Installing @agent-relay/fleet@11.4.2 as a production dependency brings in 7 known vulnerabilities — 2 high, 5 moderate — none of which a consumer can fix without a fleet release.
Reproduced from a clean, isolated npm ci --omit=dev of a package whose only runtime dependencies are @agent-relay/fleet@11.4.2, @agent-relay/sdk@11.1.0, and zod.
Dependency path
herdr-relay-bridge@0.1.0
`-- @agent-relay/fleet@11.4.2
`-- @agent-relay/harnesses@11.4.2
`-- @ai-sdk/harness-pi@1.0.34
`-- @earendil-works/pi-coding-agent@0.79.10
`-- undici / brace-expansion / protobufjs
Every advisory lands under @earendil-works/pi-coding-agent, reached transitively via @agent-relay/harnesses → @ai-sdk/harness-pi.
Advisories
High
undici (8.0.0 – 8.8.0) — five distinct advisories: downstream response desynchronization via retry interceptor; cross-user information disclosure and parse-time crash via degenerate private cache directives; CRLF injection via blob-like body type; cross-user information disclosure via whitespace around equals in Cache-Control directives; cookie attribute injection via unsanitized domain and unparsed setCookie fields.brace-expansion (3.0.0 – 5.0.8) — three DoS advisories: exponential-time expansion of consecutive non-expanding {} groups (GHSA-3jxr-9vmj-r5cp); unbounded expansion length causing OOM crash (GHSA-mh99-v99m-4gvg); unbounded intermediate arrays bypassing the CVE-2026-14257 mitigation (GHSA-rgw5-rvv9-x895).
Moderate
protobufjs (7.5.0 – 7.6.4) — DoS via infinite loop in .proto option parsing (GHSA-j3f2-48v5-ccww).@earendil-works/pi-coding-agent (0.75.4 – 0.83.0), @ai-sdk/harness-pi, @agent-relay/harnesses (>=11.0.0), @agent-relay/fleet (>=11.0.0) — flagged as the propagating chain.
Why this is worth fixing upstream rather than locally
The consumer cannot resolve it. npm audit fix wants to alter a transitive tree owned by fleet's own dependency chain, and any local override would be silently invalidated by the next @agent-relay/fleet release. The fix belongs where the range is declared.
Two things that would each reduce the blast radius independently of the CVEs:
undici at all. Node 22 — which @agent-relay/fleet already requires via engines — has a built-in fetch. If pi-coding-agent is pulling undici for HTTP, that is five high advisories inherited for something the runtime provides.- Coupling. A package whose job is to let a host serve fleet capabilities (
defineNode / serveNode) currently drags in a full coding-agent harness. Anyone writing a fleet node — the exact use case the package documents — inherits that whole tree whether or not they ever use a PTY harness. Splitting the harness bundle out of the serveNode path, or making @agent-relay/harnesses an optional peer, would let a node provider install a much smaller surface.
Impact in practice
For a plugin that only calls defineNode/serveNode and never launches a PTY harness, none of this code is on a reachable path — but it is installed, it is what npm audit reports to every consumer, and it is what any downstream security gate will block on.
Environment: @agent-relay/fleet@11.4.2, @relaycast/sdk@6.2.0 (transitive), Node 22, npm --omit=dev, macOS.
Installing
@agent-relay/fleet@11.4.2as a production dependency brings in 7 known vulnerabilities — 2 high, 5 moderate — none of which a consumer can fix without a fleet release.Reproduced from a clean, isolated
npm ci --omit=devof a package whose only runtime dependencies are@agent-relay/fleet@11.4.2,@agent-relay/sdk@11.1.0, andzod.Dependency path
Every advisory lands under
@earendil-works/pi-coding-agent, reached transitively via@agent-relay/harnesses→@ai-sdk/harness-pi.Advisories
High
undici(8.0.0 – 8.8.0) — five distinct advisories: downstream response desynchronization via retry interceptor; cross-user information disclosure and parse-time crash via degenerate private cache directives; CRLF injection via blob-like bodytype; cross-user information disclosure via whitespace around equals in Cache-Control directives; cookie attribute injection via unsanitized domain and unparsedsetCookiefields.brace-expansion(3.0.0 – 5.0.8) — three DoS advisories: exponential-time expansion of consecutive non-expanding{}groups (GHSA-3jxr-9vmj-r5cp); unbounded expansion length causing OOM crash (GHSA-mh99-v99m-4gvg); unbounded intermediate arrays bypassing the CVE-2026-14257 mitigation (GHSA-rgw5-rvv9-x895).Moderate
protobufjs(7.5.0 – 7.6.4) — DoS via infinite loop in.protooption parsing (GHSA-j3f2-48v5-ccww).@earendil-works/pi-coding-agent(0.75.4 – 0.83.0),@ai-sdk/harness-pi,@agent-relay/harnesses(>=11.0.0),@agent-relay/fleet(>=11.0.0) — flagged as the propagating chain.Why this is worth fixing upstream rather than locally
The consumer cannot resolve it.
npm audit fixwants to alter a transitive tree owned by fleet's own dependency chain, and any local override would be silently invalidated by the next@agent-relay/fleetrelease. The fix belongs where the range is declared.Two things that would each reduce the blast radius independently of the CVEs:
undiciat all. Node 22 — which@agent-relay/fleetalready requires viaengines— has a built-in fetch. Ifpi-coding-agentis pullingundicifor HTTP, that is five high advisories inherited for something the runtime provides.defineNode/serveNode) currently drags in a full coding-agent harness. Anyone writing a fleet node — the exact use case the package documents — inherits that whole tree whether or not they ever use a PTY harness. Splitting the harness bundle out of theserveNodepath, or making@agent-relay/harnessesan optional peer, would let a node provider install a much smaller surface.Impact in practice
For a plugin that only calls
defineNode/serveNodeand never launches a PTY harness, none of this code is on a reachable path — but it is installed, it is whatnpm auditreports to every consumer, and it is what any downstream security gate will block on.Environment:
@agent-relay/fleet@11.4.2,@relaycast/sdk@6.2.0(transitive), Node 22, npm--omit=dev, macOS.