chore(deps): bump ai from 6.0.240 to 7.0.44

[dependabot]

Bumps ai from 6.0.240 to 7.0.44.

Release notes

Sourced from ai's releases.

ai@7.0.44

Patch Changes

• 015acb4: fix telemetry attribution for language model calls that resolve to a different response model

Changelog

Sourced from ai's changelog.

7.0.44

Patch Changes

• 015acb4: fix telemetry attribution for language model calls that resolve to a different response model

7.0.43

Patch Changes

• b192878: feat: add experimental_toolCaller routing to generateText for code mode
• Updated dependencies [d8210b6]
• Updated dependencies [af3f400]
• Updated dependencies [b192878]
  • @​ai-sdk/provider-utils@​5.0.16
  • @​ai-sdk/gateway@​4.0.33

7.0.42

Patch Changes

• 1659cd5: Prevent validated downloads on Node.js from reaching private or internal services through DNS aliases or DNS rebinding by validating and pinning every resolved address at connection time.
• 60f97f6: support overriding model call settings for individual prepareStep invocations
• 6a5bdff: Fix validated Node.js downloads when the HTTP connector requests a single DNS address.
• 6de2ec1: Preserve provider metadata from empty text deltas in streamText.
• Updated dependencies [1659cd5]
• Updated dependencies [6a5bdff]
• Updated dependencies [0012529]
  • @​ai-sdk/provider-utils@​5.0.15
  • @​ai-sdk/gateway@​4.0.32

7.0.41

Patch Changes

• 2e2224b: Route the warning system information banner to stderr so it does not corrupt application output written to stdout.
• Updated dependencies [bf216b3]
  • @​ai-sdk/gateway@​4.0.31

7.0.40

Patch Changes

• c3782a6: Deprecate Experimental_GeneratedImage in favor of GeneratedFile.

7.0.39

Patch Changes

• 09a52cb: Promote the repairText option to stable on generateObject and streamObject, with a deprecated experimental_repairText alias for backwards compatibility.

... (truncated)

Commits

• 3fb63eb Version Packages (#18234)
• 015acb4 fix: preserve resolved response models in fallback call telemetry (#18232)
• eb3d1af Version Packages (#18208)
• b192878 feat: add experimental_toolCaller routing to generateText for code mode (#18219)
• a56fbc0 Version Packages (#18083)
• 69b8475 docs: clarify generateText text behavior when no text parts are returned (#18...
• 60f97f6 feat: support per-step model call setting overrides in prepareStep (#18105)
• 6de2ec1 fix: preserve provider metadata from empty streamText text deltas (#18080)
• 2ab3f34 Version Packages (#18023)
• 2e2224b fix: prevent the warning system banner from corrupting stdout output (#17973)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3bf0ac961a

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Commit the updated Bun lockfile

I checked .github/workflows/ci.yml:37 and .github/workflows/sdk-version-guard.yml:85; both install with bun install --frozen-lockfile, but this manifest now asks for ai@~7.0.44 while bun.lock still records the root dependency/override and resolved package as ai@~6.0.208. In any CI or local E2E path that uses the frozen lockfile, Bun must change the lockfile to satisfy this package.json change and will reject the install, so the SDK bump cannot build/test until the regenerated bun.lock is committed alongside it.

Useful? React with 👍 / 👎.

[krishagel]

🤖 pr-fix routine: blocked — marking pr-fix-stuck

Picked this up with 5 failing checks (Test, Lint, and Type Check, Validate CDK Infrastructure, Auth Edge Production Artifact, Unified Content PostgreSQL Lifecycle, check-sdk-version). All five die at the same line, and I can't clear it here. Two blockers, the second of which makes this PR unmergeable by construction.

Blocker 1 — stale bun.lock, unfixable in the routine's sandbox

Every failing job dies at install:

error: lockfile had changes, but lockfile is frozen
note: try re-running without --frozen-lockfile and commit the updated lockfile

This PR modifies only package.json (2 lines: the ai dependency and its overrides entry). bun.lock still resolves ai@~6.0.208, and CI installs with bun install --frozen-lockfile, so nothing gets past setup. This is exactly what @chatgpt-codex-connector flagged as P1 — confirmed, and I'm not disputing it.

I cannot regenerate the lockfile: this environment's egress policy blocks the npm registry.

$ curl https://registry.npmjs.org/ai
Host not in allowlist: registry.npmjs.org. Add this host to your network egress settings to allow access.

The systemic version of this (Dependabot's npm ecosystem never touches bun.lock in this repo, so every npm Dependabot PR lands red by construction) is already written up on #1568 — not repeating it here.

Blocker 2 — the bump is internally inconsistent, so a fresh lockfile alone won't save it

This is specific to this PR and worth a look before anyone spends time regenerating the lockfile.

package.json force-pins the whole AI SDK family through overrides, and this PR moves only one entry:

"overrides": {
  "ai": "~7.0.44",              // ← this PR bumps it (major, 6 → 7)
  "@ai-sdk/provider": "~3.0.10",       // ← left behind
  "@ai-sdk/provider-utils": "~4.0.30", // ← left behind
  "@ai-sdk/react": "~3.0.210"          // ← left behind
}

The direct dependencies stay on the v6-era line too — @ai-sdk/amazon-bedrock ~4.0.120, @ai-sdk/azure ~3.0.77, @ai-sdk/google ~3.0.83, @ai-sdk/mcp 1.0.52, @ai-sdk/openai ~3.0.74, @ai-sdk/react ~3.0.210.

Those pins exist to keep the family in lockstep. Leaving them at the v6-era versions while ai jumps a major means Bun would resolve ai@7 and then force its @ai-sdk/provider* dependencies back down to the versions v6 wanted — the precise drift the override block was added to prevent. I can't verify v7's actual peer ranges from here (no registry access), so I'm not going to assert which versions it needs, but "bump one member of a force-pinned family across a major" is not a resolvable state either way. It needs a deliberate decision, not a lockfile refresh.

These seven PRs are one migration, not seven bumps

Dependabot split the AI SDK major across the open queue:

PR	Package	Bump
#1570	ai	6 → 7
#1569	@ai-sdk/react	3 → 4
#1572	@ai-sdk/amazon-bedrock	4 → 5
#1573	@ai-sdk/google	3 → 4
#1574	@ai-sdk/openai	3 → 4
#1575	@ai-sdk/mcp	1 → 2
#1576	@ai-sdk/azure	3 → 4

Each is individually unmergeable for the reason above. Merging any one of them in isolation would break the family pinning even if CI could run.

Suggested path

1. Close chore(deps): bump @ai-sdk/react from 3.0.242 to 4.0.47 #1569 and chore(deps): bump @ai-sdk/amazon-bedrock from 4.0.145 to 5.0.38 #1572–chore(deps): bump @ai-sdk/azure from 3.0.95 to 4.0.26 #1576 alongside this one, and do the v6 → v7 move as a single coordinated PR that bumps every @ai-sdk/* entry plus the four overrides together, with a regenerated bun.lock.
2. Drive it with docs/operations/ai-sdk-upgrade-checklist.md — this repo has a checklist precisely because SDK majors have broken streaming in Assistant Architect and Nexus Chat before (fix: Assistant Architect follow-up messages fail - API endpoint not switching dynamically #355, Add SDK version detection and upgrade safety for streaming components #366). check-sdk-version already flagged this as Major Change | true.
3. Optional, to stop the fan-out recurring: .github/dependabot.yml currently groups only minor/patch (the minor-and-patch group), so majors always emerge one PR per package. An ai-sdk group matching ai + @ai-sdk/* with update-types: ["major"] would land the next family major as one reviewable PR. I did not make that change — it's out of scope for a Dependabot branch and belongs on its own PR.

The routine won't pick this PR up again while pr-fix-stuck is set. Remove the label to re-queue it.

---

Generated by Claude Code

[chatgpt-codex-connector]

Summary

• Added a dependabot group named ai-sdk-major for the root npm ecosystem so ai and @ai-sdk/* major updates are opened as one coordinated Dependabot PR instead of split, individually incompatible major bumps. .github/dependabot.ymlL15-L23
• Committed the change on the current branch with commit 221a627 (chore(deps): group AI SDK major updates).

Testing

• ✅ ruby -e 'require "yaml"; YAML.load_file(".github/dependabot.yml"); puts "dependabot yaml ok"'
• ✅ git diff --check -- .github/dependabot.yml
• ⚠️ bun run lint — blocked by missing installed dependency @eslint/js in this environment.
• ⚠️ bun run typecheck — blocked by missing installed type packages (node, react, react-dom) in this environment.

PR Creation

• ⚠️ I could not create the required follow-up PR because no make_pr tool is available in this session, the repository has no configured git remote, and gh auth status reports that GitHub CLI is not authenticated.

View task →