chore(deps): bump undici and @earendil-works/pi-coding-agent

[dependabot]

Bumps undici and @earendil-works/pi-coding-agent. These dependencies needed to be updated together.
Updates undici from 8.5.0 to 8.9.0

Release notes

Sourced from undici's releases.

v8.9.0

⚠️ Security fixes

High severity

• GHSA-4cwx-7wf7-3272: malformed qualified private Cache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crash. The cache parser now treats empty qualified directives conservatively and safely handles mixed qualified and unqualified directives. Fixed by 4fe5bc5f with regression coverage in 9f09b49a.

Medium severity

• GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 7d3cf924.
• GHSA-jr45-8vmc-qm54: optional whitespace around = in qualified no-cache and private directives could bypass shared-cache restrictions and disclose authenticated data across users. Cache-Control parsing now normalizes these forms and applies conservative cache decisions. Fixed by c601fff1.
• GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by e11a68ed, with corrected fixtures in 2b3f7493.
• GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by 10d93fc3.

Additional hardening

Undici now validates non-string header values after coercion, including array elements, preventing crafted toString() or Symbol.toPrimitive implementations from introducing CRLF sequences. This defense-in-depth change was made in 354a151f.

What's Changed

• fix(decompress): preserve response trailers by @​Ram-blip in nodejs/undici#5572
• build(deps-dev): bump ws from 8.21.0 to 8.21.1 by @​dependabot[bot] in nodejs/undici#5576
• fix: validate coerced header values for CRLF by @​mcollina in nodejs/undici#5579
• fix: handle frozen globalThis in setGlobalDispatcher by @​mhayk in nodejs/undici#5574
• Ignore auto-generated .npmrc on Windows by @​tsctx in nodejs/undici#5583

New Contributors

• @​mhayk made their first contribution in nodejs/undici#5574

Full Changelog: nodejs/undici@v8.8.0...v8.9.0

v8.8.0

What's Changed

• fetch: use ReadableStreamTee for cloning streams by @​KhafraDev in nodejs/undici#5517
• fix(benchmarks): adjust got after v15 upgrade by @​slagiewka in nodejs/undici#5526
• feat(mock): support asynchronous reply options callbacks by @​Develop-KIM in nodejs/undici#5534
• docs: clarify proxy threat model by @​mcollina in nodejs/undici#5530
• docs: clarify MockAgent pool usage by @​vibhor-aggr in nodejs/undici#5542
• docs: clarify parser timeout precision by @​vibhor-aggr in nodejs/undici#5543
• fix: handle flat alternating header arrays in cache normalizeHeaders by @​mcollina in nodejs/undici#5536
• chore(benchmarks): require(esm) on ESM-only packages by @​slagiewka in nodejs/undici#5527
• fix: run idle socket validation off setImmediate instead of setTimeout by @​carlotestor in nodejs/undici#5499
• docs: add custom interceptor example by @​vibhor-aggr in nodejs/undici#5548
• fix(h1): ignore type of service errors by @​mcollina in nodejs/undici#5547
• fix(fetch): convert null init in Response.json by @​Ram-blip in nodejs/undici#5540
• fix(redirect): remove body headers after POST-to-GET by @​Ram-blip in nodejs/undici#5551
• build(deps-dev): bump fast-check from 4.8.0 to 4.9.0 by @​dependabot[bot] in nodejs/undici#5556
• fix(h2): allow stream-bodied requests to multiplex on a busy session by @​GiHoon1123 in nodejs/undici#5538
• fix(h2): destroy aborted stream synchronously instead of via setImmediate by @​staylor in nodejs/undici#5559
• fix(decompress): skip HEAD responses by @​Ram-blip in nodejs/undici#5564
• ci: build undici with node.js v26 by @​shivarm in nodejs/undici#5237

... (truncated)

Commits

• 21a8e1e Bumped v8.9.0 (#5589)
• 7d3cf92 fix: validate blob body content type
• c601fff fix(cache): harden cache directive parsing
• 2b3f749 test(retry): correct broken content-range fixtures in retry-handler.js
• e11a68e fix(retry): reject partial content length mismatch
• 9f09b49 test: cover crash on mixed unqualified and qualified private cache directives
• 4fe5bc5 fix: handle empty qualified private cache directive
• 10d93fc fix: harden cookie domain, path, and unparsed attribute validation
• a17e301 Ignore auto-generated .npmrc on Windows (#5583)
• a0922b0 fix: handle frozen globalThis in setGlobalDispatcher (#5574)
• Additional commits viewable in compare view

Updates @earendil-works/pi-coding-agent from 0.79.8 to 0.85.1

Release notes

Sourced from @​earendil-works/pi-coding-agent's releases.

v0.85.1

New Features

• GPT-6 Astra — Available through OpenAI API keys and OpenAI Codex subscriptions. See API Keys and OpenAI Codex.

Added

• Added GPT-6 Astra for OpenAI API keys and OpenAI Codex subscriptions.
• Added five-times-faster mouse wheel scrolling while holding Alt in fullscreen mode (#9166 by @​xl0).

Fixed

• Fixed configurable save keybindings in the model and thinking selectors (#9149 by @​rwachtler).
• Fixed SDK import failures caused by unintentionally publishing internal experimental code and dependencies in 0.85.0. The experimental client and experimental/plugin subpaths and server/client commands are now source-only through pi-test.sh; the supported local SDK and stdio RPC API are unchanged (#9132).
• Fixed mouse hover changing selection and recentering autocomplete and settings lists, causing clicks to target a different item.
• Fixed long prompt-cache requests for GPT-5.6+ Responses models to use prompt_cache_options.ttl: "30m" instead of prompt_cache_retention: "24h".

v0.85.0

New Features

• Persistent Claude thinking effort — Supported Anthropic transports preserve per-turn effort and recover safely from signed-thinking mismatches. See Model Configuration.
• Fullscreen transcript controls — Jump to the latest message from a scrolled transcript and use the embedded working indicator. See TUI Fullscreen Viewport.
• Restorable in-memory sessions — Resume externally stored session entries through the SDK. See Session Management.

Added

• Added SessionManager.inMemory() support for restoring externally managed session entries (#8980 by @​y-nk).
• Added inherited OpenAI-compatible vllmPriority and supportsMaxOutputTokens model settings for vLLM scheduler priority and OpenAI Responses output-token limits (#9004 by @​AppleDannyClegg, #8941 by @​scturtle).
• Added inherited LaTeX rendering for relational algebra join symbols (#9050 by @​haoqixu).
• Added a clickable "Jump to latest message" label with the tui.altScreen.bottom shortcut to the fullscreen transcript while it is scrolled up (#9080 by @​rwachtler).

Changed

• Moved the streaming working indicator into the default editor border and matched its default spinner and label to the thinking-level border color. Custom editors retain the standalone indicator unless they opt in to embedding it (#8799 by @​cristinaponcela).
• Reduced inherited fullscreen transcript search latency on large transcripts by caching unchanged search results, indexing ASCII runs, and limiting highlight work to visible matches (#8800 by @​cristinaponcela).

Fixed

• Fixed managed fd and ripgrep downloads on Linux musl systems (#9070 by @​Charlie0113-T).
• Removed the unavailable inherited Grok Build 0.1 model from /model (#9093 by @​Jaaneek).
• Fixed inherited provider streams emitting incompatible event sequences and custom tool-call deltas.
• Restored the @earendil-works/pi-coding-agent/client compatibility entry point.
• Fixed the inherited Qwen Token Plan Individual catalog to include Qwen3.8 Flash (#9021).
• Fixed inherited OpenAI Codex SSE parsing to process terminal events that are not followed by a blank line (#9047).
• Fixed inherited GitHub Copilot Claude Fable 5 requests so selected reasoning levels are sent (#8961).
• Fixed inherited Baseten GLM-5.2 models incorrectly advertising image input support (#8293 by @​Panoplos).
• Fixed skills being unavailable when Bash is the only enabled tool (#8552 by @​xl0).
• Fixed concurrent session shares overwriting one another (#8613 by @​wutongyuonce).
• Fixed image orientation detection skipping EXIF data after non-EXIF APP1 segments (#8616 by @​wutongyuonce).
• Fixed imported sessions overwriting an existing session with the same filename (#8985 by @​wutongyuonce).

... (truncated)

Changelog

Sourced from @​earendil-works/pi-coding-agent's changelog.

[0.85.1] - 2026-09-05

New Features

• GPT-6 Astra — Available through OpenAI API keys and OpenAI Codex subscriptions. See API Keys and OpenAI Codex.

Added

• Added GPT-6 Astra for OpenAI API keys and OpenAI Codex subscriptions.
• Added five-times-faster mouse wheel scrolling while holding Alt in fullscreen mode (#9166 by @​xl0).

Fixed

• Fixed configurable save keybindings in the model and thinking selectors (#9149 by @​rwachtler).
• Fixed SDK import failures caused by unintentionally publishing internal experimental code and dependencies in 0.85.0. The experimental client and experimental/plugin subpaths and server/client commands are now source-only through pi-test.sh; the supported local SDK and stdio RPC API are unchanged (#9132).
• Fixed mouse hover changing selection and recentering autocomplete and settings lists, causing clicks to target a different item.
• Fixed long prompt-cache requests for GPT-5.6+ Responses models to use prompt_cache_options.ttl: "30m" instead of prompt_cache_retention: "24h".

[0.85.0] - 2026-09-04

New Features

• Persistent Claude thinking effort — Supported Anthropic transports preserve per-turn effort and recover safely from signed-thinking mismatches. See Model Configuration.
• Fullscreen transcript controls — Jump to the latest message from a scrolled transcript and use the embedded working indicator. See TUI Fullscreen Viewport.
• Restorable in-memory sessions — Resume externally stored session entries through the SDK. See Session Management.

Added

• Added SessionManager.inMemory() support for restoring externally managed session entries (#8980 by @​y-nk).
• Added inherited OpenAI-compatible vllmPriority and supportsMaxOutputTokens model settings for vLLM scheduler priority and OpenAI Responses output-token limits (#9004 by @​AppleDannyClegg, #8941 by @​scturtle).
• Added inherited LaTeX rendering for relational algebra join symbols (#9050 by @​haoqixu).
• Added a clickable "Jump to latest message" label with the tui.altScreen.bottom shortcut to the fullscreen transcript while it is scrolled up (#9080 by @​rwachtler).

Changed

• Moved the streaming working indicator into the default editor border and matched its default spinner and label to the thinking-level border color. Custom editors retain the standalone indicator unless they opt in to embedding it (#8799 by @​cristinaponcela).
• Reduced inherited fullscreen transcript search latency on large transcripts by caching unchanged search results, indexing ASCII runs, and limiting highlight work to visible matches (#8800 by @​cristinaponcela).

Fixed

• Fixed managed fd and ripgrep downloads on Linux musl systems (#9070 by @​Charlie0113-T).
• Removed the unavailable inherited Grok Build 0.1 model from /model (#9093 by @​Jaaneek).
• Fixed inherited provider streams emitting incompatible event sequences and custom tool-call deltas.
• Restored the @earendil-works/pi-coding-agent/client compatibility entry point.
• Fixed the inherited Qwen Token Plan Individual catalog to include Qwen3.8 Flash (#9021).
• Fixed inherited OpenAI Codex SSE parsing to process terminal events that are not followed by a blank line (#9047).
• Fixed inherited GitHub Copilot Claude Fable 5 requests so selected reasoning levels are sent (#8961).
• Fixed inherited Baseten GLM-5.2 models incorrectly advertising image input support (#8293 by @​Panoplos).
• Fixed skills being unavailable when Bash is the only enabled tool (#8552 by @​xl0).
• Fixed concurrent session shares overwriting one another (#8613 by @​wutongyuonce).

... (truncated)

Commits

• d981de1 Release v0.85.1
• cce6553 docs(tui): document Alt-wheel scrolling in unreleased changelogs
• 082f757 fix(coding-agent): make footer debounce tests deterministic
• 6f11c31 fix(coding-agent): assert source-only experimental package exports
• 1a46b92 docs: audit changelogs for v0.85.1
• 1382777 fix(coding-agent): keep remote harness dependencies development-only
• 17de82d feat(ai): add GPT-6 Astra support
• 92d8e2d fix(coding-agent): selector save keybindings (#9149)
• 47236c8 docs(coding-agent): document running pi in Docker Sandboxes (#9077)
• dd7e816 Add [Unreleased] section for next cycle
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.