chore(deps): bump undici and @earendil-works/pi-coding-agent

[dependabot]

Bumps undici to 8.9.0 and updates ancestor dependency @earendil-works/pi-coding-agent. These dependencies need to be updated together.

Updates undici from 8.5.0 to 8.9.0

Release notes

Sourced from undici's releases.

v8.9.0

⚠️ Security fixes

High severity

• GHSA-4cwx-7wf7-3272: malformed qualified private Cache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crash. The cache parser now treats empty qualified directives conservatively and safely handles mixed qualified and unqualified directives. Fixed by 4fe5bc5f with regression coverage in 9f09b49a.

Medium severity

• GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 7d3cf924.
• GHSA-jr45-8vmc-qm54: optional whitespace around = in qualified no-cache and private directives could bypass shared-cache restrictions and disclose authenticated data across users. Cache-Control parsing now normalizes these forms and applies conservative cache decisions. Fixed by c601fff1.
• GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by e11a68ed, with corrected fixtures in 2b3f7493.
• GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by 10d93fc3.

Additional hardening

Undici now validates non-string header values after coercion, including array elements, preventing crafted toString() or Symbol.toPrimitive implementations from introducing CRLF sequences. This defense-in-depth change was made in 354a151f.

What's Changed

• fix(decompress): preserve response trailers by @​Ram-blip in nodejs/undici#5572
• build(deps-dev): bump ws from 8.21.0 to 8.21.1 by @​dependabot[bot] in nodejs/undici#5576
• fix: validate coerced header values for CRLF by @​mcollina in nodejs/undici#5579
• fix: handle frozen globalThis in setGlobalDispatcher by @​mhayk in nodejs/undici#5574
• Ignore auto-generated .npmrc on Windows by @​tsctx in nodejs/undici#5583

New Contributors

• @​mhayk made their first contribution in nodejs/undici#5574

Full Changelog: nodejs/undici@v8.8.0...v8.9.0

v8.8.0

What's Changed

• fetch: use ReadableStreamTee for cloning streams by @​KhafraDev in nodejs/undici#5517
• fix(benchmarks): adjust got after v15 upgrade by @​slagiewka in nodejs/undici#5526
• feat(mock): support asynchronous reply options callbacks by @​Develop-KIM in nodejs/undici#5534
• docs: clarify proxy threat model by @​mcollina in nodejs/undici#5530
• docs: clarify MockAgent pool usage by @​vibhor-aggr in nodejs/undici#5542
• docs: clarify parser timeout precision by @​vibhor-aggr in nodejs/undici#5543
• fix: handle flat alternating header arrays in cache normalizeHeaders by @​mcollina in nodejs/undici#5536
• chore(benchmarks): require(esm) on ESM-only packages by @​slagiewka in nodejs/undici#5527
• fix: run idle socket validation off setImmediate instead of setTimeout by @​carlotestor in nodejs/undici#5499
• docs: add custom interceptor example by @​vibhor-aggr in nodejs/undici#5548
• fix(h1): ignore type of service errors by @​mcollina in nodejs/undici#5547
• fix(fetch): convert null init in Response.json by @​Ram-blip in nodejs/undici#5540
• fix(redirect): remove body headers after POST-to-GET by @​Ram-blip in nodejs/undici#5551
• build(deps-dev): bump fast-check from 4.8.0 to 4.9.0 by @​dependabot[bot] in nodejs/undici#5556
• fix(h2): allow stream-bodied requests to multiplex on a busy session by @​GiHoon1123 in nodejs/undici#5538
• fix(h2): destroy aborted stream synchronously instead of via setImmediate by @​staylor in nodejs/undici#5559
• fix(decompress): skip HEAD responses by @​Ram-blip in nodejs/undici#5564
• ci: build undici with node.js v26 by @​shivarm in nodejs/undici#5237

... (truncated)

Commits

• 21a8e1e Bumped v8.9.0 (#5589)
• 7d3cf92 fix: validate blob body content type
• c601fff fix(cache): harden cache directive parsing
• 2b3f749 test(retry): correct broken content-range fixtures in retry-handler.js
• e11a68e fix(retry): reject partial content length mismatch
• 9f09b49 test: cover crash on mixed unqualified and qualified private cache directives
• 4fe5bc5 fix: handle empty qualified private cache directive
• 10d93fc fix: harden cookie domain, path, and unparsed attribute validation
• a17e301 Ignore auto-generated .npmrc on Windows (#5583)
• a0922b0 fix: handle frozen globalThis in setGlobalDispatcher (#5574)
• Additional commits viewable in compare view

Updates @earendil-works/pi-coding-agent from 0.80.10 to 0.84.4

Release notes

Sourced from @​earendil-works/pi-coding-agent's releases.

v0.84.4

New Features

• Terminal capability overrides — Override detected terminal hyperlink, image, and truecolor support. See Capability Overrides.
• Extension UI prompt events — Integrations can distinguish active agent work from time spent waiting for ctx.ui prompts. See Extension UI prompt events.
• RPC queue clearing — Retrieve and clear queued steering and follow-up messages with clear_queue. See RPC clear_queue.
• Fullscreen selection copy controls — Disable automatic selection copying in fullscreen mode and use Ctrl+X to copy the active selection. See UI & Display.
• DeepSeek V4 Flash Vision (experimental) — Use the vision-capable model through the built-in DeepSeek provider. See API Keys.

Added

• Added ui_prompt_start and ui_prompt_end extension events so host integrations can distinguish active agent work from waiting on user-facing ctx.ui prompts (#8355 by @​cristinaponcela).
• Added detectSupportedImageMimeTypeFromFile() to the public library exports (#8600 by @​xl0).
• Added inherited experimental vision-capable deepseek-v4-flash-vision-exp model support.
• Added transcript usage notices for compaction and branch summaries when cache miss notices are enabled.
• Added RPC clear_queue to retrieve and remove queued steering and follow-up messages (#8432).
• Added environment variables and advanced settings for overriding auto-detected terminal hyperlink, image, and truecolor capabilities (#8665).
• Added fullscreenCopyOnSelect to disable automatic fullscreen selection copy; when disabled, Ctrl+X copies the active text selection before falling back to the last assistant message, while /tree still copies the selected message (#7720).

Fixed

• Fixed toggling thinking visibility clearing partial output from running Bash tools (#8611).
• Fixed Windows shell aborts crashing Pi when taskkill.exe is unavailable on PATH (#6596).
• Fixed resumed sessions corrupting the next appended entry when their JSONL file lacks a trailing newline (#8345).
• Fixed extension messages sent with triggerTurn: false while the agent is running being inserted between a tool call and its result, which made providers that validate message order reject the replayed history. They are now appended once the turn's tool results are in (#8537).
• Fixed compaction and branch summaries forcing toolChoice: "none" (#8649, #8638).
• Fixed large tool results crossing the auto-compaction threshold being sent to the provider before compaction. Pi now compacts between tool execution and the next assistant response in the same run, and restores interactive progress when that run resumes (#6879).
• Fixed Google Vertex requests failing with HttpsProxyAgent is not a constructor when the bundled Node.js runtime uses an HTTP(S) proxy (#8610).
• Fixed saving a default model from a non-empty model scope so it remains available in that scope.
• Fixed inherited @ file autocomplete ranking to prefer direct and shallower matches over similarly ranked nested paths (#8669).
• Fixed inherited OpenAI-compatible streams serializing thinking signatures repeatedly during streaming (#8671).
• Fixed inherited main-screen rendering crashing when image-heavy output exceeded V8's string length limit (#8028).
• Fixed inherited fullscreen double-click word selection splitting paths and kebab-case tokens on / and - (#8676).
• Fixed inherited Cloudflare AI Gateway catalogs omitting supported workers-ai/* passthrough models.
• Fixed inherited OpenAI-compatible reasoning replay to merge consecutive streamed text and summary reasoning_details deltas.
• Fixed inherited OpenRouter reasoning controls so reasoning-mandatory models do not receive effort: "none" (#8614 by @​davidbrai).
• Fixed inherited OpenAI-compatible Chat Completions ignoring an explicitly requested toolChoice when no tools are defined.
• Fixed inherited fragmented Mistral tool calls splitting when continuation chunks omit the tool-call ID (#8387).

v0.84.3

New Features

• PowerShell tool — Use optional native PowerShell command execution on Windows. See PowerShell Tool.
• Safer managed updates — Stage, verify, and atomically activate updates for installer-managed installations. See Install and Manage.
• Model and thinking controls — Select thinking levels with /thinking, search defaults, keep selections session-scoped, and persist them explicitly with Ctrl+S. See Models and Thinking.

Breaking Changes

• Renamed the inherited GoogleThinkingLevel type to GoogleApiThinkingLevel and added ResolvedGoogleThinkingLevel for normalized adapter levels.

... (truncated)

Changelog

Sourced from @​earendil-works/pi-coding-agent's changelog.

[0.84.4] - 2026-08-28

New Features

• Terminal capability overrides — Override detected terminal hyperlink, image, and truecolor support. See Capability Overrides.
• Extension UI prompt events — Integrations can distinguish active agent work from time spent waiting for ctx.ui prompts. See Extension UI prompt events.
• RPC queue clearing — Retrieve and clear queued steering and follow-up messages with clear_queue. See RPC clear_queue.
• Fullscreen selection copy controls — Disable automatic selection copying in fullscreen mode and use Ctrl+X to copy the active selection. See UI & Display.
• DeepSeek V4 Flash Vision (experimental) — Use the vision-capable model through the built-in DeepSeek provider. See API Keys.

Added

• Added supportsMidConvoEffort to custom Anthropic Messages model compatibility settings.
• Added transcript notices for Anthropic thinking blocks dropped during provider recovery when cache miss notices are enabled.
• Added ui_prompt_start and ui_prompt_end extension events so host integrations can distinguish active agent work from waiting on user-facing ctx.ui prompts (#8355 by @​cristinaponcela).
• Added detectSupportedImageMimeTypeFromFile() to the public library exports (#8600 by @​xl0).
• Added inherited experimental vision-capable deepseek-v4-flash-vision-exp model support.
• Added transcript usage notices for compaction and branch summaries when cache miss notices are enabled.
• Added RPC clear_queue to retrieve and remove queued steering and follow-up messages (#8432).
• Added environment variables and advanced settings for overriding auto-detected terminal hyperlink, image, and truecolor capabilities (#8665).
• Added fullscreenCopyOnSelect to disable automatic fullscreen selection copy; when disabled, Ctrl+X copies the active text selection before falling back to the last assistant message, while /tree still copies the selected message (#7720).

Changed

• Changed fullscreen scrollbars to reveal on pointer entry, support optional scrollbarTrack and scrollbarThumb theme colors with muted and text fallbacks, keep one thumb color across normal and expanded states, and support track-click jumping.
• Changed fullscreen transcript search arrows to underline on hover and capitalized the search placeholder.
• Changed selectors in /thinking, /model, /scoped-models, /trust, per-model thinking settings, and theme settings to keep active options marked while browsing. /scoped-models now uses consistent per-item toggles and strikes through unavailable models (#8900).

Fixed

• Fixed toggling thinking visibility clearing partial output from running Bash tools (#8611).
• Fixed Windows shell aborts crashing Pi when taskkill.exe is unavailable on PATH (#6596).
• Fixed resumed sessions corrupting the next appended entry when their JSONL file lacks a trailing newline (#8345).
• Fixed extension messages sent with triggerTurn: false while the agent is running being inserted between a tool call and its result, which made providers that validate message order reject the replayed history. They are now appended once the turn's tool results are in (#8537).
• Fixed compaction and branch summaries forcing toolChoice: "none" (#8649, #8638).
• Fixed large tool results crossing the auto-compaction threshold being sent to the provider before compaction. Pi now compacts between tool execution and the next assistant response in the same run, and restores interactive progress when that run resumes (#6879).
• Fixed Google Vertex requests failing with HttpsProxyAgent is not a constructor when the bundled Node.js runtime uses an HTTP(S) proxy (#8610).
• Fixed saving a default model from a non-empty model scope so it remains available in that scope.
• Fixed inherited @ file autocomplete ranking to prefer direct and shallower matches over similarly ranked nested paths (#8669).
• Fixed inherited OpenAI-compatible streams serializing thinking signatures repeatedly during streaming (#8671).
• Fixed inherited main-screen rendering crashing when image-heavy output exceeded V8's string length limit (#8028).
• Fixed inherited fullscreen double-click word selection splitting paths and kebab-case tokens on / and - (#8676).
• Fixed inherited Cloudflare AI Gateway catalogs omitting supported workers-ai/* passthrough models.
• Fixed inherited OpenAI-compatible reasoning replay to merge consecutive streamed text and summary reasoning_details deltas.
• Fixed inherited OpenRouter reasoning controls so reasoning-mandatory models do not receive effort: "none" (#8614 by @​davidbrai).
• Fixed inherited OpenAI-compatible Chat Completions ignoring an explicitly requested toolChoice when no tools are defined.
• Fixed inherited fragmented Mistral tool calls splitting when continuation chunks omit the tool-call ID (#8387).

[0.84.3] - 2026-08-24

New Features

... (truncated)

Commits

• b79e4cc Release v0.84.4
• bba6be9 docs: audit unreleased changelogs
• e54d45d docs(coding-agent): remove issue-specific regression test placement rule (#8775)
• 56700d4 fix(coding-agent): compact before post-tool model requests (#8782)
• 4e49492 feat(tui): allow disable copy on fullscreen, ctrl + x copies selection (#8731)
• 1defa15 fix(coding-agent): expose https-proxy-agent named export (#8723)
• ccfe79e feat(extensions): ui prompt events (#8355)
• e868230 feat(tui): add terminal capability overrides closes #8665
• 42f7f29 docs(settings): default model and thinking
• b07e17f fix(coding-agent): preserve partial Bash output when toggling thinking
• Additional commits viewable in compare view