fix: clear four new advisories, override undici to a patched 8.x

[TheAmericanMaker]

main is red right now. The advisory database picked up four new CVEs overnight, so the npm audit --omit=dev --audit-level=high gate is failing again — which blocks every PR, exactly as it did before #78. This is unrelated to anything merged yesterday.

All four are transitive:

Package	Severity	Reached via
fast-uri	high	@modelcontextprotocol/sdk → ajv
ip-address	high	@modelcontextprotocol/sdk → express-rate-limit
undici	high	@earendil-works/pi-coding-agent
hono	moderate	@modelcontextprotocol/sdk

Three are a plain lockfile bump

npm audit fix handles fast-uri (3.1.4 → 3.1.5), hono (→ 4.13.0), and ip-address (10.2.0 → 10.4.0). No manifest change, fully resolved.

undici is different — read this before merging

Important

The undici override clears CI. It does not patch users. Treat this PR as CI hygiene, not remediation.

pi-coding-agent pins undici at exactly 8.5.0, and still does on its latest release (0.83.0), so upgrading the dependency doesn't help. npm audit fix --force "resolves" it by downgrading pi-coding-agent from 0.80.10 to 0.75.3 — a major version backwards — which is worse than the advisory.

That leaves "overrides": { "undici": "^8.10.0" }. It clears the gate here, but I packed the tarball and installed it as a real consumer to check whether it actually protects anyone:

codecartographer-pi@0.12.11
└─┬ @earendil-works/pi-coding-agent@0.80.10
    └── undici@8.5.0        ← override did NOT apply

3 vulnerabilities (2 moderate, 1 high)

npm only honors overrides from the root package. In a consumer's tree this package is a dependency, so the field ships in the manifest and is ignored. pi-coding-agent is also a peerDependency, so npm resolves it in the consumer's tree where our constraint has no say.

So a green audit badge on this repo will not mean installed users are patched. Worth knowing before anyone reads CI as an all-clear.

Actual exposure

Lower than the severity label suggests, for two reasons.

It isn't reachable from the MCP surface. Tracing the module graph from dist/mcp-server/bin.mjs reaches 17 modules, none of which value-import pi-coding-agent — every MCP-side import is import type and erased at compile time. The value imports (createAgentSession, compact, SessionManager) live only in agent-runner, agent-rewriter, dashboard-narrator, and phase-compaction. undici only executes on the Pi extension surface.

The advisories target shapes this doesn't have. Three of five are cross-user information disclosure via shared caches or a proxy serving multiple users; the others are CRLF injection via a blob body type and cookie attribute injection. A single-user local process talking to a trusted LLM endpoint has no multi-tenant cache and no untrusted intermediary. The realistic residual is the parse-time crash — a local DoS.

The real fix is upstream

pi-coding-agent needs to unpin undici or move past 8.8.0. The exact pin is what makes this unfixable downstream — every consumer of theirs inherits it. This override should be removed once that lands.

Verification

• npm audit --omit=dev → 0 vulnerabilities in this repo (see caveat above re: consumers)
• 274/274 tests pass, build clean
• MCP initialize + tools/list handshake returns all 18 tools
• Packaged smoke test (npm run smoke) passes 9/9 against the real tarball

🤖 Generated with Claude Code