Skip to content

chore(deps-dev): bump the dev-dependencies group across 1 directory with 3 updates - #20

Merged
codegiveness merged 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-b9137eb873
Jul 22, 2026
Merged

chore(deps-dev): bump the dev-dependencies group across 1 directory with 3 updates#20
codegiveness merged 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-b9137eb873

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 19, 2026

Copy link
Copy Markdown
Contributor

Bumps the dev-dependencies group with 3 updates in the / directory: @changesets/cli, @earendil-works/pi-coding-agent and typescript.

Updates @changesets/cli from 2.31.0 to 2.31.1

Release notes

Sourced from @​changesets/cli's releases.

@​changesets/cli@​2.31.1

Patch Changes

  • #2159 15cf592 Thanks @​ingvaldlorentzen! - Fixed already-published version detection with npm 12, which always wraps successful npm info --json output in an array. The unwrapped output made changeset publish treat every package as unpublished and fail attempting to republish existing versions.
Commits
  • a897bb8 Use a different publish tag for maintenance/v2 branch (#2162)
  • e8650b9 Version Packages (#2161)
  • 15cf592 Fixed handling of the npm 12 info output (#2159)
  • 9f2cb2a Configure Changesets for maintenance/v2 line (#2076)
  • 97247cb Change allowed publish pattern to maintenance/v* given rulesets behavior (#...
  • 13286a8 Build(deps): Bump the github-actions group across 1 directory with 3 updates ...
  • 8f6acd6 Update dependabot group to exclude major (#2067)
  • c70c675 Setup backport workflow and sync next setup (#2057)
  • 9672019 Remove SECURITY.md to defer to .github (#2055)
  • 18e1661 Use internal bot for versioning (#2039)
  • Additional commits viewable in compare view

Updates @earendil-works/pi-coding-agent from 0.80.2 to 0.80.10

Release notes

Sourced from @​earendil-works/pi-coding-agent's releases.

v0.80.10

New Features

  • Kimi Coding thinking compatibility — Kimi Coding models now use adaptive thinking correctly; K3 exposes its supported max level and supports replaying empty-signature thinking blocks. See Kimi For Coding setup and Model Options.

Fixed

  • Fixed inherited Kimi Coding requests to use Anthropic adaptive thinking effort without token budgets, and enabled empty thinking signatures for K3 and kimi-for-coding.
  • Fixed inherited Kimi K3 pricing metadata for Moonshot AI and Moonshot AI China.
  • Fixed inherited Kimi Coding K3 thinking-level metadata to expose only the supported max level (#6737).
  • Fixed inherited catalog generation restoring xAI models removed in 0.80.9 (#6736).

v0.80.9

New Features

Added

Changed

  • Changed xAI login to use a prefilled device-authorization link labeled “Sign in with SuperGrok or X Premium,” and changed the default xAI model to Grok 4.5 (#6734 by @​Jaaneek).

Fixed

  • Fixed inherited Kimi K3 output limits for Vercel AI Gateway and OpenRouter models.
  • Fixed cloning or forking a session before its first assistant response to explain that the session must be saved first.

Removed

  • Removed Grok 3, Grok 3 Fast, Grok 4.20 variants, and Grok Code Fast 1 from the built-in xAI model catalog (#6734 by @​Jaaneek).

v0.80.8

New Features

  • Unified model runtime and provider authentication — ModelRuntime centralizes model configuration, provider-owned /login, and dynamic provider catalogs. See Providers.
  • Live model catalog refresh — /model refreshes configured providers in the background, and pi update --models forces an immediate refresh. See Install and Manage.
  • xAI device-code OAuth and Grok 4.5 Responses support — Sign in to xAI with a device code and use Grok 4.5 with low, medium, or high thinking. See xAI.

Breaking Changes

  • Replaced the SDK's CreateAgentSessionOptions.authStorage and modelRegistry options with the async modelRuntime option. AuthStorage and its storage backends are no longer exported; use ModelRuntime (or a custom pi-ai CredentialStore), or readStoredCredential() for one-off reads of auth.json.
  • Removed redundant ModelRuntime.getAll(), find(), getSnapshot(), and getAuthOptions() projections. Use the pi-ai Models methods getModels(), getModel(), getProviders(), and checkAuth() directly.
  • Replaced SDK request-auth assembly through ModelRegistry.getApiKeyAndHeaders() with ModelRuntime.getAuth(). Passing a provider ID returns provider-scoped auth; passing a model also resolves built-in, models.json, and extension model headers.
  • Changed extension-facing ModelRegistry.refresh() from synchronous void to Promise<void> because models.json loading is asynchronous. Extensions must await it before making synchronous registry reads.
  • Moved canonical dynamic catalog refresh to async ModelRuntime.refresh()/pi-ai Models.refresh(). Legacy extension OAuth modifyModels remains supported as a synchronous compatibility projection after credential initialization.

... (truncated)

Changelog

Sourced from @​earendil-works/pi-coding-agent's changelog.

[0.80.10] - 2026-07-16

New Features

  • Kimi Coding thinking compatibility — Kimi Coding models now use adaptive thinking correctly; K3 exposes its supported max level and supports replaying empty-signature thinking blocks. See Kimi For Coding setup and Model Options.

Fixed

  • Fixed inherited Kimi Coding requests to use Anthropic adaptive thinking effort without token budgets, and enabled empty thinking signatures for K3 and kimi-for-coding.
  • Fixed inherited Kimi K3 pricing metadata for Moonshot AI and Moonshot AI China.
  • Fixed inherited Kimi Coding K3 thinking-level metadata to expose only the supported max level (#6737).
  • Fixed inherited catalog generation restoring xAI models removed in 0.80.9 (#6736).

[0.80.9] - 2026-07-16

New Features

Added

Changed

  • Changed xAI login to use a prefilled device-authorization link labeled “Sign in with SuperGrok or X Premium,” and changed the default xAI model to Grok 4.5 (#6734 by @​Jaaneek).

Fixed

  • Fixed inherited Kimi K3 output limits for Vercel AI Gateway and OpenRouter models.
  • Fixed cloning or forking a session before its first assistant response to explain that the session must be saved first.

Removed

  • Removed Grok 3, Grok 3 Fast, Grok 4.20 variants, and Grok Code Fast 1 from the built-in xAI model catalog (#6734 by @​Jaaneek).

[0.80.8] - 2026-07-16

New Features

  • Unified model runtime and provider authentication — ModelRuntime centralizes model configuration, provider-owned /login, and dynamic provider catalogs. See Providers.
  • Live model catalog refresh — /model refreshes configured providers in the background, and pi update --models forces an immediate refresh. See Install and Manage.
  • xAI device-code OAuth and Grok 4.5 Responses support — Sign in to xAI with a device code and use Grok 4.5 with low, medium, or high thinking. See xAI.

Breaking Changes

  • Replaced the SDK's CreateAgentSessionOptions.authStorage and modelRegistry options with the async modelRuntime option. AuthStorage and its storage backends are no longer exported; use ModelRuntime (or a custom pi-ai CredentialStore), or readStoredCredential() for one-off reads of auth.json.
  • Removed redundant ModelRuntime.getAll(), find(), getSnapshot(), and getAuthOptions() projections. Use the pi-ai Models methods getModels(), getModel(), getProviders(), and checkAuth() directly.
  • Replaced SDK request-auth assembly through ModelRegistry.getApiKeyAndHeaders() with ModelRuntime.getAuth(). Passing a provider ID returns provider-scoped auth; passing a model also resolves built-in, models.json, and extension model headers.

... (truncated)

Commits
  • 8dc7883 Release v0.80.10
  • c29eda6 docs(coding-agent): audit unreleased changelog
  • aba3245 fix(ai): correct Kimi K3 Moonshot pricing
  • c1b7856 fix(ai): prevent removed xAI models regenerating, closes #6736
  • f7e0603 Add [Unreleased] section for next cycle
  • 2d16f92 Release v0.80.9
  • aa508b7 docs: audit unreleased changelogs
  • b97ed20 fix(coding-agent): explain clone failure for unsaved sessions
  • a01baaa feat(xai): prefilled OAuth device link, SuperGrok login label, trimmed model ...
  • 3524cd4 Merge remote-tracking branch 'origin/main' into add-kimi-deferred-tools
  • Additional commits viewable in compare view

Updates typescript from 6.0.3 to 7.0.2

Commits
Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps-dev): bump the dev-dependencies group across 1 directory w…
5c5bb67 
…ith 3 updates

Bumps the dev-dependencies group with 3 updates in the / directory: [@changesets/cli](https://github.com/changesets/changesets), [@earendil-works/pi-coding-agent](https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent) and [typescript](https://github.com/microsoft/TypeScript).


Updates `@changesets/cli` from 2.31.0 to 2.31.1
- [Release notes](https://github.com/changesets/changesets/releases)
- [Commits](https://github.com/changesets/changesets/compare/@changesets/cli@2.31.0...@changesets/cli@2.31.1)

Updates `@earendil-works/pi-coding-agent` from 0.80.2 to 0.80.10
- [Release notes](https://github.com/earendil-works/pi/releases)
- [Changelog](https://github.com/earendil-works/pi/blob/main/packages/coding-agent/CHANGELOG.md)
- [Commits](https://github.com/earendil-works/pi/commits/v0.80.10/packages/coding-agent)

Updates `typescript` from 6.0.3 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](https://github.com/microsoft/TypeScript/commits)

---
updated-dependencies:
- dependency-name: "@changesets/cli"
  dependency-version: 2.31.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: "@earendil-works/pi-coding-agent"
  dependency-version: 0.80.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dev-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 19, 2026
@dependabot
dependabot Bot requested a review from codegiveness as a code owner July 19, 2026 17:33
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 19, 2026
@codegiveness
codegiveness merged commit 5b3927d into main Jul 22, 2026
6 checks passed
@codegiveness
codegiveness deleted the dependabot/npm_and_yarn/dev-dependencies-b9137eb873 branch July 22, 2026 03:12
codegiveness added a commit that referenced this pull request Jul 22, 2026
@codegiveness
release: v0.4.1 — security dependency overrides
56a2819 
Resolve 3 transitive dependency vulnerabilities by raising
package.json#overrides floors and bumping devDependencies.

Vulnerabilities fixed:
- brace-expansion >= 5.0.7 (high, GHSA-3jxr-9vmj-r5cp)
- js-yaml >= 4.3.0 (high, GHSA-52cp-r559-cp3m)
- protobufjs >= 7.6.5 (moderate, GHSA-j3f2-48v5-ccww)

DevDependency bumps (via Dependabot PR #20):
- @earendil-works/pi-coding-agent 0.80.2 -> 0.80.10
- typescript 6.0.3 -> 7.0.2
- @changesets/cli 2.31.0 -> 2.31.1

npm audit now reports 0 vulnerabilities. No package behavior change.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@codegiveness codegiveness Awaiting requested review from codegiveness codegiveness is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@codegiveness