build(deps-dev): bump the npm-dependencies group with 4 updates

[dependabot]

Bumps the npm-dependencies group with 4 updates: @colbymchenry/codegraph, @earendil-works/pi-coding-agent, @types/node and vitest.

Updates @colbymchenry/codegraph from 0.9.7 to 0.9.9

Updates @earendil-works/pi-coding-agent from 0.78.0 to 0.78.1

Release notes

Sourced from @​earendil-works/pi-coding-agent's releases.

v0.78.1

New Features

• More built-in provider coverage - Added Ant Ling and NVIDIA NIM provider setup, plus MiniMax-M3 support for the direct MiniMax providers. See Providers.
• Richer extension context - Extensions can use ctx.mode and ctx.getSystemPromptOptions() to adapt behavior across TUI, RPC, JSON, and print modes and inspect base system prompt inputs. See Extensions.

Added

• Added containerization documentation and a Gondolin extension example for routing built-in tools into a local micro-VM.
• Added Ant Ling provider selection and setup documentation.
• Added MiniMax-M3 model support inherited from @earendil-works/pi-ai for the minimax and minimax-cn direct providers (#5313).
• Added NVIDIA NIM provider selection, setup documentation, and direct NIM request attribution headers.
• Added ctx.mode to extension contexts so extensions can distinguish TUI, RPC, JSON, and print mode.
• Added ctx.getSystemPromptOptions() for extension commands to inspect the current base system prompt inputs (#5306 by @​xl0).

Fixed

• Fixed temporary extension package installs to use a private ~/.pi/agent/tmp/extensions directory with 0700 permissions instead of os.tmpdir()/pi-extensions.
• Fixed git package source handling to reject unsafe host/path components and keep managed clone paths inside install roots.
• Fixed stored XSS in HTML session exports by sanitizing Markdown link and image URLs with a scheme allow-list after stripping control characters.
• Fixed SDK embedding in bundled Node apps failing with ENOENT when package.json is not present next to the bundle entrypoint. The package metadata reader now gracefully handles missing package.json by using defaults, enabling createAgentSession() without requiring package-adjacent files at runtime (#5226).
• Fixed HTTP timeout setting not being respected for non-Codex providers (e.g., llama.cpp via OpenAI-compatible API). The httpIdleTimeoutMs setting (set via /settings HTTP timeout) now applies as the default SDK request timeout for all providers that support it, not just OpenAI Codex Responses. Disabling the timeout (HTTP timeout = false) now correctly disables SDK timeouts for all supported providers by sending a maximum int32 value (effectively infinite) instead of 0, since SDKs treat timeout=0 as an immediate timeout (#5294).
• Fixed inherited Amazon Bedrock requests to replace blank required user/tool-result text with a placeholder and skip blank replay text blocks (#4975).
• Fixed inherited Anthropic Claude Opus 4.7+ requests to suppress deprecated temperature parameters (#5251 by @​yzhg1983).
• Fixed inherited OpenAI GPT-5.5 generated metadata to omit unsupported minimal thinking (#5243).
• Fixed inherited OpenRouter Kimi K2.6 thinking replay and developer-role instruction handling (#5309).
• Fixed inherited OpenRouter reasoning instruction requests to preserve the system role when required (#5221 by @​PriNova).
• Fixed inherited overlay focus restoration so non-capturing overlays remain interactive after UI rerenders and explicit focus release (#5235 by @​nicobailon).
• Fixed inherited tab width accounting in column slicing and overlay compositing so tab-containing output cannot exceed the terminal width (#5218).
• Fixed opening and listing very large JSONL session files by reading session entries line-by-line instead of materializing the full file as one string (#5231).
• Fixed the footer branch display in WSL /mnt/... repositories to refresh after branch changes (#5264 by @​psoukie).
• Fixed renderShell: "self" tool renderers that emit no component lines leaving a blank chat row (#5299).
• Restored inherited NVIDIA Qwen 3.5 122B NIM model support.

Changelog

Sourced from @​earendil-works/pi-coding-agent's changelog.

[0.78.1] - 2026-06-04

New Features

• More built-in provider coverage - Added Ant Ling and NVIDIA NIM provider setup, plus MiniMax-M3 support for the direct MiniMax providers. See Providers.
• Richer extension context - Extensions can use ctx.mode and ctx.getSystemPromptOptions() to adapt behavior across TUI, RPC, JSON, and print modes and inspect base system prompt inputs. See Extensions.

Added

• Added containerization documentation and a Gondolin extension example for routing built-in tools into a local micro-VM.
• Added Ant Ling provider selection and setup documentation.
• Added MiniMax-M3 model support inherited from @earendil-works/pi-ai for the minimax and minimax-cn direct providers (#5313).
• Added NVIDIA NIM provider selection, setup documentation, and direct NIM request attribution headers.
• Added ctx.mode to extension contexts so extensions can distinguish TUI, RPC, JSON, and print mode.
• Added ctx.getSystemPromptOptions() for extension commands to inspect the current base system prompt inputs (#5306 by @​xl0).

Fixed

• Fixed temporary extension package installs to use a private ~/.pi/agent/tmp/extensions directory with 0700 permissions instead of os.tmpdir()/pi-extensions.
• Fixed git package source handling to reject unsafe host/path components and keep managed clone paths inside install roots.
• Fixed stored XSS in HTML session exports by sanitizing Markdown link and image URLs with a scheme allow-list after stripping control characters.
• Fixed SDK embedding in bundled Node apps failing with ENOENT when package.json is not present next to the bundle entrypoint. The package metadata reader now gracefully handles missing package.json by using defaults, enabling createAgentSession() without requiring package-adjacent files at runtime (#5226).
• Fixed HTTP timeout setting not being respected for non-Codex providers (e.g., llama.cpp via OpenAI-compatible API). The httpIdleTimeoutMs setting (set via /settings HTTP timeout) now applies as the default SDK request timeout for all providers that support it, not just OpenAI Codex Responses. Disabling the timeout (HTTP timeout = false) now correctly disables SDK timeouts for all supported providers by sending a maximum int32 value (effectively infinite) instead of 0, since SDKs treat timeout=0 as an immediate timeout (#5294).
• Fixed inherited Amazon Bedrock requests to replace blank required user/tool-result text with a placeholder and skip blank replay text blocks (#4975).
• Fixed inherited Anthropic Claude Opus 4.7+ requests to suppress deprecated temperature parameters (#5251 by @​yzhg1983).
• Fixed inherited OpenAI GPT-5.5 generated metadata to omit unsupported minimal thinking (#5243).
• Fixed inherited OpenRouter Kimi K2.6 thinking replay and developer-role instruction handling (#5309).
• Fixed inherited OpenRouter reasoning instruction requests to preserve the system role when required (#5221 by @​PriNova).
• Fixed inherited overlay focus restoration so non-capturing overlays remain interactive after UI rerenders and explicit focus release (#5235 by @​nicobailon).
• Fixed inherited tab width accounting in column slicing and overlay compositing so tab-containing output cannot exceed the terminal width (#5218).
• Fixed opening and listing very large JSONL session files by reading session entries line-by-line instead of materializing the full file as one string (#5231).
• Fixed the footer branch display in WSL /mnt/... repositories to refresh after branch changes (#5264 by @​psoukie).
• Fixed renderShell: "self" tool renderers that emit no component lines leaving a blank chat row (#5299).
• Restored inherited NVIDIA Qwen 3.5 122B NIM model support.

Commits

• 592c34c Release v0.78.1
• e0c2813 Audit unreleased changelog entries
• dc7b547 docs(coding-agent): remove containerization platform note
• 86314bf docs: add containerization guide and Gondolin example (#5356)
• 564ad70 Merge pull request #5333 from vastxie/zai-coding-cn-provider
• ea3465a fix(coding-agent): move temporary extension cache (#5345)
• 135fb54 fix(coding-agent): set auth file mode on creation
• ba6e529 fix(oauth): harden browser launch handling
• a98e087 fix(coding-agent): harden git package install paths
• 51df39b feat(ai): add ZAI Coding Plan China provider
• Additional commits viewable in compare view

Updates @types/node from 25.9.1 to 25.9.2

Commits

• See full diff in compare view

Updates vitest from 4.1.7 to 4.1.8

Release notes

Sourced from vitest's releases.

v4.1.8

   🐞 Bug Fixes

• browser:
  • Disable client cdp API when allowWrite/allowExec: false [backport to v4]  -  by @​hi-ogawa and Codex in vitest-dev/vitest#10450 (e4067)
  • Remove orphaned Playwright route when same module is mocked via multiple ids [backport to v4]  -  by @​toxik and @​Zelys-DFKH in vitest-dev/vitest#10474 (675b4)

    View changes on GitHub

Commits

• e61f2dd chore: release v4.1.8
• e4067b3 fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions