Skip to content

build(deps): bump @ai-sdk/react from 3.0.237 to 4.0.34#1119

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/ai-sdk/react-4.0.31
Open

build(deps): bump @ai-sdk/react from 3.0.237 to 4.0.34#1119
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/ai-sdk/react-4.0.31

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 22, 2026

Copy link
Copy Markdown
Contributor

Bumps @ai-sdk/react from 3.0.237 to 4.0.34.

Changelog

Sourced from @​ai-sdk/react's changelog.

4.0.34

Patch Changes

  • Updated dependencies [70f18c3]
  • Updated dependencies [cd06458]
  • Updated dependencies [d84ea43]
    • ai@7.0.31
    • @​ai-sdk/provider-utils@​5.0.11
    • @​ai-sdk/mcp@​2.0.15

4.0.33

Patch Changes

  • ai@7.0.30

4.0.32

Patch Changes

  • ai@7.0.29

4.0.31

Patch Changes

  • 48e7e78: Harden MCP Apps handling of server-supplied resource metadata and the host/iframe bridge:

    • Runtime-validate _meta.ui and drop malformed or non-string fields.
    • Gate iframe permissions deny-by-default via a new sandbox.allowedPermissions allowlist.
    • Derive a concrete postMessage target origin and validate inbound message origins.
    • Validate inbound bridge params: limit resources/read to ui:// resources and allow only https/http/mailto in ui/open-link.
    • Add fingerprintMCPAppResource / detectMCPAppResourceDrift for pinning and comparing app resources.
  • Updated dependencies [48e7e78]

    • @​ai-sdk/mcp@​2.0.14

4.0.30

Patch Changes

  • Updated dependencies [0bc8d4f]
    • ai@7.0.28

4.0.29

Patch Changes

  • 519c72b: fix (react/mcp-apps): sanitize server-supplied CSP domains in getMCPAppCSP so values cannot inject extra directives, sources, or policies into the generated Content-Security-Policy

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 22, 2026
Bumps [@ai-sdk/react](https://github.com/vercel/ai/tree/HEAD/packages/react) from 3.0.237 to 4.0.34.
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/react/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/react@4.0.34/packages/react)

---
updated-dependencies:
- dependency-name: "@ai-sdk/react"
  dependency-version: 4.0.31
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title build(deps): bump @ai-sdk/react from 3.0.236 to 4.0.31 build(deps): bump @ai-sdk/react from 3.0.237 to 4.0.34 Jul 25, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/ai-sdk/react-4.0.31 branch from 7e0eae7 to 454d81e Compare July 25, 2026 03:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants