Skip to content

chore(deps): bump the pi group across 1 directory with 2 updates - #544

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/pi-562229f64b
Closed

chore(deps): bump the pi group across 1 directory with 2 updates#544
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/pi-562229f64b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the pi group with 2 updates in the / directory: @mariozechner/pi-agent-core and @mariozechner/pi-ai.

Updates @mariozechner/pi-agent-core from 0.72.1 to 0.73.1

Release notes

Sourced from @​mariozechner/pi-agent-core's releases.

v0.73.1

New Features

  • Self-update support for the npm scope migration: pi update --self now supports the upcoming package rename from @mariozechner/pi-coding-agent to @earendil-works/pi-coding-agent. After the new package is published, existing global installs can update through the normal self-update flow; pi will uninstall the old global package and install the package name returned by the version check endpoint.
  • Interactive OAuth login selection: OAuth providers can now present multiple login choices in /login, enabling provider-specific interactive authentication flows. See Providers.
  • JSONC-style models.json parsing: models.json now allows comments and trailing commas, making custom provider and model configuration easier to maintain. See Providers and Custom Providers.

Added

  • Added interactive login selection support so OAuth providers can present multiple login choices (#4190 by @​mitsuhiko).

Changed

  • Changed pi update --self to honor the active package name returned by the Pi version check endpoint, defaulting to the current package when omitted and uninstalling the old global package before installing a renamed package.
  • Changed extension loading to use upstream jiti 2.7 instead of the @mariozechner/jiti fork (#4244 by @​pi0).
  • Changed models.json parsing to allow comments and trailing commas (#4162 by @​julien-c).

Fixed

  • Fixed pi -p treating prompts that start with YAML frontmatter as extension flags instead of user messages (#4163).
  • Fixed pending tool results not updating in the live TUI after toggling thinking block visibility while the tool is running (#4167).
  • Fixed /copy reporting success on Linux without writing the clipboard on Wayland-only compositors (Hyprland, Niri, ...) by skipping the X11-only native addon on Linux and routing through wl-copy/xclip/xsel instead (#4177).
  • Fixed HTML session exports to strip skill wrapper XML from rendered user messages (#4234 by @​aliou).
  • Fixed OpenAI-compatible chat completion streams that interleave content and tool-call deltas in the same choice.
  • Fixed OpenAI Codex OAuth refresh failures writing directly to stderr while the TUI is active (#4141).
  • Fixed OpenAI Codex Responses requests to send a non-empty system prompt (#4184).
  • Fixed Kimi For Coding model resolution for the Kimi K2 P6 alias (#4218).
  • Fixed Kitty inline image redraws to stay within TUI-owned terminal regions and avoid writing below the active viewport.
  • Fixed Kitty inline image rendering by letting the terminal allocate image ids and bounding parsed image ids to valid values.
  • Fixed inline image capability detection to disable inline images in cmux terminals.

v0.73.0

New Features

Breaking Changes

  • Switched the built-in xiaomi provider from Token Plan AMS to Xiaomi's API billing endpoint, and renamed its /login display from "Xiaomi MiMo Token Plan" to "Xiaomi MiMo". XIAOMI_API_KEY now refers to the API billing key from platform.xiaomimimo.com. Users on Token Plan should switch to the appropriate xiaomi-token-plan-* provider and set the corresponding env var (#4112 by @​Phoen1xCode).

Added

  • Added three Xiaomi MiMo Token Plan regional providers visible in /login: xiaomi-token-plan-cn (XIAOMI_TOKEN_PLAN_CN_API_KEY), xiaomi-token-plan-ams (XIAOMI_TOKEN_PLAN_AMS_API_KEY), xiaomi-token-plan-sgp (XIAOMI_TOKEN_PLAN_SGP_API_KEY). Each defaults to mimo-v2.5-pro (#4112 by @​Phoen1xCode).

Changed

... (truncated)

Changelog

Sourced from @​mariozechner/pi-agent-core's changelog.

[0.73.1] - 2026-05-07

[0.73.0] - 2026-05-04

Commits

Updates @mariozechner/pi-ai from 0.72.1 to 0.73.1

Release notes

Sourced from @​mariozechner/pi-ai's releases.

v0.73.1

New Features

  • Self-update support for the npm scope migration: pi update --self now supports the upcoming package rename from @mariozechner/pi-coding-agent to @earendil-works/pi-coding-agent. After the new package is published, existing global installs can update through the normal self-update flow; pi will uninstall the old global package and install the package name returned by the version check endpoint.
  • Interactive OAuth login selection: OAuth providers can now present multiple login choices in /login, enabling provider-specific interactive authentication flows. See Providers.
  • JSONC-style models.json parsing: models.json now allows comments and trailing commas, making custom provider and model configuration easier to maintain. See Providers and Custom Providers.

Added

  • Added interactive login selection support so OAuth providers can present multiple login choices (#4190 by @​mitsuhiko).

Changed

  • Changed pi update --self to honor the active package name returned by the Pi version check endpoint, defaulting to the current package when omitted and uninstalling the old global package before installing a renamed package.
  • Changed extension loading to use upstream jiti 2.7 instead of the @mariozechner/jiti fork (#4244 by @​pi0).
  • Changed models.json parsing to allow comments and trailing commas (#4162 by @​julien-c).

Fixed

  • Fixed pi -p treating prompts that start with YAML frontmatter as extension flags instead of user messages (#4163).
  • Fixed pending tool results not updating in the live TUI after toggling thinking block visibility while the tool is running (#4167).
  • Fixed /copy reporting success on Linux without writing the clipboard on Wayland-only compositors (Hyprland, Niri, ...) by skipping the X11-only native addon on Linux and routing through wl-copy/xclip/xsel instead (#4177).
  • Fixed HTML session exports to strip skill wrapper XML from rendered user messages (#4234 by @​aliou).
  • Fixed OpenAI-compatible chat completion streams that interleave content and tool-call deltas in the same choice.
  • Fixed OpenAI Codex OAuth refresh failures writing directly to stderr while the TUI is active (#4141).
  • Fixed OpenAI Codex Responses requests to send a non-empty system prompt (#4184).
  • Fixed Kimi For Coding model resolution for the Kimi K2 P6 alias (#4218).
  • Fixed Kitty inline image redraws to stay within TUI-owned terminal regions and avoid writing below the active viewport.
  • Fixed Kitty inline image rendering by letting the terminal allocate image ids and bounding parsed image ids to valid values.
  • Fixed inline image capability detection to disable inline images in cmux terminals.

v0.73.0

New Features

Breaking Changes

  • Switched the built-in xiaomi provider from Token Plan AMS to Xiaomi's API billing endpoint, and renamed its /login display from "Xiaomi MiMo Token Plan" to "Xiaomi MiMo". XIAOMI_API_KEY now refers to the API billing key from platform.xiaomimimo.com. Users on Token Plan should switch to the appropriate xiaomi-token-plan-* provider and set the corresponding env var (#4112 by @​Phoen1xCode).

Added

  • Added three Xiaomi MiMo Token Plan regional providers visible in /login: xiaomi-token-plan-cn (XIAOMI_TOKEN_PLAN_CN_API_KEY), xiaomi-token-plan-ams (XIAOMI_TOKEN_PLAN_AMS_API_KEY), xiaomi-token-plan-sgp (XIAOMI_TOKEN_PLAN_SGP_API_KEY). Each defaults to mimo-v2.5-pro (#4112 by @​Phoen1xCode).

Changed

... (truncated)

Changelog

Sourced from @​mariozechner/pi-ai's changelog.

[0.73.1] - 2026-05-07

Added

  • Added OAuth login flow metadata so clients can present interactive provider choices during login (#4190 by @​mitsuhiko).

Fixed

  • Fixed OpenAI Responses reasoning text streaming for LM Studio and other compatible providers that emit response.reasoning_text.delta events (#4191 by @​yaanfpv).
  • Fixed OpenAI Codex OAuth refresh failures writing directly to stderr while the TUI is active (#4141).
  • Fixed OpenAI-compatible chat completion streams that interleave content and tool-call deltas in the same choice.
  • Fixed the Kimi K2 P6 model alias to normalize to kimi-for-coding (#4218).
  • Fixed OpenAI Codex Responses requests to send a non-empty system prompt (#4184).

[0.73.0] - 2026-05-04

Breaking Changes

  • Switched the built-in xiaomi provider endpoint from Token Plan AMS (https://token-plan-ams.xiaomimimo.com/anthropic) to API billing (https://api.xiaomimimo.com/anthropic). XIAOMI_API_KEY now refers to the API billing key from platform.xiaomimimo.com. Users still on Token Plan must move to the appropriate xiaomi-token-plan-* provider and set the corresponding env var (#4112 by @​Phoen1xCode).

Added

  • Added Xiaomi MiMo Token Plan regional providers with per-region env vars: xiaomi-token-plan-cn (XIAOMI_TOKEN_PLAN_CN_API_KEY), xiaomi-token-plan-ams (XIAOMI_TOKEN_PLAN_AMS_API_KEY), and xiaomi-token-plan-sgp (XIAOMI_TOKEN_PLAN_SGP_API_KEY) (#4112 by @​Phoen1xCode).
  • Added registerSessionResourceCleanup() and cleanupSessionResources() so providers can register cleanup hooks for session-scoped resources.

Fixed

  • Fixed generated OpenAI-compatible model metadata for Qwen 3.5/3.6 and MiniMax M2.7 to match models.dev and OpenCode Go (#4110 by @​jsynowiec).
  • Fixed Bedrock Converse thinking effort mapping to preserve native xhigh for Claude Opus 4.7.
  • Fixed OpenAI Codex Responses WebSocket transport to fall back to SSE when setup fails before streaming starts, and attach transport diagnostics to the assistant message (#4133).
Commits
  • 781152f Release v0.73.1
  • 7fa924b docs: audit unreleased changelog entries
  • 9eb126e docs(ai): document interleaved stream events
  • 6b27184 fix(ai): handle mixed chat completion deltas
  • ace3fd7 fix(ai): normalize kimi k2p6 alias to kimi-for-coding closes #4218
  • 3029836 fix(ai): stop Codex OAuth stderr writes
  • 31f5c23 fix(ai): handle OpenAI Responses reasoning text deltas
  • 15aa313 Closes #4184, codex needs a non-empty system prompt
  • b5755fd feat(oauth): support interactive login selection (#4190)
  • 3c9c54d Add [Unreleased] section for next cycle
  • Additional commits viewable in compare view

@dependabot dependabot Bot added area:build Turbo/Vite/Biome/tsconfig toolchain chore Routine maintenance / non-feature work labels Nov 4, 2026
@github-actions github-actions Bot added area:desktop apps/desktop (Electron shell, renderer) area:core packages/core (generation orchestration) area:providers packages/providers (pi-ai adapter, model calls) labels Nov 4, 2026
@dependabot
chore(deps): bump the pi group across 1 directory with 2 updates
3d987e9 
Bumps the pi group with 2 updates in the / directory: [@mariozechner/pi-agent-core](https://github.com/badlogic/pi-mono/tree/HEAD/packages/agent) and [@mariozechner/pi-ai](https://github.com/badlogic/pi-mono/tree/HEAD/packages/ai).


Updates `@mariozechner/pi-agent-core` from 0.72.1 to 0.73.1
- [Release notes](https://github.com/badlogic/pi-mono/releases)
- [Changelog](https://github.com/earendil-works/pi/blob/main/packages/agent/CHANGELOG.md)
- [Commits](https://github.com/badlogic/pi-mono/commits/v0.73.1/packages/agent)

Updates `@mariozechner/pi-ai` from 0.72.1 to 0.73.1
- [Release notes](https://github.com/badlogic/pi-mono/releases)
- [Changelog](https://github.com/earendil-works/pi/blob/main/packages/ai/CHANGELOG.md)
- [Commits](https://github.com/badlogic/pi-mono/commits/v0.73.1/packages/ai)

---
updated-dependencies:
- dependency-name: "@mariozechner/pi-agent-core"
  dependency-version: 0.73.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pi
- dependency-name: "@mariozechner/pi-ai"
  dependency-version: 0.73.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pi
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title chore(deps): bump the pi group with 2 updates chore(deps): bump the pi group across 1 directory with 2 updates Nov 10, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/pi-562229f64b branch from 8c341bb to 3d987e9 Compare November 10, 2026 05:56
@Sun-sunshine06 Sun-sunshine06 mentioned this pull request Nov 10, 2026
Merged
@dependabot @github

dependabot Bot commented on behalf of github Nov 10, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are no longer updatable, so this is no longer needed.

@dependabot dependabot Bot closed this Nov 10, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/pi-562229f64b branch November 10, 2026 06:37
Sun-sunshine06 added a commit that referenced this pull request Nov 10, 2026
@dependabot @Sun-sunshine06
fix(deps): migrate pi to maintained secure packages (#500)
cc4ae6f 
Migrate all three pi packages together to the maintained
`@earendil-works` namespace (0.79.10), preserving existing sessions,
provider integration and native hosted web search. Integrate current
main and refresh the native-event/message-replay patch against the new
SDK. Keep the current monthly Dependabot groups and disabled Renovate
configuration.

Align the desktop and nested pi Undici runtime at 8.12.4 with a scoped
8.x security floor, addressing advisories affecting the earlier 8.10.2
pin. Require Node >=22.19.0. The transitive OpenTelemetry API packages
do not add an SDK or exporter. Existing lifecycle guards handle only the
exact internal halt error; unrelated observer exceptions still
propagate.

Validation on the updated tree: repository typechecks and lint,
core/provider tests (including hosted-search protocol and patched SDK
hook tests), HTTP runtime version/dispatcher regressions, and desktop
production build passed. Production audit reports no remaining Undici
advisories; unrelated baseline advisories remain. Full pre-push and
remote integration checks are tracked on the latest head.

Supersedes the deprecated-namespace update in #544. The independent
Undici 7.x security update #531 is already merged; this migration
retains its security intent on the SDK-required 8.x line.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Sun-sunshine06 <Sun-sunshine06@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Sun-sunshine06 <Sun-sunshine06@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

area:build Turbo/Vite/Biome/tsconfig toolchain area:core packages/core (generation orchestration) area:desktop apps/desktop (Electron shell, renderer) area:providers packages/providers (pi-ai adapter, model calls) chore Routine maintenance / non-feature work

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants