chore: upgrade ai to ^6.0.280 to address CVE-2026-8769 - #1639
Open
claude[bot] wants to merge 4 commits into
Open
chore: upgrade ai to ^6.0.280 to address CVE-2026-8769#1639claude[bot] wants to merge 4 commits into
claude[bot] wants to merge 4 commits into
Conversation
…8769 Every @ai-sdk/* provider package pins @ai-sdk/provider-utils to an exact version (4.0.23), so neither a lockfile refresh nor a top-level bump that stays inside the existing ranges can move it. Bumping the top-level @ai-sdk/* packages to their latest in-range releases does move it, but also pulls in a breaking `ai` v6 change (ToolExecutionOptions now requires `context`), which fails typecheck. Use a qualified resolution keyed to the existing exact source range instead, which is the narrowest supported fix here. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
|
@claude[bot] your pull request is missing a changelog! |
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
License Audit❌ Audit failed to produce results. Check the workflow logs for details. |
brendan-kellam
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes SOU-2197
Addresses CVE-2026-8769 (Dependabot alert #340) by upgrading the top-level AI SDK dependencies.
aimoves to^6.0.280,@ai-sdk/reactto^3.0.283, and the model providers to compatible patch releases. Every@ai-sdk/provider-utilsrequester now resolves to patched4.0.51through its normal dependency constraints; the resolution override is removed.Replaces
@ai-sdk/mcp@^2.0.0-beta.11with the maintained, stable AI SDK 6-compatible release^1.0.80. This is an intentional move back to the 1.x line: it retains the MCP APIs used here, includingtoolsFromDefinitions,listTools, and OAuth, while sharingprovider-utilsand tool execution types withai@6. Nocontextadapter is needed, and the separateprovider-utils@5.0.0-beta.7dependency is also removed.With the schema types aligned, removes the
anycast on MCP input schemas. The existing MCP validation tests now exercise the real AI SDKjsonSchemahelper instead of mocking it.Validation:
yarn install --immutablepasses (existing peer dependency warnings).yarn why @ai-sdk/provider-utils --recursiveshows only4.0.51, with no override.yarn test: all 2,153 tests pass across four workspaces.yarn workspace @sourcebot/web lintpasses.tsc --noEmit --incremental false: 67 existing errors; output is byte-for-byte identical to the pre-update PR baseline, with no new errors.