sscoble/pi-mono
1
0
Fork 0
mirror of https://github.com/badlogic/pi-mono.git synced 2026-11-05 23:37:25 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

fix: bump vitest to 4.1.11 and gondolin's undici to 6.29.0

Browse source 
Addresses GHSA-82fw-gwwq-j7x9 (vitest mocker path traversal) and
GHSA-3wwx-pv8p-q78v (undici 6.x permessage-deflate DoS). Both are
dev/example-only; the shipped coding-agent shrinkwrap is unchanged.
This commit is contained in:
Armin Ronacher 2026-09-29 18:38:07 +02:00
parent 1ff5b6fddf
commit 8eb2bccf26
14 changed files with 83 additions and 83 deletions
Download patch file Download diff file Expand all files Collapse all files

136
package-lock.json generated
View file

@ -711,9 +711,9 @@
}
},
"node_modules/@earendil-works/gondolin/node_modules/undici": {
"version": "6.28.0",
"resolved": "https://registry.npmjs.org/undici/-/undici-6.28.0.tgz",
"integrity": "sha512-LIY910g9TI13YS95lrMFrs8Rm/u/irgHeTWoKCoteeJ04CUJ92eEfj0rVn+7VKMPBpUPiUoBKfhNyLI23EE/KA==",
"version": "6.29.0",
"resolved": "https://registry.npmjs.org/undici/-/undici-6.29.0.tgz",
"integrity": "sha512-R+RODBqp6i2pPflGdq+xIOUkl+RNfGgHwoinecKu/JCuf2uO06cOKoDbI2P7Dn6KcswdKwrczbU6IYJ6K8X+wg==",
"license": "MIT",
"engines": {
"node": ">=18.17"
@ -2202,14 +2202,14 @@
}
},
"node_modules/@vitest/coverage-v8": {
"version": "4.1.9",
"resolved": "https://registry.npmjs.org/@vitest/coverage-v8/-/coverage-v8-4.1.9.tgz",
"integrity": "sha512-G9/lgqibheLVBDRuya45EbsEXTYcWoSG+TLg7i2axuzx0Eq62eXn+aWXyaVdV5vKvFSWd6ywcX8hA7la9Pvu8g==",
"version": "4.1.11",
"resolved": "https://registry.npmjs.org/@vitest/coverage-v8/-/coverage-v8-4.1.11.tgz",
"integrity": "sha512-8MVGEFnJIcdGjcbfKmeq8z0pZHH0JlVtoVZH9Q/qwUp6wyFnEJUBMrw9DCaj+ra3vShGmhavjalMIhPNxZAUcw==",
"dev": true,
"license": "MIT",
"dependencies": {
"@bcoe/v8-coverage": "^1.0.2",
"@vitest/utils": "4.1.9",
"@vitest/utils": "4.1.11",
"ast-v8-to-istanbul": "^1.0.0",
"istanbul-lib-coverage": "^3.2.2",
"istanbul-lib-report": "^3.0.1",
@ -2223,8 +2223,8 @@
"url": "https://opencollective.com/vitest"
},
"peerDependencies": {
"@vitest/browser": "4.1.9",
"vitest": "4.1.9"
"@vitest/browser": "4.1.11",
"vitest": "4.1.11"
},
"peerDependenciesMeta": {
"@vitest/browser": {
@ -2233,16 +2233,16 @@
}
},
"node_modules/@vitest/expect": {
"version": "4.1.9",
"resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.1.9.tgz",
"integrity": "sha512-vl/rYsUKcBr3SnQn166+XR5ZQcgMx3DQhFWdfli/cWpLnLUmbxZvyrJZotLFUryib+LtArYMSTJ5RbQ57ZqrlA==",
"version": "4.1.11",
"resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.1.11.tgz",
"integrity": "sha512-VX2x5vNJXET47KAFzwERI+KRMtTTCSWTfSMKsW7JsUsXV4psq++e3DvZpuTDOpHcxytiDs6p2nhVb2tVDiiUYw==",
"dev": true,
"license": "MIT",
"dependencies": {
"@standard-schema/spec": "^1.1.0",
"@types/chai": "^5.2.2",
"@vitest/spy": "4.1.9",
"@vitest/utils": "4.1.9",
"@vitest/spy": "4.1.11",
"@vitest/utils": "4.1.11",
"chai": "^6.2.2",
"tinyrainbow": "^3.1.0"
},
@ -2251,13 +2251,13 @@
}
},
"node_modules/@vitest/mocker": {
"version": "4.1.9",
"resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-4.1.9.tgz",
"integrity": "sha512-EVkXzBjrPGM+cK8/ANWgBrkUCfJfb38/EfTSO8h7pWvKkyPkpWxvR7BkD2MyItMF62C97zAEoqdpUixwR/e+Rw==",
"version": "4.1.11",
"resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-4.1.11.tgz",
"integrity": "sha512-2XJVD55d1o5AZous5CCGKS74g/riOj9odEt2bQpCVZeblHyHdnMeFl4jl0XjU21stf4mbjUkew2eXQZt65g5CQ==",
"dev": true,
"license": "MIT",
"dependencies": {
"@vitest/spy": "4.1.9",
"@vitest/spy": "4.1.11",
"estree-walker": "^3.0.3",
"magic-string": "^0.30.21"
},
@ -2278,9 +2278,9 @@
}
},
"node_modules/@vitest/pretty-format": {
"version": "4.1.9",
"resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.9.tgz",
"integrity": "sha512-s0iufns3iIFitdgm+YR7g1whCAaGtXz459VS9/PqyKDEEFgYIhsHOQmXgIgDuYCt7DeQmiZT0Qe2OA2p4ZPu5A==",
"version": "4.1.11",
"resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.11.tgz",
"integrity": "sha512-yiZzPbGTS9Sr/JpFl8zHrcIkAofNbFV6k21vIgQN/cY/oxZeXhJv5sc/MBJ5jFKWmWs+oJHw0UXLZjmf931+Vw==",
"dev": true,
"license": "MIT",
"dependencies": {
@ -2291,13 +2291,13 @@
}
},
"node_modules/@vitest/runner": {
"version": "4.1.9",
"resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-4.1.9.tgz",
"integrity": "sha512-KXLMDtc7oe70+3mJfGrPUWPesswH+3sTxAMAMl8DG7I8IUQT4XW718dY5ID3vPUcmlu27CcKfY4P3h3I29SLJg==",
"version": "4.1.11",
"resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-4.1.11.tgz",
"integrity": "sha512-LztvUgdwMNJMIkj3hQnnxiC2Xy1zNxq928W/xhjCLaNCzqTZOudjwbQf6v9IntZGPw132i2Lq2rgTRZHD3JHNw==",
"dev": true,
"license": "MIT",
"dependencies": {
"@vitest/utils": "4.1.9",
"@vitest/utils": "4.1.11",
"pathe": "^2.0.3"
},
"funding": {
@ -2305,14 +2305,14 @@
}
},
"node_modules/@vitest/snapshot": {
"version": "4.1.9",
"resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.1.9.tgz",
"integrity": "sha512-Jc7RKGNBo8Z28WYIm0Niej4xdSPByRf6mU58VpHQkd6Zh05rlnA+twjbK5HyeIGHxrzsc3mJgS43uM0CZKzaIA==",
"version": "4.1.11",
"resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.1.11.tgz",
"integrity": "sha512-pN7ikn1ON7h8ee4gIAp4AzyK+zBtJPzVbqOgu5LCEh4VaJVbPQcgYQYJIMGQPXVeJJq1fnfazis7a5pFNPahog==",
"dev": true,
"license": "MIT",
"dependencies": {
"@vitest/pretty-format": "4.1.9",
"@vitest/utils": "4.1.9",
"@vitest/pretty-format": "4.1.11",
"@vitest/utils": "4.1.11",
"magic-string": "^0.30.21",
"pathe": "^2.0.3"
},
@ -2321,9 +2321,9 @@
}
},
"node_modules/@vitest/spy": {
"version": "4.1.9",
"resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.1.9.tgz",
"integrity": "sha512-fHpsS6mIi+PiEW+vcRVOMkX1oSaPKne3VOclSFICPcGOmfKgXPU5iAah+wcNcj2xPrCCmfq99IDGf+EojhhvhA==",
"version": "4.1.11",
"resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.1.11.tgz",
"integrity": "sha512-apNa/prQy2qCeywhnixOHPRCgGNhvg7T4Dapfl1GahLp/R+uhBm5cPyFoNVyqsNd2h1nJxL6BqqdIjiABL60YA==",
"dev": true,
"license": "MIT",
"funding": {
@ -2331,13 +2331,13 @@
}
},
"node_modules/@vitest/utils": {
"version": "4.1.9",
"resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.1.9.tgz",
"integrity": "sha512-A51o8ymO5PpqlWNnBP9ZHPXDIpuMtTLlGSjN7la4US+LJzoUMyhwjA5QXlm39JexgwHKW4Xjs8Z2d3dLCXOeuA==",
"version": "4.1.11",
"resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.1.11.tgz",
"integrity": "sha512-zTCVGpyFsGWBhllOyKlTw/vnr6D9qxsfSDyfbyZmTyjHw5N/VuvzHpHoQjm2ZJzn4RJgx5w4r7V0er69CmLgPQ==",
"dev": true,
"license": "MIT",
"dependencies": {
"@vitest/pretty-format": "4.1.9",
"@vitest/pretty-format": "4.1.11",
"convert-source-map": "^2.0.0",
"tinyrainbow": "^3.1.0"
},
@ -5283,19 +5283,19 @@
}
},
"node_modules/vitest": {
"version": "4.1.9",
"resolved": "https://registry.npmjs.org/vitest/-/vitest-4.1.9.tgz",
"integrity": "sha512-nE3/LEyc0z87uHYLZebqCUOaJr2hdtuPp7BQ4BosVFnfltxgAvMG08NyrSGlPpOUWvR27c5flSmYFTNr78L9GQ==",
"version": "4.1.11",
"resolved": "https://registry.npmjs.org/vitest/-/vitest-4.1.11.tgz",
"integrity": "sha512-fhACrNXUidIbGSBr5FlbuBkO7VWC1ZyLl0DO4CU2DrQoAPxX84Ysxs+HeGQpii5lZWV1Q4gBZTTu49mF+A6Edw==",
"dev": true,
"license": "MIT",
"dependencies": {
"@vitest/expect": "4.1.9",
"@vitest/mocker": "4.1.9",
"@vitest/pretty-format": "4.1.9",
"@vitest/runner": "4.1.9",
"@vitest/snapshot": "4.1.9",
"@vitest/spy": "4.1.9",
"@vitest/utils": "4.1.9",
"@vitest/expect": "4.1.11",
"@vitest/mocker": "4.1.11",
"@vitest/pretty-format": "4.1.11",
"@vitest/runner": "4.1.11",
"@vitest/snapshot": "4.1.11",
"@vitest/spy": "4.1.11",
"@vitest/utils": "4.1.11",
"es-module-lexer": "^2.0.0",
"expect-type": "^1.3.0",
"magic-string": "^0.30.21",
@ -5323,12 +5323,12 @@
"@edge-runtime/vm": "*",
"@opentelemetry/api": "^1.9.0",
"@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0",
"@vitest/browser-playwright": "4.1.9",
"@vitest/browser-preview": "4.1.9",
"@vitest/browser-webdriverio": "4.1.9",
"@vitest/coverage-istanbul": "4.1.9",
"@vitest/coverage-v8": "4.1.9",
"@vitest/ui": "4.1.9",
"@vitest/browser-playwright": "4.1.11",
"@vitest/browser-preview": "4.1.11",
"@vitest/browser-webdriverio": "4.1.11",
"@vitest/coverage-istanbul": "4.1.11",
"@vitest/coverage-v8": "4.1.11",
"@vitest/ui": "4.1.11",
"happy-dom": "*",
"jsdom": "*",
"vite": "^6.0.0 || ^7.0.0 || ^8.0.0"
@ -5531,8 +5531,8 @@
},
"devDependencies": {
"@types/node": "22.19.19",
"@vitest/coverage-v8": "4.1.9",
"vitest": "4.1.9"
"@vitest/coverage-v8": "4.1.11",
"vitest": "4.1.11"
},
"engines": {
"node": ">=22.19.0"
@ -5567,7 +5567,7 @@
"devDependencies": {
"@types/node": "22.19.19",
"canvas": "3.2.3",
"vitest": "4.1.9"
"vitest": "4.1.11"
},
"engines": {
"node": ">=22.19.0"
@ -5642,7 +5642,7 @@
},
"devDependencies": {
"shx": "0.4.0",
"vitest": "4.1.9"
"vitest": "4.1.11"
},
"engines": {
"node": ">=22.19.0"
@ -5658,7 +5658,7 @@
},
"devDependencies": {
"shx": "0.4.0",
"vitest": "4.1.9"
"vitest": "4.1.11"
},
"engines": {
"node": ">=22.19.0"
@ -5673,7 +5673,7 @@
},
"devDependencies": {
"shx": "0.4.0",
"vitest": "4.1.9"
"vitest": "4.1.11"
},
"engines": {
"node": ">=22.19.0"
@ -5721,7 +5721,7 @@
"@types/semver": "7.7.1",
"marked": "18.0.11",
"shx": "0.4.0",
"vitest": "4.1.9"
"vitest": "4.1.11"
},
"engines": {
"node": ">=22.19.0"
@ -5816,7 +5816,7 @@
},
"devDependencies": {
"shx": "0.4.0",
"vitest": "4.1.9"
"vitest": "4.1.11"
},
"engines": {
"node": ">=22.19.0"
@ -5832,7 +5832,7 @@
"@vitest-evals/core": "0.15.0",
"autoevals": "0.3.0",
"shx": "0.4.0",
"vitest": "4.1.9",
"vitest": "4.1.11",
"vitest-evals": "0.15.0"
}
},
@ -5846,7 +5846,7 @@
"devDependencies": {
"@types/cross-spawn": "6.0.6",
"shx": "0.4.0",
"vitest": "4.1.9"
"vitest": "4.1.11"
},
"engines": {
"node": ">=22.19.0"
@ -5862,7 +5862,7 @@
},
"devDependencies": {
"shx": "0.4.0",
"vitest": "4.1.9"
"vitest": "4.1.11"
},
"engines": {
"node": ">=22.19.0"
@ -5879,7 +5879,7 @@
},
"devDependencies": {
"shx": "0.4.0",
"vitest": "4.1.9"
"vitest": "4.1.11"
},
"engines": {
"node": ">=22.19.0"
@ -5894,8 +5894,8 @@
"@earendil-works/pi-ai": "^0.87.1"
},
"devDependencies": {
"@vitest/coverage-v8": "4.1.9",
"vitest": "4.1.9"
"@vitest/coverage-v8": "4.1.11",
"vitest": "4.1.11"
},
"engines": {
"node": ">=22.19.0"
@ -5907,7 +5907,7 @@
"license": "MIT",
"devDependencies": {
"@types/node": "22.19.19",
"vitest": "4.1.9"
"vitest": "4.1.11"
},
"engines": {
"node": ">=22.19.0"

4
packages/agent/package.json
View file

@ -86,7 +86,7 @@
},
"devDependencies": {
"@types/node": "22.19.19",
"@vitest/coverage-v8": "4.1.9",
"vitest": "4.1.9"
"@vitest/coverage-v8": "4.1.11",
"vitest": "4.1.11"
}
}

2
packages/ai/package.json
View file

@ -97,6 +97,6 @@
"devDependencies": {
"@types/node": "22.19.19",
"canvas": "3.2.3",
"vitest": "4.1.9"
"vitest": "4.1.11"
}
}

2
packages/chord/package.json
View file

@ -67,6 +67,6 @@
},
"devDependencies": {
"shx": "0.4.0",
"vitest": "4.1.9"
"vitest": "4.1.11"
}
}

2
packages/client/package.json
View file

@ -52,6 +52,6 @@
},
"devDependencies": {
"shx": "0.4.0",
"vitest": "4.1.9"
"vitest": "4.1.11"
}
}

2
packages/codemode/package.json
View file

@ -59,6 +59,6 @@
},
"devDependencies": {
"shx": "0.4.0",
"vitest": "4.1.9"
"vitest": "4.1.11"
}
}

2
packages/coding-agent/package.json
View file

@ -86,7 +86,7 @@
"@types/semver": "7.7.1",
"marked": "18.0.11",
"shx": "0.4.0",
"vitest": "4.1.9"
"vitest": "4.1.11"
},
"keywords": [
"coding-agent",

2
packages/durable/package.json
View file

@ -89,6 +89,6 @@
},
"devDependencies": {
"shx": "0.4.0",
"vitest": "4.1.9"
"vitest": "4.1.11"
}
}

2
packages/evals/package.json
View file

@ -17,7 +17,7 @@
"@vitest-evals/core": "0.15.0",
"autoevals": "0.3.0",
"shx": "0.4.0",
"vitest": "4.1.9",
"vitest": "4.1.11",
"vitest-evals": "0.15.0"
}
}

2
packages/mcp/package.json
View file

@ -56,6 +56,6 @@
"devDependencies": {
"@types/cross-spawn": "6.0.6",
"shx": "0.4.0",
"vitest": "4.1.9"
"vitest": "4.1.11"
}
}

2
packages/protocol/package.json
View file

@ -44,6 +44,6 @@
},
"devDependencies": {
"shx": "0.4.0",
"vitest": "4.1.9"
"vitest": "4.1.11"
}
}

2
packages/server/package.json
View file

@ -53,6 +53,6 @@
},
"devDependencies": {
"shx": "0.4.0",
"vitest": "4.1.9"
"vitest": "4.1.11"
}
}

4
packages/session-backends/sqlite-node/package.json
View file

@ -39,7 +39,7 @@
"@earendil-works/pi-agent-core": "^0.87.1"
},
"devDependencies": {
"@vitest/coverage-v8": "4.1.9",
"vitest": "4.1.9"
"@vitest/coverage-v8": "4.1.11",
"vitest": "4.1.11"
}
}

2
packages/telemetry/package.json
View file

@ -42,6 +42,6 @@
},
"devDependencies": {
"@types/node": "22.19.19",
"vitest": "4.1.9"
"vitest": "4.1.11"
}
}