From c26d7b3ee8102e728627f1879a9c5adbd016236a Mon Sep 17 00:00:00 2001
From: James Sesler <James.sesler@pm.me>
Date: Mon, 3 Aug 2026 20:39:47 -0400
Subject: [PATCH] fix: clear four new advisories, override undici to a patched
 8.x
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The advisory database picked up four new CVEs overnight and the audit gate
is failing on main again, blocking every PR. All four are transitive:

- fast-uri (high)   @modelcontextprotocol/sdk -> ajv
- ip-address (high) @modelcontextprotocol/sdk -> express-rate-limit
- hono (moderate)   @modelcontextprotocol/sdk
- undici (high)     @earendil-works/pi-coding-agent

`npm audit fix` resolves the first three as a lockfile-only change:
fast-uri 3.1.4 -> 3.1.5, hono -> 4.13.0, ip-address 10.2.0 -> 10.4.0.

undici needs an override. pi-coding-agent pins undici at exactly 8.5.0, and
still does on its latest release (0.83.0), so upgrading the dependency does
not help. `npm audit fix --force` "fixes" it by downgrading pi-coding-agent
from 0.80.10 to 0.75.3 — a major version backwards — which is worse than the
advisory.

Overriding undici to ^8.10.0 keeps the same major (vulnerable range is
8.0.0-8.8.0) and is the narrowest change that clears the gate. This is a
deliberate exception to the "no overrides" posture in #78: it exists because
an upstream vendor pins an exact vulnerable version and has shipped no fix.
It should be removed once pi-coding-agent unpins or moves past 8.8.0.

Verified beyond the unit suite, since undici is the HTTP layer under the Pi
agent: 274/274 tests, build clean, MCP initialize + tools/list handshake
returns all 18 tools, and the packaged smoke test passes 9/9.
`npm audit --omit=dev` now reports 0 vulnerabilities.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 package-lock.json | 24 ++++++++++++------------
 package.json      |  3 +++
 2 files changed, 15 insertions(+), 12 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 0bcc66a..94e612b 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1665,9 +1665,9 @@
       "license": "MIT"
     },
     "node_modules/fast-uri": {
-      "version": "3.1.4",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz",
-      "integrity": "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz",
+      "integrity": "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==",
       "funding": [
         {
           "type": "github",
@@ -1945,9 +1945,9 @@
       }
     },
     "node_modules/hono": {
-      "version": "4.12.31",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.31.tgz",
-      "integrity": "sha512-zJIHFrl6bq3RDd2YusFNCDlM8qUprxKswyi/OPzPyzKDdyBXDqWx8bZlZ7R+saTdSTatUmb3O7K4SspGPaEOQg==",
+      "version": "4.13.0",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.0.tgz",
+      "integrity": "sha512-jhunvfHWxd7J5EFfSgH4xsYJzSe/lfqbUCxiyyeaQasUsXeEHXtzVid+7EOGByc5JnFa23SSFL3Y2RV/z1T+eQ==",
       "license": "MIT",
       "engines": {
         "node": ">=16.9.0"
@@ -2047,9 +2047,9 @@
       "license": "ISC"
     },
     "node_modules/ip-address": {
-      "version": "10.2.0",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz",
-      "integrity": "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==",
+      "version": "10.4.0",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.4.0.tgz",
+      "integrity": "sha512-oSK96Grm3aP6OrS263xVxbNDGVL7rzBtYdpGqlDG8iQdoenDoTs/nkki+DflYbAEE8Xl6o5YxhxlrKvI3nqKXQ==",
       "license": "MIT",
       "engines": {
         "node": ">= 12"
@@ -2873,9 +2873,9 @@
       }
     },
     "node_modules/undici": {
-      "version": "8.5.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-8.5.0.tgz",
-      "integrity": "sha512-xamtWoB1EshgjpmlXd7GGm2VfdDtw1+rD8uhry8pSNW3If6S8E0m2T2+orSKeZXEn/aPJMviCpDBA65WJt8zhg==",
+      "version": "8.10.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-8.10.0.tgz",
+      "integrity": "sha512-HvltHd7avK13QIw/oLe4qoOLyoVSoafqJ2jYOrtMRBkbYT31eiBQ8O0ehRKZiEZCMEyLFQNIADpgCWC5fALvYQ==",
       "license": "MIT",
       "peer": true,
       "engines": {
diff --git a/package.json b/package.json
index e321a0f..a956f03 100644
--- a/package.json
+++ b/package.json
@@ -64,5 +64,8 @@
   },
   "devDependencies": {
     "typescript": "^5.9.3"
+  },
+  "overrides": {
+    "undici": "^8.10.0"
   }
 }