Bump pi-coding-agent to 0.82.1 to resolve protobufjs DoS alert #292 - #4357
Merged
Conversation
Dependabot alert #292 (GHSA-j3f2-48v5-ccww) flags a medium-severity DoS in protobufjs <= 7.6.4, pulled in transitively via pi-coding-agent's bundled @google/genai. The package's own npm-shrinkwrap pins protobufjs, so it can only be moved by upgrading pi-coding-agent. 0.82.1 ships protobufjs 7.6.5. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Collaborator
📊 Performance Test ResultsComparing df90bd6 vs trunk app-size
site-editor
site-startup
Results are median values from multiple test runs. Legend: 🟢 Improvement (faster) | 🔴 Regression (slower) | ⚪ No change (<50ms diff) |
pi-agent-core 0.82.1 types AgentTool.execute params from the tool's own schema, so a concrete AgentTool no longer widens into AgentTool<any> (the contravariant execute param made the assignment fail under strict typing). Make renameTool generic over the tool schema so each tool keeps its type through the rename, fixing the CI typecheck. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related issues
How AI was used in this PR
Claude Code traced the alert to its root cause, identified that
pi-coding-agent's bundlednpm-shrinkwrap.jsonwas pinning the vulnerable transitive dependency, confirmed a newer release ships the fix, applied the version bumps, and ran typecheck + the affected test suites. All findings were reviewed by me.Proposed Changes
Dependabot flags a medium-severity denial-of-service in
protobufjs(>= 7.5.0, <= 7.6.4) — an infinite loop in.protooption parsing, fixed upstream in 7.6.5. We don't depend onprotobufjsdirectly; it arrives transitively throughpi-coding-agent→@google/genai.The catch:
pi-coding-agent@0.81.0publishes its ownnpm-shrinkwrap.jsonthat hard-pins its entire subtree, includingprotobufjs@7.6.4. Because npm honors a package's bundled shrinkwrap, the nested copy can't be lifted by a root-levelnpm dedupe, aninstall protobufjs@7.6.5, or anoverridesentry — the only clean fix is upgradingpi-coding-agentitself. Version 0.82.1 shipsprotobufjs@7.6.5in its shrinkwrap.This bumps
@earendil-works/pi-coding-agent(and@earendil-works/pi-ai, declared inapps/cli) from0.81.0to0.82.1. Both the top-level and the nestedprotobufjscopies now resolve to 7.6.5, clearing the alert. The 0.82.x release notes are additive (new provider support, opt-in constrained tool sampling, fixes) with no breaking API changes; same remediation pattern as the earlier #288 brace-expansion bump.No user-visible behavior change.
Testing Instructions
npm installresolves bothprotobufjscopies (top-level and the one nested underpi-coding-agent) to 7.6.5 — verify withnpm ls protobufjs.npm run typecheckpasses across all workspaces (the pi packages have a wide type-import surface, so this confirms no signatures changed).npm test -- apps/cli/ai packages/common/ai apps/studio/src/components/studio-code-session apps/cli/remote-session(498 tests).Pre-merge Checklist