort excessive content encoding responses
• 8c59f6b fix: preserve Agent connection options
• b40fbfc fix: handle post-connect TLS certificate errors
• 407630a [v6.x] fix(fetch): fix aborting Streams (#3754) (#6000)
• e1d0501 Bumped v6.29.0 (#5888)
• 57ac4de test: synchronize the issue-3356 body timeout (#5834)
• 6d44174 Backport upgrade diagnostics lifecycle fixes to v6.x (#5833)
• Additional commits viewable in compare view

Updates undici from 7.29.0 to 7.30.1

Release notes

Sourced from undici's releases.

v6.29.1

Security fixes

High severity

Denial of service via TLS 1.2 certificate-changing renegotiation

CVE-2026-87018 · GHSA-qrxm-fqhp-jwvm

A malicious or compromised HTTPS server could crash the Node.js process by initiating TLS 1.2 renegotiation and presenting a different, CA-trusted certificate whose hostname did not match the requested host. The resulting socket error reached an assertion in undici's HTTP/1.1 and HTTP/2 connection handling. This release handles post-connect certificate errors without terminating the process.

TLS certificate validation bypass through dropped Agent options

CVE-2026-109383 · GHSA-2m5v-pch6-74hx

Agent used a JSON-based clone for constructor options, which silently removed function-valued TLS options such as checkServerIdentity. Applications relying on custom certificate or public-key verification could therefore accept a certificate that the callback was intended to reject. This release preserves TLS options when creating per-origin dispatchers.

Denial of service through excessive Content-Encoding values

CVE-2026-109869 · GHSA-xjj6-f33q-929c

A malicious HTTP server could crash the Node.js process by returning more than five content codings and closing the connection before sending the body. Although fetch() rejected the response, an error from an orphaned internal stream could remain unhandled. This release validates the content-encoding chain before creating the body stream and aborts oversized chains safely.

Medium severity

Denial of service through unbounded EventSource parser state

CVE-2026-109924 · GHSA-4qv8-2p9j-2685

A malicious Server-Sent Events endpoint could exhaust process memory by sending many tiny data: fields without completing an event, or by splitting an unfinished line across many chunks. This release bounds retained EventSource parser state, including field counts, buffered chunks, unfinished-line length, and retained field data.

Denial of service through unbounded automatic WebSocket PONG buffering

CVE-2026-109932 · GHSA-9fm3-97px-rjf6

A malicious WebSocket server could exhaust process memory by flooding the client with PING frames while not reading the automatic PONG responses. undici previously ignored socket backpressure and allowed the outbound queue to grow without bound. This release pauses frame parsing when PONG writes encounter backpressure and resumes after the socket drains.

What's Changed

• [v6.x] fix(fetch): fix aborting Streams (#3754) by @​mrityunjay-pandey in nodejs/undici#6000

Full Changelog: nodejs/undici@v6.29.0...v6.29.1

v6.29.0

What's Changed

• [v6.x] fix(retry): settle exposed body on terminal failure by @​mcollina in nodejs/undici#5778
• Backport upgrade diagnostics lifecycle fixes to v6.x by @​BridgeAR in nodejs/undici#5833
• test: synchronize the issue-3356 body timeout by @​BridgeAR in nodejs/undici#5834

... (truncated)

Commits

• 8c57f6c [Release] v6.29.1 (#6023)
• 39f93e1 fix(websocket): bound automatic PONG writes under backpressure
• c43b23f fix(eventsource): bound retained SSE parser state
• 1325a87 fix(fetch): abort excessive content encoding responses
• 8c59f6b fix: preserve Agent connection options
• b40fbfc fix: handle post-connect TLS certificate errors
• 407630a [v6.x] fix(fetch): fix aborting Streams (#3754) (#6000)
• e1d0501 Bumped v6.29.0 (#5888)
• 57ac4de test: synchronize the issue-3356 body timeout (#5834)
• 6d44174 Backport upgrade diagnostics lifecycle fixes to v6.x (#5833)
• Additional commits viewable in compare view

Updates @earendil-works/pi-coding-agent from 0.79.9 to 1.4.0

Release notes

Sourced from @​earendil-works/pi-coding-agent's releases.

v1.4.0

New Features

• Image input for classifiers: codemode models.classify() accepts images for TypeSafe's Jev and Cloudflare's Clef models on typesafe, cloudflare-workers-ai, and OpenRouter. See Use classifier models and Codemode.
• Models Configuration reference: every provider, model, model override, and compatibility field of models.json, generated from its schema. See Models Configuration.
• Summaries without a fixed output cap: compaction and branch summaries use the model's output limit, so long reasoning no longer makes them fail. See Compaction.
• Codemode waits for a free worker: parallel scripts and in-process subagents queue instead of failing, and PI_CODEMODE_MAX_WORKERS raises the limit. See Codemode limits.
• Rex terminal support: OSC 8 hyperlinks, truecolor, and inline images.

Added

• Added a Models Configuration reference generated from the models.json schema, listing all provider, model, model override, and compatibility fields (#10790)
• Codemode models.classify() now accepts images for TypeSafe's Jev and Cloudflare's Clef models on typesafe, cloudflare-workers-ai, and OpenRouter, and lists Clef Omni and Jev 1.14 on Workers AI.
• Provider-level compat in models.json now also applies to classifier models, with the System One fields imageInput and sendImageOptInHeader for proxies that serve another service's classifiers. Extension classifier models accept compat too.
• Added MiniMax-M3.1-Flash to the minimax and minimax-cn providers, with thinking levels low through max (#11121)
• Added support for the Rex terminal: OSC 8 hyperlinks, truecolor, and inline images (#11131, #11150 by @​petrroll, #11183 by @​nihaals)

Changed

• Provider attribution headers now come from pi-ai's client identity. Extensions' before_provider_headers handlers no longer see the OpenRouter, NVIDIA NIM, and OpenCode attribution headers; returning null for one still removes it. Cloudflare requests send pi's detailed User-Agent instead of pi-coding-agent, as do GitHub release checks for tool downloads, and OpenCode requests send x-opencode-client whenever attribution is enabled, not only with a session.
• generateSummary() and generateSummaryWithUsage() now ignore their reserveTokens parameter. Summary requests use the model's output limit instead.
• Changed the default GitHub Copilot model from gpt-5.4, which Copilot retired, to gpt-6.1-sol.
• Changed the default NVIDIA model to nvidia/nemotron-3.5-super-vl-120b-a12b (#10910 by @​cv)
• Changed the default Xiaomi model to mimo-v2.6-pro for the xiaomi and Xiaomi Token Plan providers, since mimo-v2.5-pro left the catalog.
• Grok 4.3 and Grok 4.5 on the xai provider now offer the xhigh thinking level.
• Sign in with ChatGPT: ChatGPT Business workspace usage-limit errors are not retried and tell the user to ask their workspace admin to increase the limit.

Fixed

• Fixed compaction and branch summaries failing with "generation hit the token cap" when reasoning used most of the fixed summary output limit. Summaries now use the model's output limit, and compaction.reserveTokens only controls when compaction starts (#9512, #9075).
• Fixed models.schema.json missing descriptions for provider and model fields, so editors showed no hints for them (#10790)
• Fixed pi update failing with "Managed install marker is missing or invalid" when managed-install.json starts with a UTF-8 BOM, which Windows PowerShell 5.1 adds when it rewrites the file.
• Fixed HTML export showing literal asterisks for Markdown bold and italic next to CJK punctuation (#3353, #10154)
• Fixed the terminal staying in mouse-tracking, focus-reporting, Kitty keyboard, and alternate-screen modes when pi exits without its normal terminal teardown, which flooded the shell prompt with escape sequences (#11170)
• Fixed concurrent extension select/confirm/input/editor dialogs and inline custom() components in interactive mode: a second dialog replaced the first and the first promise never settled; closing the visible dialog now shows the previous one again (#11166, #9909)
• Fixed pasting in the shell hanging after copying text in pi and suspending it with Ctrl+Z on Linux: the background wl-copy/xclip/xsel process that keeps serving the clipboard was suspended along with pi (#11179)
• Fixed codemode scripts failing immediately when both codemode workers are busy, for example with parallel codemode calls or in-process subagents. Scripts now wait up to 60 seconds for a free worker, and PI_CODEMODE_MAX_WORKERS raises the limit of two workers (#11184)
• Fixed extensions failing to load when importing @earendil-works/pi-ai/models (e.g. for clampThinkingLevel) by exposing the subpath through the extension loader aliases and virtual modules (#11156)
• Fixed mcp.json files that start with a UTF-8 BOM failing to parse, which skipped all their MCP servers and made pi mcp add/pi mcp remove fail (#11191)
• Fixed /compact <instructions> ignoring the instructions when summarizing the start of a turn that compaction splits. When the split turn was the only new content since the last compaction, the instructions were ignored entirely (#11058)
• Fixed resumed sessions and /tree navigation leaving extension tools inactive when the branch recorded its tools before they were registered, such as tools from extensions installed after the session started. Extension tools the branch never added or removed are now active unless they are registered with defaultActive: false (#11062, #11075)
• Fixed sessions breaking after recovery from a response cut off at the output limit: the truncated tool call was omitted but its tool results were kept, so providers rejected every later request (#11227, #11233 by @​petrroll)
• Fixed the grep tool following RIPGREP_CONFIG_PATH, where options such as --fixed-strings silently changed regex searches into literal ones. The tool now runs rg --no-config (#11203, #11230 by @​petrroll)
• Fixed Windows shell detection rejecting runnable Microsoft Store shell aliases (#9504 by @​petrroll)
• Fixed Windows shell detection missing PowerShell outside PATH and the legacy WSL bash.exe launcher when Windows is not installed in C:\Windows. pi now checks %ProgramFiles%\PowerShell\7, %SystemRoot%\System32\WindowsPowerShell\v1.0, and %SystemRoot% (#9501 by @​petrroll)
• Fixed GitHub Copilot sessions with large request bodies, such as many images, failing with HTTP 413 failed to parse request instead of compacting and retrying (#11016 by @​petrroll)
• Fixed the openai-codex provider offering gpt-5.5 and gpt-5.3-codex-spark, which always fail for ChatGPT accounts (#11173 by @​lucasmeijer)
• Fixed whitespace-only tool output (for example a bare \r\n from bash) making OpenAI Completions, OpenAI Responses, and Google requests fail with a 400 (#8720)
• Fixed automatic retry not triggering for more gateway upstream failures, stream disconnected before completion errors relayed by Codex CLI proxies, and transient Google Vertex OAuth token refresh failures, and retrying errors because of digits inside request ids or byte counts (#10920, #11057, #10996)
• Fixed OpenAI Responses models losing the prompt cache on every deferred tool load after a tool was removed (#10940)

... (truncated)

Changelog

Sourced from @​earendil-works/pi-coding-agent's changelog.

[1.4.0] - 2026-10-21

New Features

• Image input for classifiers: codemode models.classify() accepts images for TypeSafe's Jev and Cloudflare's Clef models on typesafe, cloudflare-workers-ai, and OpenRouter. See Use classifier models and Codemode.
• Models Configuration reference: every provider, model, model override, and compatibility field of models.json, generated from its schema. See Models Configuration.
• Summaries without a fixed output cap: compaction and branch summaries use the model's output limit, so long reasoning no longer makes them fail. See Compaction.
• Codemode waits for a free worker: parallel scripts and in-process subagents queue instead of failing, and PI_CODEMODE_MAX_WORKERS raises the limit. See Codemode limits.
• Rex terminal support: OSC 8 hyperlinks, truecolor, and inline images.

Added

• Added a Models Configuration reference generated from the models.json schema, listing all provider, model, model override, and compatibility fields (#10790)
• Codemode models.classify() now accepts images for TypeSafe's Jev and Cloudflare's Clef models on typesafe, cloudflare-workers-ai, and OpenRouter, and lists Clef Omni and Jev 1.14 on Workers AI.
• Provider-level compat in models.json now also applies to classifier models, with the System One fields imageInput and sendImageOptInHeader for proxies that serve another service's classifiers. Extension classifier models accept compat too.
• Added MiniMax-M3.1-Flash to the minimax and minimax-cn providers, with thinking levels low through max (#11121)
• Added support for the Rex terminal: OSC 8 hyperlinks, truecolor, and inline images (#11131, #11150 by @​petrroll, #11183 by @​nihaals)

Changed

• Provider attribution headers now come from pi-ai's client identity. Extensions' before_provider_headers handlers no longer see the OpenRouter, NVIDIA NIM, and OpenCode attribution headers; returning null for one still removes it. Cloudflare requests send pi's detailed User-Agent instead of pi-coding-agent, as do GitHub release checks for tool downloads, and OpenCode requests send x-opencode-client whenever attribution is enabled, not only with a session.
• generateSummary() and generateSummaryWithUsage() now ignore their reserveTokens parameter. Summary requests use the model's output limit instead.
• Changed the default GitHub Copilot model from gpt-5.4, which Copilot retired, to gpt-6.1-sol.
• Changed the default NVIDIA model to nvidia/nemotron-3.5-super-vl-120b-a12b (#10910 by @​cv)
• Changed the default Xiaomi model to mimo-v2.6-pro for the xiaomi and Xiaomi Token Plan providers, since mimo-v2.5-pro left the catalog.
• Grok 4.3 and Grok 4.5 on the xai provider now offer the xhigh thinking level.
• Sign in with ChatGPT: ChatGPT Business workspace usage-limit errors are not retried and tell the user to ask their workspace admin to increase the limit.

Fixed

• Fixed compaction and branch summaries failing with "generation hit the token cap" when reasoning used most of the fixed summary output limit. Summaries now use the model's output limit, and compaction.reserveTokens only controls when compaction starts (#9512, #9075).
• Fixed models.schema.json missing descriptions for provider and model fields, so editors showed no hints for them (#10790)
• Fixed pi update failing with "Managed install marker is missing or invalid" when managed-install.json starts with a UTF-8 BOM, which Windows PowerShell 5.1 adds when it rewrites the file.
• Fixed HTML export showing literal asterisks for Markdown bold and italic next to CJK punctuation (#3353, #10154)
• Fixed the terminal staying in mouse-tracking, focus-reporting, Kitty keyboard, and alternate-screen modes when pi exits without its normal terminal teardown, which flooded the shell prompt with escape sequences (#11170)
• Fixed concurrent extension select/confirm/input/editor dialogs and inline custom() components in interactive mode: a second dialog replaced the first and the first promise never settled; closing the visible dialog now shows the previous one again (#11166, #9909)
• Fixed pasting in the shell hanging after copying text in pi and suspending it with Ctrl+Z on Linux: the background wl-copy/xclip/xsel process that keeps serving the clipboard was suspended along with pi (#11179)
• Fixed codemode scripts failing immediately when both codemode workers are busy, for example with parallel codemode calls or in-process subagents. Scripts now wait up to 60 seconds for a free worker, and PI_CODEMODE_MAX_WORKERS raises the limit of two workers (#11184)
• Fixed extensions failing to load when importing @earendil-works/pi-ai/models (e.g. for clampThinkingLevel) by exposing the subpath through the extension loader aliases and virtual modules (#11156)
• Fixed mcp.json files that start with a UTF-8 BOM failing to parse, which skipped all their MCP servers and made pi mcp add/pi mcp remove fail (#11191)
• Fixed /compact <instructions> ignoring the instructions when summarizing the start of a turn that compaction splits. When the split turn was the only new content since the last compaction, the instructions were ignored entirely (#11058)
• Fixed resumed sessions and /tree navigation leaving extension tools inactive when the branch recorded its tools before they were registered, such as tools from extensions installed after the session started. Extension tools the branch never added or removed are now active unless they are registered with defaultActive: false (#11062, #11075)
• Fixed sessions breaking after recovery from a response cut off at the output limit: the truncated tool call was omitted but its tool results were kept, so providers rejected every later request (#11227, #11233 by @​petrroll)
• Fixed the grep tool following RIPGREP_CONFIG_PATH, where options such as --fixed-strings silently changed regex searches into literal ones. The tool now runs rg --no-config (#11203, #11230 by @​petrroll)
• Fixed Windows shell detection rejecting runnable Microsoft Store shell aliases (#9504 by @​petrroll)
• Fixed Windows shell detection missing PowerShell outside PATH and the legacy WSL bash.exe launcher when Windows is not installed in C:\Windows. pi now checks %ProgramFiles%\PowerShell\7, %SystemRoot%\System32\WindowsPowerShell\v1.0, and %SystemRoot% (#9501 by @​petrroll)
• Fixed GitHub Copilot sessions with large request bodies, such as many images, failing with HTTP 413 failed to parse request instead of compacting and retrying (#11016 by @​petrroll)
• Fixed the openai-codex provider offering gpt-5.5 and gpt-5.3-codex-spark, which always fail for ChatGPT accounts (#11173 by @​lucasmeijer)
• Fixed whitespace-only tool output (for example a bare \r\n from bash) making OpenAI Completions, OpenAI Responses, and Google requests fail with a 400 (#8720)
• Fixed automatic retry not triggering for more gateway upstream failures, stream disconnected before completion errors relayed by Codex CLI proxies, and transient Google Vertex OAuth token refresh failures, and retrying errors because of digits inside request ids or byte counts (#10920, #11057, #10996)

... (truncated)

Commits

• 4a08025 Release v1.4.0
• f76b248 docs(ai,tui,coding-agent): audit changelogs since v1.3.0
• 7f225f2 feat(ai,coding-agent): image input for System One classifiers
• 0272608 fix(coding-agent): recovery omits tool results with the truncated tool call
• 8c4e873 fix(coding-agent): grep tool ignores ripgrep config via --no-config
• bd3c9b8 fix(coding-agent): activate extension tools registered after the branch recor...
• 04a93ba fix(ai,agent,coding-agent,durable): client identity follow-ups
• adc5fa9 feat(ai,agent,coding-agent): move client identity and provider attribution in...
• adfc144 fix(coding-agent): apply /compact instructions to split-turn prefix summary
• e5fe977 fix(ai,coding-agent): drop models retired upstream
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

@dependabot merge