Update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@earendil-works/pi-coding-agent (source)	0.99.1 → 0.99.2
@types/node (source)	25.9.5 → 25.9.9
cac	7.0.0 → 7.0.1
prettier (source)	3.9.6 → 3.9.9
yaml (source)	2.9.0 → 2.9.1

---

Release Notes

earendil-works/pi (@​earendil-works/pi-coding-agent)

v0.99.2

Compare Source

New Features

• MCP servers stay out of the way: servers with the default codemode exposure are no longer listed in the codemode description and no longer block the first prompt. They appear in a short system prompt section, and scripts find their tools with searchTools() and describeNamespace(). See Control tool exposure.
• More MCP authentication options: oauth.clientName for servers that only accept known OAuth clients, and "auth": { "provider": "<provider>" } to authenticate HTTP servers with a provider's /login token. See Authenticate with OAuth.
• Anthropic workload identity federation from the Anthropic SDK environment variables. See Use an API key from the environment.
• /reload enables tools newly added to the defaultTools setting. See Tools.

Added

• Added a description field for MCP servers (pi mcp add --description), shown with the server in the system prompt and used to rank its tools in tool search, and a describeNamespace(name) codemode helper that returns a namespace's instructions and tool names. describeNamespace() and searchTools() accept a namespace as mcp__dev-radius, mcp__dev_radius, dev-radius, or dev_radius.
• Added an oauth.clientName setting for MCP servers (pi mcp add --oauth-client-name) to change the client name sent during OAuth client registration, for servers that only accept known clients (#​10226).
• Added "auth": { "provider": "<provider>" } for HTTP MCP servers to send a provider's current /login token as the bearer token instead of using MCP OAuth. The token is read on every request, so provider refreshes apply. Only allowed in the global mcp.json and from extensions, and requires https except on loopback hosts.
• Added Anthropic workload identity federation from the ANTHROPIC_FEDERATION_RULE_ID, ANTHROPIC_ORGANIZATION_ID, and ANTHROPIC_IDENTITY_TOKEN_FILE environment variables (see Providers) (#​10177, #​10242 by @​philfreo).
• /reload now enables tools newly added to the defaultTools setting. Tools removed from it stay enabled, tools turned off during the session stay off unless newly added, and --tools, --no-tools, and --no-builtin-tools still override the setting (#​10245).

Changed

• MCP servers with the default codemode exposure no longer appear in the codemode description; scripts find them with searchTools(). codemode-deferred is now an alias for codemode. Use direct exposure for tools the model should see without searching (#​10212).
• The codemode description no longer includes deferred tools, tool counts, or MCP server instructions, so it no longer changes when MCP servers connect or change their tools. The tool_search description no longer lists the servers whose tools it can load, for the same reason. Servers are listed instead in an mcp_servers system prompt section with a one-line summary, updated at the start of each prompt; a changed section is appended to the conversation. Scripts read server instructions with describeNamespace() (#​10212).
• The first prompt no longer waits for MCP servers without direct tools. They connect in the background and are waited for when a codemode script names them, a script searches tools, or tool_search runs (#​10212).

Fixed

• Fixed new sessions intermittently ignoring the saved default model, or warning that no models are available, when it belongs to an extension-registered native provider with a stored credential (#​9962, #​10190 by @​davidbrai).
• Fixed the /mcp sign-in URL not being clickable when it wraps across lines, by emitting it as a terminal hyperlink with a Cmd/Ctrl+click to open line like /login (#​10186).
• Fixed codemode image() accepting malformed base64 data or unsupported image types, which persisted an invalid image block that made every later provider request fail with HTTP 400 (#​10215).
• Fixed codemode failing to start its script worker from the standalone Windows executable (#​10204).
• Fixed prompt submission slowing down with session length, because resolving the session's model selection looked up the model catalog once per assistant message (#​10198).
• Fixed model lookups slowing down for providers with a refreshed pi.dev catalog, because merging remote catalog models took quadratic time.
• Fixed the built-in-tool-renderer.ts and minimal-mode.ts extension examples removing the built-in tools' summaries and guidelines from the system prompt (#​10072, #​10193 by @​christianklotz).
• Fixed context overflow detection for Z.AI CN endpoint Prompt exceeds max length errors (#​10208).
• Fixed Anthropic requests failing when a tool schema uses keywords Anthropic strict tool use rejects, such as minimum/maximum; such tools are now sent non-strict (#​9953).
• Fixed provider retries firing immediately when a Retry-After header contains an unparseable date; they now use exponential backoff (#​9571).
• Fixed extension commands registered without a string name or handler crashing pi when typing /; the extension now fails to load with an error instead (#​10054).
• Fixed collapsed codemode and MCP tool results filling the screen when the output is one long line, such as minified JSON. Like bash output, the preview is now limited to wrapped lines instead of logical lines.
• Fixed codemode.mode: "only" listing read, bash, edit, and write in the system prompt's tool list although requests only declare codemode (#​10192).
• Fixed codemode scripts calling the wrong MCP tool when two tool names differ only in - and _, such as read-file and read_file. Like in Codex, MCP tool and namespace names now replace - with _ (mcp__my-server__x is now mcp__my_server__x), colliding tools of a server all get a hash suffix, and server names that differ only in - and _ are rejected (#​10239).

cacjs/cac (cac)

v7.0.1

Compare Source

   🐞 Bug Fixes

• Prevent prototype pollution via dotted option names  -  by @​sxzz (604d4)

    View changes on GitHub

prettier/prettier (prettier)

v3.9.9

Compare Source

diff

Markdown: Fix text with $ been incorrectly parsed as math syntax (#​20140 by @​fisker)

<!-- Input -->
**Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR` from `c.sh`, before anything else runs here.

<!-- Prettier 3.9.8 -->
**Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR`from`c.sh`, before anything else runs here.

<!-- Prettier 3.9.9 -->
**Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR` from `c.sh`, before anything else runs here.

v3.9.8

Compare Source

diff

Markdown: Don't let Liquid objects interrupt paragraphs (#​20087 by @​seiyab)

<!-- Input -->
If `module` is not a [`WebAssembly.Module`](/en-US/docs/WebAssembly/Reference/JavaScript_interface/Module) object instance, a
{{jsxref("TypeError")}} is thrown.

<!-- Prettier 3.9.7 -->
If `module` is not a [`WebAssembly.Module`](/en-US/docs/WebAssembly/Reference/JavaScript_interface/Module) object instance, a

{{jsxref("TypeError")}} is thrown.

<!-- Prettier 3.9.8 -->
If `module` is not a [`WebAssembly.Module`](/en-US/docs/WebAssembly/Reference/JavaScript_interface/Module) object instance, a
{{jsxref("TypeError")}} is thrown.

v3.9.7

Compare Source

diff

Markdown: Prevent indentation drift in list-item code blocks (#​19647, #​19990 by @​Austin1serb, @​giaBaoJS)

<!-- Input -->
- [x] short first line.

      second paragraph at six spaces that wraps
      onto another line here.

<!-- Prettier 3.9.6 -->
- [x] short first line.

      second paragraph at six spaces that wraps
          onto another line here.

<!-- Prettier 3.9.7 -->
- [x] short first line.

      second paragraph at six spaces that wraps
      onto another line here.

JavaScript: Fix embedded template literal idempotency (#​19725 by @​fisker)

// Input
const foo = html`
            <div>${getText({
            value,
            })}</div>
`;

// Prettier 3.9.6 (first format)
const foo = html`
  <div>
    ${getText({
              value,
            })}
  </div>
`;

// Prettier 3.9.6 (second format)
const foo = html`
  <div>
    ${getText({
      value,
    })}
  </div>
`;

// Prettier 3.9.7
const foo = html`
  <div>
    ${getText({
      value,
    })}
  </div>
`;

Markdown: Preserve Liquid blocks after Markdown tables (#​19730 by @​wanxiankai, @​seiyab)

<!-- Input -->
| Argument | Type |
| -------- | ---- |
{% set default_params = {
    "model": ["str"],
} %}

<!-- Prettier 3.9.6 -->
| Argument                  | Type |
| ------------------------- | ---- |
| {% set default_params = { |

    "model": ["str"],

} %}

<!-- Prettier 3.9.7 -->
| Argument | Type |
| -------- | ---- |
{% set default_params = {
    "model": ["str"],
} %}

Markdown: Preserve single tildes in Markdown (#​19739 by @​lazerg)

Since 3.9.0, single-tilde spans like H~2~O were rewritten to double tildes, turning subscript syntax into strike-through. Only double tildes are treated that way now, matching GitHub.

<!-- Input -->
H~2~O

<!-- Prettier 3.9.6 -->
H~~2~~O

<!-- Prettier 3.9.7 -->
H~2~O

Markdown: Fix Markdown blockquote containing > characters (#​19802 by @​seiyab)

<!-- Input -->
> **test**\>

<!-- Prettier 3.9.6 -->
> **test**>\>

<!-- Prettier 3.9.7 -->
> **test**\>

Markdown: Strip blockquote markers from a setext heading's continuation lines (#​19878 by @​Kjubikstronk)

A setext heading spanning multiple lines inside a blockquote kept the > marker of its continuation lines as literal text.

<!-- Input -->
> Multi
> Line
> ===

<!-- Prettier 3.9.6 -->
> Multi > Line
> ===

<!-- Prettier 3.9.7 -->
> Multi
> Line
> ===

Markdown: Fix HTML block indentation drift in markdown list items (#​19987 by @​lazerg)

<!-- Input -->
1. Enable images:

    <p align="center">
      <img alt="example">
    </p>

<!-- Prettier 3.9.6 (--tab-width=4) -->
1. Enable images:

     <p align="center">
       <img alt="example">
     </p>

<!-- Prettier 3.9.7 (--tab-width=4) -->
1. Enable images:

    <p align="center">
      <img alt="example">
    </p>

Angular: Support @boundary error boundaries (#​20014 by @​Yahiro025)

<!-- Input -->
@boundary {
<complex-chart [data]="data"/>
}
@error (let err) {
<p>{{err.message}}</p>
}

<!-- Prettier 3.9.6 -->
SyntaxError: Unexpected character "EOF" (Do you have an unescaped "{" in your template? Use "{{ '{' }}") to escape it.) (6:1)

<!-- Prettier 3.9.7 -->
@boundary {
  <complex-chart [data]="data" />
} @error (let err) {
  <p>{{ err.message }}</p>
}

eemeli/yaml (yaml)

v2.9.1

Compare Source

• Limit recursive merge aliases (#​685, #​713)
• Simplify line unfolding during quoted string parsing (#​714)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 06:59 AM, only on Tuesday (* 0-6 * * 2)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.