chore(deps): bump @ai-sdk/mcp from 1.0.52 to 2.0.10

[dependabot]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

[krishagel]

🤖 pr-fix routine: blocked by environment, not by this PR

I diagnosed the failing checks — root cause found, but I can't apply the fix from this session.

Root cause: package.json bumps @ai-sdk/mcp from 1.0.52 to 2.0.10, but bun.lock was not regenerated to match. bun install --frozen-lockfile fails with error: lockfile had changes, but lockfile is frozen, which cascades into both the Test, Lint, and Type Check and Validate CDK Infrastructure jobs. (The claude-review check also fails, but that's expected and unrelated — Dependabot-authored PRs don't receive the ANTHROPIC_API_KEY secret, a GitHub security restriction with no code-level fix.)

Why I couldn't apply the lockfile fix: this automated session's outbound network policy blocks registry.npmjs.org (403 host_not_allowed at the egress proxy) even though it's needed to run bun install and regenerate the lockfile. Per this session's operating rules, a blocked-host denial must be reported, not worked around (no manual lockfile hand-editing, no bypass).

To unblock: a human (or a session with npm registry access) needs to run, on this branch:

bun install
git add bun.lock
git commit -m "chore: regenerate lockfile for @ai-sdk/mcp bump"
git push

after which Test, Lint, and Type Check and Validate CDK Infrastructure should pass; claude-review will remain red on Dependabot PRs regardless (no secret access — expected).

Heads up: this is the same root cause on the other 8 open dependabot/npm_and_yarn/* PRs (#1208–#1217) — Dependabot isn't regenerating bun.lock alongside package.json for any of them. Worth checking whether Dependabot's bun-lockfile support needs a config change, since this will keep recurring.

Remove pr-fix-stuck once the lockfile is regenerated (or if repo/network config changes let this routine reach the npm registry) to let the routine re-check.

---

Generated by Claude Code

[krishagel]

🔬 Deferred as part of the AI SDK v7 cluster — see the full triage and migration plan on #1214. These majors are interdependent (shared provider-spec version) and can only land via one consolidated migration branch, which requires live-provider E2E verification not available in the current environment. Labeled pr-fix-skip; do not hand back to the pr-fix routine.

[dependabot]

Superseded by #1575.