chore(deps): update dependency ai to v6.0.204 by renovate[bot] · Pull Request #3496 · tailcallhq/forgecode · GitHub

This PR contains the following updates:

Package	Change	Age	Confidence
ai (source)	6.0.202 → 6.0.204

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

vercel/ai (ai)

v6.0.204

Compare Source

v6.0.203

Compare Source

Patch Changes

f42aa79: fix: harden download URL SSRF guard against hostname and redirect bypasses

validateDownloadUrl and the file download helpers (downloadBlob, download) could be bypassed in several ways when handling untrusted URLs:
- A fully-qualified hostname with a trailing dot (e.g. localhost., myhost.local.) skipped the localhost/.local blocklist.
- IPv6 addresses that embed an IPv4 address in their last 32 bits — IPv4-compatible (::127.0.0.1), IPv4-translated (::ffff:0:127.0.0.1), and NAT64 (64:ff9b::127.0.0.1, including the 64:ff9b:1::/48 local-use prefix) — were not decoded and checked against the private IPv4 ranges.
- Redirects were validated only after fetch had already followed them, so the request to a redirect target (e.g. an internal/metadata address) had already been issued before the check ran.
- Several reserved/internal address ranges were not blocked: CGNAT (100.64.0.0/10, used by some cloud providers for internal traffic), benchmarking (198.18.0.0/15), IETF protocol assignments (192.0.0.0/24), the reserved 240.0.0.0/4 block (including the 255.255.255.255 broadcast address), and IPv6 site-local (fec0::/10) and multicast (ff00::/8).
The validator now strips trailing dots before the hostname checks and fully expands IPv6 addresses to detect embedded private IPv4 targets. The download helpers now follow redirects manually (redirect: 'manual'), re-validating each hop before requesting it, so an unsafe redirect target is never fetched. When a redirect cannot be inspected because the runtime returns an opaque response, the helpers fail closed (reject the redirect) on the server; only in a real browser — where SSRF is not reachable (fetch is constrained by CORS and cannot reach a server's internal network or cloud-metadata endpoints) — is the redirect followed natively so legitimate redirected downloads keep working.
5291f7e: Harden stream text processing and middleware against prototype pollution from stream part IDs.
b4b575a: fix: redact server error details from UI message streams by default

streamText(...).toUIMessageStream() and createUIMessageStream defaulted their onError callback to getErrorMessage, which serializes the raw error (error.toString() / JSON.stringify(error)) into the client-facing { type: 'error', errorText } chunk — and also into tool-output-error parts. The documented default was () => 'An error occurred.', so applications relying on the documented behavior were unknowingly streaming server exception details (internal hostnames, paths, provider request data, validation inputs) to end users.

The default onError now returns the documented generic 'An error occurred.'. Raw error details are only emitted when the developer explicitly supplies an onError handler. This also redacts tool-output-error and invalid-tool-input error text by default; pass an onError to surface richer messages.
Updated dependencies [bfa5864]
Updated dependencies [f42aa79]
- @ai-sdk/provider-utils@4.0.29
- @ai-sdk/gateway@3.0.129

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

…tion, and loop commands (#20) * fix: pin reedline to 0.47.0 (tailcallhq#3398) Co-authored-by: ForgeCode <noreply@forgecode.dev> Co-authored-by: laststylebender <43403528+laststylebender14@users.noreply.github.com> * chore(deps): update rust crate reedline to v0.48.0 (tailcallhq#3406) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * Revert "chore(deps): update rust crate reedline to v0.48.0" (tailcallhq#3409) * fix(openai_responses): handle codex response completed/incomplete events (tailcallhq#3405) * chore(deps): update rust crate posthog-rs to v0.7.2 (tailcallhq#3410) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update dependency @ai-sdk/google-vertex to v4.0.140 (tailcallhq#3412) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update dependency ai to v6.0.192 (tailcallhq#3413) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * fix(provider): add model entries to provider.json and vertex.json (tailcallhq#3414) * chore(deps): update rust crate posthog-rs to v0.7.3 (tailcallhq#3415) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update rust crate aws-sdk-bedrockruntime to v1.132.0 (tailcallhq#3416) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * fix: apply Opus 4.7 API contract to Claude Opus 4.8 (tailcallhq#3418) Co-authored-by: ForgeCode <noreply@forgecode.dev> * refactor(editor): replace reedline with rustyline completer (tailcallhq#3399) Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> * fix(minimax): MiniMax M3 model support (tailcallhq#3434) Co-authored-by: ForgeCode <noreply@forgecode.dev> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> * fix(gemini): strip propertyNames from tool schemas (tailcallhq#3426) Co-authored-by: Amit Singh <amitksingh1490@gmail.com> * fix(http): map invalid response status to openai error (tailcallhq#3439) * chore(deps): update aws-sdk-rust monorepo (tailcallhq#3420) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update dependency @ai-sdk/google-vertex to v4.0.142 (tailcallhq#3440) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update dependency ai to v6.0.197 (tailcallhq#3444) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update dependency tsx to v4.22.4 (tailcallhq#3427) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update rust crate chrono to v0.4.45 (tailcallhq#3445) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update rust crate diesel to v2.3.10 (tailcallhq#3446) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update rust crate unicode-segmentation to v1.13.3 (tailcallhq#3431) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update rust crate uuid to v1.23.2 (tailcallhq#3421) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update dependency @types/node to v24.13.0 (tailcallhq#3447) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update rust to 1.96 (tailcallhq#3419) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update rust crate ignore to v0.4.26 (tailcallhq#3453) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update rust crate google-cloud-auth to v1.12.0 (tailcallhq#3449) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update rust crate serial_test to v3.5.0 (tailcallhq#3423) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * fix(deps): update rust crate posthog-rs to 0.9.0 (tailcallhq#3451) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * fix(deps): update rust crate posthog-rs to 0.10.0 (tailcallhq#3455) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * fix(provider): Ambient as a built-in verified-inference provider (tailcallhq#3389) Co-authored-by: Amit Singh <amitksingh1490@gmail.com> * chore(deps): update dependency @types/node to v24.13.1 (tailcallhq#3458) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Amit Singh <amitksingh1490@gmail.com> * build(deps): bump brace-expansion from 5.0.5 to 5.0.6 (tailcallhq#3359) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix(openai_responses): preserve 503 retryable errors in stream (tailcallhq#3460) Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> * fix(select): ignore key Release events so pickers do not close instantly on Windows (tailcallhq#3462) Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * fix(editor): strip ANSI from rustyline prompt raw() so the cursor tracks on Windows (tailcallhq#3461) Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: Amit Singh <amitksingh1490@gmail.com> * chore(deps): update tokio-prost monorepo to v0.14.4 (tailcallhq#3467) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update dependency ai to v6.0.198 (tailcallhq#3470) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update rust crate http to v1.4.2 (tailcallhq#3471) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update rust crate uuid to v1.23.3 (tailcallhq#3473) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update dependency @ai-sdk/google-vertex to v4.0.143 (tailcallhq#3475) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update dependency ai to v6.0.199 (tailcallhq#3476) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * fix(anthropic): support for claude mythos and fable models (tailcallhq#3474) * chore(deps): update rust crate regex to v1.12.4 (tailcallhq#3478) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update dependency ai to v6.0.200 (tailcallhq#3481) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update dependency @types/node to v24.13.2 (tailcallhq#3483) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update dependency ai to v6.0.201 (tailcallhq#3484) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update rust crate insta to v1.48.0 (tailcallhq#3486) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update dependency @ai-sdk/google-vertex to v4.0.144 (tailcallhq#3488) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update dependency ai to v6.0.202 (tailcallhq#3489) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update rust crate rmcp to v1 [security] (tailcallhq#3277) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Amit Singh <amitksingh1490@gmail.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> * build(deps): bump openssl from 0.10.78 to 0.10.80 (tailcallhq#3364) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Amit Singh <amitksingh1490@gmail.com> * fix(config): config auto_install_vscode_extension option (tailcallhq#3485) Co-authored-by: laststylebender <43403528+laststylebender14@users.noreply.github.com> * chore(deps): update rust crate aws-smithy-types to v1.5.0 (tailcallhq#3490) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update rust crate async-openai to 0.41.0 (tailcallhq#3078) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Amit Singh <amitksingh1490@gmail.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> * feat(provider): add claude-fable-5 to vertex_ai_anthropic models (tailcallhq#3480) Co-authored-by: akhilapp <akhilapp@google.com> Co-authored-by: Amit Singh <amitksingh1490@gmail.com> * chore(deps): update rust crate google-cloud-auth to v1.13.0 (tailcallhq#3491) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * fix(deps): update rust crate posthog-rs to 0.11.0 (tailcallhq#3487) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * fix(forge_select): enter alternate screen to keep prompt visible (tailcallhq#3492) Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> * fix(zsh): pad _forge_reset to avoid zle clearing output (tailcallhq#3494) * chore(deps): update dependency @ai-sdk/google-vertex to v4.0.145 (tailcallhq#3495) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * fix(deps): update rust crate posthog-rs to 0.12.0 (tailcallhq#3498) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update dependency ai to v6.0.204 (tailcallhq#3496) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update rust crate aws-sdk-bedrockruntime to v1.134.0 (tailcallhq#3499) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * fix(provider): add missing fireworks models in provider.json (tailcallhq#3504) * fix(provider): add z.ai glm-5.2 model to provider.json (tailcallhq#3505) * chore(deps): update dependency ai to v6.0.205 (tailcallhq#3509) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * fix: show only direct conversation initiated by the user via the `:conversation` command (tailcallhq#3510) Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> * feat: add parent_id, source, FTS5, subagent hiding, and loop commands * fix(ui): apply user_initiated_conversations filter to SelectCommand::Conversation --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: Amit Singh <amitksingh1490@gmail.com> Co-authored-by: ForgeCode <noreply@forgecode.dev> Co-authored-by: laststylebender <43403528+laststylebender14@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Imamuzzaki Abu Salam <imamuzzaki@gmail.com> Co-authored-by: Pascal <git@pascalbrokmeier.de> Co-authored-by: Gregory <205641639+ambient-gregory@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: resrever <scottyoung@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: Sandipsinh Dilipsinh Rathod <zotbysandip@gmail.com> Co-authored-by: Akhil Appana <akhil.appana@gmail.com> Co-authored-by: akhilapp <akhilapp@google.com> Co-authored-by: Tushar Mathur <tusharmath@gmail.com> Co-authored-by: Phenotype Agent <agent@phenotype.ai>

renovate Bot enabled auto-merge (squash) June 12, 2026 20:02

github-actions Bot added the type: chore Routine tasks like conversions, reorganization, and maintenance work. label Jun 12, 2026

renovate Bot force-pushed the renovate/ai-6.x-lockfile branch 2 times, most recently from 285b913 to bb92d2f Compare June 13, 2026 02:07

renovate Bot changed the title chore(deps): update dependency ai to v6.0.203 chore(deps): update dependency ai to v6.0.204 Jun 13, 2026

chore(deps): update dependency ai to v6.0.204

181684c

renovate Bot force-pushed the renovate/ai-6.x-lockfile branch from bb92d2f to 181684c Compare June 13, 2026 02:08

renovate Bot merged commit b5a91a3 into main Jun 13, 2026
10 checks passed

renovate Bot deleted the renovate/ai-6.x-lockfile branch June 13, 2026 05:47

chore(deps): update dependency ai to v6.0.204 by renovate[bot] · Pull Request #3496 · tailcallhq/forgecode · GitHub

Uh oh!

chore(deps): update dependency ai to v6.0.204 - #3496

chore(deps): update dependency ai to v6.0.204#3496
renovate[bot] merged 1 commit into
mainfrom
renovate/ai-6.x-lockfile

renovate Bot commented Jun 12, 2026 •
edited
Loading

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

chore(deps): update dependency ai to v6.0.204 by renovate[bot] · Pull Request #3496 · tailcallhq/forgecode · GitHub

Uh oh!

chore(deps): update dependency ai to v6.0.204 - #3496

chore(deps): update dependency ai to v6.0.204#3496renovate[bot] merged 1 commit intomaintailcallhq/forgecode:mainfrom renovate/ai-6.x-lockfiletailcallhq/forgecode:renovate/ai-6.x-lockfileCopy head branch name to clipboard

Conversation

renovate Bot commented Jun 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v6.0.204

v6.0.203

Patch Changes

Configuration

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

chore(deps): update dependency ai to v6.0.204#3496
renovate[bot] merged 1 commit into
mainfrom
renovate/ai-6.x-lockfile

renovate Bot commented Jun 12, 2026 •
edited
Loading