[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
ai (source)	7.0.159 → 7.0.163
nitropack	2.13.5 → 2.13.6
nuxt (source)	4.6.3 → 4.6.4
typebox	1.4.3 → 1.4.4

---

Release Notes

vercel/ai (ai)

v7.0.163

Compare Source

Patch Changes

• 5d18351: fix(ai): detect downloaded audio types from bytes when servers return a generic or non-audio content type such as application/octet-stream

• 8da48db: Respect recordInputs and recordOutputs when delivering telemetry events to integrations and the ai:telemetry channel. Filter nested content and omit raw span results when content recording is disabled, while preserving application results.

• fd7e8a7: Preserve the order of text and complete function calls in streamed Google responses, including standalone thought signatures on empty text or reasoning parts.

  Keep provider metadata on empty text parts when converting results to response messages so it can be passed back in subsequent requests.

  Omit foreign-provider empty signature text when replaying history through Anthropic or Bedrock, preserving Bedrock’s existing native reasoning-history handling.

• 36802d4: Support native URL transcription with an optional provider capability, keeping existing file-generation contracts unchanged. Groq sends HTTP(S) audio URLs through its url parameter without downloading and re-uploading them, avoiding the attachment upload limit. Supplying a custom download function retains local download behavior.

  For telemetry integrations, TranscriptionEndEvent.audio.byteLength and audio.mediaType can now be undefined when a provider fetches the audio URL natively. Check for missing values before using them as a number or string. Downloaded and inline audio continue to report their metadata; streaming transcription metadata is unchanged.

  Strip media fragments before sending URLs to Groq. If Groq rejects a redirect, fall back to the existing secure local downloader and file upload rather than failing previously working URL inputs. Other provider errors are preserved.

• 933dae3: fix (ai): download deprecated file-url and image-url tool result content

  Tool result content parts that use the deprecated file-url and image-url
  types were converted to file parts with { type: 'url' } data, but they were
  never passed to the download function. When the model does not support the URL,
  the provider received a bare URL instead of the file contents, even though the
  replacement file part with { type: 'url' } data was downloaded and inlined.

  Downloaded legacy URL parts now use the same media type normalization as file
  parts, resolving generic types from the response header or image bytes.
  Legacy base64 data URLs also normalize to inline data with the media type from
  their data URL, matching replacement file parts.

• e0143b0: feat(ai): support provider-owned realtime transports

  Add an optional createTransport interface and provider connection capability.

• 934100c: Report the actual OpenAI Chat HTTP endpoint (also used by Azure Chat and Bedrock Mantle Chat) through optional request metadata and model-call end events. Record its host and port on OpenTelemetry chat spans without exposing URL credentials, paths, queries, or fragments. Expose only the sanitized HTTP origin in text and object generation results and step/finish callbacks. Providers that do not report an endpoint leave these attributes unset.

• c389374: fix(ai): infer union output types when passing a union of schemas to Output.object and Output.array

  Previously, passing a schema whose type is a union of schemas (e.g. a schema selected from a map at runtime) failed to type-check because the output type was inferred from the first union member only. The output type is now inferred as the union of the schemas' output types.

• 892af4d: feat (ai): re-export realtime server-connection and usage types

  Adds Experimental_RealtimeServerConnection, Experimental_RealtimeSessionIntent, and Experimental_RealtimeUsage aliases for the new experimental RealtimeModelV4 server-side spec types.

• 1a1da8d: stream steering messages to the ui and keep them in converted messages

• 41465fd: Expose optional transcription word timings separately from segments and accept shared timestampGranularities. Explicit provider timing settings take precedence. OpenAI now sends timestamp_granularities only with verbose_json and warns when a requested timing is unavailable or excluded.

• 9754014: Add typed streaming heartbeat parts. Anthropic emits them only with includePings: true (disabled by default), without requiring raw chunks. Core forwards pings through stream retries without storing them as generated content or sending them to UI message streams. Consumers with exhaustive stream-part switches must handle the new ping union variant when upgrading, even when the opt-in is disabled. Typed pings do not flush partial words during stream smoothing.

• 2e44144: Represent videos delivered directly to caller-managed storage with an explicit uploaded outcome. Video generation reports uploadedVideos without downloading or synthesizing video bytes; access video only when videos is nonempty.

• Updated dependencies [722d4a9]

• Updated dependencies [acea2b5]

• Updated dependencies [89aff56]

• Updated dependencies [41465fd]

• Updated dependencies [2e44144]

• Updated dependencies [36802d4]

• Updated dependencies [ef2dfb5]

• Updated dependencies [e0143b0]

• Updated dependencies [934100c]

• Updated dependencies [892af4d]

• Updated dependencies [892af4d]

• Updated dependencies [89aff56]

• Updated dependencies [32acf43]

• Updated dependencies [41465fd]

• Updated dependencies [9754014]

• Updated dependencies [4bb73b0]

• Updated dependencies [2e44144]

  • @​ai-sdk/gateway@4.0.136
  • @​ai-sdk/provider@4.0.36
  • @​ai-sdk/provider-utils@5.0.75

v7.0.162

Compare Source

Patch Changes

• 857ca45: Restore server-defined tool metadata, dynamic status, and title when validating tool approval continuations so approval policies receive the same tool definition fields as new model calls.
• 4d6d830: Support a single telemetry operation for durable WorkflowAgent runs, including the prompt, final output, steps, and tools. Events recorded in the workflow are reported on completion or suspension with their original timestamps. For OpenTelemetry, pass the same OpenTelemetryIdGenerator instance as the tracer provider's idGenerator and sampler and as new OpenTelemetry({ durable }). This explicit bridge carries parent trace context and sampling across steps, reports model spans live with provider requests nested beneath them, and reconstructs the enclosing invoke_agent tree when the run completes. Without the bridge, existing live per-model tracing is preserved. Add typed experimental durable context hooks for telemetry integrations; remove reliance on process-global ID-generator detection.
• Updated dependencies [fa15312]
  • @​ai-sdk/provider-utils@5.0.74
  • @​ai-sdk/gateway@4.0.135

v7.0.161

Compare Source

Patch Changes

• 51ca5b7: fix(ai): support cross-realm Uint8Array and ArrayBuffer in DefaultGeneratedFile
• 51ca5b7: fix(ai): handle cross-realm Uint8Array and ArrayBuffer in data-content and file-part-data
• 51ca5b7: fix(ai): support cross-realm binary buffers and circular structures in cloneModelMessages
• Updated dependencies [51ca5b7]
• Updated dependencies [dc6f1c3]
• Updated dependencies [4ae6986]
  • @​ai-sdk/provider-utils@5.0.73
  • @​ai-sdk/gateway@4.0.134

v7.0.160

Compare Source

Patch Changes

• a71172d: fix(ai): clarify inverted smoothStream prefix error message

• cf27969: add steering.queue() to send a message once the current task is done

• 17b6923: fix(ai): validate streamed data parts against dataPartSchemas

  processUIMessageStream looked up dataPartSchemas by the full chunk type (data-weather) instead of the bare part name (weather), so useChat / Chat never validated streamed data parts. Invalid data parts now raise a TypeValidationError.

• Updated dependencies [2099d45]

• Updated dependencies [d05ff62]

  • @​ai-sdk/gateway@4.0.133

nitrojs/nitro (nitropack)

v2.13.6

Compare Source

compare changes

🔒 Security

This release contains 3 security fixes and additional hardening for cache, proxy and redirect route rules. If you're on nitropack v2 (including Nuxt 3 and 4), please upgrade.

• GHSA-39r7-wfcx-99xg: Cached event handlers might share entries across HTTP methods or replay per-user Set-Cookie headers
• GHSA-rhhp-7488-3qwf: Proxy route rule scope bypass via empty // segment and prefix re-entry
• GHSA-pqxc-r4h5-jc95: Open redirect via backslash and control characters in wildcard redirect route rules

🔥 Performance

• externals: Memoize tryResolve per importer directory in node-externals (v2) (#​4800)

🩹 Fixes

• Add typeFrom support for autoimports exports generation (#​3963)
• cache: Only cache GET/HEAD and never store per-user responses (9c2691d9)
• route-rules: Validate final proxy/redirect target scope (353eff5c)
• route-rules: Prevent open redirect via backslash and control characters in wildcard redirects (f16a4fad)

Dependencies

• Update archiver to v8 (#​4936)

Preset Changes

• vercel: Support node.js 26 (#​4968)

❤️ Contributors

• Pooya Parsa (@​pi0)
• Ali Smesseim (@​ali-vercel)
• Liang Xu (@​lx3133584)
• Octavio Araiza (@​8ctavio)
• @​agustin18

nuxt/nuxt (nuxt)

v4.6.4

Compare Source

4.6.4 is a security release. It fixes eight advisories in Nuxt and pulls in nitropack 2.13.6, which fixes three more in Nitro. We recommend upgrading as soon as you can.

⚠️ Behaviour changes

These probably won't affect most apps, but it's worth flagging anyway:

1. Error details in production. When a page fails to render on the server, the error page and the payload now only carry message and data of errors you create with createError. Everything else is stripped.
2. Dev server Host checks. Webpack and rspack dev servers now reject requests with an unexpected Host header, as Vite already does. If you use a custom hostname or tunnel, you'll need to add it to the new devServer.allowedHosts option.
3. workspaceDir detection. When workspaceDir isn't set, Nuxt now only widens it past rootDir to an explicit workspace root or the closest git repository.
4. Nitropack cached routes. cache, swr and isr route rules now only cache GET and HEAD requests, and no longer store responses that set a cookie or send Cache-Control: private or no-store. Wildcard proxy and redirect rules also reject requests whose resolved target would leave the rule's scope.
5. Route rules and encoded slashes. Route rules now match paths that contain encoded slashes, so /api%2Fadmin is covered by a /api/** rule.

👉 Changelog

compare changes

🩹 Fixes

• nitro,nuxt: require unrouting 0.3.2 (768d21368)
• nitro: preserve wildcard tails in case-insensitive route rules (bf31e4cd8)
• nitro: require nitropack 2.13.6 (1b13c6981)
• nitro: keep leading double slash in renderer request path (75c12c6fb)
• nuxt: use unambiguous encoding for island hash (6f1b93c64)
• vite-server: resolve wildcard redirect tails from the matched segments (1e7dfa6a7)
• nuxt: do not expose details of untrusted thrown errors (8c56b71e4)
• nuxt: strip trailing slashes in linear time (97424dd21)
• nitro,webpack: include hosts the CLI allows after loading the config (8c11d965d)
• webpack: skip hot middleware for forbidden dev requests (3c9645326)
• rspack,webpack: reject unexpected Host headers in dev middleware (f8d64c9aa)
• schema,nitro,vite: add devServer.allowedHosts (3e1c7964e)
• nitro,nuxt: match route rules for paths with encoded slashes (084396b10)
• schema: only widen workspace dir to a declared workspace root (89d3306d1)
• nitro: only trust x-forwarded-proto in when opted-in (#​36818)
• nitro: stream the body read through a nuxt/server handler (#​36817)
• kit: suggest the specific fix when loading falls back to jiti (24d75659d)
• vite: use a single type checker (#​36774)
• nitro,vite: remove windows + virtual dev ssr css links after hydration (#​36765)
• nitro,vite: dedupe dev css by module node (#​36420)
• nuxt: avoid hoisting setup-only values from definePageMeta (#​36751)
• nuxt: only match hydration modifiers after lazy prefix (#​36750)
• kit,nitro,nuxt: make emitted tsconfig/types stable across reruns (#​36747)
• nuxt: render inlined component styles after stylesheet links (#​36714)
• webpack: use valid devtool for hidden client sourcemaps in dev (#​36555)

📖 Documentation

• clarify template dependency regeneration (#​36766)
• revise README structure and headings (#​36772)
• link the Nuxt DevTools docs on nuxt.com (#​36769)
• warn against spreading untrusted objects onto server components (1225ca7ff)
• update anchors for flat heading ids (#​36664)

🏡 Chore

• add 1000-row listing routes to the benchmark (c852d871f)
• add client page weight and browser timing suites (#​36788)

✅ Tests

• update bundle size snapshot (7528c3ce6)
• list new main-only diagnostic codes (545b5934c)
• tolerate node 26 proxy inspect output (40f72b40b)
• normalise rolldown comment (861e153dd)
• improve benchmark tests (#​36745)

🤖 CI

• check unversioned docs links against branch docs version (d093c88b1)
• skip unneeded checks for release prs (4b90681bd)
• skip benchmarks in merge groups (6428070e0)
• re-enable codspeed ⚡ (bc17c03d1)

❤️ Contributors

• Daniel Roe (@​danielroe)
• Max (@​onmax)
• Sébastien Chopin (@​atinux)
• saini-25 (@​saini-25)
• Baptiste Leproux (@​larbish)

sinclairzx81/typebox (typebox)

v1.4.4

Compare Source

---

Configuration

📅 Schedule: (in timezone Europe/Warsaw)

• Branch creation
  • "before 6am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coldtea-pr-lens]

Note

renovate[bot] opened this pull request, so PR Lens left it undrawn. Comment @pr-lens draw to draw it

_{github.comment.notice: false in .github/pr-lens.yml turns this note off}