Skip to content

build(deps): bump ai from 6.0.206 to 6.0.207 in /typescript in the ai-runtime group across 1 directory#464

Merged
matoous merged 1 commit into
mainfrom
dependabot/npm_and_yarn/typescript/ai-runtime-1e138f428a
Jun 27, 2026
Merged

build(deps): bump ai from 6.0.206 to 6.0.207 in /typescript in the ai-runtime group across 1 directory#464
matoous merged 1 commit into
mainfrom
dependabot/npm_and_yarn/typescript/ai-runtime-1e138f428a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the ai-runtime group with 1 update in the /typescript directory: ai.

Updates ai from 6.0.206 to 6.0.207

Changelog

Sourced from ai's changelog.

6.0.207

Patch Changes

  • 779f5cd: fix(provider-utils): cancel response body on download rejection to prevent socket leak

    When a download was rejected early — because the Content-Length header exceeded the size limit, the response status was not ok, or a redirect resolved to a blocked URL — the fetch response body was left unconsumed and uncancelled. With WHATWG Fetch/undici this leaves the underlying TCP socket open instead of returning it to the connection pool, allowing an attacker-controlled origin to exhaust file descriptors and cause a denial of service. The body is now cancelled on all early-rejection paths in readResponseWithSizeLimit, download, and downloadBlob, and fetchWithValidatedRedirects cancels each redirect hop's body before following or rejecting the next hop.

  • Updated dependencies [5bfde36]

  • Updated dependencies [779f5cd]

    • @​ai-sdk/gateway@​3.0.133
    • @​ai-sdk/provider-utils@​4.0.30
Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 24, 2026
@dependabot
build(deps): bump ai
17c7950 
Bumps the ai-runtime group with 1 update in the /typescript directory: [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai).


Updates `ai` from 6.0.206 to 6.0.207
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/ai@6.0.207/packages/ai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/ai@6.0.207/packages/ai)

---
updated-dependencies:
- dependency-name: ai
  dependency-version: 6.0.207
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ai-runtime
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title build(deps): bump ai from 6.0.206 to 6.0.207 in /typescript in the ai-runtime group build(deps): bump ai from 6.0.206 to 6.0.207 in /typescript in the ai-runtime group across 1 directory Jun 24, 2026
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/typescript/ai-runtime-1e138f428a branch from 06650c9 to 17c7950 Compare June 24, 2026 11:58
@matoous matoous merged commit 63c04ab into main Jun 27, 2026
7 checks passed
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/typescript/ai-runtime-1e138f428a branch June 27, 2026 20:22
@github-actions github-actions Bot mentioned this pull request Jun 27, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@matoous matoous matoous approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@matoous