fix(deps): update patch updates group - #283
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
renovate
Bot
force-pushed
the
renovate/patch-updates-group
branch
13 times, most recently
from
June 8, 2026 17:59
fd4a01a to
9b7fef3
Compare
renovate
Bot
force-pushed
the
renovate/patch-updates-group
branch
6 times, most recently
from
June 17, 2026 20:42
7d1ce27 to
4b33db1
Compare
renovate
Bot
force-pushed
the
renovate/patch-updates-group
branch
10 times, most recently
from
June 25, 2026 18:05
413eaf2 to
031de18
Compare
renovate
Bot
force-pushed
the
renovate/patch-updates-group
branch
from
June 26, 2026 15:51
031de18 to
fb612ad
Compare
renovate
Bot
force-pushed
the
renovate/patch-updates-group
branch
8 times, most recently
from
July 17, 2026 00:48
1217383 to
9c37cbe
Compare
renovate
Bot
force-pushed
the
renovate/patch-updates-group
branch
9 times, most recently
from
July 27, 2026 01:43
c6ace01 to
69298b2
Compare
renovate
Bot
force-pushed
the
renovate/patch-updates-group
branch
9 times, most recently
from
August 2, 2026 09:07
2d5ce8d to
9c679d8
Compare
renovate
Bot
force-pushed
the
renovate/patch-updates-group
branch
3 times, most recently
from
August 4, 2026 13:48
f9b7aa5 to
3bba99d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
3.0.30→3.0.608.3.17→8.3.188.3.17→8.3.188.3.17→8.3.188.3.17→8.3.188.3.17→8.3.180.10.32→0.10.352.0.3→2.0.42.0.3→2.0.414.6.1→14.6.63.7.1→3.7.519.2.14→19.2.1819.2.3→19.2.43.2.4→3.2.73.2.4→3.2.76.0.128→6.0.2646.2.1→6.2.104.3.2→4.3.34.3.2→4.3.38.5.8→8.5.2619.2.4→19.2.819.2.4→19.2.87.3.1→7.3.65.0.12→5.0.15Release Notes
vercel/ai (@ai-sdk/groq)
v3.0.60Compare Source
Patch Changes
31205a4]v3.0.59Compare Source
Patch Changes
b2a4d5a]v3.0.58Compare Source
Patch Changes
2171d15]v3.0.57Compare Source
Patch Changes
dab0a08]v3.0.56Compare Source
Patch Changes
ee2bf30]v3.0.55Compare Source
Patch Changes
ae2812a: fix(groq): map word timestamps to transcription segments when segment timestamps are unavailablecc3269f: Support plain-text responses from Groq transcription models whenresponseFormatis set totext.v3.0.54Compare Source
Patch Changes
9ecdefe]v3.0.53Compare Source
Patch Changes
19093fd]v3.0.52Compare Source
Patch Changes
06fb54c]v3.0.51Compare Source
Patch Changes
cee7e45: fix (provider/groq): surface prompt cache reads in usageconvertGroqUsageacceptedprompt_tokens_details.cached_tokensbut never read it, so cache hits were reported ascacheRead: undefinedand the entire prompt was counted asnoCache. Groq's implicit prompt caching now surfaces asusage.cachedInputTokens(mapped tocacheRead, subtracted fromnoCache). Groq has no cache-creation charge, socacheWriteremains undefined.v3.0.50Compare Source
Patch Changes
e1af05f]v3.0.49Compare Source
Patch Changes
bef93ae: fix(security): prevent streaming tool calls from finalizing on parsable partial JSONStreaming tool call arguments were finalized using
isParsableJson()as a heuristic for completion. If partial accumulated JSON happened to be valid JSON before all chunks arrived, the tool call would be executed with incomplete arguments. Tool call finalization now only occurs inflush()after the stream is fully consumed.327642b: fix: more precise default message for tool execution denialUpdated dependencies [
d559de9]v3.0.48Compare Source
Patch Changes
0952964]v3.0.47Compare Source
Patch Changes
ea1e95b]v3.0.46Compare Source
Patch Changes
fa850e6]v3.0.45Compare Source
Patch Changes
b30e43a]v3.0.44Compare Source
Patch Changes
f19334d]v3.0.43Compare Source
Patch Changes
1b40ac7: Publish all packages under the@ai-v6dist tag.1b40ac7]v3.0.42Compare Source
Patch Changes
779f5cd]v3.0.41Patch Changes
bfa5864]f42aa79]v3.0.39Compare Source
Patch Changes
f591416]v3.0.38Compare Source
Patch Changes
7beadf0]v3.0.37Compare Source
Patch Changes
a727da4: chore: ensure consistent import handling and avoid import duplicates or cyclesa727da4]v3.0.36Compare Source
Patch Changes
a7f3c72: trigger release for all packages after provenance setupa7f3c72]v3.0.35Compare Source
Patch Changes
d42076d: Add AI Gateway hint to provider READMEsv3.0.34Compare Source
Patch Changes
6247886]v3.0.33Compare Source
Patch Changes
0469aed]v3.0.32Patch Changes
cb3ca8f: feat: Groq support for performance service tiermantinedev/mantine (@mantine/core)
v8.3.18Compare Source
This is the last 8.x release. You are welcome to test 9.0 alpha version and provide feedback before its release on March 31 – https://alpha.mantine.dev/changelog/9-0-0/
[@mantine/core]PasswordInput: Fix styles api props not resolving correctly in theme (#8716)testing-library/user-event (@testing-library/user-event)
v14.6.6Compare Source
Bug Fixes
v14.6.5Compare Source
Bug Fixes
v14.6.4Compare Source
v14.6.3Compare Source
vitest-dev/vitest (@vitest/runner)
v3.2.7Compare Source
🐞 Bug Fixes
View changes on GitHub
v3.2.6Compare Source
🐞 Bug Fixes
View changes on GitHub
v3.2.5Compare Source
🚀 Features
allowWriteandallowExecoptions toapi[backport to v3] - by @hi-ogawa and Codex in #10445 (af88b)🐞 Bug Fixes
cdpAPI whenallowWrite/allowExec: false[backport to v3] - by @hi-ogawa and Codex in #10456 (385a1)View changes on GitHub
vercel/ai (ai)
v6.0.264Compare Source
v6.0.263Compare Source
Patch Changes
1e70580]v6.0.262Compare Source
Patch Changes
30526e9: Prevent exceptions in streamingonChunkandonErrorcallbacks from terminating the stream or masking provider errors.7de3226]504da15]v6.0.261Compare Source
v6.0.260Compare Source
Patch Changes
98c656f: fix: rejectstreamObjectresult promises and report failed completion when the provider stream errorsb253d52: Filter preliminary tool outputs whenignoreIncompleteToolCallsis enabled.9e15cb4: Prevent automatic tool execution when a model call ends with an unsafe finish reason.v6.0.259Compare Source
Patch Changes
def7999]v6.0.258Compare Source
v6.0.257Compare Source
Patch Changes
000b243]v6.0.256Compare Source
Patch Changes
31205a4]v6.0.255Compare Source
v6.0.253Compare Source
Patch Changes
d91d30b: Preserve reasoning block IDs from UI message streams on reasoning UI parts.0ec239b]v6.0.252Compare Source
Patch Changes
2f96d3f: Allow providers without reranking model support to satisfy theProvidertype.afb1965: Propagate errors thrown by the ChatonFinishcallback to the initiating request.18b0965]451d2c3]v6.0.250Compare Source
Patch Changes
a077695: Prevent streaming telemetry spans from ending twice when model calls fail.7ce3b8c: PreventresumeStreamfrom copying the previous assistant message into the resumed response.b2a4d5a]v6.0.249Compare Source
Patch Changes
a774b7b: Stop pending and active resumed chat streams after cancellation, and preventoverlapping resumptions from applying stale updates.
b39f987]d79117b]v6.0.248Compare Source
Patch Changes
2171d15: feat(video): allowaspectRatio: 'adaptive'ongenerateVideoSome video models derive the output ratio from the input and reject explicit
{width}:{height}values — BytePlus Seedance 2.5 does this for first-frame,first-and-last-frame, editing, and extension tasks.
aspectRatioonVideoModelV3CallOptions, andexperimental_generateVideois now`${number}:${number}` | 'adaptive', sothose calls no longer need a type assertion. Support is provider-specific.
Updated dependencies [
2171d15]v6.0.247Compare Source
Patch Changes
dab0a08]v6.0.246Patch Changes
ee2bf30]v6.0.244Patch Changes
79e58aa: Preserve preceding assistant messages when regenerating a response.v6.0.243v6.0.242v6.0.241Compare Source
Patch Changes
7e50c52]v6.0.240Patch Changes
b28367e]v6.0.239Patch Changes
d3d9e0b]v6.0.238Patch Changes
9ecdefe: Prevent validated downloads on Node.js from reaching private or internal services through DNS aliases or DNS rebinding by validating and pinning every resolved address at connection time.26d10c0: support overriding model call settings for individualprepareStepinvocations7767170: Preserve provider metadata from empty text deltas instreamText.9ecdefe]87fb433]v6.0.237Patch Changes
f6020d7: Avoid synthesizing client tool errors for invalid provider-executed tool calls.de438f5]v6.0.236v6.0.235Patch Changes
5d7b986]v6.0.234Patch Changes
1efdef8: fix(ai): bound media-type sniffing decode for ID3-prefixed inputMedia-type detection stripped ID3 tags before the ~18-byte prefix cap, decoding the entire base64 attachment (plus a full-size copy) whenever the data began with
ID3/SUQz. This turned the intended O(1) sniff into an O(N) decode of the whole attachment. Detection now decodes at most a bounded prefix and skips the ID3 tag within that bound, keeping cost O(1) in input size on all paths (image, audio, and combined).49414cf: Return response piping promises so callers can catch stream read and write errors.Updated dependencies [
e7d064f]v6.0.233Patch Changes
fe410e7: fix: detect MP4 audio from its ftyp box during transcriptionaf7188c: fix(ai): preserve tool parts when tool call IDs repeat across stepsa09f944]v6.0.232Compare Source
Patch Changes
7644a61: Preserve provider options when combining consecutive tool messages.v6.0.231Compare Source
Patch Changes
926f5a0: Allow UI message chunks to include fields added by newer server versions.4c5a22f: Propagate abort reasons when generation is cancelled during tool execution.842a383: Prevent tools excluded byactiveToolsfrom being parsed or executed.2dd1aab]e567091]v6.0.230Compare Source
Patch Changes
19093fd: fix(ai): callonInputStartbeforeonInputAvailableduring non-streaming tool calls19093fd]v6.0.229Compare Source
Patch Changes
49a3098]v6.0.228Compare Source
Patch Changes
5e624ac]v6.0.227Compare Source
Patch Changes
6ace546: Fix chatonFinishhandling when overlapping requests clear the active response before a resume stream finishes.v6.0.226Compare Source
Patch Changes
94219a2: Allow validating assistant UI messages with empty parts so persisted errored responses remain loadable.b1be847: Prevent pending tool executions from enqueueing results after a model stream error closes the result stream.06fb54c]bc46977]v6.0.225Compare Source
Patch Changes
7c48ed8]v6.0.224Compare Source
Patch Changes
982aa3e]v6.0.223Compare Source
Patch Changes
a452291]v6.0.222Compare Source
Patch Changes
e1af05f: feat (video): support video (not just image) reference inputs ininputReferencesfor reference-to-video generation2bfb16a]34b5acc]e1af05f]1ce0d1c]v6.0.221Compare Source
v6.0.220Compare Source
Patch Changes
158d027: Sort tool results by their tool call order when converting generation output to response messages.eb3cdd9: FixextractJsonMiddlewarepreserving leading whitespace in the final streamed text suffix when no markdown fence prefix was stripped.7dea716]4f7fe37]0952964]v6.0.219Compare Source
v6.0.218Compare Source
Patch Changes
ea1e95b: feat(mcp): add maxRetries option for failed mcp tool callsea1e95b]v6.0.217Compare Source
Patch Changes
fa850e6: feat (video): add first-classframeImagesandinputReferencescall options for video generation95bc6fd]f6b2159]fa850e6]v6.0.216Compare Source
Patch Changes
f6689df]13b6a72]v6.0.215Compare Source
Patch Changes
f66ac32: fix(ai): prune orphaned tool-approval responses inpruneMessagesWhen pruning a specific tool by name (
toolCalls: [{ type, tools: [...] }]),pruneMessagesleft the tool'stool-approval-responsein place while removing itstool-approval-requestandtool-call. The tool name of an approval response was resolved per-message, but approval responses live in a separatetoolmessage from their approval request, so the name could never be resolved and the response was always kept. Tool name resolution is now done across all messages, so approval requests and responses are pruned together.v6.0.214Compare Source
Patch Changes
b30e43a]v6.0.213Compare Source
Patch Changes
f19334d: feat (video): add first-classgenerateAudiocall optionfb601aa]f19334d]v6.0.212Compare Source
Patch Changes
932c680]v6.0.211Compare Source
Patch Changes
6ce12b0]4cb4414]v6.0.210Compare Source
Patch Changes
1b40ac7: Publish all packages under the@ai-v6dist tag.1b40ac7]v6.0.209Compare Source
v6.0.208Compare Source
v6.0.207Compare Source
Patch Changes
779f5cd: fix(provider-utils): cancel response body on download rejection to prevent socket leakWhen a download was rejected early — because the
Content-Lengthheader exceeded the size limit, the response status was not ok, or a redirect resolved to a blocked URL — the fetch response body was left unconsumed and uncancelled. With WHATWG Fetch/undici this leaves the underlying TCP socket open instead of returning it to the connection pool, allowing an attacker-controlled origin to exhaust file descriptors and cause a denial of service. The body is now cancelled on all early-rejection paths inreadResponseWithSizeLimit,download, anddownloadBlob, andfetchWithValidatedRedirectscancels each redirect hop's body before following or rejecting the next hop.Updated dependencies [
5bfde36]Updated dependencies [
779f5cd]v6.0.206Compare Source
Patch Changes
e962dda]v6.0.205Compare Source
Patch Changes
6160ced]c9b8abd]v6.0.204Compare Source
v6.0.203Compare Source
Patch Changes
f42aa79: fix: harden download URL SSRF guard against hostname and redirect bypasses`validateD
Configuration
📅 Schedule: (in timezone America/Toronto)
* 0-3 1 * *)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.