From 61351d5b01f9ccd442a99a46b6960b133121f126 Mon Sep 17 00:00:00 2001
From: simonsmh <simonsmh@users.noreply.github.com>
Date: Tue, 27 Oct 2026 20:37:16 +0800
Subject: [PATCH] fix(deps): override undici to 8.12.2 for CVE-2026-109869

undici 8.10.2 (transitive dev dependency via @earendil-works/pi-coding-agent)
is affected by GHSA-xjj6-f33q-929c: fetch() can crash the Node.js
process on a response with more than five content codings.
Upstream pi-coding-agent 1.4.0 (latest) still pins 8.10.2, so force
8.12.2 via npm overrides until upstream bumps it.
Fixes Dependabot alert #40.
---
 package-lock.json | 62 ++++++++---------------------------------------
 package.json      |  5 +++-
 2 files changed, 14 insertions(+), 53 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index d056929..69d21cc 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -481,9 +481,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT OR Apache-2.0",
       "optional": true,
       "os": [
@@ -501,9 +498,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT OR Apache-2.0",
       "optional": true,
       "os": [
@@ -521,9 +515,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT OR Apache-2.0",
       "optional": true,
       "os": [
@@ -541,9 +532,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT OR Apache-2.0",
       "optional": true,
       "os": [
@@ -828,16 +816,6 @@
       "dev": true,
       "license": "ISC"
     },
-    "node_modules/@earendil-works/pi-coding-agent/node_modules/undici": {
-      "version": "8.10.2",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-8.10.2.tgz",
-      "integrity": "sha512-/y4/bH9YNU5hi9NIrpOuvGXFcxrj3CMrV+/AYpowAYTpHn8gX/XPFjNy766FPoYY0miQhdW977JFWKGNhBdwyQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=22.19.0"
-      }
-    },
     "node_modules/@earendil-works/pi-mcp": {
       "version": "1.0.4",
       "resolved": "https://registry.npmjs.org/@earendil-works/pi-mcp/-/pi-mcp-1.0.4.tgz",
@@ -1563,9 +1541,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1584,9 +1559,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1605,9 +1577,6 @@
         "ppc64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1626,9 +1595,6 @@
         "s390x"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1647,9 +1613,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1668,9 +1631,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2920,9 +2880,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -2945,9 +2902,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -2970,9 +2924,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -2995,9 +2946,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -3566,6 +3514,16 @@
         "@typescript/typescript-win32-x64": "7.0.2"
       }
     },
+    "node_modules/undici": {
+      "version": "8.12.2",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-8.12.2.tgz",
+      "integrity": "sha512-XtuDWVdqTLr3NAxm2ly9/hU6kUsJOgGh1RASzMBbsw6aWCOaQzHdW+QQDfdERjfJ2V5vL5pRPa4RetO9UfivDg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=22.19.0"
+      }
+    },
     "node_modules/undici-types": {
       "version": "8.3.0",
       "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.3.0.tgz",
diff --git a/package.json b/package.json
index 95247c2..70d085b 100644
--- a/package.json
+++ b/package.json
@@ -53,5 +53,8 @@
   "bugs": {
     "url": "https://github.com/simonsmh/pi-provider-qoder/issues"
   },
-  "homepage": "https://github.com/simonsmh/pi-provider-qoder#readme"
+  "homepage": "https://github.com/simonsmh/pi-provider-qoder#readme",
+  "overrides": {
+    "undici": "8.12.2"
+  }
 }