chore(deps): bump the npm_and_yarn group across 3 directories with 3 updates

[dependabot]

Bumps the npm_and_yarn group with 2 updates in the /sdk/typescript/integration/fixtures/ai-4 directory: ai and @ai-sdk/provider-utils.
Bumps the npm_and_yarn group with 1 update in the /sdk/typescript/integration/fixtures/mastra-0 directory: ai.
Bumps the npm_and_yarn group with 1 update in the /sdk/typescript/integration/fixtures/mastra-1 directory: @modelcontextprotocol/client.

Updates ai from 4.3.19 to 5.0.52

Changelog

Sourced from ai's changelog.

ai

7.0.139

Patch Changes

• Updated dependencies [685667c]
• Updated dependencies [bdbeba3]
• Updated dependencies [ec2af7b]
  • @​ai-sdk/gateway@​4.0.112

7.0.138

Patch Changes

• eab278a: fix: resume interrupted chat streams when the page becomes visible again

  useChat with resume: true no longer starts a second resume request on mount when the chat is already submitted or streaming, e.g. when remounting with a shared Chat instance mid-stream.

• 26d64e9: fix(ai): update tool outputs in the message containing the matching tool call

• 75b3ea2: fix(ai): prevent duplicate message parts when resuming replayed streams

• 69f4b82: fix(ai): prevent global type conflicts across SDK versions

• e57803c: Add an optional shared citation representation to generated text and text-end stream events, separate from retrieved sources. Preserve citations in core result content and UI message text parts, including validation and persistence, without changing content or stream event discriminants.

• 4c705d9: Fix validation of rounded choice probabilities in experimental_decide.

• 5150d50: fix(ai): update streaming chat messages by stable ID

• 9aef724: fix(workflow): report incomplete no-output model streams as errors

• 7d0458b: fix(ai): reject approved tool calls without results before sending later context to providers

• Updated dependencies [9667bf2]

• Updated dependencies [e57803c]

• Updated dependencies [81663cc]

  • @​ai-sdk/provider-utils@​5.0.59
  • @​ai-sdk/provider@​4.0.27
  • @​ai-sdk/gateway@​4.0.111

7.0.137

Patch Changes

• e27cc64: fix(ai): discard unrelated message state when reading resumed streams

7.0.136

Patch Changes

• 7b5497c: Fix streaming output timeouts: stop chunkMs and firstChunkMs when the model response ends, so long-running local tools do not trigger model output timeouts. Give each retry fresh output timeout budgets. stepMs continues to cover the complete step, including local tools.
• Updated dependencies [e280aa1]
  • @​ai-sdk/gateway@​4.0.110

7.0.135

... (truncated)

Commits

• 63d5f66 Version Packages (#8895)
• 930399b Backport: fix(ai): download files when intermediate file cannot be downloaded...
• 85909a9 Backport: chore(ai): update test message (#8875)
• c56822d Backport: fix(ai): update uiMessageChunkSchema to satisfy the `UIMessageChu...
• 6bd07df Version Packages (#8853)
• 27645bb Backport: Export parseJsonEventStream and uiMessageChunkSchema from "ai" ...
• 8b7f0d2 Version Packages (#8843)
• 9eef198 Version Packages (#8831)
• 20bca65 Version Packages (#8799)
• 4254096 Version Packages (#8753)
• Additional commits viewable in compare view

Updates @ai-sdk/provider-utils from 2.2.8 to 3.0.9

Changelog

Sourced from @​ai-sdk/provider-utils's changelog.

3.0.9

Patch Changes

• 0294b58: feat(ai): set ai, @ai-sdk/provider-utils, and runtime in user-agent header

3.0.8

Patch Changes

• 99964ed: fix(provider-utils): fix type inference for toModelOutput

3.0.7

Patch Changes

• 886e7cd: chore(provider-utils): upgrade event-source parser to 3.0.5

3.0.6

Patch Changes

• 1b5a3d3: chore(provider-util): integrate zod-to-json-schema

3.0.5

Patch Changes

• 0857788: fix(provider/groq): experimental_transcribe fails with valid Buffer

3.0.4

Patch Changes

• 68751f9: fix(provider-utils): add inject json utility function

3.0.3

Patch Changes

• 034e229: fix(provider/utils): fix FlexibleSchema type inference with zod/v3
• f25040d: fix(provider-utils): fix tools type inference

3.0.2

Patch Changes

• 38ac190: feat(ai): preliminary tool results

3.0.1

... (truncated)

Commits

• 80fb3dc Version Packages (#8619)
• 0294b58 feat(ai): set ai, @ai-sdk/provider-utils, and runtime in user-agent hea...
• 494f013 chore (provider-utils): add tool type tests (#8539)
• c549b39 Version Packages (#8425)
• 99964ed fix(provider-utils): fix type inference for toModelOutput (#8437)
• d130a2a test: explicitly import vitest functions (#8277)
• 86e80d6 Version Packages (#8287)
• 886e7cd chore(provider-utils): upgrade eventsource-parser to 3.0.5 (#8292)
• 382767a Version Packages (#8265)
• 1b5a3d3 chore(provider-util): integrate zod-to-json-schema (#8224)
• Additional commits viewable in compare view

Removes ai

Updates @modelcontextprotocol/client from 2.0.0 to 2.2.0

Release notes

Sourced from @​modelcontextprotocol/client's releases.

@​modelcontextprotocol/client@​2.2.0

Minor Changes

• #2887 edd12e2 Thanks @​maxisbey! - Constructing ClientCredentialsProvider, PrivateKeyJwtProvider, StaticPrivateKeyJwtProvider or CrossAppAccessProvider without expectedIssuer is deprecated: the constructor logs one console.warn and that call signature is marked @deprecated. Behaviour is otherwise unchanged. Pass the issuer of the authorization server the credentials were registered with.

  fetchToken() throws AuthorizationServerMismatchError, before sending anything, when the provider's client information is bound to a different authorization server than the one it is called with. The AuthorizationServerMismatchError message no longer assumes the authorization-code callback; its fields are unchanged.

  OAuthTokensSchema and OAuthClientInformationSchema accept the optional issuer stamp, so a provider that reads storage back through them keeps it. auth() overwrites it on every save.

Patch Changes

• #2885 9dd722f Thanks @​claude! - Sending a notification on a closed connection no longer produces a briefly unhandled promise rejection (seen as unhandledrejection on Cloudflare Workers) in addition to the returned rejection.

• #2883 c0f7aec Thanks @​claude! - Fix a type-check failure for CommonJS TypeScript projects introduced in 2.1.0: dist/index.d.cts imported types from jose, which is ESM-only, so tsc with module: node16/node18 and skipLibCheck: false failed with TS1479. The two jose types used by the DPoP API (CryptoKey, JWK) are now inlined into the declaration files. No runtime change.

• #2768 efebf5b Thanks @​web-abin! - Correct the JSDoc for insecure OAuth token endpoints. The TLS requirement comes from the MCP authorization specification's OAuth 2.1 communication-security rules, not SEP-2207, which covers OIDC-flavored refresh-token guidance. Documentation only; no runtime behavior change.

• #2729 a4ae2f9 Thanks @​claude! - Correct the registerClient @deprecated notice: Dynamic Client Registration was deprecated by spec PR modelcontextprotocol#2858 (Client ID Metadata Documents), not SEP-2577 (which deprecates roots, sampling, and logging). The notice now also names the earliest possible removal date under the feature lifecycle policy (2027-07-28) and clarifies that the client_id_metadata_document_supported gating lives in the built-in auth() flow — registerClient called directly always sends the registration request. Documentation only; no runtime behavior change.

• #2862 e780e13 Thanks @​SyedTashfin! - Preserve _meta on input_required results. The 2026-07-28 decode seam rebuilt the payload from inputRequests and requestState only, so result-level metadata a server sent on an input_required result (including io.modelcontextprotocol/serverInfo) was dropped before an allowInputRequired: true caller could see it. Result._meta is a result-level field, so input_required carries it exactly like any other result.

• #2886 ef39308 Thanks @​claude! - listTools(), listPrompts(), listResources() and listResourceTemplates() called without a cursor now follow nextCursor until the server stops sending one, instead of stopping silently with a short list when a cursor repeats; a page that has the same items and the same nextCursor as the page before it ends the walk and is not added twice, and listMaxPages still caps the walk.

• #2642 cfa09db Thanks @​claude! - Fix Client.listen() rejections escaping as process-level unhandled rejections. The internal opening promise could reject (ack timeout, transport close, server cancel, caller abort) while listen() was still serially awaiting transport.send(...), so no rejection handler was attached yet — the rejection surfaced as an unhandledRejection that caller-side handling cannot prevent, and a send that never settles (e.g. a stdio write parked on 'drain') left listen() suspended forever even though the ack timer had already fired. listen() now suspends on the opening state machine directly and routes send failures into it, so every termination path rejects the returned promise and nothing escapes.

• #2597 7f7a94c Thanks @​arimu1! - Treat hostnames ending in .localhost as loopback for the SEP-2207 token-endpoint https guard (RFC 6761 §6.3), so host-based multi-tenant local OAuth works. The SDK does not resolve the name itself: *.localhost reaches the local machine only if the system resolver follows RFC 6761.

• Updated dependencies [edd12e2]:

  • @​modelcontextprotocol/core@​2.2.0

@​modelcontextprotocol/client@​2.1.0

Minor Changes

• #2629 dcc0102 Thanks @​gbshankar! - Add DPoP (RFC 9449 / SEP-1932) sender-constrained access token support to the client.
  • Opt in by implementing OAuthClientProvider.dpop() returning a DpopSession (new, along with generateDpopKeyPair, accessTokenHash, isDpopNonceChallenge). auth() / exchangeAuthorization / refreshAuthorization / fetchToken then sign a DPoP proof into token requests (retrying once on an authorization-server use_dpop_nonce challenge, with client authentication re-applied per attempt), and StreamableHTTPClientTransport, SSEClientTransport and withOAuth present a token_type: "DPoP" access token as Authorization: DPoP <token> plus a fresh per-request proof, retry a resource-server use_dpop_nonce challenge once, and pick up a DPoP-Nonce delivered on any response. Tokens the AS issued as Bearer are still presented as Bearer.
  • DPoP is applied at the fetch layer: the transports wrap their resource-server fetch (including a caller-supplied fetch / eventSourceInit.fetch) with the new withDpopFromProvider(provider) middleware, so proofs are always bound to the request actually sent. withDpop(session, getToken) is exported for callers that manage tokens themselves (e.g. alongside a minimal AuthProvider); the AuthProvider interface itself is unchanged.
  • auth() now recovers from invalid_dpop_proof on refresh (e.g. a refresh token bound to a key that is no longer held) by discarding the tokens and re-authorizing, like invalid_grant. OAuthErrorCode gains InvalidDpopProof and UseDpopNonce; extractWWWAuthenticateParams recognizes the DPoP challenge scheme; OAuthMetadataSchema gains dpop_signing_alg_values_supported.

Patch Changes

• #2726 6fa4227 Thanks @​LuckTerence! - SdkError and SdkHttpError accept standard ErrorOptions as an optional fourth constructor argument and forward it to Error, so a wrapped error is reachable through the standard Error.cause chain. Version-negotiation probe failures (SdkErrorCode.EraNegotiationFailed) now use it: the underlying TypeError: fetch failed and the DNS or socket error beneath it surface via error.cause, so pino, Sentry, and util.inspect render ENOTFOUND / ECONNREFUSED / ETIMEDOUT instead of stopping at the SdkError (#2657). The previous error.data.cause slot is still populated for compatibility but is deprecated and slated for removal; read error.cause instead.

• #2654 03842cd Thanks @​pshah19! - Treat request id 0 as a real id. Two guards tested a RequestId for truthiness, so the legal JSON-RPC ids 0 and '' were read as absent. Id 0 is not a corner case: the outbound request counter is zero-based, so it is the first id every peer assigns, which on the server→client leg is the first sampling/createMessage, elicitation/create, or roots/list a server sends.

  • notifications/cancelled carrying id 0 was ignored, and the in-flight handler ran to completion with its AbortSignal never fired.
  • A notification sent with relatedRequestId: 0 wrongly passed the debounce gate (for methods opted into debouncedNotificationMethods). Because the pending set is keyed by method alone, a second such notification in the same tick was silently dropped rather than sent.

  Absent is now the only value that means "no id".

• #2043 c4248a9 Thanks @​ChrisJr404! - On Windows, stdio servers spawned by StdioClientTransport now also inherit COMSPEC, PATHEXT, PROGRAMDATA, PROGRAMFILES(X86), PROGRAMW6432, and WINDIR (added to DEFAULT_INHERITED_ENV_VARS). Programs a server launches can depend on them: PowerShell finds no native executables without PATHEXT, and Windows OpenSSH exits 255 without ProgramData.

... (truncated)

Commits

• dd22ba2 Version Packages (#2849)
• c55efa6 fix(server): close a listen stream that has honored nothing (#2651)
• edd12e2 fix(client): deprecate omitting expectedIssuer and apply the SEP-2352 issuer ...
• ef39308 fix(client): follow nextCursor until it is absent; stop on a repeated page (#...
• 9dd722f fix(core): await the notification send so a failed send is never briefly unha...
• e780e13 fix(client): preserve _meta on input_required results (#2862)
• a4ae2f9 docs(client): correct the registerClient deprecation citation to spec PR #285...
• efebf5b docs(client): correct token endpoint TLS citation (#2768)
• d992df7 chore: remove CODEOWNERS patterns that match nothing on main (#2884)
• c0f7aec fix(client): inline jose types in the CommonJS declaration file (#2883)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

Thanks @dependabot[bot] for keeping our dependencies current! 🙌

[github-actions]

Automated approval for Dependabot dependency update.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 69cf6e4b-0871-4647-a74b-69d5feae258f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​mastra/​mcp@​2.0.0 ⏵ 2.3.0	+1		+1
	npm/​@​mastra/​memory@​0.15.13 ⏵ 1.37.0	+2		+15		-19
	npm/​ai@​5.0.97 ⏵ 5.0.52	-2

View full report

[NiveditJain]

Closing without merging; #901 handles these alerts instead.

• mastra-1, @modelcontextprotocol/client 2.0.0 → 2.2.0 (GHSA-6qxp-vccf-f47h): fixed in [failproofai-legion-901] Combine the open Dependabot PRs and clear every fixable security finding #901, but not by bumping @mastra/mcp. @mastra/mcp@2.3.0 peers on @mastra/core >=1.75.0-0, and the fixture pins @mastra/core@1.68.0, so this PR's bump cannot install there. [failproofai-legion-901] Combine the open Dependabot PRs and clear every fixable security finding #901 applies SECURITY.md's case 1 instead: a fixture-local overrides entry for the patched client. Every pin resolves as before, and the mcp and mcp-toolsets scenarios pass against it.
• ai-4 and mastra-0, ai 4.3.19 → 5.0.52 and @ai-sdk/provider-utils 2.2.8 → 3.0.9: not applied. Those fixtures exist to hold ai@4, and @mastra/core@0.24.9 requires ai@^4. SECURITY.md records both advisories as accepted with no fix, and moving the pin is the change it rules out. That move is also why this PR's integration shards were red.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml