[tnfssc]

Summary

Patches the 4 high findings from the 2026-11 vulnerability audit. Both packages come in through @earendil-works/pi-coding-agent@1.1.0, which pins them exactly, so they are forced with root overrides. Pi 1.4.0 (latest) still pins the vulnerable versions, so upgrading Pi does not help yet.

Package	From	To	Via
undici	8.10.2	8.12.3	overrides (latest 8.x)
minimatch	10.2.6	11.0.3	overrides (latest 11.x)

Advisories fixed

undici (fixed in 8.12.2):

• High: GHSA-4w7w-5xrc-9h26 / CVE-2026-109829: cache poisoning and cross-user disclosure via cross-origin redirects
• High: GHSA-2m5v-pch6-74hx / CVE-2026-109383: TLS certificate validation bypass via dropped tls options in Agent
• High: GHSA-qrxm-fqhp-jwvm / CVE-2026-87018: DoS via TLS 1.2 certificate-changing renegotiation
• High: GHSA-xjj6-f33q-929c / CVE-2026-109869: DoS via unhandled error on excessive content-encodings
• Medium: GHSA-9fm3-97px-rjf6, GHSA-55wc-3pg8-jfw6, GHSA-4qv8-2p9j-2685, GHSA-f72v-6w45-q472

minimatch (fixed in 11.0.1):

• GHSA-g3hv-75wg-m249 / CVE-2026-118764: DoS via globparts amplification (GitHub lists this as medium)

Things to know

• minimatch is a major bump under Pi. No 10.x fix exists; upstream says the new matching engine will not be backported. Pi calls only minimatch(path, pattern, { nocase }) (in core/model-resolver.js and core/package-manager.js), and v11 keeps that API. A quick check of Pi-style patterns (provider/* with nocase, **, braces, negation) gave the same results.
• This does not patch users. The overrides change only bruv's own dev install and CI. Users run the Pi they installed, so they need a Pi release with the fixes. Noted in .agents/notes/dep-overrides.md, along with when to drop the overrides.

Skipped: nothing.

Tests

All passed locally (bun 1.4.2, same as CI):

• bun install --frozen-lockfile: no changes
• bunx biome ci .: clean
• bun run check (tsc root, site, web): clean
• bun test: 305 pass, 0 fail
• bun run test:site: 28 pass, 0 fail

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 864dccce-b7d1-49ef-a94f-3e4ef4b3a504

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn