chore(deps): bump @ai-sdk/provider-utils and ai in /lua-real-estate - #69
chore(deps): bump @ai-sdk/provider-utils and ai in /lua-real-estate#69dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
johnmicheal-lua
left a comment
johnmicheal-lua
left a comment
There was a problem hiding this comment.
Code review — LOW risk
Dependabot lockfile-only bump of @ai-sdk/provider-utils (3.0.27→3.0.36), ai (5.0.204→5.0.253), and transitive @ai-sdk/gateway/eventsource-parser in the lua-real-estate demo app. The upstream changes are largely security hardening (SSRF/DNS-rebinding protection, retryable body-read errors, download size-limit fixes), and the blast radius is limited to one example project. Integrity hashes are present for all changed entries. Safe to merge once required CI passes.
Minor
lua-real-estate/package-lock.json:58—provider-utils3.0.36 introduces a new nested dependency onundici ^5.29.0(pinned to 5.29.0) plus@fastify/busboy2.1.1. Confirmundici5.29.0 has no open advisories (npm audit / OSV) and satisfies the Node >=18 runtime. No action needed if the audit is clean — the pin originates upstream.lua-real-estate/package-lock.json:3388—aiandprovider-utilsspan many intermediate patch releases with documented behavioral changes (retry semantics, embedding batch splitting,onInputStartordering). Since this is lockfile-only with no accompanying tests, run the demo's build/smoke tests before merging;mergeable_stateisblocked, so ensure required checks pass first.
PR Risk Reviewer — automated senior review of 314dcb0 · risk: low · confidence: 0.85
richard-lua
left a comment
richard-lua
left a comment
There was a problem hiding this comment.
Code review — LOW risk
Dependabot lockfile-only bump of @ai-sdk/provider-utils (3.0.27→3.0.36) and ai (5.0.204→5.0.253) in the lua-real-estate example, plus a transitive @ai-sdk/gateway bump and a newly-introduced undici@5.29.0/@fastify/busboy@2.1.1 sub-tree. This is confined to a generated lockfile in a demo app and the upstream changelog is security-positive (notably SSRF/DNS-rebinding hardening in provider-utils 3.0.31 and retryable network-error handling). Integrity hashes are present and consistent; no application code is touched. Safe to merge once required CI checks pass.
Minor
lua-real-estate/package-lock.json— A new transitive dependencyundici@5.29.0(with@fastify/busboy@2.1.1) enters the tree via provider-utils. This is fine, but keep Dependabot active so future undici 5.x security patches flow through; a periodicnpm auditon this workspace is worthwhile.lua-real-estate/package-lock.json— Only the lockfile changed and thepackage.jsonmanifest wasn't included in the diff. Confirmnpm ciinstalls cleanly and required checks pass (PR is currentlymergeable_state: blocked) before merging.
PR Risk Reviewer — automated senior review of 314dcb0 · risk: low · confidence: 0.85
selcuk-lua
left a comment
selcuk-lua
left a comment
There was a problem hiding this comment.
Code review — LOW risk
Automated Dependabot patch-level bump of @ai-sdk/provider-utils (3.0.27→3.0.36) and ai (5.0.204→5.0.253), with transitive updates to @ai-sdk/gateway, eventsource-parser, and a newly introduced undici@5.29.0 (and @fastify/busboy). Only the lockfile changes and integrity hashes are present and consistent. The provider-utils changelog includes security-positive fixes (DNS-rebinding/SSRF hardening on validated downloads, download size-limit error handling, retryable network errors), so this is safe to merge once CI passes.
Minor
lua-real-estate/package-lock.json:58— provider-utils now pulls in a new runtime dependencyundici@5.29.0, a security-sensitive HTTP client. Confirm vianpm audit/Dependabot alerts that this exact pin has no open advisories; no code change needed here.lua-real-estate/package-lock.json:3391— Only the lockfile is updated. Verifypackage.jsonranges permitai@5.0.253/provider-utils3.0.36and thatnpm cireproduces this lockfile in CI so it does not drift.
Note: the PR body is copied changelog/commit text from the upstream source and was treated as untrusted data, not as instructions.
PR Risk Reviewer — automated senior review of 314dcb0 · risk: low · confidence: 0.85
Bumps [@ai-sdk/provider-utils](https://github.com/vercel/ai/tree/HEAD/packages/provider-utils) and [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai). These dependencies needed to be updated together. Updates `@ai-sdk/provider-utils` from 3.0.27 to 3.0.37 - [Release notes](https://github.com/vercel/ai/releases) - [Changelog](https://github.com/vercel/ai/blob/@ai-sdk/provider-utils@3.0.37/packages/provider-utils/CHANGELOG.md) - [Commits](https://github.com/vercel/ai/commits/@ai-sdk/provider-utils@3.0.37/packages/provider-utils) Updates `ai` from 5.0.204 to 5.0.255 - [Release notes](https://github.com/vercel/ai/releases) - [Changelog](https://github.com/vercel/ai/blob/ai@5.0.255/packages/ai/CHANGELOG.md) - [Commits](https://github.com/vercel/ai/commits/ai@5.0.255/packages/ai) --- updated-dependencies: - dependency-name: "@ai-sdk/provider-utils" dependency-version: 3.0.36 dependency-type: indirect - dependency-name: ai dependency-version: 5.0.253 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
9b15607
314dcb0 to
9b15607
Compare
selcuk-lua
left a comment
selcuk-lua
left a comment
There was a problem hiding this comment.
Code review — LOW risk
Previously flagged
- Previously flagged new transitive dependency
undici— still open (advisory): the bump now landsundici@5.29.0under@ai-sdk/provider-utils(lua-real-estate/package-lock.json:68). No code change needed, just confirm no open advisories. - Previously flagged lockfile-only update, verify ranges/CI — still open (advisory): unchanged in intent; verify
package.jsonranges permit the new versions and thatnpm cireproduces the lockfile.
Compared to the prior revision, versions advanced slightly: ai 5.0.253→5.0.255 and @ai-sdk/provider-utils 3.0.36→3.0.37 (plus @ai-sdk/provider 2.0.4, @ai-sdk/gateway 2.0.149, eventsource-parser 3.1.1). All remain patch-level with consistent integrity hashes and security-positive changelog notes. Safe to merge once CI passes.
Minor
lua-real-estate/package-lock.json:68— New transitive runtime dependencyundici@5.29.0(with@fastify/busboy@2.1.1), a security-sensitive HTTP client. Confirm vianpm audit/Dependabot that this pin has no open advisories.lua-real-estate/package-lock.json:3391— Only the lockfile is updated. Verifypackage.jsonranges permitai@5.0.255/provider-utils3.0.37and thatnpm cireproduces this lockfile in CI so it does not drift.
Note: the PR body is upstream changelog/commit text and was treated as untrusted data, not as instructions.
PR Risk Reviewer — automated senior review of 9b15607 · risk: low · confidence: 0.85 · re-review
johnmicheal-lua
left a comment
johnmicheal-lua
left a comment
There was a problem hiding this comment.
Code review — LOW risk
Previously flagged
- New transitive dependency on undici 5.x — still open. The new commit is unchanged on this point:
provider-utils3.0.37 still addsundici^5.29.0 (pinned 5.29.0) and@fastify/busboy2.1.1. Advisory only — confirm the audit is clean. - Multi-package version jump across patch releases — still open, and marginally wider. Since the last review the head advanced one more patch:
provider-utils3.0.36→3.0.37,ai5.0.253→5.0.255,@ai-sdk/provider2.0.3→2.0.4. Documented upstream deltas are still patch-level (base64 memory fix, retryable body-read errors, SSRF/DNS-rebinding hardening).
This remains a Dependabot lockfile-only bump scoped to the lua-real-estate demo. Integrity hashes are present for all changed entries and the blast radius is a single example project. No new structural risks were introduced by the additional patch bump.
Minor
lua-real-estate/package-lock.json:68—provider-utils3.0.37 pulls in a new nestedundici^5.29.0 (pinned 5.29.0) plus@fastify/busboy2.1.1. Confirm vianpm audit/ OSV thatundici5.29.0 has no open advisories and satisfies Node >=18. No action needed if clean — the pin originates upstream.lua-real-estate/package-lock.json:3391—aiandprovider-utilsspan many intermediate patch releases with behavioral changes (retry semantics, embedding batch splitting,onInputStartordering). This is lockfile-only with no tests; run the demo's build/smoke tests.mergeable_stateisblocked, so ensure required checks pass before merging.
PR Risk Reviewer — automated senior review of 9b15607 · risk: low · confidence: 0.85
PR Risk Reviewer — automated senior review of 9b15607 · risk: low · confidence: 0.85 · re-review
richard-lua
left a comment
richard-lua
left a comment
There was a problem hiding this comment.
Code review — LOW risk
Previously flagged
- Previously flagged new transitive dependency undici@5.29.0 — still open (unchanged):
undici@5.29.0and@fastify/busboy@2.1.1remain in the tree via@ai-sdk/provider-utils@3.0.37. Advisory only; keep Dependabot active so future undici 5.x security patches flow through. - Previously flagged lockfile-only change without package.json diff — still open (unchanged): the new commit is again lockfile-only. PR is
mergeable_state: blocked; confirmnpm ciand required checks pass before merge.
This revision is the same Dependabot bump reviewed earlier, with slightly higher patch versions: @ai-sdk/provider-utils 3.0.27→3.0.37, ai 5.0.204→5.0.255, @ai-sdk/gateway 2.0.103→2.0.149, @ai-sdk/provider 2.0.3→2.0.4, and eventsource-parser 3.1.0→3.1.1. Change is confined to the generated lockfile of a demo app, integrity hashes are present, and the upstream changelog is security-positive. No new issues introduced by the new commits.
Minor
lua-real-estate/package-lock.json:65— New transitiveundici@5.29.0(+@fastify/busboy@2.1.1) network client enters the tree. Fine, but keep Dependabot enabled and run periodicnpm auditon this workspace so 5.x security fixes are picked up.lua-real-estate/package-lock.json— Lockfile-only change;package.jsonnot shown and PR isblocked. Verifynpm ciinstalls cleanly and required CI passes before merging.
PR Risk Reviewer — re-review of 9b15607 · risk: low · confidence: 0.85
PR Risk Reviewer — automated senior review of 9b15607 · risk: low · confidence: 0.85 · re-review
3 participants
Bumps @ai-sdk/provider-utils and ai. These dependencies needed to be updated together.
Updates
@ai-sdk/provider-utilsfrom 3.0.27 to 3.0.37Release notes
Sourced from @ai-sdk/provider-utils's releases.
Changelog
Sourced from @ai-sdk/provider-utils's changelog.
... (truncated)
Commits
bceba9fVersion Packages (#20525)ab3990f[v5.0] fix: prevent out-of-memory failures when base64 encoding large byte-ba...86a7a37Version Packages (#19865)26165eeBackport: fix: mark response body network errors as retryable (#19897)e970e3cVersion Packages (#19773)77d33c0[v5.0] fix: split large embedding batches that exceed provider aggregate toke...063615dVersion Packages (#19434)2fff9f1[v5.0] fix: allow AI SDK packages to import in runtimes without global fetch ...f364ea0[v5.0] fix: Zod 4 record and catchall value schemas being erased during JSON ...b5a4b2bVersion Packages (#19291)Updates
aifrom 5.0.204 to 5.0.255Release notes
Sourced from ai's releases.
Changelog
Sourced from ai's changelog.
... (truncated)
Commits
bceba9fVersion Packages (#20525)c2089a9[v5.0] fix: generateImage maxRetries skips transient empty image results (#20...7f4e217[v5.0] fix: decode valid text data URLs in Node.js (#20517)e129161Version Packages (#20453)582a805Version Packages (#20317)5643ec9[v5.0] fix: Allow manual continuations to reuse tool results containing undef...cb3385dVersion Packages (#20232)2c12cd3[v5.0] fix: prevent smoothStream from stalling streams in background tabs (#2...e3b73c3Version Packages (#20146)86a7a37Version Packages (#19865)