A fresh build of current master fails at deploy/core/Dockerfile:8 (npm audit --omit=dev --audit-level=moderate) with 2 high + 1 moderate, all inside the @earendil-works/pi-coding-agent qm-security.2 tarball's own npm-shrinkwrap.json subtree:
Because the pins live in the tarball's shrinkwrap, consumer-level npm overrides cannot reach them (verified: root overrides fix every other finding, these three remain). The registry release @earendil-works/pi-coding-agent@0.84.0 already depends on undici ^8.9.0, but qm pins the GitHub-release tgz.
Fix needs a new yc-software/pi security tgz (security.3) rebuilt on undici 8.10.0 / brace-expansion 5.0.9, plus a qm package.json/lockfile bump. Separately, current master also needs its existing override pins bumped (fast-uri 3.1.5/4.1.2, brace-expansion 5.0.9, hono 4.13.0) — those older pins are now themselves covered by new advisories. Happy to open that as a PR.
A fresh build of current master fails at deploy/core/Dockerfile:8 (npm audit --omit=dev --audit-level=moderate) with 2 high + 1 moderate, all inside the @earendil-works/pi-coding-agent qm-security.2 tarball's own npm-shrinkwrap.json subtree:
Because the pins live in the tarball's shrinkwrap, consumer-level npm overrides cannot reach them (verified: root overrides fix every other finding, these three remain). The registry release @earendil-works/pi-coding-agent@0.84.0 already depends on undici ^8.9.0, but qm pins the GitHub-release tgz.
Fix needs a new yc-software/pi security tgz (security.3) rebuilt on undici 8.10.0 / brace-expansion 5.0.9, plus a qm package.json/lockfile bump. Separately, current master also needs its existing override pins bumped (fast-uri 3.1.5/4.1.2, brace-expansion 5.0.9, hono 4.13.0) — those older pins are now themselves covered by new advisories. Happy to open that as a PR.