Skip to content

chore(deps): bump the production-dependencies group across 1 directory with 4 updates#68

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-9e638e5e05
Open

chore(deps): bump the production-dependencies group across 1 directory with 4 updates#68
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-9e638e5e05

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 4 updates in the / directory: @ai-sdk/anthropic, @ai-sdk/openai, ai and linkedom.

Updates @ai-sdk/anthropic from 3.0.81 to 4.0.14

Release notes

Sourced from @​ai-sdk/anthropic's releases.

@​ai-sdk/openai@​4.0.13

Patch Changes

  • 7805e4a: Fix realtime transcription auth header handling: per-call authorization headers now override configuration headers regardless of header-key casing (last case-variant wins), and the Bearer scheme is matched case-insensitively.
  • cd12954: Reject empty OpenAI, Anthropic, and Replicate base URLs with a helpful AI SDK invalid argument error.
  • Updated dependencies [4be62c1]
  • Updated dependencies [7805e4a]
  • Updated dependencies [cd12954]
    • @​ai-sdk/provider-utils@​5.0.9

@​ai-sdk/xai@​4.0.12

Patch Changes

  • 4be62c1: fix(provider-utils): validate provider-response URLs in getFromApi

    getFromApi now has a validateUrl flag. It is optional so existing callers keep compiling (omitting it behaves like false, i.e. no validation), but all AI SDK provider packages set it explicitly at every call site so each one makes a visible trust decision. When true, the URL is routed through fetchWithValidatedRedirects — the same guard used by downloadBlob — which rejects private/loopback/link-local targets, re-validates every redirect hop, strips proxy/metadata/cookie request headers, and drops all caller headers except the user-agent on cross-origin redirects (custom API-key headers must not follow a redirect off-origin any more than Authorization may); blocked URLs throw DownloadError. It is enabled at the image/video/audio download and polling call sites where the URL comes from a provider response body; URLs built from developer-configured endpoints pass validateUrl: false and are unaffected.

    A new optional credentialedOrigin withholds caller headers unless the URL is same-origin with it, so the API key is not sent to a response-supplied host on a different origin.

    A new optional trustedOrigin exempts URLs (and redirect hops) that are same-origin with the developer-configured provider endpoint from target validation, so self-hosted and localhost deployments whose response URLs point back at the configured host keep working; all other hops are still validated.

    Also closes range gaps in validateDownloadUrl (IPv4 224.0.0.0/4 multicast and the TEST-NET documentation ranges 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24; IPv6 documentation ranges 2001:db8::/32 and 3fff::/20), and follows only the fetch-spec redirect status codes (301/302/303/307/308) — a Location header on any other status is not followed. This guard performs string/literal checks only and does not resolve DNS; hostnames that resolve to private addresses and DNS rebinding remain out of scope and must be constrained at the network layer (or by injecting a Node fetch that pins the resolved IP at connect time) for server deployments handling untrusted URLs. See contributing/secure-url-handling.md.

  • Updated dependencies [4be62c1]

  • Updated dependencies [7805e4a]

  • Updated dependencies [cd12954]

    • @​ai-sdk/provider-utils@​5.0.9
    • @​ai-sdk/openai-compatible@​3.0.9

@​ai-sdk/klingai@​4.0.10

Patch Changes

  • 4be62c1: fix(provider-utils): validate provider-response URLs in getFromApi

    getFromApi now has a validateUrl flag. It is optional so existing callers keep compiling (omitting it behaves like false, i.e. no validation), but all AI SDK provider packages set it explicitly at every call site so each one makes a visible trust decision. When true, the URL is routed through fetchWithValidatedRedirects — the same guard used by downloadBlob — which rejects private/loopback/link-local targets, re-validates every redirect hop, strips proxy/metadata/cookie request headers, and drops all caller headers except the user-agent on cross-origin redirects (custom API-key headers must not follow a redirect off-origin any more than Authorization may); blocked URLs throw DownloadError. It is enabled at the image/video/audio download and polling call sites where the URL comes from a provider response body; URLs built from developer-configured endpoints pass validateUrl: false and are unaffected.

    A new optional credentialedOrigin withholds caller headers unless the URL is same-origin with it, so the API key is not sent to a response-supplied host on a different origin.

    A new optional trustedOrigin exempts URLs (and redirect hops) that are same-origin with the developer-configured provider endpoint from target validation, so self-hosted and localhost deployments whose response URLs point back at the configured host keep working; all other hops are still validated.

    Also closes range gaps in validateDownloadUrl (IPv4 224.0.0.0/4 multicast and the TEST-NET documentation ranges 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24; IPv6 documentation ranges 2001:db8::/32 and 3fff::/20), and follows only the fetch-spec redirect status codes (301/302/303/307/308) — a Location header on any other status is not followed. This guard performs string/literal checks only and does not resolve DNS; hostnames that resolve to private addresses and DNS rebinding remain out of scope and must be constrained at the network layer (or by injecting a Node fetch that pins the resolved IP at connect time) for server deployments handling untrusted URLs. See contributing/secure-url-handling.md.

  • Updated dependencies [4be62c1]

  • Updated dependencies [7805e4a]

  • Updated dependencies [cd12954]

... (truncated)

Changelog

Sourced from @​ai-sdk/anthropic's changelog.

4.0.14

Patch Changes

  • 4be62c1: fix(provider-utils): validate provider-response URLs in getFromApi

    getFromApi now has a validateUrl flag. It is optional so existing callers keep compiling (omitting it behaves like false, i.e. no validation), but all AI SDK provider packages set it explicitly at every call site so each one makes a visible trust decision. When true, the URL is routed through fetchWithValidatedRedirects — the same guard used by downloadBlob — which rejects private/loopback/link-local targets, re-validates every redirect hop, strips proxy/metadata/cookie request headers, and drops all caller headers except the user-agent on cross-origin redirects (custom API-key headers must not follow a redirect off-origin any more than Authorization may); blocked URLs throw DownloadError. It is enabled at the image/video/audio download and polling call sites where the URL comes from a provider response body; URLs built from developer-configured endpoints pass validateUrl: false and are unaffected.

    A new optional credentialedOrigin withholds caller headers unless the URL is same-origin with it, so the API key is not sent to a response-supplied host on a different origin.

    A new optional trustedOrigin exempts URLs (and redirect hops) that are same-origin with the developer-configured provider endpoint from target validation, so self-hosted and localhost deployments whose response URLs point back at the configured host keep working; all other hops are still validated.

    Also closes range gaps in validateDownloadUrl (IPv4 224.0.0.0/4 multicast and the TEST-NET documentation ranges 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24; IPv6 documentation ranges 2001:db8::/32 and 3fff::/20), and follows only the fetch-spec redirect status codes (301/302/303/307/308) — a Location header on any other status is not followed. This guard performs string/literal checks only and does not resolve DNS; hostnames that resolve to private addresses and DNS rebinding remain out of scope and must be constrained at the network layer (or by injecting a Node fetch that pins the resolved IP at connect time) for server deployments handling untrusted URLs. See contributing/secure-url-handling.md.

  • cd12954: Reject empty OpenAI, Anthropic, and Replicate base URLs with a helpful AI SDK invalid argument error.

  • Updated dependencies [4be62c1]

  • Updated dependencies [7805e4a]

  • Updated dependencies [cd12954]

    • @​ai-sdk/provider-utils@​5.0.9

4.0.13

Patch Changes

  • Updated dependencies [e193290]
    • @​ai-sdk/provider-utils@​5.0.8

4.0.12

Patch Changes

  • 308a519: chore: enforce consistent imports from zod/v4 instead of zod

4.0.11

Patch Changes

  • Updated dependencies [0f93c57]
    • @​ai-sdk/provider@​4.0.3
    • @​ai-sdk/provider-utils@​5.0.7

4.0.10

Patch Changes

  • Updated dependencies [ac306ed]
    • @​ai-sdk/provider-utils@​5.0.6

4.0.9

... (truncated)

Commits

Updates @ai-sdk/openai from 3.0.67 to 4.0.13

Release notes

Sourced from @​ai-sdk/openai's releases.

@​ai-sdk/openai@​4.0.13

Patch Changes

  • 7805e4a: Fix realtime transcription auth header handling: per-call authorization headers now override configuration headers regardless of header-key casing (last case-variant wins), and the Bearer scheme is matched case-insensitively.
  • cd12954: Reject empty OpenAI, Anthropic, and Replicate base URLs with a helpful AI SDK invalid argument error.
  • Updated dependencies [4be62c1]
  • Updated dependencies [7805e4a]
  • Updated dependencies [cd12954]
    • @​ai-sdk/provider-utils@​5.0.9
Changelog

Sourced from @​ai-sdk/openai's changelog.

4.0.13

Patch Changes

  • 7805e4a: Fix realtime transcription auth header handling: per-call authorization headers now override configuration headers regardless of header-key casing (last case-variant wins), and the Bearer scheme is matched case-insensitively.
  • cd12954: Reject empty OpenAI, Anthropic, and Replicate base URLs with a helpful AI SDK invalid argument error.
  • Updated dependencies [4be62c1]
  • Updated dependencies [7805e4a]
  • Updated dependencies [cd12954]
    • @​ai-sdk/provider-utils@​5.0.9

4.0.12

Patch Changes

  • e193290: Add connectToWebSocket to @ai-sdk/provider-utils: a shared WebSocket connect layer (constructor resolution, header hygiene, abort wiring, message decoding) analogous to postToApi for HTTP. The openai and xai streaming transcription models now use it instead of hand-rolled connects. For openai and xai this also means WebSocket constructor failures now surface as stream errors instead of throwing synchronously from doStream, an already-aborted signal no longer constructs a socket, and the caller's audio stream is cancelled on pre-open failures. Messages are processed in order with close handling deferred behind pending frames, audio send loops apply backpressure via the socket's bufferedAmount, and failed sends cancel the caller's audio stream.
  • e193290: Fix streaming transcription over header-capable WebSocket implementations: the realtime WebSocket handshake sent the api key in both the openai-insecure-api-key subprotocol and the Authorization header, which OpenAI rejects ("You must only send one of protocol api key and Authorization header"). The Authorization header is now stripped when the subprotocol carries the key.
  • e193290: Strip undefined header values before the streaming transcription WebSocket constructor (header-capable implementations like ws throw on undefined values).
  • Updated dependencies [e193290]
    • @​ai-sdk/provider-utils@​5.0.8

4.0.11

Patch Changes

  • b2b1bb9: feat(provider/openai): add GPT-5.6 reasoning and prompt cache controls

4.0.10

Patch Changes

  • fdb6d5d: feat(provider/openai,provider/gateway): add gpt-5.6 model ids
  • Updated dependencies [0f93c57]
    • @​ai-sdk/provider@​4.0.3
    • @​ai-sdk/provider-utils@​5.0.7

4.0.9

Patch Changes

  • ac306ed: Fix StreamingToolCallTracker finalizing streaming tool calls on parsable partial JSON. Tool calls now only finalize during stream flush, restoring the behavior of #13137: a parsable argument buffer can still be the prefix of a longer argument string, so finalizing early could act on truncated tool inputs.
  • Updated dependencies [ac306ed]
    • @​ai-sdk/provider-utils@​5.0.6

4.0.8

Patch Changes

  • b51ed36: Send inline image file parts in OpenAI chat requests as data URLs instead of bare base64 strings.

... (truncated)

Commits
  • cb68fa6 Version Packages (#17175)
  • cd12954 fix: reject empty OpenAI, Anthropic, and Replicate base URLs with a helpful e...
  • 7805e4a feat(provider-utils): experimental transcription-stream WebSocket envelope (#...
  • cc3ab3a Version Packages (#17172)
  • e193290 fix: streaming transcription WebSocket fixes + shared connect layer (#17093)
  • 703e0bf Version Packages (#17031)
  • b2b1bb9 feat(provider/openai): support GPT-5.6 reasoning and prompt caching controls ...
  • 405116e Version Packages (#16937)
  • fdb6d5d feat(provider/openai,provider/gateway): add gpt-5.6 model id (#17021)
  • f0d9a6c Version Packages (#16898)
  • Additional commits viewable in compare view

Updates ai from 6.0.196 to 7.0.26

Release notes

Sourced from ai's releases.

ai@7.0.26

Patch Changes

  • 27d294d: feat(ai): group orphaned tool calls after tool approvals under parent span

ai@7.0.25

Patch Changes

  • 7805e4a: Cancelling the experimental_streamTranscribe fullStream now also aborts a still-pending doStream setup, so a model whose doStream has not yet resolved is cancelled instead of leaking.
  • f8e82fd: Update the experimental_streamTranscribe unsupported-model error message now that gateway string model IDs can support streaming transcription.
  • Updated dependencies [4be62c1]
  • Updated dependencies [f8e82fd]
  • Updated dependencies [7805e4a]
  • Updated dependencies [cd12954]
    • @​ai-sdk/provider-utils@​5.0.9
    • @​ai-sdk/gateway@​4.0.19

ai@7.0.23

Patch Changes

  • 930f949: feat(ai): wrap embedMany in tracing channel context
  • Updated dependencies [867f80a]
    • @​ai-sdk/gateway@​4.0.17

ai@6.0.225

Patch Changes

  • Updated dependencies [7c48ed8]
    • @​ai-sdk/gateway@​3.0.149
Changelog

Sourced from ai's changelog.

7.0.26

Patch Changes

  • 27d294d: feat(ai): group orphaned tool calls after tool approvals under parent span

7.0.25

Patch Changes

  • 7805e4a: Cancelling the experimental_streamTranscribe fullStream now also aborts a still-pending doStream setup, so a model whose doStream has not yet resolved is cancelled instead of leaking.
  • f8e82fd: Update the experimental_streamTranscribe unsupported-model error message now that gateway string model IDs can support streaming transcription.
  • Updated dependencies [4be62c1]
  • Updated dependencies [f8e82fd]
  • Updated dependencies [7805e4a]
  • Updated dependencies [cd12954]
    • @​ai-sdk/provider-utils@​5.0.9
    • @​ai-sdk/gateway@​4.0.19

7.0.24

Patch Changes

  • e193290: Cancel the caller's audio stream when experimental_streamTranscribe fails before or during streaming. Previously, when the model's doStream rejected before a stream existed (e.g. missing API key or other auth failure), the audio stream was never consumed or cancelled, so an upstream producer piping into it would hang forever.
  • Updated dependencies [e193290]
    • @​ai-sdk/provider-utils@​5.0.8
    • @​ai-sdk/gateway@​4.0.18

7.0.23

Patch Changes

  • 930f949: feat(ai): wrap embedMany in tracing channel context
  • Updated dependencies [867f80a]
    • @​ai-sdk/gateway@​4.0.17

7.0.22

Patch Changes

  • 8f89c25: Add the Cartesia provider with Sonic 3.5 speech generation, Ink-Whisper batch transcription, and Ink 2 realtime transcription support.

7.0.21

Patch Changes

  • 308a519: chore: enforce consistent imports from zod/v4 instead of zod
  • Updated dependencies [308a519]
  • Updated dependencies [7fe53d2]
    • @​ai-sdk/gateway@​4.0.16

... (truncated)

Commits
  • 2ba5f8a Version Packages (#17181)
  • 27d294d feat(ai): group orphaned tool calls after tool approvals under parent span (#...
  • cb68fa6 Version Packages (#17175)
  • f8e82fd feat(gateway): streaming transcription via GatewayTranscriptionModel.doStream...
  • 7805e4a feat(provider-utils): experimental transcription-stream WebSocket envelope (#...
  • cc3ab3a Version Packages (#17172)
  • e193290 fix: streaming transcription WebSocket fixes + shared connect layer (#17093)
  • de63ba0 Version Packages (#17163)
  • 930f949 feat(ai): wrap embedMany in tracing channel context (#17150)
  • b162ae4 Version Packages (#17106)
  • Additional commits viewable in compare view

Updates linkedom from 0.18.12 to 0.18.13

Commits
  • fcd88e0 0.18.13
  • 195f7aa brought in better spec-compliant style and getComputed
  • b9ee7fd fix: reading an unset style property returns "" per CSSOM, not undefined (#328)
  • 2450493 Fix #320 - Updated build status
  • d001308 removed unnecessary .npmrc line + updated dev/dependencies - not htmlparser2
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the production-dependencies group across 1 director…
991dc7f 
…y with 4 updates

Bumps the production-dependencies group with 4 updates in the / directory: [@ai-sdk/anthropic](https://github.com/vercel/ai/tree/HEAD/packages/anthropic), [@ai-sdk/openai](https://github.com/vercel/ai/tree/HEAD/packages/openai), [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai) and [linkedom](https://github.com/WebReflection/linkedom).


Updates `@ai-sdk/anthropic` from 3.0.81 to 4.0.14
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/anthropic/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/anthropic@4.0.14/packages/anthropic)

Updates `@ai-sdk/openai` from 3.0.67 to 4.0.13
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/openai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/openai@4.0.13/packages/openai)

Updates `ai` from 6.0.196 to 7.0.26
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/ai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/ai@7.0.26/packages/ai)

Updates `linkedom` from 0.18.12 to 0.18.13
- [Commits](WebReflection/linkedom@v0.18.12...v0.18.13)

---
updated-dependencies:
- dependency-name: "@ai-sdk/anthropic"
  dependency-version: 4.0.14
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: "@ai-sdk/openai"
  dependency-version: 4.0.13
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: ai
  dependency-version: 7.0.26
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: linkedom
  dependency-version: 0.18.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Jul 14, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants