Evidence record / pi-coding-agent
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-10-24-pi-coding-agent-pi-pocket-declares-and-locks-a-patched-undici-graph
Pi Pocket declares and locks a patched Undici graph. Pi Pocket declares Undici 8.12.3 directly and as a root override from v0.20.0; the v0.21.0 lock resolves node_modules/undici to 8.12.3. This exceeds the 8.12.2 fixed floor for the three advisories in section 14, despite Pocket embedding Pi 1.4.0, whose own manifest still pins 8.10.2.
Channel: tagged-release. Half: both. Date: 2026-10-22.
Operator consequence: Inspect the host’s resolved graph before assigning an upstream dependency exposure to it. Pocket’s tagged graph is a concrete counterexample to blanket inheritance of Pi’s Undici pin. No installed Pocket artifact was audited or executed, so verify the deployed artifact separately.
Receipt
- https://github.com/TannerMidd/pi-pocket/releases/tag/v0.20.0
- https://github.com/TannerMidd/pi-pocket/blob/v0.20.0/package.json
- https://github.com/TannerMidd/pi-pocket/blob/v0.21.0/package.json
- https://github.com/TannerMidd/pi-pocket/blob/v0.21.0/package-lock.json
- https://github.com/advisories/GHSA-xjj6-f33q-929c
Finding metadata
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
Finding ID: 2026-10-24-pi-coding-agent-pi-pocket-declares-and-locks-a-patched-undici-graph
Profile citations
- Pi Coding Agent / claim / pocket-patched-undici
- Pi Coding Agent / posture / governance
Source links
Primary links, including exact changelog lines when available.
- github release2026-10-24-pi-coding-agent-pi-pocket-declares-and-locks-a-patched-undici-graphTannerMidd/pi-pocket / v0.20.0tagged commit file2026-10-24-pi-coding-agent-pi-pocket-declares-and-locks-a-patched-undici-graphTannerMidd/pi-pocket / package.jsontagged commit file2026-10-24-pi-coding-agent-pi-pocket-declares-and-locks-a-patched-undici-graphTannerMidd/pi-pocket / package.jsontagged commit file2026-10-24-pi-coding-agent-pi-pocket-declares-and-locks-a-patched-undici-graphTannerMidd/pi-pocket / package-lock.jsonofficial docs2026-10-24-pi-coding-agent-pi-pocket-declares-and-locks-a-patched-undici-graphgithub.com/advisories/GHSA-xjj6-f33q-929c
Versioned source: run artifact