Skip to content

build(deps): bump undici, @ai-sdk/openai-compatible, @ai-sdk/react and ai - #263

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-8ad764de5e
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-8ad764de5e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 18, 2026

Copy link
Copy Markdown
Contributor

Bumps undici to 7.29.1 and updates ancestor dependencies undici, @ai-sdk/openai-compatible, @ai-sdk/react and ai. These dependencies need to be updated together.

Updates undici from 5.29.0 to 7.29.1

Release notes

Sourced from undici's releases.

v7.29.1

⚠️ Security fixes

High severity

  • GHSA-w293-vg96-wgc3: BalancedPool could drop function-valued connection options while cloning its configuration, including custom TLS certificate validation callbacks. Undici now preserves connect and legacy tls options when creating upstreams. Fixed by f690157d.
  • GHSA-rfgv-xxqx-mfg5: a WebSocket server could select a subprotocol when none was requested, causing an uncaught TypeError that could terminate the process. Undici now rejects the handshake with protocol error 1002. Fixed by 6615e017.

Medium severity

  • GHSA-3wwx-pv8p-q78v: a malformed permessage-deflate payload exceeding the configured decompression limit could emit an unhandled zlib error and terminate the process. Undici now destroys the inflater after reaching the limit. Fixed by 63cf698b.
  • GHSA-rx4f-c7p8-82vq: an unclean WebSocketStream close could create an unobserved rejected promise when its writable stream was locked, potentially terminating the process. Undici now propagates the failure through the retained writable stream controller. Fixed by 1858656e.
  • GHSA-2jfj-6hjv-fm6j: shared caches could store and replay responses containing Set-Cookie, disclosing one user's cookies to another caller. Undici now excludes these responses from shared caches, including existing entries and revalidation paths. Fixed by b6c5a002.
  • GHSA-3xpg-4rpp-hhhm: the decompression interceptor did not bound decoded output, allowing compressed responses to consume excessive memory. Undici now limits every decompression stage to 64 MiB by default and supports a configurable maxSize. Fixed by 2c7d7e12.
  • GHSA-pmjh-fq2x-6v4x: a terminal retry failure after response headers were exposed could orphan the original response body, causing consumers to hang indefinitely. Undici now propagates the terminal error to the exposed body. Fixed by 3c672659.

Low severity

  • GHSA-8436-99hf-9mmv: cache interceptors could store and replay responses to unsafe HTTP methods such as POST or DELETE. Undici now restricts cache reads and writes to safe methods while preserving invalidation by successful unsafe requests. Fixed by b61d9432.
  • GHSA-2gqq-gqf2-x968: the dump interceptor could treat an oversized chunked response as successfully truncated when no Content-Length was present. Undici now enforces maxSize against received bytes and aborts oversized responses. Fixed by 21693f40.
  • GHSA-r53p-7pc4-xj5r: the retry interceptor could concatenate a resumed response with inconsistent framing into downstream output, enabling response splitting or corruption. Undici now validates Content-Range against the original response framing before resuming. Fixed by cd8af90b.

What's Changed

Full Changelog: nodejs/undici@v7.29.0...v7.29.1

v7.29.0

⚠️ Security fixes

High severity

  • GHSA-4cwx-7wf7-3272: malformed qualified private Cache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crash. The cache parser now treats empty qualified directives conservatively and safely handles mixed qualified and unqualified directives. Fixed by 9f10f1e9, with regression coverage in 466e99d1.

Medium severity

  • GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 33928bc2.
  • GHSA-jr45-8vmc-qm54: optional whitespace around = in qualified no-cache and private directives could bypass shared-cache restrictions and disclose authenticated data across users. Cache-Control parsing now normalizes these forms and applies conservative cache decisions. Fixed by 98011a86.
  • GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by 1b5a5312, with corrected fixtures in 4a9dafb1.
  • GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by 3bf91ddb.

... (truncated)

Commits
  • d39a83e Bumped v7.29.1 (#5772)
  • 0d88464 fix(test): remove unused EventEmitter import
  • f57411b perf(h1): drop idle-socket timer floor with a ref'd setImmediate (#5707) (#5769)
  • 3c67265 fix(retry): settle exposed body on terminal failure
  • cd8af90 fix(retry): validate resumed response framing
  • 6615e01 fix(websocket): reject unrequested subprotocols
  • 2c7d7e1 fix(decompress): limit decompressed response size
  • b6c5a00 fix(cache): do not cache Set-Cookie in shared caches
  • 21693f4 fix(interceptor/dump): abort oversized chunked responses
  • f690157 fix: preserve BalancedPool connection options
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for undici since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates @ai-sdk/openai-compatible from 1.0.53 to 3.0.52

Release notes

Sourced from @​ai-sdk/openai-compatible's releases.

@​ai-sdk/openai-compatible@​3.0.52

Patch Changes

  • Updated dependencies [0455398]
    • @​ai-sdk/provider-utils@​5.0.44
Changelog

Sourced from @​ai-sdk/openai-compatible's changelog.

3.0.52

Patch Changes

  • Updated dependencies [0455398]
    • @​ai-sdk/provider-utils@​5.0.44

3.0.51

Patch Changes

  • Updated dependencies [215b25e]
  • Updated dependencies [d4d96bf]
  • Updated dependencies [a7dd893]
  • Updated dependencies [3456e2c]
  • Updated dependencies [c4e76de]
    • @​ai-sdk/provider-utils@​5.0.43
    • @​ai-sdk/provider@​4.0.17

3.0.50

Patch Changes

  • 11b4c2d: fix(openai-compatible): extract streaming response metadata after placeholder chunks
  • Updated dependencies [91c2128]
  • Updated dependencies [2cd80b3]
  • Updated dependencies [d06bb2a]
  • Updated dependencies [123d71f]
  • Updated dependencies [2fa5e0e]
    • @​ai-sdk/provider-utils@​5.0.42
    • @​ai-sdk/provider@​4.0.16

3.0.49

Patch Changes

  • Updated dependencies [5c0054d]
  • Updated dependencies [39535af]
    • @​ai-sdk/provider@​4.0.15
    • @​ai-sdk/provider-utils@​5.0.41

3.0.48

Patch Changes

  • Updated dependencies [5ec21a6]
  • Updated dependencies [7469a3b]
  • Updated dependencies [813bb36]
  • Updated dependencies [c43e4b7]
    • @​ai-sdk/provider@​4.0.14

... (truncated)

Commits

Updates @ai-sdk/react from 2.0.256 to 4.0.109

Release notes

Sourced from @​ai-sdk/react's releases.

@​ai-sdk/react@​4.0.109

Patch Changes

  • Updated dependencies [4775577]
  • Updated dependencies [6696728]
  • Updated dependencies [09516a1]
  • Updated dependencies [1aef01e]
  • Updated dependencies [9c1ea74]
  • Updated dependencies [107343a]
  • Updated dependencies [03c3e33]
  • Updated dependencies [4b5cb49]
  • Updated dependencies [5d42ebd]
  • Updated dependencies [4a67783]
  • Updated dependencies [1058ed5]
  • Updated dependencies [84f5d1b]
  • Updated dependencies [2d53a5d]
  • Updated dependencies [2a5ed55]
  • Updated dependencies [0455398]
    • ai@7.0.106
    • @​ai-sdk/mcp@​2.0.53
    • @​ai-sdk/provider-utils@​5.0.44

@​ai-sdk/react@​3.0.289

Patch Changes

  • Updated dependencies [8a9722e]
  • Updated dependencies [6a0f2d9]
  • Updated dependencies [db02971]
  • Updated dependencies [4d91999]
  • Updated dependencies [b2ad994]
  • Updated dependencies [9c85bd4]
  • Updated dependencies [becaa32]
    • ai@6.0.286

@​ai-sdk/react@​2.0.263

Patch Changes

  • Updated dependencies [ab8aa35]
    • ai@5.0.260
Changelog

Sourced from @​ai-sdk/react's changelog.

4.0.109

Patch Changes

  • Updated dependencies [4775577]
  • Updated dependencies [6696728]
  • Updated dependencies [09516a1]
  • Updated dependencies [1aef01e]
  • Updated dependencies [9c1ea74]
  • Updated dependencies [107343a]
  • Updated dependencies [03c3e33]
  • Updated dependencies [4b5cb49]
  • Updated dependencies [5d42ebd]
  • Updated dependencies [4a67783]
  • Updated dependencies [1058ed5]
  • Updated dependencies [84f5d1b]
  • Updated dependencies [2d53a5d]
  • Updated dependencies [2a5ed55]
  • Updated dependencies [0455398]
    • ai@7.0.106
    • @​ai-sdk/mcp@​2.0.53
    • @​ai-sdk/provider-utils@​5.0.44

4.0.108

Patch Changes

  • Updated dependencies [6982e9d]
    • ai@7.0.105

4.0.107

Patch Changes

  • b0cfd5b: fix(react): allow unused realtime runtime code to be tree-shaken
  • Updated dependencies [215b25e]
  • Updated dependencies [d4d96bf]
  • Updated dependencies [a7dd893]
  • Updated dependencies [227f3b0]
  • Updated dependencies [3456e2c]
  • Updated dependencies [c4e76de]
    • @​ai-sdk/provider-utils@​5.0.43
    • ai@7.0.104
    • @​ai-sdk/provider@​4.0.17
    • @​ai-sdk/mcp@​2.0.52

4.0.106

Patch Changes

... (truncated)

Commits

Updates ai from 5.0.253 to 7.0.106

Release notes

Sourced from ai's releases.

ai@7.0.106

Patch Changes

  • 4775577: fix(ai): preserve provider metadata when simulating text streams
  • 6696728: fix(ai): report the prepareStep model in streamed step results
  • 09516a1: fix(ai): prevent unhandled rejections when UI message stream reading stops early
  • 1aef01e: fix(ai): preserve prototype-named properties in serialized tool outputs
  • 9c1ea74: fix(ai): close telemetry spans when provider response streams fail
  • 107343a: fix(ai): use the prepareStep-selected model for streamed response metadata fallbacks
  • 03c3e33: fix(ai): preserve tool calls required by retained pending approvals
  • 5d42ebd: fix(ai): skip input available callbacks for invalid streamed tool calls
  • 4a67783: fix(ai): cancel prompt attachment downloads when model calls are aborted or time out
  • 1058ed5: fix(ai): strip streamed JSON fences before arbitrary trailing whitespace
  • 84f5d1b: fix(ai): stream null and empty string JSON partial outputs
  • 2d53a5d: fix(ai): prevent onEnd after aborting a multi-step text stream
  • 2a5ed55: fix(ai): stream structured output from the final tool-loop step
  • Updated dependencies [4fdf51e]
  • Updated dependencies [0455398]
    • @​ai-sdk/gateway@​4.0.86
    • @​ai-sdk/provider-utils@​5.0.44

ai@6.0.286

Patch Changes

  • 8a9722e: fix(ai): preserve provider metadata when simulating text streams
  • 6a0f2d9: fix(ai): report the prepareStep model in streamed step results
  • db02971: fix(ai): prevent unhandled rejections when UI message stream reading stops early
  • 4d91999: fix(ai): preserve tool calls required by retained pending approvals
  • b2ad994: fix(ai): cancel prompt attachment downloads when model calls are aborted or time out
  • 9c85bd4: fix(ai): stream null and empty string JSON partial outputs
  • becaa32: fix(ai): stream structured output from the final tool-loop step

ai@5.0.260

Patch Changes

  • ab8aa35: fix(ai): preserve provider metadata when simulating text streams
Changelog

Sourced from ai's changelog.

7.0.106

Patch Changes

  • 4775577: fix(ai): preserve provider metadata when simulating text streams
  • 6696728: fix(ai): report the prepareStep model in streamed step results
  • 09516a1: fix(ai): prevent unhandled rejections when UI message stream reading stops early
  • 1aef01e: fix(ai): preserve prototype-named properties in serialized tool outputs
  • 9c1ea74: fix(ai): close telemetry spans when provider response streams fail
  • 107343a: fix(ai): use the prepareStep-selected model for streamed response metadata fallbacks
  • 03c3e33: fix(ai): preserve tool calls required by retained pending approvals
  • 5d42ebd: fix(ai): skip input available callbacks for invalid streamed tool calls
  • 4a67783: fix(ai): cancel prompt attachment downloads when model calls are aborted or time out
  • 1058ed5: fix(ai): strip streamed JSON fences before arbitrary trailing whitespace
  • 84f5d1b: fix(ai): stream null and empty string JSON partial outputs
  • 2d53a5d: fix(ai): prevent onEnd after aborting a multi-step text stream
  • 2a5ed55: fix(ai): stream structured output from the final tool-loop step
  • Updated dependencies [4fdf51e]
  • Updated dependencies [0455398]
    • @​ai-sdk/gateway@​4.0.86
    • @​ai-sdk/provider-utils@​5.0.44

7.0.105

Patch Changes

  • 6982e9d: Resolve evaluation model IDs through AI Gateway when no default provider is configured, including string aliases in custom providers.
  • Updated dependencies [6982e9d]
  • Updated dependencies [6982e9d]
    • @​ai-sdk/gateway@​4.0.85

7.0.104

Patch Changes

  • a7dd893: Add experimental evaluation model aliases and registry resolution. customProvider accepts evaluationModels, registries expose evaluationModel, and experimental_evaluate accepts string IDs when an evaluation-capable default provider is explicitly configured. Evaluation never implicitly falls back to Gateway. Model-resolution errors now identify evaluationModel while stable provider contracts remain unchanged.
  • 227f3b0: fix(ai): report abnormal realtime WebSocket close diagnostics through onError
  • 3456e2c: feat(ai): support tool search with direct tool calling
  • c4e76de: feat(ai): add native tool search tool
  • Updated dependencies [215b25e]
  • Updated dependencies [d4d96bf]
  • Updated dependencies [a7dd893]
  • Updated dependencies [3456e2c]
  • Updated dependencies [c4e76de]
    • @​ai-sdk/provider-utils@​5.0.43
    • @​ai-sdk/provider@​4.0.17
    • @​ai-sdk/gateway@​4.0.84

7.0.103

... (truncated)

Commits
  • b3033f7 Version Packages (#20979)
  • 107343a fix: use prepareStep model for streamed response metadata fallbacks (#21078)
  • 1aef01e fix: allow valid prototype-named properties in serialized tool outputs (#20937)
  • 2d53a5d fix: prevent streamText from calling onEnd after aborting a later step (#20919)
  • 6696728 fix: report the model selected by prepareStep in streamed step results and ca...
  • 5d42ebd fix: prevent invalid streamed tool input from reaching onInputAvailable (#20955)
  • 03c3e33 fix: preserve originating tool calls when pruning histories with pending appr...
  • 2a5ed55 fix: preserve structured output streaming when earlier tool steps emit text (...
  • 84f5d1b fix: preserve null and empty-string values in structured partial output strea...
  • 09516a1 fix: prevent unhandled rejections when UI message stream reading stops early ...
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

…d ai

Bumps [undici](https://github.com/nodejs/undici) to 7.29.1 and updates ancestor dependencies [undici](https://github.com/nodejs/undici), [@ai-sdk/openai-compatible](https://github.com/vercel/ai/tree/HEAD/packages/openai-compatible), [@ai-sdk/react](https://github.com/vercel/ai/tree/HEAD/packages/react) and [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai). These dependencies need to be updated together.


Updates `undici` from 5.29.0 to 7.29.1
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v5.29.0...v7.29.1)

Updates `@ai-sdk/openai-compatible` from 1.0.53 to 3.0.52
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/openai-compatible/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/openai-compatible@3.0.52/packages/openai-compatible)

Updates `@ai-sdk/react` from 2.0.256 to 4.0.109
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/react/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/react@4.0.109/packages/react)

Updates `ai` from 5.0.253 to 7.0.106
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/ai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/ai@7.0.106/packages/ai)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 7.29.1
  dependency-type: indirect
- dependency-name: "@ai-sdk/openai-compatible"
  dependency-version: 3.0.52
  dependency-type: direct:production
- dependency-name: "@ai-sdk/react"
  dependency-version: 4.0.109
  dependency-type: direct:production
- dependency-name: ai
  dependency-version: 7.0.106
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 18, 2026
@kinsta

kinsta Bot commented Sep 18, 2026

Copy link
Copy Markdown

Preview deployments for wdk-docs staging ⚡️

Status Branch preview Commit preview
✅ Ready Visit preview Visit preview

Commit: 9c3a252a7608271ad9872450e06c575f835a7c94

Deployment ID: 58918504-68b1-44a1-8893-1793e9b5e6b5

Static site name: wdk-docs-ve3eh

@kinsta

kinsta Bot commented Sep 18, 2026

Copy link
Copy Markdown

Preview deployments for wdk-docs prod ⚡️

Status Branch preview Commit preview
✅ Ready Visit preview Visit preview

Commit: 9c3a252a7608271ad9872450e06c575f835a7c94

Deployment ID: f09777bc-602a-402a-b6ce-ec57d32651e3

Static site name: wdk-docs-prod-pbpbt

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updated@​ai-sdk/​react@​2.0.256 ⏵ 4.0.10999 +110075 +398100
Updated@​ai-sdk/​openai-compatible@​1.0.53 ⏵ 3.0.5299 +910010098100
Updatedai@​5.0.253 ⏵ 7.0.10699 +110010099100

View full report

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants