Skip to content

chore(deps): bump the major-updates group across 3 directories with 4 updates - #81

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/major-updates-b3c7cab28d
Closed

chore(deps): bump the major-updates group across 3 directories with 4 updates#81
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/major-updates-b3c7cab28d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the major-updates group with 4 updates in the / directory: @ai-sdk/google, @fastify/rate-limit, @types/node and typescript.
Bumps the major-updates group with 2 updates in the /packages/specter-roast directory: @types/node and typescript.
Bumps the major-updates group with 2 updates in the /vscode-extension directory: @types/node and typescript.

Updates @ai-sdk/google from 3.0.91 to 4.0.18

Release notes

Sourced from @​ai-sdk/google's releases.

@​ai-sdk/google@​3.0.110

Patch Changes

  • Updated dependencies [31205a4]
    • @​ai-sdk/provider-utils@​4.0.46

@​ai-sdk/google@​3.0.109

Patch Changes

  • 71e94ad: feat(google): add gemini-3.7-flash model
Changelog

Sourced from @​ai-sdk/google's changelog.

4.0.18

Patch Changes

  • Updated dependencies [cd06458]
    • @​ai-sdk/provider-utils@​5.0.11

4.0.17

Patch Changes

  • 5b4a299: fix(provider/google): forward Vertex-only imageConfig options (personGeneration, prominentPeople, imageOutputOptions)

4.0.16

Patch Changes

  • 662ddfc: Allow google.interactions agent requests to include supported tools, including file_search.

4.0.15

Patch Changes

  • Updated dependencies [31c7be8]
    • @​ai-sdk/provider-utils@​5.0.10

4.0.14

Patch Changes

  • 4be62c1: fix(provider-utils): validate provider-response URLs in getFromApi

    getFromApi now has a validateUrl flag. It is optional so existing callers keep compiling (omitting it behaves like false, i.e. no validation), but all AI SDK provider packages set it explicitly at every call site so each one makes a visible trust decision. When true, the URL is routed through fetchWithValidatedRedirects — the same guard used by downloadBlob — which rejects private/loopback/link-local targets, re-validates every redirect hop, strips proxy/metadata/cookie request headers, and drops all caller headers except the user-agent on cross-origin redirects (custom API-key headers must not follow a redirect off-origin any more than Authorization may); blocked URLs throw DownloadError. It is enabled at the image/video/audio download and polling call sites where the URL comes from a provider response body; URLs built from developer-configured endpoints pass validateUrl: false and are unaffected.

    A new optional credentialedOrigin withholds caller headers unless the URL is same-origin with it, so the API key is not sent to a response-supplied host on a different origin.

    A new optional trustedOrigin exempts URLs (and redirect hops) that are same-origin with the developer-configured provider endpoint from target validation, so self-hosted and localhost deployments whose response URLs point back at the configured host keep working; all other hops are still validated.

    Also closes range gaps in validateDownloadUrl (IPv4 224.0.0.0/4 multicast and the TEST-NET documentation ranges 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24; IPv6 documentation ranges 2001:db8::/32 and 3fff::/20), and follows only the fetch-spec redirect status codes (301/302/303/307/308) — a Location header on any other status is not followed. This guard performs string/literal checks only and does not resolve DNS; hostnames that resolve to private addresses and DNS rebinding remain out of scope and must be constrained at the network layer (or by injecting a Node fetch that pins the resolved IP at connect time) for server deployments handling untrusted URLs. See contributing/secure-url-handling.md.

  • Updated dependencies [4be62c1]

  • Updated dependencies [7805e4a]

  • Updated dependencies [cd12954]

    • @​ai-sdk/provider-utils@​5.0.9

4.0.13

Patch Changes

  • Updated dependencies [e193290]

... (truncated)

Commits

Updates @fastify/rate-limit from 10.3.0 to 11.1.0

Release notes

Sourced from @​fastify/rate-limit's releases.

v11.1.0

What's Changed

New Contributors

Full Changelog: fastify/fastify-rate-limit@v11.0.0...v11.1.0

v11.0.0

What's Changed

New Contributors

Full Changelog: fastify/fastify-rate-limit@v10.3.0...v11.0.0

Commits
  • d7d6086 Bumped v11.1.0
  • c76be97 feat: add increment option to createRateLimit (#449)
  • f65adef chore(package.json): fix delvedor's personal url
  • fd252f0 chore: Bump fastify-plugin from 5.1.0 to 6.0.0 in the dependencies group (#450)
  • 0ab984d chore: update depedabot setting (#447)
  • 40537e6 11.0.0
  • a7115c4 Fix Unsafe SQL Queries in Knex Example Files (#446)
  • 5905f11 chore: removed types deprecated
  • 65053cb chore(.gitattributes): retain binary file eol style (#442)
  • 1020c25 refactor(types): migrate from tsd to tstyche (#443)
  • Additional commits viewable in compare view

Updates @types/node from 25.9.4 to 26.1.1

Commits

Updates typescript from 6.0.3 to 7.0.2

Commits
Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.


Updates @types/node from 25.9.4 to 26.1.1

Commits

Updates typescript from 6.0.3 to 7.0.2

Commits
Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.


Updates @types/node from 25.9.4 to 26.1.1

Commits

Updates typescript from 6.0.3 to 7.0.2

Commits
Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.


Updates @types/node from 25.9.5 to 26.1.1

Commits

Updates typescript from 6.0.3 to 7.0.2

Commits
Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.


Updates @types/node from 25.9.5 to 26.1.1

Commits

Updates typescript from 6.0.3 to 7.0.2

Commits
Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.


Updates @types/node from 25.9.5 to 26.1.1

Commits

Updates typescript from 6.0.3 to 7.0.2

Commits
Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.


Updates @types/node from 25.9.4 to 26.1.1

Commits

Updates typescript from 6.0.3 to 7.0.2

Commits
Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 10, 2026
@socket-security

socket-security Bot commented Aug 10, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Added@​ai-sdk/​google@​3.0.110721008898100
Updated@​types/​node@​25.9.5 ⏵ 26.1.1100 +110081 +195100
Added@​fastify/​rate-limit@​11.1.010010010094100

View full report

@github-actions

github-actions Bot commented Aug 10, 2026

Copy link
Copy Markdown

👻 Specter Analysis

Metric Value
Health Score 0/100 🔴
PR Risk Low 🟢
Files Changed -
Est. Review Time ~5 min

Generated by Specter - Give your codebase a voice

@dependabot
chore(deps): bump the major-updates group across 3 directories with 4…
f62b11a 
… updates

Bumps the major-updates group with 4 updates in the / directory: [@ai-sdk/google](https://github.com/vercel/ai/tree/HEAD/packages/google), [@fastify/rate-limit](https://github.com/fastify/fastify-rate-limit), [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) and [typescript](https://github.com/microsoft/TypeScript).
Bumps the major-updates group with 2 updates in the /packages/specter-roast directory: [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) and [typescript](https://github.com/microsoft/TypeScript).
Bumps the major-updates group with 2 updates in the /vscode-extension directory: [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) and [typescript](https://github.com/microsoft/TypeScript).


Updates `@ai-sdk/google` from 3.0.91 to 4.0.18
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/google/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/google@4.0.18/packages/google)

Updates `@fastify/rate-limit` from 10.3.0 to 11.1.0
- [Release notes](https://github.com/fastify/fastify-rate-limit/releases)
- [Commits](fastify/fastify-rate-limit@v10.3.0...v11.1.0)

Updates `@types/node` from 25.9.4 to 26.1.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `typescript` from 6.0.3 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](https://github.com/microsoft/TypeScript/commits)

Updates `@types/node` from 25.9.4 to 26.1.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `typescript` from 6.0.3 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](https://github.com/microsoft/TypeScript/commits)

Updates `@types/node` from 25.9.4 to 26.1.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `typescript` from 6.0.3 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](https://github.com/microsoft/TypeScript/commits)

Updates `@types/node` from 25.9.5 to 26.1.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `typescript` from 6.0.3 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](https://github.com/microsoft/TypeScript/commits)

Updates `@types/node` from 25.9.5 to 26.1.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `typescript` from 6.0.3 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](https://github.com/microsoft/TypeScript/commits)

Updates `@types/node` from 25.9.5 to 26.1.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `typescript` from 6.0.3 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](https://github.com/microsoft/TypeScript/commits)

Updates `@types/node` from 25.9.4 to 26.1.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `typescript` from 6.0.3 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](https://github.com/microsoft/TypeScript/commits)

---
updated-dependencies:
- dependency-name: "@ai-sdk/google"
  dependency-version: 4.0.12
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: major-updates
- dependency-name: "@fastify/rate-limit"
  dependency-version: 11.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: major-updates
- dependency-name: "@types/node"
  dependency-version: 26.1.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: major-updates
- dependency-name: "@types/node"
  dependency-version: 26.1.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: major-updates
- dependency-name: "@types/node"
  dependency-version: 26.1.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: major-updates
- dependency-name: "@types/node"
  dependency-version: 26.1.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: major-updates
- dependency-name: "@types/node"
  dependency-version: 26.1.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: major-updates
- dependency-name: "@types/node"
  dependency-version: 26.1.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: major-updates
- dependency-name: "@types/node"
  dependency-version: 26.1.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: major-updates
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: major-updates
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: major-updates
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: major-updates
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: major-updates
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: major-updates
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: major-updates
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: major-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/major-updates-b3c7cab28d branch from 60fca68 to f62b11a Compare August 17, 2026 07:38
@dependabot @github

dependabot Bot commented on behalf of github Aug 24, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Aug 24, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/major-updates-b3c7cab28d branch August 24, 2026 07:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants