deps(deps-dev): bump the npm-development-dependencies group across 1 directory with 9 updates

[dependabot]

Bumps the npm-development-dependencies group with 8 updates in the / directory:

Package	From	To
@earendil-works/pi-ai	0.82.0	0.84.0
@earendil-works/pi-coding-agent	0.82.0	0.84.0
@types/node	26.1.1	26.1.2
c8	11.0.0	12.0.0
eslint	10.7.0	10.8.0
globals	17.7.0	17.9.0
typescript	6.0.3	7.0.2
typescript-eslint	8.65.0	8.66.0

Updates @earendil-works/pi-ai from 0.82.0 to 0.84.0

Release notes

Sourced from @​earendil-works/pi-ai's releases.

v0.84.0

New Features

• Fullscreen TUI mode — Switch between regular and fullscreen modes at runtime, with a sticky editor and footer, independently scrollable transcript, and draggable scrollbars. See UI & Display.
• Mermaid and LaTeX rendering — Render Mermaid diagrams and terminal-friendly Unicode math in interactive transcripts. See Markdown settings and TUI Markdown.
• Per-directory context overrides — Use AGENTS.override.md to replace context files for a specific directory. See Context Files.
• Advanced custom model sampling — Configure arbitrary OpenAI-compatible samplingParams and opt-in vLLM thinking_token_budget values. See Sampling Parameters.
• Baseten provider — Use built-in Baseten authentication and model support. See API Keys.

Breaking Changes

• Renamed the inherited pi-ai ModelsStreamTransforms interface to ModelsRequestTransforms because its header transformation now applies to all authenticated provider requests.

• Changed JSON and RPC message_update events to emit only assistantMessageEvent deltas, removing the cumulative message and assistantMessageEvent.partial fields that caused quadratic output growth. Clients that need partial messages must assemble deltas between message_start and message_end; the latter remains authoritative (#7290).

• ModelRegistry.getApiKeyAndHeaders() now returns ProviderHeaders with string | null values and preserves null header-deletion markers. Extensions that inspect returned headers must handle null; extensions forwarding them to pi-ai streams should pass them through unchanged. This prevents placeholder OpenAI credentials from being sent through Cloudflare AI Gateway (#7030).

• Changed ModelRegistry.refresh() to accept ModelsRefreshOptions and return ModelsRefreshResult instead of discarding cancellation and provider errors.

• Changed ModelRuntime.setRuntimeApiKey() to accept auth cancellation options rather than catalog refresh options. Call refresh({ providers: [providerId], signal }) separately when remote freshness is required.

• Required config-form extension OAuth refreshToken(credentials, signal) callbacks to accept and honor a concrete abort signal.

• Replaced dynamic provider refresh context store access with the read-only context.stored snapshot and generation-checked context.publish() transaction.

  Providers built with createProvider({ fetchModels }): no catalog-publication migration is required. Before and after, return the fetched models and register the resulting provider; createProvider() owns restoration, persistence, and in-memory publication.

  // Before
  const beforeProvider = createProvider({
    // ...
    fetchModels: async ({ signal }) => {
      const response = await fetch(catalogUrl, { signal });
      return parseModels(await response.json());
    },
  });
  pi.registerProvider(beforeProvider);
  // After: unchanged
  const afterProvider = createProvider({
  // ...
  fetchModels: async ({ signal }) => {
  const response = await fetch(catalogUrl, { signal });
  return parseModels(await response.json());
  },
  });
  pi.registerProvider(afterProvider);

  Handwritten native Provider.refreshModels(): replace direct store access and pre-publication mutation with generation-guarded publications.

  // Before
  refreshModels: async (context) => {
    const stored = await context.store.read();
    if (stored) currentModels = stored.models;

... (truncated)

Changelog

Sourced from @​earendil-works/pi-ai's changelog.

[0.84.0] - 2026-08-06

Breaking Changes

• Renamed the exported ModelsStreamTransforms interface to ModelsRequestTransforms because its header transformation now applies to all authenticated provider requests.

• Required dynamic model providers to accept a concrete RefreshModelsContext.signal; Models.refresh() remains unbounded when callers omit its optional signal.

• Required provider login, API-key check/resolution, and OAuth refresh implementations to accept a concrete abort signal; public auth and credential operations remain unbounded when callers omit their optional signal.

• Replaced raw RefreshModelsContext.store access with the read-only context.stored snapshot and generation-checked context.publish() transaction.

  createProvider({ fetchModels }): no catalog-publication migration is required. Before and after, return the fetched list; createProvider() restores stored models and publishes and persists refreshed models itself. signal is now guaranteed to be present.

  // Before
  const beforeProvider = createProvider({
    // ...
    fetchModels: async ({ signal }) => {
      const response = await fetch(catalogUrl, { signal });
      return parseModels(await response.json());
    },
  });
  // After: unchanged
  const afterProvider = createProvider({
  // ...
  fetchModels: async ({ signal }) => {
  const response = await fetch(catalogUrl, { signal });
  return parseModels(await response.json());
  },
  });

  Handwritten Provider.refreshModels(): replace direct store access and pre-publication mutation with generation-guarded publications.

  // Before
  refreshModels: async (context) => {
    const stored = await context.store.read();
    if (stored) currentModels = stored.models;
    if (!context.allowNetwork) return;
  const refreshed = await fetchModels(context.signal);
  currentModels = refreshed;
  await context.store.write({ models: refreshed, checkedAt: Date.now() });
  },
  // After
  refreshModels: async (context) => {
  if (context.stored) {
  const restored = context.stored.models;
  if (!(await context.publish({

... (truncated)

Commits

• a5f43bf Release v0.84.0
• b9497c8 fix(ai): correct Fireworks GLM prompt caching, closes #7676
• c0947e6 fix(ai): remove stale adaptive thinking model expectation
• b0bd0ff fix(coding-agent): only label known subscriptions in footer
• 6b461b7 feat: extract telemetry package
• db48124 docs: audit unreleased changelogs
• 639a466 fix(ai): update Anthropic abort test model
• d07889d feat(ai): support thinking_token_budget on openai-completions (#7638)
• 2f7f75a fix(ai): replace qwen3.8-max-preview with qwen3.8-max on token plan (#7670)
• 14cc26e fix(ai): restore Copilot models from account policy (#7672)
• Additional commits viewable in compare view

Updates @earendil-works/pi-coding-agent from 0.82.0 to 0.84.0

Release notes

Sourced from @​earendil-works/pi-coding-agent's releases.

v0.84.0

New Features

• Fullscreen TUI mode — Switch between regular and fullscreen modes at runtime, with a sticky editor and footer, independently scrollable transcript, and draggable scrollbars. See UI & Display.
• Mermaid and LaTeX rendering — Render Mermaid diagrams and terminal-friendly Unicode math in interactive transcripts. See Markdown settings and TUI Markdown.
• Per-directory context overrides — Use AGENTS.override.md to replace context files for a specific directory. See Context Files.
• Advanced custom model sampling — Configure arbitrary OpenAI-compatible samplingParams and opt-in vLLM thinking_token_budget values. See Sampling Parameters.
• Baseten provider — Use built-in Baseten authentication and model support. See API Keys.

Breaking Changes

• Renamed the inherited pi-ai ModelsStreamTransforms interface to ModelsRequestTransforms because its header transformation now applies to all authenticated provider requests.

• Changed JSON and RPC message_update events to emit only assistantMessageEvent deltas, removing the cumulative message and assistantMessageEvent.partial fields that caused quadratic output growth. Clients that need partial messages must assemble deltas between message_start and message_end; the latter remains authoritative (#7290).

• ModelRegistry.getApiKeyAndHeaders() now returns ProviderHeaders with string | null values and preserves null header-deletion markers. Extensions that inspect returned headers must handle null; extensions forwarding them to pi-ai streams should pass them through unchanged. This prevents placeholder OpenAI credentials from being sent through Cloudflare AI Gateway (#7030).

• Changed ModelRegistry.refresh() to accept ModelsRefreshOptions and return ModelsRefreshResult instead of discarding cancellation and provider errors.

• Changed ModelRuntime.setRuntimeApiKey() to accept auth cancellation options rather than catalog refresh options. Call refresh({ providers: [providerId], signal }) separately when remote freshness is required.

• Required config-form extension OAuth refreshToken(credentials, signal) callbacks to accept and honor a concrete abort signal.

• Replaced dynamic provider refresh context store access with the read-only context.stored snapshot and generation-checked context.publish() transaction.

  Providers built with createProvider({ fetchModels }): no catalog-publication migration is required. Before and after, return the fetched models and register the resulting provider; createProvider() owns restoration, persistence, and in-memory publication.

  // Before
  const beforeProvider = createProvider({
    // ...
    fetchModels: async ({ signal }) => {
      const response = await fetch(catalogUrl, { signal });
      return parseModels(await response.json());
    },
  });
  pi.registerProvider(beforeProvider);
  // After: unchanged
  const afterProvider = createProvider({
  // ...
  fetchModels: async ({ signal }) => {
  const response = await fetch(catalogUrl, { signal });
  return parseModels(await response.json());
  },
  });
  pi.registerProvider(afterProvider);

  Handwritten native Provider.refreshModels(): replace direct store access and pre-publication mutation with generation-guarded publications.

  // Before
  refreshModels: async (context) => {
    const stored = await context.store.read();
    if (stored) currentModels = stored.models;

... (truncated)

Changelog

Sourced from @​earendil-works/pi-coding-agent's changelog.

[0.84.0] - 2026-08-06

New Features

• Fullscreen TUI mode — Switch between regular and fullscreen modes at runtime, with a sticky editor and footer, independently scrollable transcript, and draggable scrollbars. See UI & Display.
• Mermaid and LaTeX rendering — Render Mermaid diagrams and terminal-friendly Unicode math in interactive transcripts. See Markdown settings and TUI Markdown.
• Per-directory context overrides — Use AGENTS.override.md to replace context files for a specific directory. See Context Files.
• Advanced custom model sampling — Configure arbitrary OpenAI-compatible samplingParams and opt-in vLLM thinking_token_budget values. See Sampling Parameters.
• Baseten provider — Use built-in Baseten authentication and model support. See API Keys.

Breaking Changes

• Renamed the inherited pi-ai ModelsStreamTransforms interface to ModelsRequestTransforms because its header transformation now applies to all authenticated provider requests.

• Changed JSON and RPC message_update events to emit only assistantMessageEvent deltas, removing the cumulative message and assistantMessageEvent.partial fields that caused quadratic output growth. Clients that need partial messages must assemble deltas between message_start and message_end; the latter remains authoritative (#7290).

• ModelRegistry.getApiKeyAndHeaders() now returns ProviderHeaders with string | null values and preserves null header-deletion markers. Extensions that inspect returned headers must handle null; extensions forwarding them to pi-ai streams should pass them through unchanged. This prevents placeholder OpenAI credentials from being sent through Cloudflare AI Gateway (#7030).

• Changed ModelRegistry.refresh() to accept ModelsRefreshOptions and return ModelsRefreshResult instead of discarding cancellation and provider errors.

• Changed ModelRuntime.setRuntimeApiKey() to accept auth cancellation options rather than catalog refresh options. Call refresh({ providers: [providerId], signal }) separately when remote freshness is required.

• Required config-form extension OAuth refreshToken(credentials, signal) callbacks to accept and honor a concrete abort signal.

• Replaced dynamic provider refresh context store access with the read-only context.stored snapshot and generation-checked context.publish() transaction.

  Providers built with createProvider({ fetchModels }): no catalog-publication migration is required. Before and after, return the fetched models and register the resulting provider; createProvider() owns restoration, persistence, and in-memory publication.

  // Before
  const beforeProvider = createProvider({
    // ...
    fetchModels: async ({ signal }) => {
      const response = await fetch(catalogUrl, { signal });
      return parseModels(await response.json());
    },
  });
  pi.registerProvider(beforeProvider);
  // After: unchanged
  const afterProvider = createProvider({
  // ...
  fetchModels: async ({ signal }) => {
  const response = await fetch(catalogUrl, { signal });
  return parseModels(await response.json());
  },
  });
  pi.registerProvider(afterProvider);

  Handwritten native Provider.refreshModels(): replace direct store access and pre-publication mutation with generation-guarded publications.

  // Before
  refreshModels: async (context) => {
    const stored = await context.store.read();

... (truncated)

Commits

• a5f43bf Release v0.84.0
• 6d0455f docs: audit unreleased changelogs
• 6189e53 fix: replace session summaries with durable metadata (#7708)
• 35f5c26 feat: add telemetry reference adapter and span composition
• b0bd0ff fix(coding-agent): only label known subscriptions in footer
• 6b461b7 feat: extract telemetry package
• db48124 docs: audit unreleased changelogs
• 5446cd7 feat(coding-agent): rename UI mode to TUI mode
• 6ca4234 event bus leak fix (#7656)
• d4eaf05 fix(coding-agent): support path globs on Windows
• Additional commits viewable in compare view

Updates @types/node from 26.1.1 to 26.1.2

Commits

• See full diff in compare view

Updates c8 from 11.0.0 to 12.0.0

Release notes

Sourced from c8's releases.

v12.0.0

12.0.0 (2026-07-14)

⚠ BREAKING CHANGES

• yargs enforces a stricter range of Node versions ^20.19.0 || ^22.12.0 || >=23

Features

• update yargs to 18.x.x (#599) (dc2d6c8)

Changelog

Sourced from c8's changelog.

12.0.0 (2026-07-14)

⚠ BREAKING CHANGES

• yargs enforces a stricter range of Node versions ^20.19.0 || ^22.12.0 || >=23

Features

• update yargs to 18.x.x (#599) (dc2d6c8)

Commits

• ae5a0cf chore(main): release 12.0.0 (#600)
• dc2d6c8 feat!: update yargs to 18.x.x (#599)
• ee2f1cf chore(deps): update dependency @​types/node to v24 (#579)
• 923c238 build: go back to publishing manually
• See full diff in compare view

Updates eslint from 10.7.0 to 10.8.0

Release notes

Sourced from eslint's releases.

v10.8.0

Features

• 2fee9bb feat: export ConfigObject from eslint/config (#21082) (sethamus)

Bug Fixes

• 6b8d2f7 fix: escape reserved characters in rule id in html formatter (#21129) (Francesco Trotta)
• 9091071 fix: prevent no-unreachable-loop crash when all loop types are ignored (#21116) (Pixel)
• e23fafe fix: prefer-object-spread add semicolon when adding parenthesis (#21081) (synthex-byte)
• 20b5ad0 fix: quadratic-time regex in prefer-template (#21096) (Milos Djermanovic)
• 8b6f6c0 fix: apply ignore configs to computed methods in class-methods-use-this (#21094) (Pixel)
• b2c608c fix: NewExpression with parenthesized callee in preserve-caught-error (#21083) (Francesco Trotta)

Documentation

• 6ddf858 docs: fix broken Specify Parser Options anchor link (#21106) (Minsu)
• 784dfbe docs: Clarify no-eq-null description (#21120) (Park Harin)
• 7ec733a docs: Fix typos and grammar in glossary (#21095) (Marry (Subin Yang))
• 92bb13f docs: replace quake link (#21108) (Jung Hyeon Jun)
• 68eb4a5 docs: fix broken Specify Globals anchor links in rule pages (#21103) (Minsu)
• d28f697 docs: replace Code Climate CLI links with Qlty CLI links (#21099) (Jung Hyeon Jun)
• eccc68d docs: correct --suppressions-location option description (#21093) (Ga eun Lee)
• c5963f7 docs: Update README (GitHub Actions Bot)

Chores

• 4fbf46d test: pin webpack version to 5.108.4 (#21137) (Francesco Trotta)
• 2d063e2 chore: update HTTP URLs to HTTPS in JSDoc and comments (#21101) (Bo Hyun Kim)
• eccbe7b test: add error locations to no-class-assign (#21123) (devoil)
• e7d1e43 ci: bump actions/setup-go from 6 to 7 (#21118) (dependabot[bot])
• e9d66d0 ci: bump actions/setup-node from 6 to 7 (#21119) (dependabot[bot])
• ee225b6 test: Add error location details to no-eq-null rule (#21117) (Park Harin)
• 044a627 chore: update minimatch to ^10.2.5 (#21107) (김채영)
• fb09aa8 chore: update ecosystem plugins (#21115) (ESLint Bot)
• 5abd878 test: add error locations to no-proto (#21114) (Gihyeon Jeong / 정기현)
• 9715887 test: Add error location details to no-div-regex (#21110) (Park Harin)
• a746ec6 test: add error locations to no-new-wrappers (#21109) (Gihyeon Jeong / 정기현)
• 8dde645 test: add error locations to no-ex-assign (#21102) (devoil)
• 13ab0ec test: add error locations to no-label-var (#21098) (Gihyeon Jeong / 정기현)
• a99906f test: Add error location details to no-delete-var rule (#21105) (Park Harin)
• c47e8dc chore: add missing backticks to languages/js/index.js (#21104) (beeen)
• 0174428 chore: add missing backticks to translate-cli-options.js (#21097) (dongkyu lee)
• 3d36589 chore: add missing backticks to serialization.js (#21091) (이규환)
• dcc9312 test: add error locations to eqeqeq (#21090) (Ga eun Lee)
• 2710b18 ci: Add explicit permissions to rebuild-docs-sites workflow (#21089) (Marry (Subin Yang))
• 5d2f866 chore: update dependency prettier to v3.9.5 (#21086) (renovate[bot])
• d584e31 chore: fix failing ecosystem test for eslint-plugin-unicorn (#21084) (Francesco Trotta)
• bf3eda0 chore: update ecosystem plugins (#21079) (ESLint Bot)

Commits

• 749dfed 10.8.0
• 4bd0d75 Build: changelog update for 10.8.0
• 4fbf46d test: pin webpack version to 5.108.4 (#21137)
• 6ddf858 docs: fix broken Specify Parser Options anchor link (#21106)
• 784dfbe docs: Clarify no-eq-null description (#21120)
• 6b8d2f7 fix: escape reserved characters in rule id in html formatter (#21129)
• 2d063e2 chore: update HTTP URLs to HTTPS in JSDoc and comments (#21101)
• eccbe7b test: add error locations to no-class-assign (#21123)
• 2fee9bb feat: export ConfigObject from eslint/config (#21082)
• e7d1e43 ci: bump actions/setup-go from 6 to 7 (#21118)
• Additional commits viewable in compare view

Updates globals from 17.7.0 to 17.9.0

Release notes

Sourced from globals's releases.

v17.9.0

• Update globals (2026-08-01) (#348) 5a958ed

---

sindresorhus/globals@v17.8.0...v17.9.0

v17.8.0

• Update globals (2026-07-01) (#347) 7394811

---

sindresorhus/globals@v17.7.0...v17.8.0

Commits

• 8e7b935 17.9.0
• 5a958ed Update globals (2026-08-01) (#348)
• 36c7659 17.8.0
• 7394811 Update globals (2026-07-01) (#347)
• See full diff in compare view

Updates typebox from 1.3.6 to 1.3.7

Commits

• 153184e Version 1.3.7 (#1654)
• 67902a3 Documentation (#1645)
• 4f8c8ba Fix keyword guards for multi-type schemas (#1652)
• bd265b3 Specification
• 0c31e10 Security
• 9fd5854 TypeScript 7.0.2
• See full diff in compare view

Updates typescript from 6.0.3 to 7.0.2

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

Updates typescript-eslint from 8.65.0 to 8.66.0

Release notes

Sourced from typescript-eslint's releases.

v8.66.0

8.66.0 (2026-08-03)

🚀 Features

• typescript-estree: handle import.defer() as ImportExpression (#12609)

🩹 Fixes

• eslint-plugin: [no-unnecessary-type-conversion] ignore shadowed built-ins (#12590)
• eslint-plugin: [prefer-nullish-coalescing] handle shadowed Boolean calls (#12591)
• eslint-plugin: [no-useless-default-assignment] don't report defaults used by other overloads (#12607)
• eslint-plugin: [no-unnecessary-type-parameters] check MappedType key remapping (#12588)
• eslint-plugin: [class-literal-property-style] preserve type annotations and don't drop decorators (#12617)
• website: list onUnsupportedTypeScriptVersion in parser options (#12585)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Kirk Waiblinger @​kirkwaiblinger
• Steffen Schroeder
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from typescript-eslint's changelog.

8.66.0 (2026-08-03)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• e51b11b chore(release): publish 8.66.0
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies, npm. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.