chore(deps): bump undici and @earendil-works/pi-coding-agent

[dependabot]

Bumps undici to 8.10.2 and updates ancestor dependency @earendil-works/pi-coding-agent. These dependencies need to be updated together.

Updates undici from 8.5.0 to 8.10.2

Release notes

Sourced from undici's releases.

v8.10.2

⚠️ Security fixes

High severity

• GHSA-vp8m-p9jh-q5pm: cache and deduplication interceptors could use caller-controlled request metadata instead of the authoritative dispatcher origin, enabling cross-origin cache poisoning and data disclosure. Undici now derives interceptor identities from the dispatcher origin and bypasses origin-dependent interceptors when no authoritative origin exists. Fixed by caf6194d.
• GHSA-w293-vg96-wgc3: BalancedPool could drop function-valued connection options while cloning its configuration, including custom TLS certificate validation callbacks. Undici now preserves connect and legacy tls options when creating upstreams. Fixed by 8f5868fb.
• GHSA-rfgv-xxqx-mfg5: a WebSocket server could select a subprotocol when none was requested, causing an uncaught TypeError that could terminate the process. Undici now rejects the handshake with protocol error 1002. Fixed by 66e12816.

Medium severity

• GHSA-3wwx-pv8p-q78v: a malformed permessage-deflate payload exceeding the configured decompression limit could emit an unhandled zlib error and terminate the process. Undici now destroys the inflater after reaching the limit. Fixed by 4411a238.
• GHSA-rx4f-c7p8-82vq: an unclean WebSocketStream close could create an unobserved rejected promise when its writable stream was locked, potentially terminating the process. Undici now propagates the failure through the retained writable stream controller. Fixed by 662d0ea6.
• GHSA-2jfj-6hjv-fm6j: shared caches could store and replay responses containing Set-Cookie, disclosing one user's cookies to another caller. Undici now excludes these responses from shared caches, including existing entries and revalidation paths. Fixed by cb75bbb3.
• GHSA-3xpg-4rpp-hhhm: the decompression interceptor did not bound decoded output, allowing compressed responses to consume excessive memory. Undici now limits every decompression stage to 64 MiB by default and supports a configurable maxSize. Fixed by 7aac7f12.
• GHSA-pmjh-fq2x-6v4x: a terminal retry failure after response headers were exposed could orphan the original response body, causing consumers to hang indefinitely. Undici now propagates the terminal error to the exposed body. Fixed by e905b5b8.

Low severity

• GHSA-8436-99hf-9mmv: cache interceptors could store and replay responses to unsafe HTTP methods such as POST or DELETE. Undici now restricts cache reads and writes to safe methods while preserving invalidation by successful unsafe requests. Fixed by 2be07bf9.
• GHSA-2gqq-gqf2-x968: the dump interceptor could treat an oversized chunked response as successfully truncated when no Content-Length was present. Undici now enforces maxSize against received bytes and aborts oversized responses. Fixed by 6d583124.
• GHSA-r53p-7pc4-xj5r: the retry interceptor could concatenate a resumed response with inconsistent framing into downstream output, enabling response splitting or corruption. Undici now validates Content-Range against the original response framing before resuming. Fixed by 0160a719.

What's Changed

• build(deps-dev): bump undici from 6.27.0 to 6.28.0 by @​dependabot[bot] in nodejs/undici#5653
• build(deps-dev): bump jest from 30.4.2 to 30.5.0 by @​dependabot[bot] in nodejs/undici#5750
• build(deps): bump github/codeql-action/analyze from 4.37.3 to 4.37.9 by @​dependabot[bot] in nodejs/undici#5752
• build(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.9 by @​dependabot[bot] in nodejs/undici#5754
• test(h2): cover stream reset with NGHTTP2_INTERNAL_ERROR by @​zeexzeex in nodejs/undici#5725
• fix(retry): reject invalid resumed responses by @​mcollina in nodejs/undici#5724
• test: make stale-while-revalidate cache update test deterministic by @​mcollina in nodejs/undici#5722
• fix: avoid unbounded recursion in Set-Cookie attribute parser by @​mcollina in nodejs/undici#5757
• fix: honor SOCKS5 connection timeout by @​mcollina in nodejs/undici#5733
• fix(eventsource): validate Last-Event-ID on reconnect by @​mcollina in nodejs/undici#5746
• fix: avoid duplicate release attempts by @​mcollina in nodejs/undici#5745
• fix(cache): refetch when 304 adds vary fields by @​mcollina in nodejs/undici#5732
• types: expose PendingInterceptor and PendingInterceptorsFormatter on the MockAgent namespace by @​RaphaelFakhri in nodejs/undici#5721
• ci(codeql): align CodeQL action versions to v4.37.9 by @​mcollina in nodejs/undici#5759
• build(deps-dev): bump @​humanfs/node from 0.16.7 to 0.16.8 by @​dependabot[bot] in nodejs/undici#5760
• fix(proxy-agent): guard Proxy-Authorization in iterable header containers by @​mcollina in nodejs/undici#5758
• docs: name the parameters these two blocks describe by @​darkdi in nodejs/undici#5735
• fix(websocket): fail the connection on a non-200 h2 extended CONNECT response by @​kjsik11 in nodejs/undici#5751
• test(node-fetch): re-enable the set-cookie header combining test by @​pacocartones in nodejs/undici#5730
• fix(retry): forward rawHeaders writes through RetryController by @​official-burak in nodejs/undici#5727
• fix(fetch): only send Sec-Fetch-Mode to potentially trustworthy URLs by @​kjsik11 in nodejs/undici#5738

New Contributors

• @​darkdi made their first contribution in nodejs/undici#5735
• @​kjsik11 made their first contribution in nodejs/undici#5751

... (truncated)

Commits

• 5e541e0 Bumped v8.10.2 (#5771)
• eb04cc3 fix(fetch): only send Sec-Fetch-Mode to potentially trustworthy URLs (#5738)
• e905b5b fix(retry): settle exposed body on terminal failure
• 0160a71 fix(retry): validate resumed response framing
• 66e1281 fix(websocket): reject unrequested subprotocols
• 7aac7f1 fix(decompress): limit decompressed response size
• cb75bbb fix(cache): do not cache Set-Cookie in shared caches
• 6d58312 fix(interceptor/dump): abort oversized chunked responses
• 8f5868f fix: preserve BalancedPool connection options
• 2be07bf fix(cache): reject unsafe method response caching
• Additional commits viewable in compare view

Updates @earendil-works/pi-coding-agent from 0.80.2 to 0.99.1

Release notes

Sourced from @​earendil-works/pi-coding-agent's releases.

v0.99.1

New Features

• GPT-6.1 Sol — Available on OpenAI, Azure OpenAI, and OpenAI Codex, and now the default OpenAI Codex model. See Select a model.

Added

• Added GPT-6.1 Sol (gpt-6.1-sol) to the OpenAI, Azure OpenAI Responses, and OpenAI Codex providers.

Changed

• Changed the default OpenAI Codex model to GPT-6.1 Sol (gpt-6.1-sol).

Fixed

• Fixed /login with OpenAI failing in the bundled release with a missing openai-chatgpt.js module error.

v0.99.0

New Features

• Codemode and MCP — Connect MCP servers and let models run JavaScript that calls tools in parallel. See MCP Servers and Enable codemode.
• System theme — Pi's colors now come from your terminal's own palette by default. See Use your terminal's colors.
• Sign in with ChatGPT — Use a ChatGPT subscription with the OpenAI provider through /login openai. See Authenticate interactively.
• Virtual models — Extensions can route each request to a different physical model. See Virtual Models.
• Classifier models — Run Jev classifiers from codemode scripts, or use any llama.cpp model as a classifier. See How codemode works and Classification.

Added

• Added codemode, tool search, and MCP support as built-in extensions. The codemode tool runs model-written JavaScript in a QuickJS sandbox that calls pi's tools; enable it with defaultTools or --tools and configure it with codemode.mode and codemode.inlineBudget. tool_search finds tools that are not declared to the model and declares them. MCP servers over stdio or streamable HTTP, with OAuth, come from mcp.json (global, or per project once trusted) or pi.registerMcpServer() and are managed with /mcp and pi mcp add|remove|list|login|logout. See MCP Servers and Enable codemode (#10040).
• Added extension tool APIs for orchestrating tools: exposure (direct, model-only, codemode, deferred, or hidden), namespace, annotations, outputSchema with structuredContent, isError results, prepareLoadout(), and ctx.executeTool() for nested tool calls, which emit events with parentToolCallId and are recorded as bounded nestedCalls on the calling tool's result. See Tool exposure.
• Added a warning when an extension that registers the same tool, command, or flag replaces a built-in extension (#10174 by @​cristinaponcela).
• Added experimental virtual models: extensions register them with pi.registerVirtualModel() and pick a physical model and thinking level for each request. The footer shows the routed model, /session lists cost per physical model, and examples/extensions/jev-router.ts routes with the Jev classifier. See Virtual Models.
• Added Sign in with ChatGPT to the OpenAI provider in /login, which uses a ChatGPT subscription with the OpenAI API. Pi stores a stable deviceId in the global settings for this login and omits it from bug reports.
• Added the system theme, now the default, which derives pi's colors from the terminal's reported foreground, background, and ANSI palette and rebuilds them when the terminal switches between light and dark. See Use your terminal's colors.
• Added #rgb, oklch(), and okhsl() colors and an optional appearance field to theme files, and theme.style(), theme.colors, and theme.appearance for extensions. See Themes and TUI.
• Added a classifier model for every llama.cpp chat model, answered from next-token label probabilities. See Classification.
• Added inherited Jev classifier models on OpenRouter, Cloudflare Workers AI, Vercel AI Gateway, and OpenCode Zen.
• Added the fullscreenWheelScrollLines setting and /settings entry for fullscreen mouse-wheel scrolling. The default "auto" accelerates fast wheel spins outside local macOS terminals (#9758).
• Added per-input disposition to successful RPC prompt, steer, and follow_up responses, AgentSession.steer()/followUp(), and RpcClient.prompt()/steer()/followUp(); RpcClient.prompt() also accepts streamingBehavior (#9098, #9803).
• Added image generation to ModelRuntime: generateImages() with runtime-resolved auth (stored credentials, OAuth, runtime API keys, models.json headers), plus getModelsOfType(), getModelOfType(), getAvailableOfType(), getAllModels(), and getAllAvailable(). OpenRouter image models are listed under the openrouter provider and share its credential; an upstream ID can have separate chat and image entries. models.json providers and extension registrations without a model list keep built-in image generation. Extension model lists can include discriminated chat, image, and classifier entries with operation implementations; when supplied, they replace the provider catalog across every operation. Chat-facing reads (getModels(), getAvailableSnapshot(), the model picker) are unchanged.
• Added classifier support to ModelRuntime, including classify(), classifier model accessors, runtime-resolved authentication, and the built-in TypeSafe jev-latest model.
• Added types=chat,image,classifier to pi.dev model catalog requests so remote refreshes overlay every supported model type; entries of unknown model types are ignored.
• Added the provider_stream_event extension event for observing parsed provider events before normalization, with an opt-in /debug-provider example viewer (#9784, #9901 by @​davidbrai).
• Added a show/hide toggle (H) in HTML exports for custom messages marked display: false. Messages remain hidden by default and can also be revealed from the sidebar (#8896, #10020 by @​rwachtler).
• Added inherited Claude Sonnet 5.5 support for Anthropic with adaptive thinking and a 1M context window.
• Added a Built-in section in pi config to disable the built-in mcp, llama.cpp, codemode, and tool-search extensions globally or per project, stored as -builtin:<name> in the extensions setting. SDK inline extensions opt in with builtin: true.
• Added +name and -name entries to the defaultTools setting to add or remove tools without repeating the defaults, for example "defaultTools": ["+codemode"]. Project entries of this form apply on top of the user setting. Documented how to enable codemode without MCP and how to use classifier models such as Jev from codemode scripts.
• Added the token usage and cost of codemode models.classify() calls to the codemode tool result, so they count toward the session cost; the codemode result shows each call's cost.

Changed

... (truncated)

Changelog

Sourced from @​earendil-works/pi-coding-agent's changelog.

[0.99.1] - 2026-09-29

New Features

• GPT-6.1 Sol — Available on OpenAI, Azure OpenAI, and OpenAI Codex, and now the default OpenAI Codex model. See Select a model.

Added

• Added GPT-6.1 Sol (gpt-6.1-sol) to the OpenAI, Azure OpenAI Responses, and OpenAI Codex providers.

Changed

• Changed the default OpenAI Codex model to GPT-6.1 Sol (gpt-6.1-sol).

Fixed

• Fixed /login with OpenAI failing in the bundled release with a missing openai-chatgpt.js module error.

[0.99.0] - 2026-09-29

New Features

• Codemode and MCP — Connect MCP servers and let models run JavaScript that calls tools in parallel. See MCP Servers and Enable codemode.
• System theme — Pi's colors now come from your terminal's own palette by default. See Use your terminal's colors.
• Sign in with ChatGPT — Use a ChatGPT subscription with the OpenAI provider through /login openai. See Authenticate interactively.
• Virtual models — Extensions can route each request to a different physical model. See Virtual Models.
• Classifier models — Run Jev classifiers from codemode scripts, or use any llama.cpp model as a classifier. See How codemode works and Classification.

Added

• Added codemode, tool search, and MCP support as built-in extensions. The codemode tool runs model-written JavaScript in a QuickJS sandbox that calls pi's tools; enable it with defaultTools or --tools and configure it with codemode.mode and codemode.inlineBudget. tool_search finds tools that are not declared to the model and declares them. MCP servers over stdio or streamable HTTP, with OAuth, come from mcp.json (global, or per project once trusted) or pi.registerMcpServer() and are managed with /mcp and pi mcp add|remove|list|login|logout. See MCP Servers and Enable codemode (#10040).
• Added extension tool APIs for orchestrating tools: exposure (direct, model-only, codemode, deferred, or hidden), namespace, annotations, outputSchema with structuredContent, isError results, prepareLoadout(), and ctx.executeTool() for nested tool calls, which emit events with parentToolCallId and are recorded as bounded nestedCalls on the calling tool's result. See Tool exposure.
• Added a warning when an extension that registers the same tool, command, or flag replaces a built-in extension (#10174 by @​cristinaponcela).
• Added experimental virtual models: extensions register them with pi.registerVirtualModel() and pick a physical model and thinking level for each request. The footer shows the routed model, /session lists cost per physical model, and examples/extensions/jev-router.ts routes with the Jev classifier. See Virtual Models.
• Added Sign in with ChatGPT to the OpenAI provider in /login, which uses a ChatGPT subscription with the OpenAI API. Pi stores a stable deviceId in the global settings for this login and omits it from bug reports.
• Added the system theme, now the default, which derives pi's colors from the terminal's reported foreground, background, and ANSI palette and rebuilds them when the terminal switches between light and dark. See Use your terminal's colors.
• Added #rgb, oklch(), and okhsl() colors and an optional appearance field to theme files, and theme.style(), theme.colors, and theme.appearance for extensions. See Themes and TUI.
• Added a classifier model for every llama.cpp chat model, answered from next-token label probabilities. See Classification.
• Added inherited Jev classifier models on OpenRouter, Cloudflare Workers AI, Vercel AI Gateway, and OpenCode Zen.
• Added the fullscreenWheelScrollLines setting and /settings entry for fullscreen mouse-wheel scrolling. The default "auto" accelerates fast wheel spins outside local macOS terminals (#9758).
• Added per-input disposition to successful RPC prompt, steer, and follow_up responses, AgentSession.steer()/followUp(), and RpcClient.prompt()/steer()/followUp(); RpcClient.prompt() also accepts streamingBehavior (#9098, #9803).
• Added image generation to ModelRuntime: generateImages() with runtime-resolved auth (stored credentials, OAuth, runtime API keys, models.json headers), plus getModelsOfType(), getModelOfType(), getAvailableOfType(), getAllModels(), and getAllAvailable(). OpenRouter image models are listed under the openrouter provider and share its credential; an upstream ID can have separate chat and image entries. models.json providers and extension registrations without a model list keep built-in image generation. Extension model lists can include discriminated chat, image, and classifier entries with operation implementations; when supplied, they replace the provider catalog across every operation. Chat-facing reads (getModels(), getAvailableSnapshot(), the model picker) are unchanged.
• Added classifier support to ModelRuntime, including classify(), classifier model accessors, runtime-resolved authentication, and the built-in TypeSafe jev-latest model.
• Added types=chat,image,classifier to pi.dev model catalog requests so remote refreshes overlay every supported model type; entries of unknown model types are ignored.
• Added the provider_stream_event extension event for observing parsed provider events before normalization, with an opt-in /debug-provider example viewer (#9784, #9901 by @​davidbrai).
• Added a show/hide toggle (H) in HTML exports for custom messages marked display: false. Messages remain hidden by default and can also be revealed from the sidebar (#8896, #10020 by @​rwachtler).
• Added inherited Claude Sonnet 5.5 support for Anthropic with adaptive thinking and a 1M context window.
• Added a Built-in section in pi config to disable the built-in mcp, llama.cpp, codemode, and tool-search extensions globally or per project, stored as -builtin:<name> in the extensions setting. SDK inline extensions opt in with builtin: true.
• Added +name and -name entries to the defaultTools setting to add or remove tools without repeating the defaults, for example "defaultTools": ["+codemode"]. Project entries of this form apply on top of the user setting. Documented how to enable codemode without MCP and how to use classifier models such as Jev from codemode scripts.
• Added the token usage and cost of codemode models.classify() calls to the codemode tool result, so they count toward the session cost; the codemode result shows each call's cost.

... (truncated)

Commits

• d86654a Release v0.99.1
• a879e23 docs(coding-agent): audit unreleased changelog
• 72abf01 fix(coding-agent): bundle openai-chatgpt OAuth flow
• 12c416e feat(ai,coding-agent): add GPT-6.1 Sol and make it the Codex default
• 312184e Add [Unreleased] section for next cycle
• 4b060d3 Release v0.99.0
• f81cf55 docs: audit changelogs for 0.99.0
• 8eb2bcc fix: bump vitest to 4.1.11 and gondolin's undici to 6.29.0
• 1ff5b6f feat(coding-agent): return up to 1 MiB of bash output to codemode scripts
• 02eed88 feat(ai,coding-agent): add alternative sign in for the openai provider
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.