chore(deps): bump @ai-sdk/google from 3.0.91 to 4.0.12

[dependabot]

Bumps @ai-sdk/google from 3.0.91 to 4.0.12.

Release notes

Sourced from @​ai-sdk/google's releases.

@​ai-sdk/google@​4.0.12

Patch Changes

• e40118c: Forward text file references as documents when using the Google Interactions API.

Changelog

Sourced from @​ai-sdk/google's changelog.

4.0.12

Patch Changes

• e40118c: Forward text file references as documents when using the Google Interactions API.

4.0.11

Patch Changes

• 17d66c5: Fix Google tool result conversion to send file data as inline data instead of JSON text on the legacy tool-result path.
• 96d40bc: Expand standalone Google threshold provider options into safety settings.
• 0f93c57: feat (video): support video (not just image) reference inputs in inputReferences for reference-to-video generation
• Updated dependencies [0f93c57]
  • @​ai-sdk/provider@​4.0.3
  • @​ai-sdk/provider-utils@​5.0.7

4.0.10

Patch Changes

• Updated dependencies [ac306ed]
  • @​ai-sdk/provider-utils@​5.0.6

4.0.9

Patch Changes

• 7401c2c: Pass documented Gemini external HTTPS file URLs through without downloading them.

4.0.8

Patch Changes

• 5c5c0f5: Add experimental streaming transcription support for transcription models, including OpenAI gpt-realtime-whisper and xAI WebSocket STT.
• Updated dependencies [5c5c0f5]
  • @​ai-sdk/provider@​4.0.2
  • @​ai-sdk/provider-utils@​5.0.5

4.0.7

Patch Changes

• c6f5e62: Prevent prototype pollution when synchronously parsing provider JSON inputs and expose secureJsonParse from provider-utils.
• bd8d172: Fix Google embedding batch size to respect the Gemini API limit of 100 requests per batch.
• Updated dependencies [c6f5e62]
  • @​ai-sdk/provider-utils@​5.0.4

4.0.6

... (truncated)

Commits

• 58d77ca Version Packages (#17043)
• e40118c fix: Google Interactions drops text ProviderReference file parts (#17054)
• 405116e Version Packages (#16937)
• 17d66c5 fix: Google provider serializes PDF tool result file data as text on the lega...
• 96d40bc fix: standalone Google threshold provider option is silently ignored (#16922)
• 0f93c57 support video reference input for r2v (#16328)
• f0d9a6c Version Packages (#16898)
• 7718519 Version Packages (#16881)
• 7401c2c fix: Google provider marks Gemini external HTTPS file URLs as unsupported (#1...
• c73f2ef Version Packages (#16651)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

[krishagel]

🤖 pr-fix routine: nothing I can safely fix here

I looked into the failing checks on this PR:

Test, Lint, and Type Check / Validate CDK Infrastructure — both fail with:

error: lockfile had changes, but lockfile is frozen
note: try re-running without --frozen-lockfile and commit the updated lockfile

Root cause: .github/dependabot.yml declares package-ecosystem: "npm", but this repo actually runs on Bun (bun.lock, "packageManager": "bun@1.2.23"). Dependabot's npm-ecosystem updater bumps package.json version ranges but doesn't understand/regenerate bun.lock, so the lockfile is left stale on every dependency-bump PR. bun install --frozen-lockfile then correctly rejects the mismatch in CI.

I tried to fix this myself by running bun install to regenerate bun.lock, but this session's network policy blocks direct egress to registry.npmjs.org (confirmed via the sandbox's proxy status — an organization-level policy denial, not something to retry or work around). So I can't safely produce a correct lockfile here.

claude-review fails for an unrelated reason:

Action failed with error: Workflow initiated by non-human actor: dependabot (type: Bot).
Add bot to allowed_bots list or use '*' to allow all bots.

Fixing that requires editing .github/workflows/claude-code-review.yml, which is a protected path this autonomous routine cannot modify.

This same lockfile problem almost certainly affects the other open Dependabot PRs (#1216, #1215, #1214, #1213, #1212, #1211, #1210, #1209, #1208) — they show the identical failure signature. Worth fixing once at the root rather than per-PR.

Suggested fixes for a human (any one of these unblocks all the sibling PRs too):

1. Run bun install locally on this branch (and the sibling branches) to regenerate bun.lock, then push.
2. Add a CI step/bot that auto-regenerates bun.lock for Dependabot PRs before checks run.
3. Investigate whether Dependabot's package-ecosystem should be changed (GitHub has been rolling out Bun-aware update support) — note this would only help future PRs, not the ones already open.
4. Optionally add dependabot to the claude-review workflow's allowed_bots list if AI review on dependency PRs is desired.

The routine will not pick this PR up again until a human removes the pr-fix-stuck label.

---

Generated by Claude Code

[krishagel]

🔬 Deferred as part of the AI SDK v7 cluster — see the full triage and migration plan on #1214. These majors are interdependent (shared provider-spec version) and can only land via one consolidated migration branch, which requires live-provider E2E verification not available in the current environment. Labeled pr-fix-skip; do not hand back to the pr-fix routine.

[dependabot]

Superseded by #1573.