chore(deps, agent-service): update agent-service patch updates - #7263
Conversation
forking-renovate
Bot
added
the
dependencies
Automated Reviewer SuggestionsBased on the
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #7263 +/- ##
=========================================
Coverage 82.73% 82.73%
Complexity 4090 4090
=========================================
Files 1162 1162
Lines 46302 46302
Branches 5162 5162
=========================================
Hits 38309 38309
Misses 6302 6302
Partials 1691 1691
*This pull request uses carry forward flags. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Pull request overview
This PR updates a small set of agent-service NPM dependencies (patch-level Renovate bumps) and keeps the lockfile and bundled-license inventory in sync so the agent-service build and licensing drift checks remain consistent.
Changes:
- Bump
@ai-sdk/openaifrom4.0.17to4.0.27andaifrom7.0.33to7.0.48. - Bump
tsxfrom4.23.1to4.23.5. - Update
bun.lockandagent-service/LICENSE-binaryto reflect the resolved dependency graph changes (including newundici@7.29.0via@ai-sdk/provider-utils).
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| agent-service/package.json | Updates direct dependency versions for the agent-service. |
| agent-service/bun.lock | Updates resolved dependency versions/hashes to match the new direct versions. |
| agent-service/LICENSE-binary | Updates the bundled third-party dependency inventory to match the new resolved set (incl. undici). |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
ai 7.0.48 pulls in undici@7.29.0 (MIT) as a new bundled transitive dep, and the ai-sdk packages moved versions. Refresh the claimed versions and add the undici bullet so check_binary_deps.py passes.
f178b90 to
5a26544
Compare
This PR contains the following updates:
4.0.17→4.0.277.0.33→7.0.484.23.1→4.23.5Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
vercel/ai (@ai-sdk/openai)
v4.0.27Compare Source
Patch Changes
5fc7da5: chore: centralize empty language model usage creation in provider utilities.93b2acd: chore: centralize response metadata conversion5fc7da5]93b2acd]v4.0.26Compare Source
Patch Changes
f7c4a38: Serialize file upload expiry settings in the multipart field shape accepted by OpenAI.fa95504]v4.0.25Compare Source
Patch Changes
beaecb3: fix(provider/openai): resolve responses doStream at response.in_progress instead of first output tokenThe early-stream-error peek treated
response.in_progressas an unknown chunk, sodoStreamdid not resolve until the first output item arrived — delaying stream availability (and downstream TTFB for proxies/gateways) by the model's full time-to-first-token.response.in_progressis now modeled in the chunk schema and marks the request as accepted: the peek keeps watching for error frames for a short grace window (50ms) so quota/rate-limit errors flushed alongsideresponse.in_progressstill throw as retryableAPICallErrors, while healthy streams become available right after upstream acknowledges the request.b192878: feat: add experimental_toolCaller routing to generateText for code modeUpdated dependencies [
d8210b6]Updated dependencies [
b192878]v4.0.24Compare Source
Patch Changes
1659cd5]6a5bdff]v4.0.23Compare Source
Patch Changes
96a237d: Add blocked domain filters to the OpenAI and Azure Responses API web search tools.v4.0.22Compare Source
Patch Changes
c49380c: feat: add experimental streaming speech translation models (openai.translation('gpt-realtime-translate')over the OpenAI Realtime translations WebSocket andgoogle.translation('gemini-3.5-live-translate-preview')over the Gemini Live API).connectToWebSocketin@ai-sdk/provider-utilsnow passes close code and reason toonClose(additive, optional parameter).0c464d9]c49380c]v4.0.21Compare Source
Patch Changes
1e2f324]v4.0.20Compare Source
Patch Changes
1f6dd3a: Add OpenAI Responses Programmatic Tool Calling with hosted program tools, function caller controls, structured output schemas, and multi-step continuation support.v4.0.19Compare Source
Patch Changes
34c53c0: Apply reasoning, service tier, and image defaults to recognizable future OpenAI model family versions.v4.0.18Compare Source
Patch Changes
bc43dc2: Preserve stored tool search output item IDs from provider metadata.vercel/ai (ai)
v7.0.48Compare Source
Patch Changes
bdd5e28]v7.0.47Compare Source
Patch Changes
5fc7da5]93b2acd]v7.0.46Compare Source
Patch Changes
4f2e064]v7.0.45Compare Source
Patch Changes
d6ce0ee: feat(ai): support experimental_toolCallers in streamTextfa95504: feat(ai): support experimental tool callers in ToolLoopAgent349afe7: Warn whengenerateTextreceives streaming-onlyfirstChunkMsorchunkMstimeout settings.fa95504]v7.0.44Compare Source
Patch Changes
015acb4: fix telemetry attribution for language model calls that resolve to a different response modelv7.0.43Compare Source
Patch Changes
b192878: feat: add experimental_toolCaller routing to generateText for code moded8210b6]af3f400]b192878]v7.0.42Compare Source
Patch Changes
1659cd5: Prevent validated downloads on Node.js from reaching private or internal services through DNS aliases or DNS rebinding by validating and pinning every resolved address at connection time.60f97f6: support overriding model call settings for individualprepareStepinvocations6a5bdff: Fix validated Node.js downloads when the HTTP connector requests a single DNS address.6de2ec1: Preserve provider metadata from empty text deltas instreamText.1659cd5]6a5bdff]0012529]v7.0.41Compare Source
Patch Changes
2e2224b: Route the warning system information banner to stderr so it does not corrupt application output written to stdout.bf216b3]v7.0.40Compare Source
Patch Changes
c3782a6: DeprecateExperimental_GeneratedImagein favor ofGeneratedFile.v7.0.39Compare Source
Patch Changes
09a52cb: Promote therepairTextoption to stable ongenerateObjectandstreamObject, with a deprecatedexperimental_repairTextalias for backwards compatibility.0c464d9]c49380c]v7.0.38Compare Source
Patch Changes
7bd6bdd: Avoid synthesizing client tool errors for invalid provider-executed tool calls.1e2f324: feat: add experimental speech translation model specification (Experimental_SpeechTranslationModelV4) andexperimental_streamTranslatefor streaming speech-to-speech translationd9d2a11]1e2f324]v7.0.37Compare Source
Patch Changes
0a7c7f4]v7.0.36Compare Source
Patch Changes
7fa85b2: fix(ai): use injective serialization for tool approval HMAC payloadThe tool approval signature (
experimental_toolApprovalSecret) built its HMACpayload by joining fields with
\n. Because fields such astoolNameandtoolCallIdcan themselves contain a newline, distinct field tuples couldserialize to identical bytes, allowing a signed approval to verify against a
different tuple. The payload is now serialized with
JSON.stringify(with aversioned domain-separation prefix), which escapes delimiter/control characters
and makes the encoding injective.
Verification remains backwards compatible: a signature in the old format still
verifies, but only when no field contains the
\ndelimiter (the conditionthat made the old format ambiguous), so a pending approval that straddles an
upgrade is not rejected while the collision stays closed.
v7.0.35Compare Source
Patch Changes
7f6650b: Return response piping promises so callers can catch stream read and write errors.106ea59: feat(ai): add per-step first content timeout for streaming generations2112ff1]v7.0.34Compare Source
Patch Changes
7c16f21]privatenumber/tsx (tsx)
v4.23.5Compare Source
v4.23.4Compare Source
Bug Fixes
This release is also available on:
v4.23.3Compare Source
Bug Fixes
This release is also available on:
v4.23.2Compare Source
Configuration
📅 Schedule: (in timezone Etc/UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.