chore: upgrade ai to ^6.0.280 to address CVE-2026-8769

CHANGELOG.md

@@ -18,6 +18,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Upgraded `postcss-selector-parser` to `^6.1.4`. [#1625](https://github.com/sourcebot-dev/sourcebot/pull/1625)
 - Upgraded `fast-uri` to `3.1.7`. [#1626](https://github.com/sourcebot-dev/sourcebot/pull/1626)
 - Upgraded `qs` to `6.16.0`. [#1627](https://github.com/sourcebot-dev/sourcebot/pull/1627)
+- Upgraded `ai` to `^6.0.280` and aligned its AI SDK dependencies. [#1639](https://github.com/sourcebot-dev/sourcebot/pull/1639)
 
 ## [5.1.10] - 2026-08-27
 

packages/web/package.json

@@ -17,18 +17,18 @@
     "tool:oauth-flow": "tsx tools/oauthFlow.ts"
   },
   "dependencies": {
-    "@ai-sdk/amazon-bedrock": "^4.0.94",
-    "@ai-sdk/anthropic": "^3.0.70",
-    "@ai-sdk/azure": "^3.0.54",
-    "@ai-sdk/deepseek": "^2.0.29",
-    "@ai-sdk/google": "^3.0.64",
-    "@ai-sdk/google-vertex": "^4.0.111",
-    "@ai-sdk/mcp": "^2.0.0-beta.11",
-    "@ai-sdk/mistral": "^3.0.30",
-    "@ai-sdk/openai": "^3.0.53",
-    "@ai-sdk/openai-compatible": "^2.0.41",
-    "@ai-sdk/react": "^3.0.169",
-    "@ai-sdk/xai": "^3.0.83",
+    "@ai-sdk/amazon-bedrock": "^4.0.175",
+    "@ai-sdk/anthropic": "^3.0.117",
+    "@ai-sdk/azure": "^3.0.119",
+    "@ai-sdk/deepseek": "^2.0.63",
+    "@ai-sdk/google": "^3.0.122",
+    "@ai-sdk/google-vertex": "^4.0.198",
+    "@ai-sdk/mcp": "^1.0.80",
+    "@ai-sdk/mistral": "^3.0.64",
+    "@ai-sdk/openai": "^3.0.112",
+    "@ai-sdk/openai-compatible": "^2.0.75",
+    "@ai-sdk/react": "^3.0.283",
+    "@ai-sdk/xai": "^3.0.131",
     "@anthropic-ai/sdk": "^0.104.0",
     "@auth/prisma-adapter": "^2.11.3",
     "@aws-sdk/credential-providers": "^3.1036.0",
@@ -120,7 +120,7 @@
     "@uiw/react-codemirror": "^4.23.0",
     "@viz-js/lang-dot": "^1.0.4",
     "@xiechao/codemirror-lang-handlebars": "^1.0.4",
-    "ai": "^6.0.167",
+    "ai": "^6.0.280",
     "ajv": "^8.17.1",
     "bcryptjs": "^3.0.2",
     "canvas-confetti": "^1.9.4",

packages/web/src/ee/features/chat/mcp/mcpToolSets.test.ts

@@ -53,10 +53,6 @@ vi.mock('@/lib/redis', () => ({
     }),
 }));
 
-vi.mock('ai', () => ({
-    jsonSchema: vi.fn((schema: unknown, opts: unknown) => ({ schema, ...(opts as object) })),
-}));
-
 // --- Helpers ---
 
 interface MockToolDef {
@@ -510,7 +506,7 @@ describe('getMcpTools', () => {
         ]);
 
         const tool = result.tools['mcp_linear__create_issue'];
-        // The inputSchema should have a validate function from our jsonSchema mock
+        // Exercise the real AI SDK schema with our MCP input validator.
         const schema = tool.inputSchema as { validate?: (value: unknown) => Promise<{ success: boolean; error?: Error }> };
         expect(schema.validate).toBeDefined();
 

packages/web/src/ee/features/chat/mcp/mcpToolSets.ts

@@ -363,13 +363,7 @@ export async function getMcpTools(clients: McpToolSet[], analyticsContext?: McpT
                 clientTools[qualifiedName] = {
                     ...tool,
                     execute: executeWithTimeout,
-                    // The @ai-sdk/mcp package bundles its own copy of @ai-sdk/provider-utils,
-                    // so its Schema<unknown> isn't structurally identical to the workspace copy.
-                    // The runtime shape is the same; cast through `any` to bridge the duplicate
-                    // type identity (the two FlexibleSchema types differ only by their internal
-                    // schemaSymbol brand).
-                    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-                    inputSchema: validatedInputSchema as any,
+                    inputSchema: validatedInputSchema,
                     ...(needsApproval ? { needsApproval: true } : {}),
                 };
             }