Skip to content

chore(deps): bump the npm_and_yarn group across 1 directory with 3 updates#3

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-935401e1ca
Open

chore(deps): bump the npm_and_yarn group across 1 directory with 3 updates#3
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-935401e1ca

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 20, 2026

Copy link
Copy Markdown

Bumps the npm_and_yarn group with 1 update in the / directory: @earendil-works/pi-coding-agent.

Updates @earendil-works/pi-coding-agent from 0.78.1 to 0.79.0

Release notes

Sourced from @​earendil-works/pi-coding-agent's releases.

v0.79.0

New Features

  • Project trust for local inputs - Pi now asks before loading project-local settings, resources, instructions, and packages, with saved decisions and --approve / --no-approve controls for non-interactive modes. See Project Trust.
  • Extension-controlled trust decisions - Global and CLI extensions can handle project_trust, decide, remember, or defer project trust before project-local resources load. See project_trust.
  • Cache-hit visibility in the footer - The interactive footer now shows the latest prompt cache hit rate (CH). See Interactive Mode.
  • Richer SDK and RPC extension surfaces - Public exports now include RPC extension UI request/response types and package asset path helpers. See Extension UI Protocol and SDK Exports.

Added

  • Added a project_trust extension event so global and CLI extensions can decide or defer project trust during startup and runtime cwd switches.
  • Added project trust gating for project-local settings, resources, instructions, and packages (#5332).
  • Added the latest prompt cache hit rate to the interactive footer.
  • Exported RPC extension UI request and response types from the public API (#5455).
  • Exported coding-agent package asset path helpers from the public API (#5415).

Fixed

  • Fixed package exports by removing the stale ./hooks subpath that pointed at non-existent build output.
  • Fixed inherited TUI rendering to clear stale lines when content shrinks to zero.
  • Fixed inherited autocomplete suggestions to refresh after editor cursor movement (#5499 by @​Roman-Galeev).
  • Fixed /reload to persist project trust when an implicitly trusted session creates a project .pi directory.
  • Fixed project trust input discovery to traverse parent directories portably.
  • Fixed inherited intermittent Shift+Enter handling by making Kitty keyboard protocol fallback response-driven instead of timeout-driven (#5188).
  • Fixed the compaction summarization system prompt to use neutral AI assistant wording for non-coding agents (#5401).
  • Fixed models.json schema support and inherited OpenAI Responses custom-provider handling for compat.supportsDeveloperRole: false (#5456).
  • Fixed inherited prompt history navigation to place the cursor at the start when browsing upward and at the end when browsing downward (#5454).
  • Fixed tmux setup documentation to require tmux 3.5 for extended-keys-format csi-u and document the tmux 3.2-3.4 fallback (#5432).
  • Fixed inherited OpenRouter routing preferences on OpenAI-compatible custom providers to work when the custom provider base URL does not point directly at OpenRouter (#5347).
  • Fixed built-in tool expand hints to style closing parentheses consistently (#5359).
  • Fixed skill-wrapped prompts to insert spacing between skill instructions and the user message (#5371 by @​Perlence).
Changelog

Sourced from @​earendil-works/pi-coding-agent's changelog.

[0.79.0] - 2026-06-08

New Features

  • Project trust for local inputs - Pi now asks before loading project-local settings, resources, instructions, and packages, with saved decisions and --approve / --no-approve controls for non-interactive modes. See Project Trust.
  • Extension-controlled trust decisions - Global and CLI extensions can handle project_trust, decide, remember, or defer project trust before project-local resources load. See project_trust.
  • Cache-hit visibility in the footer - The interactive footer now shows the latest prompt cache hit rate (CH). See Interactive Mode.
  • Richer SDK and RPC extension surfaces - Public exports now include RPC extension UI request/response types and package asset path helpers. See Extension UI Protocol and SDK Exports.

Added

  • Added a project_trust extension event so global and CLI extensions can decide or defer project trust during startup and runtime cwd switches.
  • Added project trust gating for project-local settings, resources, instructions, and packages (#5332).
  • Added the latest prompt cache hit rate to the interactive footer.
  • Exported RPC extension UI request and response types from the public API (#5455).
  • Exported coding-agent package asset path helpers from the public API (#5415).

Fixed

  • Fixed package exports by removing the stale ./hooks subpath that pointed at non-existent build output.
  • Fixed inherited TUI rendering to clear stale lines when content shrinks to zero.
  • Fixed inherited autocomplete suggestions to refresh after editor cursor movement (#5499 by @​Roman-Galeev).
  • Fixed /reload to persist project trust when an implicitly trusted session creates a project .pi directory.
  • Fixed project trust input discovery to traverse parent directories portably.
  • Fixed inherited intermittent Shift+Enter handling by making Kitty keyboard protocol fallback response-driven instead of timeout-driven (#5188).
  • Fixed the compaction summarization system prompt to use neutral AI assistant wording for non-coding agents (#5401).
  • Fixed models.json schema support and inherited OpenAI Responses custom-provider handling for compat.supportsDeveloperRole: false (#5456).
  • Fixed inherited prompt history navigation to place the cursor at the start when browsing upward and at the end when browsing downward (#5454).
  • Fixed tmux setup documentation to require tmux 3.5 for extended-keys-format csi-u and document the tmux 3.2-3.4 fallback (#5432).
  • Fixed inherited OpenRouter routing preferences on OpenAI-compatible custom providers to work when the custom provider base URL does not point directly at OpenRouter (#5347).
  • Fixed built-in tool expand hints to style closing parentheses consistently (#5359).
  • Fixed skill-wrapped prompts to insert spacing between skill instructions and the user message (#5371 by @​Perlence).
Commits
  • c10fb95 Release v0.79.0
  • 35120d7 docs: audit unreleased changelogs
  • ce3a724 docs(coding-agent): document security model
  • d8aef0f feat(coding-agent): allow project trust extensions to defer
  • 085a085 fix(coding-agent): remove stale hooks export
  • 718215b feat(coding-agent): add extension project trust decisions
  • 38f18be fix(coding-agent): persist implicit project trust on reload
  • 130ae57 fix(tui,coding-agent): make keyboard protocol fallback response-driven
  • 72fd911 fix(coding-agent): neutralize compaction summarization prompt
  • eb43bd4 fix(coding-agent): export package asset path helpers
  • Additional commits viewable in compare view

Updates fast-xml-builder from 1.1.5 to 1.2.0

Changelog

Sourced from fast-xml-builder's changelog.

1.2.0 (2026-05-08)

  • Add support for sanitizeName option
  • Support xml-naming for validating and sanitizing tag and attribute names

1.1.9 (2026-05-06)

  • fix: format output for preserve order when indent by is set to empty string

1.1.8 (2026-05-05)

  • fix: skip text property for PI tags
  • improve typings

1.1.7 (2026--05-04)

  • fix security issues when attribute value contains quotes

1.1.6 (2026--05-04)

  • fix security issues related to comment
  • skip comment with null value

1.1.5 (2026-04-17)

  • fix security issues related to comment and cdata

1.1.4 (2026-03-16)

  • support maxNestedTags option

1.1.3 (2026-03-13)

  • declare Matcher & Expression as unknown so user is not forced to install path-expression-matcher

1.1.2 (2026-03-11)

  • fix typings

1.1.1 (2026-03-11)

  • upgrade path-expression-matcher to 1.1.3

1.1.0 (2026-03-10)

Commits

Updates protobufjs from 7.5.5 to 7.6.4

Release notes

Sourced from protobufjs's releases.

protobufjs: v7.6.4

7.6.4 (2026-06-12)

Bug Fixes

protobufjs: v7.6.3

7.6.3 (2026-06-09)

Bug Fixes

  • Avoid name collisions in generated code (#2311) (78a9576)
  • Preserve null conversion behavior for fieldless messages (#2312) (df91652)

protobufjs: v7.6.2

7.6.2 (2026-05-30)

Bug Fixes

  • Backport consistency and correctness fixes (#2294) (a92f72e)

protobufjs: v7.6.1

7.6.1 (2026-05-22)

Bug Fixes

protobufjs: v7.6.0

7.6.0 (2026-05-18)

Features

protobufjs: v7.5.9

7.5.9 (2026-05-17)

Bug Fixes

  • Backport bundler-safe optional module lookups (#2254) (0853a62)

... (truncated)

Changelog

Sourced from protobufjs's changelog.

7.6.4 (2026-06-12)

Bug Fixes

7.6.3 (2026-06-09)

Bug Fixes

  • Avoid name collisions in generated code (#2311) (78a9576)
  • Preserve null conversion behavior for fieldless messages (#2312) (df91652)

7.6.2 (2026-05-30)

Bug Fixes

  • Backport consistency and correctness fixes (#2294) (a92f72e)

7.6.1 (2026-05-22)

Bug Fixes

7.6.0 (2026-05-18)

Features

7.5.9 (2026-05-17)

Bug Fixes

  • Backport bundler-safe optional module lookups (#2254) (0853a62)

7.5.8 (2026-05-12)

Bug Fixes

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for protobufjs since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump the npm_and_yarn group across 1 directory with 3 up…
a5b02ff 
…dates

Bumps the npm_and_yarn group with 1 update in the / directory: [@earendil-works/pi-coding-agent](https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent).


Updates `@earendil-works/pi-coding-agent` from 0.78.1 to 0.79.0
- [Release notes](https://github.com/earendil-works/pi/releases)
- [Changelog](https://github.com/earendil-works/pi/blob/main/packages/coding-agent/CHANGELOG.md)
- [Commits](https://github.com/earendil-works/pi/commits/v0.79.0/packages/coding-agent)

Updates `fast-xml-builder` from 1.1.5 to 1.2.0
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-builder/blob/main/CHANGELOG.md)
- [Commits](NaturalIntelligence/fast-xml-builder@v1.1.5...v1.2.0)

Updates `protobufjs` from 7.5.5 to 7.6.4
- [Release notes](https://github.com/protobufjs/protobuf.js/releases)
- [Changelog](https://github.com/protobufjs/protobuf.js/blob/protobufjs-v7.6.4/CHANGELOG.md)
- [Commits](protobufjs/protobuf.js@protobufjs-v7.5.5...protobufjs-v7.6.4)

---
updated-dependencies:
- dependency-name: "@earendil-works/pi-coding-agent"
  dependency-version: 0.79.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: fast-xml-builder
  dependency-version: 1.2.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: protobufjs
  dependency-version: 7.6.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants