Menu ▾ ▴

#10 chore(deps): bump the minor-and-patch group with 8 updates

closed
nobody
dependencies (40) javascript (44)
2026-06-22
2026-06-19
Anonymous
No

Originally created by: dependabot[bot]

Bumps the minor-and-patch group with 8 updates:

Package From To
@ai-sdk/anthropic 3.0.81 3.0.84
@ai-sdk/openai 3.0.68 3.0.71
@openrouter/ai-sdk-provider 2.9.0 2.9.1
@tailwindcss/vite 4.3.0 4.3.1
@tanstack/react-virtual 3.14.2 3.14.3
ai 6.0.198 6.0.206
ollama-ai-provider-v2 3.5.1 3.6.0
tailwindcss 4.3.0 4.3.1

Updates @ai-sdk/anthropic from 3.0.81 to 3.0.84

Changelog

Sourced from @​ai-sdk/anthropic's changelog.

3.0.84

Patch Changes

  • Updated dependencies [bfa5864]
  • Updated dependencies [f42aa79]
    • @​ai-sdk/provider-utils@​4.0.29

3.0.83

Patch Changes

  • Updated dependencies [942f2f8]
    • @​ai-sdk/provider-utils@​4.0.28

3.0.82

Patch Changes

  • 2a91a17: feat(provider/anthropic): add support for claude-fable-5 and the fallbacks API parameter
Commits


Updates @ai-sdk/openai from 3.0.68 to 3.0.71

Changelog

Sourced from @​ai-sdk/openai's changelog.

3.0.71

Patch Changes

  • Updated dependencies [bfa5864]
  • Updated dependencies [f42aa79]
    • @​ai-sdk/provider-utils@​4.0.29

3.0.70

Patch Changes

  • Updated dependencies [942f2f8]
    • @​ai-sdk/provider-utils@​4.0.28

3.0.69

Patch Changes

  • 9a55f6d: feat(openai): add namespaces for tool definitions
Commits


Updates @openrouter/ai-sdk-provider from 2.9.0 to 2.9.1

Release notes

Sourced from @​openrouter/ai-sdk-provider's releases.

2.9.1

What's Changed

Full Changelog: https://github.com/OpenRouterTeam/ai-sdk-provider/compare/2.9.0...2.9.1

Changelog

Sourced from @​openrouter/ai-sdk-provider's changelog.

2.9.1

Patch Changes

Commits


Updates @tailwindcss/vite from 4.3.0 to 4.3.1

Release notes

Sourced from @​tailwindcss/vite's releases.

v4.3.1

Added

Fixed

Changed

Changelog

Sourced from @​tailwindcss/vite's changelog.

[4.3.1] - 2026-06-12

Added

Fixed

Changed

Commits


Updates @tanstack/react-virtual from 3.14.2 to 3.14.3

Release notes

Sourced from @​tanstack/react-virtual's releases.

@​tanstack/react-virtual@​3.14.3

Patch Changes

Changelog

Sourced from @​tanstack/react-virtual's changelog.

3.14.3

Patch Changes

Commits


Updates ai from 6.0.198 to 6.0.206

Changelog

Sourced from ai's changelog.

6.0.206

Patch Changes

  • Updated dependencies [e962dda]
    • @​ai-sdk/gateway@​3.0.132

6.0.205

Patch Changes

  • Updated dependencies [6160ced]
  • Updated dependencies [c9b8abd]
    • @​ai-sdk/gateway@​3.0.131

6.0.204

Patch Changes

  • Updated dependencies [c5d4716]
    • @​ai-sdk/gateway@​3.0.130

6.0.203

Patch Changes

  • f42aa79: fix: harden download URL SSRF guard against hostname and redirect bypasses

    validateDownloadUrl and the file download helpers (downloadBlob, download) could be bypassed in several ways when handling untrusted URLs:

    • A fully-qualified hostname with a trailing dot (e.g. localhost., myhost.local.) skipped the localhost/.local blocklist.
    • IPv6 addresses that embed an IPv4 address in their last 32 bits — IPv4-compatible (::127.0.0.1), IPv4-translated (::ffff:0:127.0.0.1), and NAT64 (64:ff9b::127.0.0.1, including the 64:ff9b:1::/48 local-use prefix) — were not decoded and checked against the private IPv4 ranges.
    • Redirects were validated only after fetch had already followed them, so the request to a redirect target (e.g. an internal/metadata address) had already been issued before the check ran.
    • Several reserved/internal address ranges were not blocked: CGNAT (100.64.0.0/10, used by some cloud providers for internal traffic), benchmarking (198.18.0.0/15), IETF protocol assignments (192.0.0.0/24), the reserved 240.0.0.0/4 block (including the 255.255.255.255 broadcast address), and IPv6 site-local (fec0::/10) and multicast (ff00::/8).

    The validator now strips trailing dots before the hostname checks and fully expands IPv6 addresses to detect embedded private IPv4 targets. The download helpers now follow redirects manually (redirect: 'manual'), re-validating each hop before requesting it, so an unsafe redirect target is never fetched. When a redirect cannot be inspected because the runtime returns an opaque response, the helpers fail closed (reject the redirect) on the server; only in a real browser — where SSRF is not reachable (fetch is constrained by CORS and cannot reach a server's internal network or cloud-metadata endpoints) — is the redirect followed natively so legitimate redirected downloads keep working.

  • 5291f7e: Harden stream text processing and middleware against prototype pollution from stream part IDs.

  • b4b575a: fix: redact server error details from UI message streams by default

    streamText(...).toUIMessageStream() and createUIMessageStream defaulted their onError callback to getErrorMessage, which serializes the raw error (error.toString() / JSON.stringify(error)) into the client-facing { type: 'error', errorText } chunk — and also into tool-output-error parts. The documented default was () => 'An error occurred.', so applications relying on the documented behavior were unknowingly streaming server exception details (internal hostnames, paths, provider request data, validation inputs) to end users.

    The default onError now returns the documented generic 'An error occurred.'. Raw error details are only emitted when the developer explicitly supplies an onError handler. This also redacts tool-output-error and invalid-tool-input error text by default; pass an onError to surface richer messages.

  • Updated dependencies [bfa5864]

  • Updated dependencies [f42aa79]

    • @​ai-sdk/provider-utils@​4.0.29
    • @​ai-sdk/gateway@​3.0.129

6.0.202

... (truncated)

Commits


Updates ollama-ai-provider-v2 from 3.5.1 to 3.6.0

Commits


Updates tailwindcss from 4.3.0 to 4.3.1

Release notes

Sourced from tailwindcss's releases.

v4.3.1

Added

Fixed

Changed

Changelog

Sourced from tailwindcss's changelog.

[4.3.1] - 2026-06-12

Added

Fixed

Changed

Commits


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name=""> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name=""> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name=""> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name="">` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name="">` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name=""> <ignore condition="">` will remove the ignore condition of the specified dependency and ignore conditions </ignore></dependency></dependency></dependency></dependency></dependency></dependency>

Related

Tickets: #146

Discussion

  • Anonymous

    Anonymous - 2026-06-22

    Originally posted by: dependabot[bot]

    Looks like these dependencies are updatable in another way, so this is no longer needed.

     

  • Anonymous

    Anonymous - 2026-06-22

    Ticket changed by: dependabot[bot]

    • status: open --> closed
     

Log in to post a comment.

MongoDB Logo MongoDB