[vitaliyslion]

Summary

Clears the Dependabot alerts for undici 8.10.2 (GHSA-4qv8-2p9j-2685, GHSA-f72v-6w45-q472, GHSA-xjj6-f33q-929c). @earendil-works/pi-coding-agent pins that version exactly, and Pi 1.4.0 still does, so npm audit fix cannot resolve it without downgrading Pi to 0.75.3.

An npm overrides entry lifts undici to ^8.12.3. Overrides apply only to this repo's own install, so published users are unaffected; they get undici from the Pi they run.

The other unpinned dev dependencies (@types/node, jiti, typescript) are already at the newest versions their ranges allow.

Refs #41, which tracks removing the override once Pi ships a fixed undici.

Testing

• npm run check passes
• New behaviour has a suite that drives it through Pi's ExtensionRunner (see docs/tests.md) (n/a, no behaviour change)
• Tried by hand in Pi (pi -e /path/to/checkout), if user-visible (n/a)

npm audit reports 0 vulnerabilities.

Checklist

• No runtime dependencies added
• README configuration table updated, if config changed (n/a)
• docs/architecture.md updated briefly, only if a design decision changed (n/a)
• Works on Windows paths and process spawning, if touching either (n/a)