Skip to content

build(deps): bump the compatible-updates group across 1 directory with 6 updates - #8

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/code-review-bot/compatible-updates-6f54e6a775
Closed

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/code-review-bot/compatible-updates-6f54e6a775

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 31, 2026

Copy link
Copy Markdown

Bumps the compatible-updates group with 6 updates in the /code-review-bot directory:

Package From To
@ai-sdk/mcp 1.0.59 1.0.66
@ai-sdk/openai 3.0.81 3.0.90
ai 6.0.220 6.0.238
@types/node 24.10.0 24.13.3
@types/react 19.2.7 19.2.17
eslint 9.39.1 9.39.5

Updates @ai-sdk/mcp from 1.0.59 to 1.0.66

Changelog

Sourced from @​ai-sdk/mcp's changelog.

1.0.66

Patch Changes

  • e8d2654: Honor MCP request deadlines and support bounding or aborting client initialization.

1.0.65

Patch Changes

  • Updated dependencies [9ecdefe]
    • @​ai-sdk/provider-utils@​4.0.41

1.0.64

Patch Changes

  • a3bc948: fix(mcp): accept OAuth metadata without code challenge methods

1.0.63

Patch Changes

  • Updated dependencies [19093fd]
    • @​ai-sdk/provider-utils@​4.0.40

1.0.62

Patch Changes

  • Updated dependencies [06fb54c]
    • @​ai-sdk/provider-utils@​4.0.39

1.0.61

Patch Changes

  • Updated dependencies [e1af05f]
    • @​ai-sdk/provider@​3.0.14
    • @​ai-sdk/provider-utils@​4.0.38

1.0.60

Patch Changes

  • 937d731: Reject in-flight MCP requests when their abort signal fires and remove the pending response handler.
  • 2b6c67f: Prevent streamable HTTP MCP background SSE disconnects from surfacing as unhandled promise rejections.
  • Updated dependencies [d559de9]
    • @​ai-sdk/provider-utils@​4.0.37
Commits

Updates @ai-sdk/openai from 3.0.81 to 3.0.90

Changelog

Sourced from @​ai-sdk/openai's changelog.

3.0.90

Patch Changes

  • Updated dependencies [9ecdefe]
    • @​ai-sdk/provider-utils@​4.0.41

3.0.89

Patch Changes

  • 23632b1: Add blocked domain filters to the OpenAI and Azure Responses API web search tools.

3.0.88

Patch Changes

  • 8100830: Apply reasoning, service tier, and image defaults to recognizable future OpenAI model family versions.

3.0.87

Patch Changes

  • 2f11af1: Preserve stored tool search output item IDs from provider metadata.

3.0.86

Patch Changes

  • Updated dependencies [19093fd]
    • @​ai-sdk/provider-utils@​4.0.40

3.0.85

Patch Changes

  • Updated dependencies [06fb54c]
    • @​ai-sdk/provider-utils@​4.0.39

3.0.84

Patch Changes

  • 356918c: feat(provider/openai): add GPT-5.6 reasoning and prompt cache controls

3.0.83

Patch Changes

  • 34b5acc: feat(provider/openai,provider/gateway): add gpt-5.6 model ids

... (truncated)

Commits

Updates ai from 6.0.220 to 6.0.238

Changelog

Sourced from ai's changelog.

6.0.238

Patch Changes

  • 9ecdefe: Prevent validated downloads on Node.js from reaching private or internal services through DNS aliases or DNS rebinding by validating and pinning every resolved address at connection time.
  • 26d10c0: support overriding model call settings for individual prepareStep invocations
  • 7767170: Preserve provider metadata from empty text deltas in streamText.
  • Updated dependencies [9ecdefe]
  • Updated dependencies [87fb433]
    • @​ai-sdk/provider-utils@​4.0.41
    • @​ai-sdk/gateway@​3.0.160

6.0.237

Patch Changes

  • f6020d7: Avoid synthesizing client tool errors for invalid provider-executed tool calls.
  • Updated dependencies [de438f5]
    • @​ai-sdk/gateway@​3.0.159

6.0.236

Patch Changes

  • Updated dependencies [8418710]
    • @​ai-sdk/gateway@​3.0.158

6.0.235

Patch Changes

  • Updated dependencies [5d7b986]
    • @​ai-sdk/gateway@​3.0.157

6.0.234

Patch Changes

  • 1efdef8: fix(ai): bound media-type sniffing decode for ID3-prefixed input

    Media-type detection stripped ID3 tags before the ~18-byte prefix cap, decoding the entire base64 attachment (plus a full-size copy) whenever the data began with ID3/SUQz. This turned the intended O(1) sniff into an O(N) decode of the whole attachment. Detection now decodes at most a bounded prefix and skips the ID3 tag within that bound, keeping cost O(1) in input size on all paths (image, audio, and combined).

  • 49414cf: Return response piping promises so callers can catch stream read and write errors.

  • Updated dependencies [e7d064f]

    • @​ai-sdk/gateway@​3.0.156

6.0.233

Patch Changes

... (truncated)

Commits
  • 006a2f8 Version Packages (#18089)
  • 2deee5b v6.0: docs: clarify generateText text aggregation and empty-string behavior (...
  • 26d10c0 [v6.0] feat: support per-step model call setting overrides in prepareStep (#1...
  • 9ecdefe [v6] fix(provider-utils): prevent DNS alias SSRF in validated downloads (#18095)
  • 7767170 [v6.0] fix: preserve provider metadata from empty streamText text deltas (#18...
  • 98d8c43 Version Packages (#18028)
  • f6020d7 [v6.0] fix: prevent orphaned Anthropic tool results after invalid provider-ex...
  • 8e4c560 [v6.0] docs: clarify that textStream does not surface error parts (#18001)
  • 0226bf6 Version Packages (#17981)
  • 07edaea Version Packages (#17825)
  • Additional commits viewable in compare view

Updates @types/node from 24.10.0 to 24.13.3

Commits

Updates @types/react from 19.2.7 to 19.2.17

Commits

Updates eslint from 9.39.1 to 9.39.5

Release notes

Sourced from eslint's releases.

v9.39.5

Bug Fixes

Documentation

  • 74930ed docs: switch build to Node.js 24 (#20894) (Milos Djermanovic)
  • eaec8bb docs: Add ESLint v9.x EOL notice (#20828) (Milos Djermanovic)

Chores

  • 458205f chore: update @eslint/eslintrc and @eslint/js for v9.39.5 (#21077) (Francesco Trotta)
  • 202117b chore: package.json update for @​eslint/js release (Jenkins)
  • d9eb6ed test: disable warning for vm.constants.USE_MAIN_CONTEXT_DEFAULT_LOADER (#21074) (Francesco Trotta)
  • 7b431a7 chore: override re2 dependency for @metascraper/helpers (#21068) (Milos Djermanovic)
  • daf7791 chore: pin fflate@0.8.2 (#20895) (Milos Djermanovic)
  • daee8ba ci: use pnpm in eslint-flat-config-utils type integration test (#20829) (Milos Djermanovic)
  • 116d4be ci: unpin Node.js 25.x in CI (#20619) (Copilot)

v9.39.4

Bug Fixes

  • f18f6c8 fix: update dependency minimatch to ^3.1.5 (#20564) (Milos Djermanovic)
  • a3c868f fix: update dependency @​eslint/eslintrc to ^3.3.4 (#20554) (Milos Djermanovic)
  • 234d005 fix: minimatch security vulnerability patch for v9.x (#20549) (Andrej Beles)
  • b1b37ee fix: update ajv to 6.14.0 to address security vulnerabilities (#20538) (루밀LuMir)

Documentation

  • 4675152 docs: add deprecation notice partial (#20520) (Milos Djermanovic)

Chores

  • b8b4eb1 chore: update dependencies for ESLint v9.39.4 (#20596) (Francesco Trotta)
  • 71b2f6b chore: package.json update for @​eslint/js release (Jenkins)
  • 1d16c2f ci: pin Node.js 25.6.1 (#20563) (Milos Djermanovic)

v9.39.3

Bug Fixes

  • 791bf8d fix: restore TypeScript 4.0 compatibility in types (#20504) (sethamus)

Chores

  • 8594a43 chore: upgrade @​eslint/js@​9.39.3 (#20529) (Milos Djermanovic)
  • 9ceef92 chore: package.json update for @​eslint/js release (Jenkins)
  • af498c6 chore: ignore /docs/v9.x in link checker (#20453) (Milos Djermanovic)

v9.39.2

Bug Fixes

  • 5705833 fix: warn when eslint-env configuration comments are found (#20381) (sethamus)

Build Related

  • 506f154 build: add .scss files entry to knip (#20391) (Milos Djermanovic)

Chores

  • 7ca0af7 chore: upgrade to @eslint/js@9.39.2 (#20394) (Francesco Trotta)

... (truncated)

Commits


View with [code]smith Autofix with [code]smith
Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 31, 2026
@greptile-apps

greptile-apps Bot commented Jul 31, 2026

Copy link
Copy Markdown

Greptile Summary

Updates six compatible dependencies in the code-review-bot example.

  • Bumps the Vercel AI SDK, OpenAI provider, and MCP packages to newer patch releases.
  • Updates Node.js and React type definitions and ESLint.
  • Regenerates the pnpm lockfile with consistent peer and transitive dependency resolutions.

Confidence Score: 5/5

The dependency updates appear safe to merge, with no concrete compatibility, build, lint, or security failure identified.

The updated packages remain within compatible peer ranges, and the lockfile consistently resolves the AI SDK, TypeScript declaration, ESLint, Next.js, and harness integration dependency graph.

Important Files Changed

Filename Overview
code-review-bot/package.json Updates six dependencies within compatible release lines; declared engine and peer requirements remain satisfied.
code-review-bot/pnpm-lock.yaml Regenerates the dependency graph consistently for the updated direct and transitive package versions.

Reviews (1): Last reviewed commit: "Bump the compatible-updates group across..." | Re-trigger Greptile

…h 6 updates

Bumps the compatible-updates group with 6 updates in the /code-review-bot directory:

| Package | From | To |
| --- | --- | --- |
| [@ai-sdk/mcp](https://github.com/vercel/ai/tree/HEAD/packages/mcp) | `1.0.59` | `1.0.66` |
| [@ai-sdk/openai](https://github.com/vercel/ai/tree/HEAD/packages/openai) | `3.0.81` | `3.0.90` |
| [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai) | `6.0.220` | `6.0.238` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `24.10.0` | `24.13.3` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.7` | `19.2.17` |
| [eslint](https://github.com/eslint/eslint) | `9.39.1` | `9.39.5` |



Updates `@ai-sdk/mcp` from 1.0.59 to 1.0.66
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/@ai-sdk/mcp@1.0.66/packages/mcp/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/mcp@1.0.66/packages/mcp)

Updates `@ai-sdk/openai` from 3.0.81 to 3.0.90
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/@ai-sdk/openai@3.0.90/packages/openai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/openai@3.0.90/packages/openai)

Updates `ai` from 6.0.220 to 6.0.238
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/ai@6.0.238/packages/ai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/ai@6.0.238/packages/ai)

Updates `@types/node` from 24.10.0 to 24.13.3
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@types/react` from 19.2.7 to 19.2.17
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `eslint` from 9.39.1 to 9.39.5
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v9.39.1...v9.39.5)

---
updated-dependencies:
- dependency-name: "@ai-sdk/mcp"
  dependency-version: 1.0.64
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: compatible-updates
- dependency-name: "@ai-sdk/openai"
  dependency-version: 3.0.88
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: compatible-updates
- dependency-name: "@types/node"
  dependency-version: 24.13.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: compatible-updates
- dependency-name: "@types/react"
  dependency-version: 19.2.17
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: compatible-updates
- dependency-name: ai
  dependency-version: 6.0.236
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: compatible-updates
- dependency-name: eslint
  dependency-version: 9.39.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: compatible-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title Bump the compatible-updates group across 1 directory with 6 updates build(deps): bump the compatible-updates group across 1 directory with 6 updates Aug 2, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/code-review-bot/compatible-updates-6f54e6a775 branch from 3b79ba8 to 3a43b02 Compare August 2, 2026 20:19
@dependabot @github

dependabot Bot commented on behalf of github Aug 6, 2026

Copy link
Copy Markdown
Author

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

@dependabot @github

dependabot Bot commented on behalf of github Aug 13, 2026

Copy link
Copy Markdown
Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Aug 13, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/code-review-bot/compatible-updates-6f54e6a775 branch August 13, 2026 17:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants