Add Vercel AI SDK lockfile example and verified case study

[Ayush7614]

Summary

• Adds lockfile-only snapshot examples/vercel-ai-sdk/ from vercel/ai@3215032 (package.json + pnpm-lock.yaml).
• Documents verified baseline scan in website/docs/case-studies/vercel-ai-sdk.md (3,570 packages, 55 findings, pnpm audit comparison).
• Hosts official AI SDK logotype at website/static/img/vercel-ai-sdk-logo.svg (Vercel brand assets).
• Includes Remaining risk, full 55-row Baseline findings table, and Want your project reviewed?

Distinct from the existing Turborepo case study (vercel/turborepo) — this targets the AI SDK monorepo (vercel/ai).

Test plan

• npm run build && node dist/index.js examples/vercel-ai-sdk --verbose --all — 55 findings (2 critical · 22 high · 27 medium · 4 low)
• cd examples/vercel-ai-sdk && pnpm audit — 162 entries documented in case study
• cd website && npm run build — Docusaurus build succeeds
• Re-scan confirms stable counts (3,570 packages / 55 findings)

Made with Cursor

[sonukapoor]

This is one of the stronger studies in the collection. Three direct findings (next@15.0.7 critical, next@15.5.9 high, turbo@2.4.4 medium), five generated command groups, and clear workspace-scoped pnpm add examples make this genuinely actionable. The distinction between vercel/ai and the Turborepo snapshot already in the repo is a good call to make explicit. Single clean commit, all sections present.

[sonukapoor]

After #474 merged today, this PR has conflicts in the shared files (README.md, CHANGELOG.md, examples/readme.md, website/sidebars.ts). Please rebase against main and push:

git fetch upstream
git rebase upstream/main
# resolve any conflicts in README.md, examples/readme.md, sidebars.ts
git push --force-with-lease

The review approval stands — this just needs a clean rebase.

[sonukapoor]

Good content and structure — a few missing pieces before merge:

README not updated. The case studies list in README.md and the in-repo fixtures line ("Astro, Turborepo, and Visual Studio Code live under examples/...") both need entries for this project. Follow the pattern of the existing entries.

CHANGELOG entry missing. No CHANGELOG.md update in the diff. Add a line to the [Unreleased] section under ### Docs following the same one-line format as the other case study entries.

Add a row to website/docs/case-studies/index.md. A case studies index page was added after your branch was cut — it's on main now but missing an entry for this project. After rebasing you'll find it at website/docs/case-studies/index.md. Use the format from the existing rows as a guide.

Please also rebase against main before pushing — the branch is behind the v1.18.2 release.

[Ayush7614]

Thanks for the review @sonukapoor — addressed the missing pieces and rebased onto latest main:

• Rebased onto upstream/main (conflicts resolved in examples/readme.md and website/sidebars.ts)
• Added Vercel AI SDK to the README case studies list and in-repo fixtures line
• Added [Unreleased] CHANGELOG entry under ### Docs
• Added row to website/docs/case-studies/index.md
• Kept explicit distinction from the Turborepo snapshot in examples/readme.md

I will update anything else you flag on this PR. Ready for another look.

[sonukapoor]

All feedback addressed — README, CHANGELOG, and index.md all updated, rebased cleanly against main. Good to merge.

[sonukapoor]

We just merged the Gatsby case study (#494) which touched the same files (CHANGELOG.md, README.md, website/docs/case-studies/index.md). This branch now has conflicts — please rebase against main and we'll merge right away. Same applies to your other open PRs (#498, #499, #500, #501) — once each one merges it'll cause conflicts in the remaining ones, so the fastest path is to rebase them all against main now before we start merging them in order.

[sonukapoor]

Hey Ayush — really sorry about this. We accidentally wiped the content of your branch during a rebase attempt on our end. Your original work is completely safe in your local git history.

To restore this PR, please run:

git fetch upstream   # where upstream is OWASP/cve-lite-cli
git checkout <your-branch>
git rebase upstream/main
git push origin <your-branch> --force

The PR will reopen automatically once the branch has content again. Sorry for the extra work.

[Ayush7614]

Restored the branch after the accidental wipe — sorry for the churn on your side.

• Recovered from local commit history (c5e2ff9)
• Rebased onto latest upstream/main (post-Add Gatsby lockfile example and verified case study #494 Gatsby merge)
• Conflicts resolved in CHANGELOG.md, README.md, examples/readme.md, website/sidebars.ts, website/docs/case-studies/index.md (Gatsby + Vercel AI SDK kept together)
• PR diff is Vercel-only on top of main: lockfile snapshot, case study, logo, README/CHANGELOG/index/sidebar wiring

Ready to merge when CI is green. Thanks @sonukapoor