build(deps): refresh dependencies for Pi 1.0.3

[trvon]

Dependencies

Update all direct npm development dependencies to their latest stable releases. TypeScript remains at 7.0.2, already current.

Package	Previous manifest	Updated
@earendil-works/pi-coding-agent	0.85.1	1.0.3
@earendil-works/pi-tui	0.85.1	1.0.3
typebox	1.3.30	1.3.35
@biomejs/biome	^2.4.13	^2.5.15
@types/node	^26.1.2	^26.6.4
@vitest/coverage-v8	^5.0.1	^5.0.3
vitest	^5.0.1	^5.0.3
fast-check	^4.9.0	^4.10.2
tsx	^4.23.1	^4.23.15
postcss override	^8.5.18	^8.5.29

Refresh the compatible transitive dependency graph. Undici resolves to 8.10.2 and brace-expansion to 5.0.12, addressing the audit failures on seven existing Dependabot PRs. Match the Biome configuration schema to 2.5.15. Keep host dependencies as peers, existing exact pins, and the Node >=22.19.0 requirement. No runtime source changes.

Reviewed metadata, diffs, CI logs, and relevant release notes/advisories for all eight Dependabot PRs. Each changes only manifests and/or lockfiles. Seven fail the audit gate before compatibility tests run; #126 passed before the newer advisories were published. In particular, #128 also upgrades the Pi host rather than only Undici.

Supersedes Dependabot PRs #126, #128, #129, #130, #131, #132, #133, and #134. Pi 0.87 changes lifecycle/context APIs; Pi 1.0 changes TUI defaults and provider configuration. The extension's used APIs pass typechecking, tests, package imports, and a real-host RPC startup check.

Validation

• Full local gate passes on Node 26.10.0: lint, typecheck, tests, coverage, property tests, build, package smoke, audit, and diff check.
• Clean npm ci and repeat gates pass on minimum Node 22.19.0.
• 67 test files and 1,067 tests pass; separate property run passes 7 files and 22 tests.
• Coverage: statements 90%, branches 84.27%, functions 96.55%, lines 94.7%; all enforced thresholds pass.
• Pi 1.0.3 RPC startup on Node 22.19.0 loads the packaged extension and registers /loop and native /tasks without a model request.
• Lint reports two existing optional-chain warnings; no new warnings.
• npm outdated reports no outdated direct dependencies. npm audit reports zero vulnerabilities.
• Model-driven live E2E is not run. Ubuntu and Windows CI must pass before merge.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Broad dependency and host-version upgrades warrant final human review despite passing validation.

Review effort: Lite
Findings: None

What changed in this PR

Refreshes development dependencies for Pi 1.0.3 compatibility, updates the Biome schema, and refreshes transitive dependency resolutions.

Changes:

• Upgrades Pi, tooling, testing, and type dependencies.
• Refreshes security-related transitive dependencies.
• Updates the Biome schema to 2.5.15.

File	Description
package.json	Updates direct dependencies and the PostCSS override.
biome.json	Aligns the schema reference with Biome 2.5.15.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.