v1.28.3

PI WEBUI v1.28.3

Fixes

Session list no longer jumps back to the selected session on a background refresh (5dacec9, closes #20)

SessionList previously re-ran scrollIntoView() on the selected row on every sessions replacement, so a poll that left the selection unchanged yanked a list the user had scrolled elsewhere. The reveal is now keyed on the selected row's identity — session id plus the section it renders in — so a refresh that leaves it unchanged does nothing, while a genuinely new or newly visible selection is still revealed. A reveal attempted while an enclosing panel is display: none is deferred and delivered once the panel has layout.

Verified in real Chromium against the pre-fix tree using issue #20's own reproduction (60 sessions, selection near the end, list scrolled to the top, sessions replaced with a copied array):

step	v1.28.2	v1.28.3
background refresh keeps scroll	scrollTop 2854 (snaps)	scrollTop 0
same-id selection replacement	2854	0
panel hidden then shown, no new debt	2854	0
selection changed while panel hidden, then shown	never lands	1873, once
total scrollIntoView calls	8	3

13 new cases in SessionList.scroll.test.ts; 7 of them fail against the previous implementation.

Production dependency advisories cleared (039b23f)

fastify 5.12.5 → 5.12.7, fast-uri 3.1.8/4.2.1 → 3.1.9/4.2.3, zod 4.4.3 → 4.6.7. All in-range; no declared range changed. npm audit --omit=dev now exits 0 with zero production vulnerabilities.

Security disclosure — known advisory in the resolved runtime graph

This release ships with an accepted, disclosed dependency advisory that PI WEBUI cannot remediate. No audit exception is claimed: the register in IGNORED.md does not cover this finding and has not been amended to.

Path: @earendil-works/pi-coding-agent@1.4.0 declares "undici": "8.10.2" — an exact pin, not a range. That package is a peerDependency (>=1.4.0 <2) and is statically imported by the published dist/server/piPackageService.js, so a deployed install resolves the pinned undici at runtime. npm audit --omit=dev reports zero only because npm excludes the peer subtree from the local production tree; it does not mean a deployed install avoids it.

Advisories present in undici@8.10.2:

Advisory	CVSS	Impact
GHSA-xjj6-f33q-929c	7.5	Denial of Service — excessive content-encodings
GHSA-qrxm-fqhp-jwvm	7.5	Denial of Service — TLS 1.2 certificate-changing renegotiation
GHSA-4w7w-5xrc-9h26	7.4	cache poisoning and cross-user disclosure via cross-origin redirects
GHSA-2m5v-pch6-74hx	7.4	TLS certificate validation bypass — dropped TLS options in Agent
GHSA-9fm3-97px-rjf6	5.9	Denial of Service — WebSocket PONG buffering
GHSA-55wc-3pg8-jfw6	5.9	Denial of Service — decompress interceptor
GHSA-f72v-6w45-q472	5.9	Subresource Integrity bypass
GHSA-4qv8-2p9j-2685	5.9	Denial of Service — EventSource parser memory

Four are Denial of Service. The remaining four are not: one TLS certificate-validation bypass, one cache-poisoning/cross-user disclosure issue, and a Subresource Integrity bypass.

Why it is not fixed here: the vulnerable resolution is an exact pin inside a third-party published package. There is no range to move within, npm audit fix --force proposes downgrading @earendil-works/pi-coding-agent to 0.75.3, and forcing an overrides entry would substitute a version upstream never tested against an explicit pin — which IGNORED.md prohibits. @earendil-works/pi-coding-agent 1.4.0 is the latest published release. The fix belongs upstream: repin undici to >=8.12.2 and publish. Patched undici 8.12.3 is already published.

Decision: published on 2026-10-27 with this disclosure, on the recorded basis that the vulnerability is upstream's to fix, that it is disclosed rather than hidden, and that main alone does not deliver it to npm consumers. Consumers who can wait should pin to a later release once upstream repins undici.

Verification

• npm run verify (serial): 521 files, 6488 tests passed, 2 skipped — twice.
• npm audit --omit=dev: exit 0, 0 vulnerabilities.
• npm audit --include=dev: exit 1, the two findings documented above (undici and its parent).
• Full suite flake note: src/server/app.speechInput.test.ts occasionally exceeds its 5000 ms timeout in a loaded serial run; it passes in isolation and has no timers. Pre-existing, unrelated to these changes.