fix(runner): update vulnerable dependencies

[mmabrouk]

The runner currently resolves 42 vulnerable dependency instances, including one critical node-tar denial-of-service advisory.

This change updates the direct undici dependency to 8.9.0 and pins patched, compatible transitive versions for the runner dependency tree. The regenerated lockfile reduces the local pnpm audit result to 9 instances, with no critical or low-severity findings.

Tests:

• pnpm run typecheck: passed
• git diff --check: passed
• Runner unit suite: 2,179 passed and 9 filesystem-watch tests failed
• Baseline comparison: the same 9 watch tests fail on untouched main in this execution environment

How to review:

1. Check the direct undici bump and the exact pnpm overrides in services/runner/package.json.
2. Confirm the lockfile resolves the intended patched versions.
3. Review CI for behavior outside this environment's unsupported filesystem-watch path.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
agenta-documentation	Ready	Preview	Aug 18, 2026 1:10pm

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 913459a1-fe21-4968-af14-edf680bb889c

📥 Commits

Reviewing files that changed from the base of the PR and between 1df3eed and 3915275.

⛔ Files ignored due to path filters (1)

• services/runner/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

• services/runner/package.json

Included review availability: Your plan includes up to 8 reviews per rolling hour; 7 remain after this review.

---

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Updated underlying runtime components to improve reliability, compatibility, and security.
  • Applied targeted maintenance updates to support more consistent application behavior.
  • No changes were made to the public API or user-facing functionality.

Walkthrough

The runner package updates undici from 8.3.0 to 8.9.0 and adds pnpm overrides for nine transitive dependencies.

Changes

Runner dependency updates

Layer / File(s)	Summary
Dependency version constraints services/runner/package.json	Updates undici to 8.9.0 and adds explicit pnpm overrides for nine transitive dependencies.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 39152

The dependency and lockfile changes are localized, and the required package overrides remain in place; no actionable merge-blocking risk remains at the current head.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: updating vulnerable runner dependencies.
Description check	✅ Passed	The description directly explains the dependency updates, vulnerability remediation, validation results, and review scope.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/dependabot-runner-batch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}