Skip to content

fix(deps): update routine updates - #259

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/routine-updates
Open

fix(deps): update routine updates#259
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/routine-updates

Conversation

@renovate

@renovate renovate Bot commented Oct 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update Pending
@ai-sdk/mcp (source) 2.0.81 → 2.0.95 age confidence dependencies patch 2.0.97 (+1)
@ai-sdk/provider (source) 4.0.31 → 4.0.37 age confidence dependencies patch
@ai-sdk/provider-utils (source) 5.0.65 → 5.0.78 age confidence dependencies patch 5.0.79
@convex-dev/agent (source) 0.7.8 → 0.7.9 age confidence dependencies patch
@convex-dev/workpool (source) 0.4.14 → 0.4.15 age confidence dependencies patch 0.4.16
@effect/platform-node (source) 4.1.2 → 4.1.3 age confidence devDependencies patch
@samebase/convex-auth-tanstack-start (source) 0.1.1 → 0.1.2 age confidence dependencies patch
@samebase/sidebars (source) 0.1.2 → 0.1.3 age confidence dependencies patch
@tailwindcss/vite (source) 4.3.3 → 4.3.5 age confidence dependencies patch
@tanstack/react-query (source) 5.104.5 → 5.107.1 age confidence dependencies minor
@tanstack/react-router (source) 1.170.45 → 1.170.46 age confidence dependencies patch
@tanstack/react-start (source) 1.169.3 → 1.169.5 age confidence dependencies patch
@tanstack/router-plugin (source) 1.168.47 → 1.169.0 age confidence devDependencies minor
@testing-library/user-event 14.6.8 → 14.6.9 age confidence devDependencies patch
@types/node (source) ^24.19.2 → ^26.0.0 age confidence devDependencies major
@vitejs/plugin-react (source) 6.1.2 → 6.3.0 age confidence devDependencies minor
actions/setup-node v6 → v7 age confidence action major
ai (source) 7.0.148 → 7.0.168 age confidence dependencies patch 7.0.170 (+1)
convex (source) 1.48.0 → 1.49.0 age confidence dependencies minor
convex-helpers 0.1.128 → 0.1.134 age confidence dependencies patch 0.1.135
convex-test (source) 0.0.57 → 0.0.69 age confidence devDependencies patch 0.0.70
dotenv 18.0.8 → 18.0.10 age confidence devDependencies patch
effect (source) 4.1.2 → 4.1.3 age confidence devDependencies patch 4.1.4
firecrawl 4.50.0 → 4.52.0 age confidence dependencies minor
guarded-fetch>undici (source) 7.30.1 → 8.12.4 age confidence pnpm-workspace.overrides major
hls.js 1.7.3 → 1.7.4 age confidence dependencies patch
lucide-react (source) 1.61.0 → 1.71.0 age confidence dependencies minor 1.72.0
mediabunny (source) 1.62.0 → 1.65.2 age confidence dependencies minor
node (source) 24 → 26 age confidence major
node 24.x → 26.x age confidence uses-with major
openai 7.40.0 → 7.55.0 age confidence dependencies minor
playwright-core (source) 1.64.1 → 1.65.0 age confidence dependencies minor
pnpm (source) 12.15.0+sha512.b3951d6d6ff4a9f13dc7cf56cd28d2b8eb37dbcc9c68e52e1e1191873ea9f82a017287ab50baadc5ccc494f036c67c0e47eb13608c2fa36f47711b61ea128e61 → 12.18.0 age confidence packageManager minor
pnpm/action-setup (changelog) 0977fd9 → 73e4699 action digest
posthog-js (source) 1.438.13 → 1.447.9 age confidence dependencies minor 1.447.12 (+2)
shadcn (source) 4.22.1 → 4.23.0 age confidence devDependencies minor
tailwindcss (source) 4.3.3 → 4.3.5 age confidence dependencies patch
typegpu (source) 0.12.8 → 0.12.10 age confidence dependencies patch
unplugin-typegpu (source) 0.12.6 → 0.12.8 age confidence devDependencies patch
vite (source) 1.3.0 → 1.5.1 age confidence pnpm.catalog.default minor 1.6.0
vite-plus (source) 1.3.0 → 1.5.1 age confidence pnpm.catalog.default minor 1.6.0

Release Notes

vercel/ai (@​ai-sdk/mcp)

v2.0.95

Compare Source

Patch Changes
  • 88b9575: Require a DNS-pinned fetch for untrusted MCP OAuth discovery and metadata-derived token/registration URLs on server runtimes without a protected default transport. Preserve developer-configured endpoints and allow explicitly supplied fetch implementations that provide equivalent connect-time validation. Browser workers without a DOM follow the same explicit custom-fetch requirement.
  • Updated dependencies [88b9575]

v2.0.93

Compare Source

Patch Changes
  • dc0f7f2: Prevent newly registered OAuth clients from supplying an authorization server binding for existing unbound refresh tokens. Clear unbound tokens before saving new registration information, and stop authorization if they remain in storage.
  • Updated dependencies [6400cf8]
  • Updated dependencies [f608c05]
  • Updated dependencies [cab9c1f]
  • Updated dependencies [c70adf6]

v2.0.92

Compare Source

Patch Changes
  • ae13fce: fix(mcp): include the canonical MCP resource in OAuth authorization, code exchange, and refresh requests when protected resource metadata is unavailable or custom resource validation returns undefined, preventing unbound authorization grants.

v2.0.91

Compare Source

Patch Changes

v2.0.90

Compare Source

Patch Changes

v2.0.89

Compare Source

Patch Changes

v2.0.88

Compare Source

Patch Changes

  • c3af430: Handle MCP 2026-07-28 input-required results through the registered elicitation handler and retry the original tool, prompt, or resource request with its answers and request state.

    Preserve the browser fetch receiver in MCP HTTP and SSE transports to prevent illegal-invocation errors.

  • 1afa510: Graduate StdioMCPTransport, MCPClient.listPrompts, MCPClient.getPrompt, and MCPAppRenderer to stable APIs. Deprecate their experimental names while retaining them as compatible aliases. MCP events remain experimental.

  • Updated dependencies [7716e18]

  • Updated dependencies [5c247e9]

  • Updated dependencies [dcd2f8d]

v2.0.87

Compare Source

Patch Changes

v2.0.86

Compare Source

Patch Changes
  • ade2a33: Improve unsupported-version discovery errors when a server advertises a compatible legacy version. Include the requested and advertised versions and explain how to explicitly select legacy initialization with protocolVersionDiscovery: false, while preserving the original error details and avoiding automatic legacy fallback.
  • Updated dependencies [57086ff]
  • Updated dependencies [95348b3]

v2.0.85

Compare Source

Patch Changes

v2.0.84

Compare Source

Patch Changes
  • 84d7880: Fix MCP tool output conversion throwing on primitive or nullish results returned by output schemas or execute wrappers. Convert strings to text and normalize undefined outputs to JSON null while preserving MCP content conversion.
  • e729d58: chore(docs): update README.md for consistent format and to avoid duplication
  • Updated dependencies [5475347]
  • Updated dependencies [e729d58]

v2.0.83

Compare Source

Patch Changes

v2.0.82

Compare Source

Patch Changes
vercel/ai (@​ai-sdk/provider)

v4.0.37

Compare Source

Patch Changes
  • c70adf6: Fix TypeSafe decision requests with primitive JSON state by serializing those values as text, reject empty criteria and null or undefined Score levels before sending a request, and expose structured Score legends in provider metadata. Allow omitted or null Box instructions and null Boolean criteria in experimental decision question types.

v4.0.36

Compare Source

Patch Changes

  • 36802d4: Support native URL transcription with an optional provider capability, keeping existing file-generation contracts unchanged. Groq sends HTTP(S) audio URLs through its url parameter without downloading and re-uploading them, avoiding the attachment upload limit. Supplying a custom download function retains local download behavior.

    For telemetry integrations, TranscriptionEndEvent.audio.byteLength and audio.mediaType can now be undefined when a provider fetches the audio URL natively. Check for missing values before using them as a number or string. Downloaded and inline audio continue to report their metadata; streaming transcription metadata is unchanged.

    Strip media fragments before sending URLs to Groq. If Groq rejects a redirect, fall back to the existing secure local downloader and file upload rather than failing previously working URL inputs. Other provider errors are preserved.

  • e0143b0: feat(ai): support provider-owned realtime transports

    Add an optional createTransport interface and provider connection capability.

  • 934100c: Report the actual OpenAI Chat HTTP endpoint (also used by Azure Chat and Bedrock Mantle Chat) through optional request metadata and model-call end events. Record its host and port on OpenTelemetry chat spans without exposing URL credentials, paths, queries, or fragments. Expose only the sanitized HTTP origin in text and object generation results and step/finish callbacks. Providers that do not report an endpoint leave these attributes unset.

  • 892af4d: feat (provider): add server-side realtime extensions to the experimental RealtimeModelV4 spec

    Extends the existing optional getServerWebSocketConfig() method and a normalized usage field so a trusted server/proxy can drive realtime providers the way it drives HTTP language models:

    • getServerWebSocketConfig({ intent? }) returns the upstream WebSocket { url, headers, protocols? } for a server-initiated connection (header auth with the long-lived credential). Providers fail fast for unsupported endpoint intents instead of silently falling back. It is the server-side sibling of the browser-only getWebSocketConfig.
    • serializeClientEvent and buildSessionConfig now accept the same optional intent so server-side callers can keep endpoint selection and session serialization aligned.
    • New RealtimeModelV4Usage type and optional usage on response-done, input-transcription-completed, and provider custom snapshot events. Gross totals and known modality buckets remain separate, and duration is reported as seconds. Counts are gross (cache-inclusive) with cached portions reported separately so consumers can apply their own billing split without re-parsing raw.
    • New RealtimeModelV4ServerConnection and RealtimeModelV4SessionIntent types, exported with the Experimental_ prefix.

  • 41465fd: Expose optional transcription word timings separately from segments and accept shared timestampGranularities. Explicit provider timing settings take precedence. OpenAI now sends timestamp_granularities only with verbose_json and warns when a requested timing is unavailable or excluded.

  • 9754014: Add typed streaming heartbeat parts. Anthropic emits them only with includePings: true (disabled by default), without requiring raw chunks. Core forwards pings through stream retries without storing them as generated content or sending them to UI message streams. Consumers with exhaustive stream-part switches must handle the new ping union variant when upgrading, even when the opt-in is disabled. Typed pings do not flush partial words during stream smoothing.

  • 4bb73b0: Add optional video, reranking and decision sections to model capability catalogs, including support for declaring provider options for these operations.

  • 2e44144: Represent videos delivered directly to caller-managed storage with an explicit uploaded outcome. Video generation reports uploadedVideos without downloading or synthesizing video bytes; access video only when videos is nonempty.

v4.0.35

Compare Source

Patch Changes
  • dcd2f8d: Introduce a model entry contract with named capability sections and request configuration. Consolidate the OpenAI and Anthropic model catalogs so existing request behavior and generated capability documentation use the same source of truth. Catalogs also declare the provider options each provider accepts and which models support them.

v4.0.34

Compare Source

Patch Changes
  • 5475347: Fix non-streaming Responses API structured output failing when multiple assistant messages contain JSON. Providers can supply separate structured-output text for parsing, allowing OpenAI and Azure Responses models to select the last final_answer while preserving all generated content, annotations, conversation history, and token usage.
  • e729d58: chore(docs): update README.md for consistent format and to avoid duplication

v4.0.33

Compare Source

Patch Changes

  • 85d84a1: feat(provider): add experimental streaming speech model spec

    Adds Experimental_StreamingSpeechModelV4, a SpeechModelV4 extension with doStream() that takes the input text as a stream of text parts (each with an optional per-part voice and providerOptions) and returns a stream of audio parts, plus Experimental_-prefixed stream option, text part, part, result, and usage types. The stable SpeechModelV4 is unchanged.

v4.0.32

Compare Source

Patch Changes

  • 10026d1: Add the interrupted finish reason for provider streams that end without a completion signal. Preserve partial output without introducing an error solely for interruption, and stop tool execution, agent continuation, and automatic UI follow-ups for interrupted responses, including late tool results and approvals. Provider detection and emission will be added separately.

    Compatibility notice: Adding interrupted to the public finish-reason types can break type checking after upgrading, even though this is a patch release. Exhaustive switches (for example, using an assertNever fallback) and mappings such as Record<FinishReason, string> must handle the new value. Update any custom validation or application logic that assumes the existing set of finish reasons is exhaustive.

    When providers begin emitting interrupted, a stream ending without a completion signal will preserve partial output and report this finish reason without emitting an error solely for the interruption. Applications that need to detect incomplete responses should check finishReason === 'interrupted' as well as their existing error handling.

vercel/ai (@​ai-sdk/provider-utils)

v5.0.78

Compare Source

Patch Changes
  • 88b9575: Require a DNS-pinned fetch for untrusted MCP OAuth discovery and metadata-derived token/registration URLs on server runtimes without a protected default transport. Preserve developer-configured endpoints and allow explicitly supplied fetch implementations that provide equivalent connect-time validation. Browser workers without a DOM follow the same explicit custom-fetch requirement.

v5.0.76

Compare Source

Patch Changes
  • 6400cf8: Add resolveProviderOptions to parse provider options that a model accepts under several providerOptions keys, either as aliases (first) or merged in order (merge), and use it for the existing multi-key lookups in the OpenAI, OpenAI-compatible, Anthropic, Google, and Amazon Bedrock models. Resolution behavior for these models is unchanged.
  • f608c05: Reject HTTPS-to-HTTP redirects in validated downloads before requesting the insecure target, including when it matches a configured trusted origin.
  • cab9c1f: Return undefined instead of throwing when detectMediaType receives an unsupported topLevelType that matches an inherited object property.
  • Updated dependencies [c70adf6]

v5.0.75

Compare Source

Patch Changes

  • 89aff56: feat(provider-utils): add an experimental_binaryFields option to createJsonResponseHandler

    Providers whose JSON responses carry large base64 strings (images, files) can list their paths, e.g. createJsonResponseHandler(schema, { experimental_binaryFields: ['images[*]'] }). The body is then read as a stream and canonical base64 strings of 64 KiB and more are decoded to Uint8Array while they arrive, instead of holding about four copies of the body in memory (chunks, concatenated bytes, text, parsed string). rawValue, validation errors and APICallError.responseBody contain a short placeholder string instead of the data. Handlers without the option are unchanged. readResponseWithSizeLimit accepts an optional onChunk callback that receives each chunk instead of the chunks being collected.

  • Updated dependencies [36802d4]

  • Updated dependencies [e0143b0]

  • Updated dependencies [934100c]

  • Updated dependencies [892af4d]

  • Updated dependencies [41465fd]

  • Updated dependencies [9754014]

  • Updated dependencies [4bb73b0]

  • Updated dependencies [2e44144]

v5.0.74

Compare Source

Patch Changes

v5.0.73

Compare Source

Patch Changes
  • 51ca5b7: fix(provider-utils): support cross-realm Uint8Array and ArrayBuffer in uint8-utils and inline file data conversion
  • dc6f1c3: fix(provider-utils): decode base64 into a preallocated Uint8Array to avoid ~25x transient memory and long event-loop blocking on large files
  • 4ae6986: Add stringifyWithBigIntAndCycles for provider tool serialization that converts BigInt values to decimal strings and replaces ancestor cycles while preserving shared references and toJSON behavior.

v5.0.72

Compare Source

Patch Changes

  • 7716e18: Support promises and synchronous or asynchronous callbacks in provider API key and token settings. Resolve credentials per authenticated request while preserving existing authentication behavior and synchronous credential serialization.

    The experimental OpenAI Live getServerWebSocketConfig() method can now resolve asynchronously. Await its result before using the connection settings.

  • 5c247e9: feat(sandbox): add stat, listDirectory, and deleteFile to Experimental_SandboxSession, and specify that relative paths in every method resolve against the directory run and spawn start in

    The just-bash and Vercel Sandbox adapters implement the new methods. Both now resolve a relative workingDirectory for run and spawn against the sandbox's working directory, and the just-bash adapter rejects writes to a directory instead of replacing it with a file.

  • Updated dependencies [dcd2f8d]

v5.0.71

Compare Source

Patch Changes

  • 61a315e: fix: map the top-level reasoning option consistently across providers

    Providers now resolve reasoning the same way:

    1. A provider-specific reasoning setting in providerOptions is sent unchanged. OpenAI no longer drops providerOptions.openai.reasoningEffort values that are not in its list for the model, and Fireworks no longer rewrites providerOptions.fireworks.reasoningEffort. Fireworks also sends top-level reasoning values directly instead of rounding them to 'high' at most, except for model families known to reject 'none' (GPT-OSS, GLM-5.3, Muse Spark) or 'minimal' (Nemotron, Inkling).
    2. Otherwise, reasoning maps to the closest level the model supports, rounding down, and rounds up only when there is no lower level. For example, 'xhigh' now maps to 'high' instead of 'max' on Anthropic and Bedrock models without xhigh effort, and 'medium' maps to 'low' instead of 'high' on DeepSeek, Kimi K3, and Mistral GLM-5.3 models.
    3. 'none' on a model that cannot disable reasoning maps to the model's lowest level with a compatibility warning, instead of being dropped or sending a request the API rejects. This affects GPT-6 models without 'none', xAI grok-4.5 and later, Groq GPT-OSS, Kimi K3, Perplexity, QuiverAI, Bedrock OpenAI gpt-oss models, and Gemini 2.5 Pro (minimum thinking budget). Gemini 3 and Anthropic and Bedrock between_tools mappings now emit the compatibility warning too.

    mapReasoningToProviderEffort now accepts any reasoning value, returns an optional providerOptionsEffort unchanged, and rounds levels that are missing from the effort map to the closest supported level. mapReasoningToProviderBudget maps 'none' to the minimum reasoning budget, always returns a budget, and uses the default percentage for levels missing from budgetPercentages. OpenAICompatibleChatConfig adds an optional mapReasoning function for mapping the top-level reasoning option.

v5.0.70

Compare Source

Patch Changes
  • 57086ff: chore(provider-utils): export types for Experimental_SandboxSession's method inputs
  • 95348b3: feat(provider-utils): change Experimental_SandboxSession's spawn() method to support optional stdin arg for a process with writable input stream

v5.0.69

Compare Source

Patch Changes
  • e64ed82: use native Buffer base64 encoding when available. encoding a Uint8Array backed by a detached ArrayBuffer now throws a TypeError in runtimes with Buffer instead of returning an empty string

v5.0.68

Compare Source

Patch Changes

v5.0.67

Compare Source

Patch Changes

  • 8202f5b: feat(gateway): implement experimental streaming speech in the gateway provider

    GatewaySpeechModel implements Experimental_StreamingSpeechModelV4 and streams speech over the AI Gateway speech WebSocket (/speech-model, ai-gateway-speech.v1 subprotocol). @ai-sdk/provider-utils adds the experimental speech-stream envelope (experimental_parseSpeechStreamClientFrame, `experimental_serial

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/routine-updates branch from b403cdf to b6716f8 Compare October 30, 2026 21:54
@renovate
renovate Bot force-pushed the renovate/routine-updates branch from b6716f8 to 164dc84 Compare October 30, 2026 21:58
@renovate
renovate Bot force-pushed the renovate/routine-updates branch from 164dc84 to 79403ea Compare October 31, 2026 16:59
@renovate
renovate Bot force-pushed the renovate/routine-updates branch from 79403ea to f2ab70b Compare October 31, 2026 21:26
@renovate
renovate Bot force-pushed the renovate/routine-updates branch from f2ab70b to 02450af Compare October 31, 2026 21:28
@renovate
renovate Bot force-pushed the renovate/routine-updates branch from 02450af to 35ee46b Compare November 1, 2026 03:12
@renovate
renovate Bot force-pushed the renovate/routine-updates branch from 35ee46b to 4344271 Compare November 3, 2026 07:13
@renovate
renovate Bot force-pushed the renovate/routine-updates branch from 4344271 to d0de4a1 Compare November 6, 2026 10:48
@renovate
renovate Bot force-pushed the renovate/routine-updates branch from d0de4a1 to 12e22ab Compare November 6, 2026 11:06
@renovate
renovate Bot force-pushed the renovate/routine-updates branch from 12e22ab to 4f42ede Compare November 6, 2026 12:50
@renovate
renovate Bot force-pushed the renovate/routine-updates branch from 4f42ede to 9995559 Compare November 6, 2026 22:13
@renovate
renovate Bot force-pushed the renovate/routine-updates branch from 9995559 to f20eb4a Compare November 6, 2026 22:17
@renovate
renovate Bot force-pushed the renovate/routine-updates branch from f20eb4a to 2c5b5f2 Compare November 7, 2026 12:44
@renovate
renovate Bot force-pushed the renovate/routine-updates branch from 2c5b5f2 to ac6c2bd Compare November 7, 2026 12:54
@renovate
renovate Bot force-pushed the renovate/routine-updates branch from ac6c2bd to db33416 Compare November 7, 2026 13:52
@renovate
renovate Bot force-pushed the renovate/routine-updates branch from db33416 to a6f36c8 Compare November 8, 2026 04:12
@renovate
renovate Bot force-pushed the renovate/routine-updates branch from a6f36c8 to 5f785e8 Compare November 8, 2026 14:37
@renovate
renovate Bot force-pushed the renovate/routine-updates branch from 5f785e8 to 32cbba8 Compare November 8, 2026 19:30
@renovate
renovate Bot force-pushed the renovate/routine-updates branch from 32cbba8 to f8dcc52 Compare November 9, 2026 07:54
@renovate
renovate Bot force-pushed the renovate/routine-updates branch from f8dcc52 to dd315f3 Compare November 9, 2026 15:11
@renovate
renovate Bot force-pushed the renovate/routine-updates branch from dd315f3 to 6f22b19 Compare November 9, 2026 22:52
@renovate
renovate Bot force-pushed the renovate/routine-updates branch from 6f22b19 to d692169 Compare November 11, 2026 20:13
@renovate
renovate Bot force-pushed the renovate/routine-updates branch from d692169 to 0058c72 Compare November 11, 2026 20:21

This branch had an error being deployed

1 failed (outdated) deployment
preview — d6921698 Deployed Nov 11, 2026 by renovate[bot] via Deploy the preview #190
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants