Skip to content

Bump AI SDK and current minor and patch dependencies - #192

Merged
jonbeckman merged 2 commits into
masterfrom
cursor/minor-patch-deps-3af0
Nov 13, 2026
Merged

Bump AI SDK and current minor and patch dependencies#192
jonbeckman merged 2 commits into
masterfrom
cursor/minor-patch-deps-3af0

Conversation

@jonbeckman

@jonbeckman jonbeckman commented Nov 9, 2026 •
edited by cursor Bot
Loading

Copy link
Copy Markdown
Contributor

Summary

  • Pin ai at 7.0.166, including the overrides entry and @solzero/api.
  • Pin @ai-sdk/anthropic at 4.0.99, @ai-sdk/openai at 4.0.111, @ai-sdk/typesafe-ai at 3.0.35, and @ai-sdk/openai-compatible at 3.0.87.
  • Pin @ai-sdk/provider at 4.0.37 so ai 7.0.166 and the harness packages share one copy.
  • Pin turbo at 2.11.10, semver at 7.8.6, @electric-sql/pglite at 0.4.6, and @electric-sql/pglite-socket at 0.1.6.
  • Allow ai@7.0.166 and @ai-sdk/gateway@4.0.139 through the release-age gate.
  • Refresh other dependencies that were already inside their current ranges. The regenerated lockfile keeps Vite 8.3.6, Tailwind CSS 4.3.5, TanStack Query 5.107.1, and TanStack Start 1.169.5. nub resolved the open ranges to lucide-react 1.72.0, @cloudflare/kumo 2.18.0, @vitejs/plugin-react 6.3.0, and jose 6.2.17.

Left unchanged because they are already current: esbuild 0.28.2, @types/node 24.19.2, @cloudflare/workers-types 4.20260702.1, and tsx 4.23.15. Drizzle stays at 1.0.0-rc.5-ab785fc. Alchemy, Effect, workerd, miniflare, and wrangler are untouched.

Not included: agents, @cloudflare/think, @cloudflare/shell, @cloudflare/codemode, and the @ai-sdk/harness* packages. The Codex patch is pinned to @ai-sdk/harness-codex@1.0.43, and those packages are the agent runtime rather than a patch of the current pin. @modelcontextprotocol/sdk stays at 1.32.0 because of its override (1.32.2 exists).

This pull request uses release:none. It does not change VERSION on its own. The merge brings master's VERSION from the already merged Version Packages pull request. The dependency updates stay inside current majors, and this pull request does not ship a product behavior change of its own.

Merge

Merged origin/master after #188, #189, #190, and #191. Kept master's Nub 0.10.0, e2e 0.23.0, oxlint 1.93.0, oxfmt 0.78.0, and tsrs 0.23.0. Kept this pull request's newer AI SDK, Turbo, semver, and PGlite pins. Regenerated nub.lock with nub from master's lockfile.

Validation

  • nub install --frozen-lockfile
  • nub run typecheck
  • nub run lint
  • nub run format
  • nub run test:config (31 tests passed)
  • The pre-push hook ran typecheck, lint, and format again before the push.
  • The core nub run test suite was not run here because this environment has no Docker daemon.

Checklist

  • I added or updated tests for behavior changes, or explained why tests are not needed.
  • I updated documentation and config examples when behavior or configuration changed.
  • I added a .tegami/ release entry, or explained why this pull request uses release:none.
  • I ran nub run config:check, nub run typecheck, nub run lint, nub run format, and nub run test.
  • I did not include credentials, private data, internal URLs, or organization-specific defaults.
  • I updated THIRD_PARTY_NOTICES.md for new third-party code or separately licensed assets.
Open in Web Open in Cursor 

@cursoragent @jonbeckman
Bump AI SDK and other current minor and patch dependencies
99a3173 
Update ai to 7.0.166, the Anthropic, OpenAI, and typesafe providers, turbo, semver, and PGlite inside 0.4. Pin @ai-sdk/provider at 4.0.37 so the AI SDK and harness packages share one copy. Refresh in-range lockfile updates for the web toolchain.

Co-authored-by: Jonathan Beckman <jonathantbeckman@gmail.com>
@jonbeckman jonbeckman added the release:none label Nov 9, 2026 — with Cursor
@jonbeckman
jonbeckman marked this pull request as ready for review November 9, 2026 20:59
@github-actions

github-actions Bot commented Nov 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Tegami

This repository uses Tegami to manage releases. When your changes affect published packages, add a changelog file under .tegami/ before merging.

Create a changelog → · Changelog format

No changelogs yet

This PR has no pending changelog files. If your changes require a release, add a changelog before merging.

Run nub run tegami locally to create a changelog interactively.

Managed by Tegami.

@github-actions

github-actions Bot commented Nov 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🟢 e2e solzero-core: 1 flaky, 31 passed

4 agent steps · 4 replayed from cache

⚠️ 1 flaky test passed on a retry

⚠️ secret editor creates, finds and deletes a disposable secret
tests/settings.e2e.ts:84

ASSERTION_FAILED at step 8 of 8: expect.toBeVisible getByText("E2E_SECRET_7b4c6fa6"), after 20.0s

  • Expected: visible
  • Observed: no node (0 matches)
  • Screen: /settings?category=secrets

Evidence: screenshot, log

Change 5 files changed since 5afa68a
Filter decision kept all 30 tests (the diff is over 60 kB, so the decision filter left nothing out)

All 32 tests in 13 files
Test Agent Time
⚠️ tests/settings.e2e.ts · 1 flaky, 4 passed 2 steps 25.2s
🟢 all settings categories load real data 8.0s
🟢 runtime default persists after reload 6.0s
🟢 MCP deep link and legacy settings URL open the MCP tab 2.3s
⚠️ secret editor creates, finds and deletes a disposable secret (1 failed attempt first) 1 step 4.1s
🟢 theme preference survives reload 1 step 4.8s
🟢 tests/accounts.e2e.ts · 3 passed 7.3s
🟢 create, use and revoke an isolated user API key 3.7s
🟢 Better Auth 1.7 account APIs select the local account row id 217ms
🟢 Accounts settings shows GitHub as unlinked without OAuth providers 3.4s
🟢 tests/admin.e2e.ts · 1 passed 4.8s
🟢 administrator pages show live control-plane configuration 4.8s
🟢 tests/advanced-sessions.e2e.ts · 2 passed 7.2s
🟢 incognito sessions stay outside normal lists but open directly 3.4s
🟢 session MCP definitions and subagent preferences persist 3.8s
🟢 tests/api-contract.e2e.ts · 1 passed 539ms
🟢 exported API key and session schemas decode actual Worker responses 539ms
🟢 tests/auth.e2e.ts · 4 passed 14.4s
🟢 sign-in gate protects every application route 1.1s
🟢 credential sign-in opens the requested settings page 6.4s
🟢 anonymous callers cannot access any protected API group 110ms
🟢 sign-out removes authenticated UI access 6.8s
🟢 tests/auth.setup.e2e.ts · 2 passed 7.5s
🟢 authenticate isolated admin 5.3s
🟢 authenticate isolated peer 2.2s
🟢 tests/bots.e2e.ts · 1 passed 5.1s
🟢 create a bot and manage a temporary routine through the UI 5.1s
🟢 tests/branding.e2e.ts · 3 passed 250ms
🟢 the selected deployment brand reaches the browser 213ms
🟢 health identifies the configured application without exposing configuration 20ms
🟢 OpenAPI uses the selected deployment brand 17ms
🟢 tests/session-transfer.e2e.ts · 1 passed 2.1s
🟢 admin authentication transfer redeems once and retains its deep link 2.1s
🟢 tests/sessions.e2e.ts · 5 passed 1 step 42.9s
🟢 session tools, archive and restoration persist through the real Worker 1 step 5.7s
🟢 a second account cannot read or mutate another account's session 240ms
🟢 isolate executes a real prompt and persists its output 8.2s
🟢 opencode executes a real prompt and persists its output 15.3s
🟢 codex executes a real prompt and persists its output 13.5s
🟢 tests/skills.e2e.ts · 1 passed 7.3s
🟢 global skill defaults and per-user preferences persist independently 7.3s
🟢 tests/workflows.e2e.ts · 3 passed 1 step 8.7s
🟢 workflow authoring, rename, export, disable and archive persist 1 step 5.9s
🟢 manual workflow executes JavaScript and stores a real R2 artifact 2.8s
🟢 invalid workflow definitions are rejected before storage 80ms

Tested by e2e 0.23.0 · 3m 28s · local-cloudflare · run artifacts

@jonbeckman
jonbeckman marked this pull request as draft November 13, 2026 16:51
@cursoragent @jonbeckman
Merge origin/master into the minor and patch dependency update.
6280dcf 
Keep the Nub 0.10.0, e2e 0.23.0, and oxlint 1.93.0 toolchain from master. Keep this branch's newer AI SDK, Turbo, semver, and PGlite pins. Regenerate nub.lock with nub.

Co-authored-by: Jonathan Beckman <jonathantbeckman@gmail.com>
@cursor
cursor Bot marked this pull request as ready for review November 13, 2026 16:59
@jonbeckman
jonbeckman enabled auto-merge (squash) November 13, 2026 17:00
@jonbeckman
jonbeckman merged commit fa02d62 into master Nov 13, 2026
20 checks passed
@jonbeckman
jonbeckman deleted the cursor/minor-patch-deps-3af0 branch November 13, 2026 17:05
@cursor cursor Bot mentioned this pull request Nov 13, 2026
Merged
6 tasks done
jonbeckman added a commit that referenced this pull request Nov 13, 2026
@jonbeckman @cursoragent
Bump Alchemy to 2.0.0-beta.85 and Effect to 4.1.2 (#180)
95171b0 
<!-- CURSOR_AGENT_PR_BODY_BEGIN -->
## Summary

Moves the workspace onto Alchemy `2.0.0-beta.85` and Effect `4.1.2`, and
merges current `master` (through #195).

The root `workerd` override is removed. It held workerd behind the
release Alchemy beta.85's Vite forwarder needs. That forwarder waits for
`HTTP/1.1 100 Continue` before it sends a POST body, and `workerd`
`1.20261006.1` never sends that response.

No published Miniflare release depends on `workerd` `1.20261026.1`, the
exact version `@alchemy.run/cloudflare-runtime@2.0.0-beta.85` depends
on. Miniflare is now `5.20261101.0-beta`, the next published release,
and it depends on `workerd` `1.20261101.1`. Wrangler `4.149.0` also
depended on `workerd` `1.20261006.1` and Miniflare `5.20261006.1-alpha`,
so Wrangler is now `4.156.1`, which uses that same Miniflare and
`workerd` `1.20261101.1`.

`nub why workerd` shows two versions:

- `1.20261026.1`, supplied by `@alchemy.run/cloudflare-runtime` (the
binary `alchemy dev` uses)
- `1.20261101.1`, supplied by `miniflare` and `wrangler`

Both binaries include `100 Continue`. `1.20261006.1` is gone.
`allowScripts` still allows the `workerd` install script. `VERSION` is
untouched. The `release:none` label stays.

Master's versions are kept for everything this pull request does not
bump, including oxlint `1.93.0`, oxfmt `0.78.0`, tsrs
`0.23.0-ts7.1.0-beta`, the AI SDK pins from #192, and the AI Search
config shape from #186. The config JSON schema was regenerated for
Effect 4.1 against that shape.

#195 moved `@alchemy.run/cloudflare` and `alchemy` to production
dependencies of `@solzero/background-api` so a pruned publish can still
deploy. Those packages stay production dependencies, at `2.0.0-beta.85`.
Effect stays a devDependency at `4.1.2`.

## Root cause

File: `@alchemy.run/cloudflare-runtime@2.0.0-beta.85`
`src/vite/worker-request.ts`, in `forwardWorkerRequest`.

- Lines 70–79: a request with `content-length` or `transfer-encoding` is
forwarded with `expect: 100-continue`.
- Lines 169–174: the body is not piped until the upstream emits
`continue`.

That landed in commit `3bb45b0f08` (`feat(cloudflare-runtime): update
workerd and sync workers-sdk`, #2673), which is in `2.0.0-beta.85` and
not in `2.0.0-beta.84`. Beta.84 piped the body immediately.

A packet capture of `POST /api/auth/sign-in/email` to port 3000 showed
the Vite process sending headers, including `expect: 100-continue` and
`content-length: 40`, and then no body. workerd acknowledged the headers
and never replied `100 Continue`. The Worker then failed
`request.arrayBuffer()` with `Network connection lost` once the client
gave up. The same POST to port 3100 does not go through this Vite
forwarder, so it returned 200.

`workerd` `1.20261006.1` has no `100 Continue` string in the binary.
`1.20261026.1` and `1.20261101.1` do.

## Conflicts

- `.npmrc`: kept master's release-age exclusions, including oxfmt
`0.78.0`, oxlint `1.93.0`, and `ai@7.0.166`, and removed the `workerd`
`1.20261006.1` exclusions.
- `package.json`: Miniflare `5.20261101.0-beta` and Wrangler `4.156.1`
from this branch; oxfmt `0.78.0` and oxlint `1.93.0` from master. The
`workerd` override stays removed.
- `apps/api/package.json`: Alchemy `2.0.0-beta.85` and Effect `4.1.2`
from this branch; tsrs `0.23.0-ts7.1.0-beta` from master. After #195,
`@alchemy.run/cloudflare` and `alchemy` are production dependencies.
- `config/s0.config.schema.json`: master's removal of
`aiSearch.serviceTokenId`, then regenerated with Effect 4.1.
- `nub.lock`: regenerated with nub. Not hand-edited.

## Validation

- `nub run format`, `nub run lint`, and `nub run typecheck`: passed,
including the pre-push hook on both pushes.
- `nub run config:check`: passed.
- `nub run test:config`: 31 passed (5 files), including the Miniflare
service-binding and storage fixtures. One workerd stderr line reported a
hung request during the service-binding case; the test still passed.
Re-run after the #195 merge.
- `nub run test`: 30 passed, 2 failed. Sign-in, Isolate, settings,
workflows, and the other core flows passed. OpenCode and Codex timed out
because `cloudflare/proxy-everything` exited before the container could
start (`iptables` `PREROUTING` append failed: missing kernel module).
That is this VM, not an application change. CI runs that suite on a host
that can run the proxy. The #195 follow-up only moves the same Alchemy
packages into production dependencies, so that browser suite was not
repeated.

## Checklist

- [x] I added or updated tests for behavior changes, or explained why
tests are not needed. The existing config suite covers the Miniflare
fixtures.
- [x] I updated documentation and config examples when behavior or
configuration changed. The config JSON schema was regenerated for Effect
4.1. Stale `workerd` `1.20261006.1` entries were removed from `.npmrc`
`minimumReleaseAgeExclude`. The new Miniflare and workerd versions did
not need an age exclusion.
- [x] I added a `.tegami/` release entry. `VERSION` is untouched. This
pull request keeps `release:none`.
- [x] I ran `nub run config:check`, `nub run format`, `nub run lint`,
`nub run typecheck`, `nub run test:config`, and `nub run test`.
- [x] I did not include credentials, private data, internal URLs, or
organization-specific defaults.
- [x] I updated `THIRD_PARTY_NOTICES.md` for new third-party code or
separately licensed assets. No new third-party source was added.

<!-- CURSOR_AGENT_PR_BODY_END -->

<div><a
href="https://cursor.com/agents/bc-85cb0616-7478-5004-89c8-7a62aca4d1cb?cursor_ref=pr_footer&cursor_cta=open_in_web"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/assets/images/open-in-web-light.png"><img
alt="Open in Web" width="114" height="28"
src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a>&nbsp;<a
href="https://cursor.com/background-agent?bcId=bc-85cb0616-7478-5004-89c8-7a62aca4d1cb&cursor_ref=pr_footer&cursor_cta=open_in_cursor"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img
alt="Open in Cursor" width="131" height="28"
src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a>&nbsp;</div>

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

release:none

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@jonbeckman @cursoragent