Skip to content

deps(deps-dev): bump the npm-major group across 1 directory with 6 updates#487

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-major-85eb3bb50b
Open

deps(deps-dev): bump the npm-major group across 1 directory with 6 updates#487
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-major-85eb3bb50b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm-major group with 6 updates in the / directory:

Package From To
typescript 6.0.3 7.0.2
@types/node 25.9.3 26.1.1
@ai-sdk/openai-compatible 2.0.50 3.0.7
@arizeai/openinference-vercel 2.7.8 3.1.0
ai 6.0.205 7.0.20
@cloudflare/workers-types 4.20260615.1 5.20260710.1

Updates typescript from 6.0.3 to 7.0.2

Commits
Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.


Updates @types/node from 25.9.3 to 26.1.1

Commits

Updates @ai-sdk/openai-compatible from 2.0.50 to 3.0.7

Release notes

Sourced from @​ai-sdk/openai-compatible's releases.

@​ai-sdk/openai-compatible@​3.0.7

Patch Changes

  • Updated dependencies [0f93c57]
    • @​ai-sdk/provider@​4.0.3
    • @​ai-sdk/provider-utils@​5.0.7

@​ai-sdk/openai-compatible@​2.0.59

Patch Changes

  • Updated dependencies [e1af05f]
    • @​ai-sdk/provider@​3.0.14
    • @​ai-sdk/provider-utils@​4.0.38
Changelog

Sourced from @​ai-sdk/openai-compatible's changelog.

3.0.7

Patch Changes

  • Updated dependencies [0f93c57]
    • @​ai-sdk/provider@​4.0.3
    • @​ai-sdk/provider-utils@​5.0.7

3.0.6

Patch Changes

  • ac306ed: Fix StreamingToolCallTracker finalizing streaming tool calls on parsable partial JSON. Tool calls now only finalize during stream flush, restoring the behavior of #13137: a parsable argument buffer can still be the prefix of a longer argument string, so finalizing early could act on truncated tool inputs.
  • Updated dependencies [ac306ed]
    • @​ai-sdk/provider-utils@​5.0.6

3.0.5

Patch Changes

  • 5c5c0f5: Add experimental streaming transcription support for transcription models, including OpenAI gpt-realtime-whisper and xAI WebSocket STT.
  • Updated dependencies [5c5c0f5]
    • @​ai-sdk/provider@​4.0.2
    • @​ai-sdk/provider-utils@​5.0.5

3.0.4

Patch Changes

  • Updated dependencies [c6f5e62]
    • @​ai-sdk/provider-utils@​5.0.4

3.0.3

Patch Changes

  • Updated dependencies [8c616f0]
    • @​ai-sdk/provider-utils@​5.0.3

3.0.2

Patch Changes

  • Updated dependencies [0274f34]
    • @​ai-sdk/provider@​4.0.1
    • @​ai-sdk/provider-utils@​5.0.2

3.0.1

Patch Changes

... (truncated)

Commits

Updates @arizeai/openinference-vercel from 2.7.8 to 3.1.0

Commits

Updates ai from 6.0.205 to 7.0.20

Release notes

Sourced from ai's releases.

ai@7.0.20

Patch Changes

  • b9ac19f: Flush compressed Node.js response chunks as they are piped so UI message and text streams remain incremental in Express and Next.js.
  • a4186d6: Promote the repairToolCall option to stable, with a deprecated experimental_repairToolCall alias for backwards compatibility.

ai@7.0.19

Patch Changes

  • be7f05a: Add fingerprintTools and detectToolDrift to detect MCP tool-definition drift ("rug pull"). Pin a tool set's server-controlled fields (string description, input schema, title) at trust time with fingerprintTools, then diff later fetches with detectToolDrift to catch injected descriptions or widened schemas before passing tools to the model. Baseline storage and the drift response remain the app's responsibility.

  • ee55a07: Preserve tool approval signatures when approvals transition to responded.

  • aad737d: Use own-property checks when resolving per-tool approvals so tool names and approval ids that match inherited object properties (e.g. constructor, toString, valueOf, __proto__) are treated as unconfigured/absent.

    • @ai-sdk/policy-opa: wrapMcpTools builds its per-tool map with a null prototype and reads supplied approvals via an own-property check, and shadow guards its per-tool map lookup the same way.
    • ai: tool and tool-context lookups keyed by a model- or client-supplied name now go through an own-property check (getOwn), so a name matching an inherited object property resolves to "no such tool"/"unconfigured" instead of a prototype value. This covers the approval path (per-tool approval resolution and replay re-validation) as well as tool-call parsing, execution, streaming callbacks, and UI message conversion/validation. The human-in-the-loop approval matching (collectToolApprovals) and streaming tool-name maps are built with a null prototype so a client-supplied id that matches an inherited property no longer slips past the "unknown approval" / "tool call not found" guards.

  • 0f93c57: feat (video): support video (not just image) reference inputs in inputReferences for reference-to-video generation

  • Updated dependencies [e12411e]

  • Updated dependencies [5d894a7]

  • Updated dependencies [fdb6d5d]

  • Updated dependencies [0f93c57]

  • Updated dependencies [d25a084]

    • @​ai-sdk/gateway@​4.0.15
    • @​ai-sdk/provider@​4.0.3
    • @​ai-sdk/provider-utils@​5.0.7

ai@6.0.223

Patch Changes

  • Updated dependencies [a452291]
    • @​ai-sdk/gateway@​3.0.147

ai@6.0.222

Patch Changes

  • e1af05f: feat (video): support video (not just image) reference inputs in inputReferences for reference-to-video generation
  • Updated dependencies [2bfb16a]
  • Updated dependencies [34b5acc]
  • Updated dependencies [e1af05f]
  • Updated dependencies [1ce0d1c]
    • @​ai-sdk/gateway@​3.0.146
    • @​ai-sdk/provider@​3.0.14
    • @​ai-sdk/provider-utils@​4.0.38
Changelog

Sourced from ai's changelog.

7.0.20

Patch Changes

  • b9ac19f: Flush compressed Node.js response chunks as they are piped so UI message and text streams remain incremental in Express and Next.js.
  • a4186d6: Promote the repairToolCall option to stable, with a deprecated experimental_repairToolCall alias for backwards compatibility.

7.0.19

Patch Changes

  • be7f05a: Add fingerprintTools and detectToolDrift to detect MCP tool-definition drift ("rug pull"). Pin a tool set's server-controlled fields (string description, input schema, title) at trust time with fingerprintTools, then diff later fetches with detectToolDrift to catch injected descriptions or widened schemas before passing tools to the model. Baseline storage and the drift response remain the app's responsibility.

  • ee55a07: Preserve tool approval signatures when approvals transition to responded.

  • aad737d: Use own-property checks when resolving per-tool approvals so tool names and approval ids that match inherited object properties (e.g. constructor, toString, valueOf, __proto__) are treated as unconfigured/absent.

    • @ai-sdk/policy-opa: wrapMcpTools builds its per-tool map with a null prototype and reads supplied approvals via an own-property check, and shadow guards its per-tool map lookup the same way.
    • ai: tool and tool-context lookups keyed by a model- or client-supplied name now go through an own-property check (getOwn), so a name matching an inherited object property resolves to "no such tool"/"unconfigured" instead of a prototype value. This covers the approval path (per-tool approval resolution and replay re-validation) as well as tool-call parsing, execution, streaming callbacks, and UI message conversion/validation. The human-in-the-loop approval matching (collectToolApprovals) and streaming tool-name maps are built with a null prototype so a client-supplied id that matches an inherited property no longer slips past the "unknown approval" / "tool call not found" guards.

  • 0f93c57: feat (video): support video (not just image) reference inputs in inputReferences for reference-to-video generation

  • Updated dependencies [e12411e]

  • Updated dependencies [5d894a7]

  • Updated dependencies [fdb6d5d]

  • Updated dependencies [0f93c57]

  • Updated dependencies [d25a084]

    • @​ai-sdk/gateway@​4.0.15
    • @​ai-sdk/provider@​4.0.3
    • @​ai-sdk/provider-utils@​5.0.7

7.0.18

Patch Changes

  • Updated dependencies [ac306ed]
    • @​ai-sdk/provider-utils@​5.0.6
    • @​ai-sdk/gateway@​4.0.14

7.0.17

Patch Changes

  • Updated dependencies [cad8227]
    • @​ai-sdk/gateway@​4.0.13

7.0.16

Patch Changes

  • a8f9b6d: Preserve signed tool approval metadata when recording approval responses.

7.0.15

... (truncated)

Commits

Updates @cloudflare/workers-types from 4.20260615.1 to 5.20260710.1

Commits

@dependabot @github

dependabot Bot commented on behalf of github Jul 8, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies, npm. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/npm-major-85eb3bb50b branch 5 times, most recently from 259fb2b to a708d67 Compare July 10, 2026 14:27
@dependabot
deps(deps-dev): bump the npm-major group across 1 directory with 6 up…
f7108e1 
…dates

Bumps the npm-major group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [typescript](https://github.com/microsoft/TypeScript) | `6.0.3` | `7.0.2` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.9.3` | `26.1.1` |
| [@ai-sdk/openai-compatible](https://github.com/vercel/ai/tree/HEAD/packages/openai-compatible) | `2.0.50` | `3.0.7` |
| [@arizeai/openinference-vercel](https://github.com/Arize-ai/openinference) | `2.7.8` | `3.1.0` |
| [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai) | `6.0.205` | `7.0.20` |
| [@cloudflare/workers-types](https://github.com/cloudflare/workerd) | `4.20260615.1` | `5.20260710.1` |



Updates `typescript` from 6.0.3 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](https://github.com/microsoft/TypeScript/commits)

Updates `@types/node` from 25.9.3 to 26.1.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@ai-sdk/openai-compatible` from 2.0.50 to 3.0.7
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/openai-compatible/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/openai-compatible@3.0.7/packages/openai-compatible)

Updates `@arizeai/openinference-vercel` from 2.7.8 to 3.1.0
- [Release notes](https://github.com/Arize-ai/openinference/releases)
- [Commits](https://github.com/Arize-ai/openinference/commits/python-openinference-instrumentation-llama-index-v3.1.0)

Updates `ai` from 6.0.205 to 7.0.20
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/ai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/ai@7.0.20/packages/ai)

Updates `@cloudflare/workers-types` from 4.20260615.1 to 5.20260710.1
- [Release notes](https://github.com/cloudflare/workerd/releases)
- [Changelog](https://github.com/cloudflare/workerd/blob/main/RELEASE.md)
- [Commits](https://github.com/cloudflare/workerd/commits)

---
updated-dependencies:
- dependency-name: "@ai-sdk/openai-compatible"
  dependency-version: 3.0.6
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-major
- dependency-name: "@arizeai/openinference-vercel"
  dependency-version: 3.1.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-major
- dependency-name: "@cloudflare/workers-types"
  dependency-version: 5.20260708.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-major
- dependency-name: "@types/node"
  dependency-version: 26.1.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-major
- dependency-name: ai
  dependency-version: 7.0.18
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-major
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/npm-major-85eb3bb50b branch from a708d67 to f7108e1 Compare July 10, 2026 16:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants