Skip to content

chore: bump ai sdk family to ai 7.0.142, effect 4.0.5 and vitest 5.0.5 - #352

Merged
ThomasK33 merged 1 commit into
mainfrom
deps-batch-oct16b
Oct 16, 2026
Merged

chore: bump ai sdk family to ai 7.0.142, effect 4.0.5 and vitest 5.0.5#352
ThomasK33 merged 1 commit into
mainfrom
deps-batch-oct16b

Conversation

@ThomasK33

@ThomasK33 ThomasK33 commented Oct 16, 2026

Copy link
Copy Markdown
Member

Daily dependency batch for the AI SDK family, Effect, and Vitest. Every bump is the newest version with at least 24 hours of publish age at bump time (2026-10-16T18:17Z). I re-checked each with npm view <pkg> time --json. No newer in-line version exists, so nothing is deferred.

Versions

Package Old New Published (UTC) Where
ai ^7.0.141 ^7.0.142 2026-10-15T18:11 devDeps: agent, effect, provider. deps: private release-please-ai
@ai-sdk/provider 4.0.27 4.0.28 (exact) 2026-10-15T18:11 deps: agent, effect, provider (required exactly by ai 7.0.142)
@ai-sdk/anthropic ^4.0.80 ^4.0.81 2026-10-15T18:11 deps: provider. deps: private release-please-ai
@ai-sdk/openai-compatible ^3.0.69 ^3.0.70 2026-10-15T18:10 deps: provider
@ai-sdk/provider-utils ^5.0.60 ^5.0.61 2026-10-15T18:12 devDeps: effect, sandbox
@ai-sdk/harness ^1.0.152 ^1.0.153 2026-10-15T18:09 devDeps: effect, sandbox
@ai-sdk/harness-claude-code ^1.0.156 ^1.0.157 2026-10-15T18:12 devDeps: sandbox
@ai-sdk/react 4.0.145 4.0.146 (exact) 2026-10-15T18:11 devDeps: agent
@ai-sdk/tui ^1.0.142 ^1.0.143 2026-10-15T18:10 devDeps: sandbox
@ai-sdk/gateway 4.0.114 4.0.115 2026-10-15T18:11 transitive (exact dep of ai)
@ai-sdk/mcp 2.0.76 2.0.77 2026-10-15T18:10 transitive (exact dep of react)
effect 4.0.4 4.0.5 (exact) 2026-10-15T01:27 devDeps: effect. Peer range ~4.0.0 unchanged
vitest ^5.0.4 ^5.0.5 2026-10-15T14:29 devDeps: all packages
@vitest/coverage-v8 ^5.0.4 ^5.0.5 2026-10-15T14:27 devDeps: effect, provider, sandbox
@vitest/mocker, @vitest/spy 5.0.4 5.0.5 2026-10-15T14:27 / 14:28 transitive (vitest)

Unchanged on purpose: zod 4.6.7, tsup ^9.0.0, the TypeScript alias pair, all peerDependencies, pnpm, Node, mise tools, and Actions. packages/effect/README.md lists @ai-sdk/provider as "exact (same pin as @coder/ai-sdk-provider)" with no version number, so it needs no edit. It names no @effect/* companion package.

Published runtime range changes

Package dependencies change
@coder/ai-sdk-provider @ai-sdk/anthropic ^4.0.80 → ^4.0.81, @ai-sdk/openai-compatible ^3.0.69 → ^3.0.70, @ai-sdk/provider 4.0.27 → 4.0.28
@coder/ai-sdk-agent @ai-sdk/provider 4.0.27 → 4.0.28
@coder/ai-sdk-effect @ai-sdk/provider 4.0.27 → 4.0.28 (siblings stay workspace:^)
@coder/ai-sdk-sandbox none (devDependencies only)

No peerDependencies change in any package.

Effect release PR #325

Release PR #325 (chore(effect): release 0.1.0) is held for the owner's npm steps. This PR does not merge, close, or edit it. Release-please will refresh it after this merge, so it will pin @ai-sdk/provider 4.0.28. @coder/ai-sdk-effect depends on the siblings through workspace:^. The provider and agent releases that carry 4.0.28 will reach npm before #325 merges, because #325 stays held until the owner releases it.

Lockfile

  • I ran the install with a temporary minimumReleaseAge: 1440 and no exclusions, then pnpm dedupe (already up to date). I restored pnpm-workspace.yaml byte for byte, so it is not in the diff.
  • Every added lockfile version is listed in the table above. All are older than 24 hours at bump time.
  • One @ai-sdk/provider (4.0.28), one zod (4.6.7), one effect (4.0.5).
  • An empty-cache frozen install (scratch store and cache) passed: "Lockfile passes supply-chain policies (454 entries)".
  • rm -rf node_modules && CI=true pnpm install --frozen-lockfile with the default store passed (pnpm 11.28.5).
  • pnpm -r outdated reports nothing after the bump.

Tooling freshness

  • pnpm 11.28.6 (published 2026-10-15T13:39Z) and zizmor are handled by a separate PR. npm's latest dist-tag for pnpm is 12.14.0, a major. It is out of scope here.
  • Node 26.12.0 (mise pin) is current for this batch.

Validation

Node 26.12.0 and pnpm 11.28.5 from mise. pnpm exec node --version prints v26.12.0.

  • pnpm -r build: pass
  • pnpm check (oxfmt, oxlint, typecheck): pass
  • pnpm -r test: agent 378, sandbox 191, provider 22, release-please-ai 13, effect 96 (unit, live e2e run separately): all pass
  • pnpm publint, pnpm attw: pass
  • Live, against https://dogfood.cdr.dev (coder whoami OK):
    • cd packages/agent && npx vitest run test/e2e: 7/7 (two runs, both 7/7)
    • cd packages/effect && npx vitest run test/e2e: 3/3. A second run through pnpm exec vitest also passed 3/3 on Node 26.12.0.
    • npx in this workspace resolves Node 22.19.0 (the engines floor), not the mise Node 26. The agent live runs therefore ran on Node 22.19.0.
    • No unarchived chats were left behind.

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high

@ThomasK33
chore: bump ai sdk family to ai 7.0.142, effect 4.0.5 and vitest 5.0.5
b30290a 
Dependency batch. Each bump is the newest version with at least 24
hours of publish age at bump time (2026-10-16T18:17Z):

- ai ^7.0.141 -> ^7.0.142 (devDeps: agent, effect, provider; deps:
  private release-please-ai)
- @ai-sdk/provider 4.0.27 -> 4.0.28 (deps: agent, effect, provider;
  exact pin, required by ai 7.0.142)
- @ai-sdk/anthropic ^4.0.80 -> ^4.0.81 (deps: provider, private
  release-please-ai)
- @ai-sdk/openai-compatible ^3.0.69 -> ^3.0.70 (deps: provider)
- @ai-sdk/provider-utils ^5.0.60 -> ^5.0.61 (devDeps: effect, sandbox)
- @ai-sdk/harness ^1.0.152 -> ^1.0.153 (devDeps: effect, sandbox)
- @ai-sdk/harness-claude-code ^1.0.156 -> ^1.0.157 (devDeps: sandbox)
- @ai-sdk/react 4.0.145 -> 4.0.146 (devDeps: agent, exact pin)
- @ai-sdk/tui ^1.0.142 -> ^1.0.143 (devDeps: sandbox)
- @ai-sdk/gateway 4.0.114 -> 4.0.115 (transitive, exact dep of ai)
- @ai-sdk/mcp 2.0.76 -> 2.0.77 (transitive, exact dep of react)
- effect 4.0.4 -> 4.0.5 (devDeps: effect, exact pin)
- vitest ^5.0.4 -> ^5.0.5 and @vitest/coverage-v8 ^5.0.4 -> ^5.0.5
  (devDeps; @vitest/mocker and @vitest/spy follow to 5.0.5)

Published runtime range changes: @coder/ai-sdk-provider
(@ai-sdk/anthropic ^4.0.81, @ai-sdk/openai-compatible ^3.0.70,
@ai-sdk/provider 4.0.28), @coder/ai-sdk-agent (@ai-sdk/provider
4.0.28) and @coder/ai-sdk-effect (@ai-sdk/provider 4.0.28). zod stays
4.6.7. No peerDependencies change.

Signed-off-by: Thomas Kosiewski <tk@coder.com>

---
_Generated with [`xum`](https://github.com/coder/xum) • Model: `anthropic:claude-opus-5-5` • Thinking: `high`_

Change-Id: I58eb7ad67bc013ca5667713382fd0c415ebe8d5f
Signed-off-by: Thomas Kosiewski <tk@coder.com>
@ThomasK33

ThomasK33 commented Oct 16, 2026

Copy link
Copy Markdown
Member Author

@codex review

@ThomasK33

ThomasK33 commented Oct 16, 2026

Copy link
Copy Markdown
Member Author

@codex security review

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 16, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-16T18:24:43.467058Z b30290a Manual request
🔒 Security Review ✅ Completed 2026-10-16T18:27:50.107347Z b30290a Manual request
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 16, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

Reviewed commit: b30290aa75

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 16, 2026

Copy link
Copy Markdown

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: b30290aa75

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

@ThomasK33
ThomasK33 added this pull request to the merge queue Oct 16, 2026
Merged via the queue into main with commit 2e29b81 Oct 16, 2026
6 checks passed
@ThomasK33
ThomasK33 deleted the deps-batch-oct16b branch October 16, 2026 18:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ThomasK33