chore(deps): align dependencies with upstream, including two majors - #425
Merged
Conversation
Port of nuxt/ui@6bcc97a6 (#6849). Taken as an alignment to upstream's versions rather than a replay of the deltas, because this fork had drifted behind on several packages. What upstream shipped as a non-major batch therefore includes two major jumps here: `ai` ^6.0.214 -> ^7.0.66 and `@ai-sdk/vue` ^3.0.214 -> ^4.0.66. The other twelve are patch or minor. Per PORTING.md §2 the manifests mirror across all b24ui playgrounds, not the two upstream has. `playgrounds/demo` carries `ai`, `@ai-sdk/vue` and `vue-tsc` and moves with the rest; its `vue-tsc` sat further behind than everything else at ^3.3.7, which only a per-playground pass finds. `playgrounds/repl` carries none of them. `nuxt-schema-org` is held at ^6.2.1. Not a judgement call — the newer versions do not run: [error] (0 , _kit3.useModuleLogger) is not a function at setup (nuxt-schema-org@6.2.9/dist/module.mjs:98:46) The cause is transitive. Every published `nuxt-schema-org` from 6.2.1 to 6.2.9 imports only symbols `@nuxt/kit@4.5.2` exports — all nine checked against the 98 exported names, none missing. What breaks is `nuxt-site-config`, which any bump above 6.2.1 drags from 4.0.8 to 4.2.3, and 4.2.3 calls `useModuleLogger` and `setupNitroRuntimeCompatibility`. Neither exists in `@nuxt/kit@4.5.2`, which is the newest published 4.x, so no Nuxt version available today fixes it. Pinning 6.2.7 was tried first and fails one function earlier, which is what identified `nuxt-site-config` as the constraint rather than `nuxt-schema-org` itself. Upstream carries the same defect and does not see it: their lockfile at this commit resolves `nuxt-schema-org@6.2.9` on the same `@nuxt/kit` `^4.5.2`. It stays latent because neither CI builds the docs site — here it surfaced in `dev:prepare`, which prepares `docs/` as well. Restoring the caret alone was not enough: ^6.2.1 is satisfied by 6.2.7, so pnpm kept the newer resolution. The lockfile had to be restored from HEAD before reinstalling, after which the manifest entry is byte-identical to before and the resolution is back to 6.2.1 with nuxt-site-config 4.0.8. Verify (CI=true): dev:prepare across all four apps · lint · typecheck · test (6546 passed, 6 skipped, 288 files) · build · docs:generate (1240 routes) — all green. typecheck carries the weight for the two majors, since every `ai` / `@ai-sdk/vue` call site lives under `docs/`. One caveat, stated rather than glossed: the AI features compile and prerender, but their runtime paths were not exercised. `docs:generate` runs with NUXT_PUBLIC_USE_AI=false and no DEEPSEEK_API_KEY, so a v7 behavioural change inside a request handler would not surface in any check run here.
IgorShevchik
force-pushed
the
sync/nuxt-6bcc97a
branch
from
August 18, 2026 04:05
5f841a5 to
5d8594b
Compare
This was referenced Aug 18, 2026
IgorShevchik
pushed a commit
that referenced
this pull request
Aug 19, 2026
#425 took `ai` from ^6.0.214 to ^7.0.66 and left the DeepSeek provider behind. `ai@7` resolves `@ai-sdk/provider@4`; `@ai-sdk/deepseek@2.0.38` and `@ai-sdk/mcp@1.0.52` implement `@ai-sdk/provider@3`. Two majors of the provider spec in one tree, with the assistant talking across the gap. Bumped to ^3.0.28 and 2.0.32, in `docs/` and in both Nuxt playgrounds — they declare `@ai-sdk/deepseek` too, and fixing only `docs/` would have left the same mismatch in place. The lockfile now resolves a single `@ai-sdk/provider@4.0.7`, down from two. `@ai-sdk/mcp` is pinned exactly rather than with a caret, and that is the second finding. Reaching for the newest, `2.0.33`, published the previous day, made pnpm **silently append it to `minimumReleaseAgeExclude`** in `pnpm-workspace.yaml` instead of refusing — a supply-chain policy waived by a line that reads as ordinary config. `2.0.32` carries the same `@ai-sdk/provider@4.0.7`, so the newer release bought nothing; the exclusion list is back to the single entry it had before. Nothing in the gate could have caught the version mismatch, which is the part worth recording. The provider packages peer-depend on `zod`, not on `ai`, so pnpm stays quiet. `typecheck` passes because the provider is still a valid module. `docs:generate` runs with NUXT_PUBLIC_USE_AI=false and no DEEPSEEK_API_KEY, so the request path is never exercised. The break would have first appeared to a user. `dep-parity.json` could not have caught it either, by construction: it records only packages both trees declare, and `@ai-sdk/deepseek` and `@ai-sdk/mcp` are fork-only — this fork's assistant runs on DeepSeek, so upstream's `chore(deps)` batches never mention them. §2 now carries that as an invariant, with the check to run when `ai` moves a major, and the `minimumReleaseAgeExclude` trap alongside it. Also corrects the record. #425 described the version gap as accidental drift. It was not: six ledger entries show the v6 line was a deliberate deferral — `c8e810ca` reads "ai (v6 line, deferred v7), @ai-sdk/vue (v3)" and `229b64f6` reads "ai+@ai-sdk/* (v6 line + DeepSeek)" — deferred for exactly the coupling that then broke. The bump was still the right call and was made on instruction, but it ended a considered decision rather than correcting an oversight. Found while checking why upstream's `CLAUDE.md` commit did not apply here, which surfaced the `.gitignore` entry added in `b55bd3e7` and, in that commit's body, the deferral note. Verify (CI=true): pnpm install --frozen-lockfile · dev:prepare across all four apps · lint · typecheck · test (6708 passed, 6 skipped, 294 files) · build · docs:generate (1240 routes) — all green. The load-bearing check is not the suite but the resolution: one `@ai-sdk/provider` version across the whole lockfile.
IgorShevchik
pushed a commit
that referenced
this pull request
Aug 19, 2026
#425 took `ai` from ^6.0.214 to ^7.0.66 and left the DeepSeek provider behind. `ai@7` resolves `@ai-sdk/provider@4`; `@ai-sdk/deepseek@2.0.38` and `@ai-sdk/mcp@1.0.52` implement `@ai-sdk/provider@3`. Two majors of the provider spec in one tree, with the assistant talking across the gap. Bumped to ^3.0.28 and 2.0.32, in `docs/` and in both Nuxt playgrounds — they declare `@ai-sdk/deepseek` too, and fixing only `docs/` would have left the same mismatch in place. The lockfile now resolves a single `@ai-sdk/provider@4.0.7`, down from two. `@ai-sdk/mcp` is pinned exactly rather than with a caret, and that is the second finding. Reaching for the newest, `2.0.33`, published the previous day, made pnpm **silently append it to `minimumReleaseAgeExclude`** in `pnpm-workspace.yaml` instead of refusing — a supply-chain policy waived by a line that reads as ordinary config. `2.0.32` carries the same `@ai-sdk/provider@4.0.7`, so the newer release bought nothing; the exclusion list is back to the single entry it had before. Nothing in the gate could have caught the version mismatch, which is the part worth recording. The provider packages peer-depend on `zod`, not on `ai`, so pnpm stays quiet. `typecheck` passes because the provider is still a valid module. `docs:generate` runs with NUXT_PUBLIC_USE_AI=false and no DEEPSEEK_API_KEY, so the request path is never exercised. The break would have first appeared to a user. `dep-parity.json` could not have caught it either, by construction: it records only packages both trees declare, and `@ai-sdk/deepseek` and `@ai-sdk/mcp` are fork-only — this fork's assistant runs on DeepSeek, so upstream's `chore(deps)` batches never mention them. §2 now carries that as an invariant, with the check to run when `ai` moves a major, and the `minimumReleaseAgeExclude` trap alongside it. Also corrects the record. #425 described the version gap as accidental drift. It was not: six ledger entries show the v6 line was a deliberate deferral — `c8e810ca` reads "ai (v6 line, deferred v7), @ai-sdk/vue (v3)" and `229b64f6` reads "ai+@ai-sdk/* (v6 line + DeepSeek)" — deferred for exactly the coupling that then broke. The bump was still the right call and was made on instruction, but it ended a considered decision rather than correcting an oversight. Found while checking why upstream's `CLAUDE.md` commit did not apply here, which surfaced the `.gitignore` entry added in `b55bd3e7` and, in that commit's body, the deferral note. Verify (CI=true): pnpm install --frozen-lockfile · dev:prepare across all four apps · lint · typecheck · test (6708 passed, 6 skipped, 294 files) · build · docs:generate (1240 routes) — all green. The load-bearing check is not the suite but the resolution: one `@ai-sdk/provider` version across the whole lockfile.
IgorShevchik
added a commit
that referenced
this pull request
Aug 19, 2026
…438) #425 took `ai` from ^6.0.214 to ^7.0.66 and left the DeepSeek provider behind. `ai@7` resolves `@ai-sdk/provider@4`; `@ai-sdk/deepseek@2.0.38` and `@ai-sdk/mcp@1.0.52` implement `@ai-sdk/provider@3`. Two majors of the provider spec in one tree, with the assistant talking across the gap. Bumped to ^3.0.28 and 2.0.32, in `docs/` and in both Nuxt playgrounds — they declare `@ai-sdk/deepseek` too, and fixing only `docs/` would have left the same mismatch in place. The lockfile now resolves a single `@ai-sdk/provider@4.0.7`, down from two. `@ai-sdk/mcp` is pinned exactly rather than with a caret, and that is the second finding. Reaching for the newest, `2.0.33`, published the previous day, made pnpm **silently append it to `minimumReleaseAgeExclude`** in `pnpm-workspace.yaml` instead of refusing — a supply-chain policy waived by a line that reads as ordinary config. `2.0.32` carries the same `@ai-sdk/provider@4.0.7`, so the newer release bought nothing; the exclusion list is back to the single entry it had before. Nothing in the gate could have caught the version mismatch, which is the part worth recording. The provider packages peer-depend on `zod`, not on `ai`, so pnpm stays quiet. `typecheck` passes because the provider is still a valid module. `docs:generate` runs with NUXT_PUBLIC_USE_AI=false and no DEEPSEEK_API_KEY, so the request path is never exercised. The break would have first appeared to a user. `dep-parity.json` could not have caught it either, by construction: it records only packages both trees declare, and `@ai-sdk/deepseek` and `@ai-sdk/mcp` are fork-only — this fork's assistant runs on DeepSeek, so upstream's `chore(deps)` batches never mention them. §2 now carries that as an invariant, with the check to run when `ai` moves a major, and the `minimumReleaseAgeExclude` trap alongside it. Also corrects the record. #425 described the version gap as accidental drift. It was not: six ledger entries show the v6 line was a deliberate deferral — `c8e810ca` reads "ai (v6 line, deferred v7), @ai-sdk/vue (v3)" and `229b64f6` reads "ai+@ai-sdk/* (v6 line + DeepSeek)" — deferred for exactly the coupling that then broke. The bump was still the right call and was made on instruction, but it ended a considered decision rather than correcting an oversight. Found while checking why upstream's `CLAUDE.md` commit did not apply here, which surfaced the `.gitignore` entry added in `b55bd3e7` and, in that commit's body, the deferral note. Verify (CI=true): pnpm install --frozen-lockfile · dev:prepare across all four apps · lint · typecheck · test (6708 passed, 6 skipped, 294 files) · build · docs:generate (1240 routes) — all green. The load-bearing check is not the suite but the resolution: one `@ai-sdk/provider` version across the whole lockfile. Co-authored-by: Shevchik Igor <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Port of
nuxt/ui@6bcc97a6(nuxt/ui#6849). First of six in the current queue.Taken as an alignment to upstream's versions rather than a replay of the deltas, per instruction — this fork had drifted behind on several packages, so what upstream shipped as a non-major batch includes two major jumps here.
ai^6.0.214^7.0.66@ai-sdk/vue^3.0.214^4.0.66@regle/core,@regle/rules^1.28.0^1.29.1@nuxtjs/mcp-toolkit^0.18.1^0.19.0@unhead/vue,magic-string,motion-v,ohash,vue-component-type-helpers,vue-tsc,@shikijs/types,shiki,vue-component-metaPer
PORTING.md§2 the manifests mirror across all b24ui playgrounds, not the two upstream has.playgrounds/democarriesai,@ai-sdk/vueandvue-tscand moves with the rest — itsvue-tscsat further behind than everything else at^3.3.7, which only a per-playground pass finds.playgrounds/replcarries none of them.One bump held back:
nuxt-schema-orgStays at
^6.2.1. Not a judgement call — the newer versions do not run:The cause is transitive, not direct, and finding that out took two wrong guesses worth recording:
nuxt-schema-org@6.2.9is broken against@nuxt/kit@4.5.2". Checking every published version6.2.1…6.2.9against the 98 names our kit exports showed none of them import a missing symbol — so the direct dependency is fine.6.2.7then failed one function earlier, onsetupNitroRuntimeCompatibility. That is what identified the real constraint:nuxt-site-config. Any bump above6.2.1drags it from4.0.8to4.2.3, and 4.2.3 is what calls both functions.Neither exists in
@nuxt/kit@4.5.2, and 4.5.2 is the newest published 4.x — there is no Nuxt version available today that would fix this.Upstream has the same defect and does not see it. Their lockfile at this commit resolves
nuxt-schema-org@6.2.9on the same@nuxt/kit^4.5.2. It stays latent because neither CI builds the docs site; here it surfaced indev:prepare, which preparesdocs/too.One mechanical note for the next porter: restoring the caret alone was not enough.
^6.2.1is satisfied by6.2.7, so pnpm kept the newer resolution and the failure persisted. The lockfile had to be restored fromHEADbefore reinstalling — after which the manifest entry is byte-identical to before and the resolution is back to6.2.1withnuxt-site-config@4.0.8.Verify (
CI=true)dev:prepare(all four apps) ·lint·typecheck·test·build·docs:generate— all green. Tests 6546 passed | 6 skipped across 288 files. 1240 routes prerendered.typecheckcarries the weight for the two majors: it runsnuxt typecheckoverdocs/, and everyai/@ai-sdk/vuecall site lives there —docs/server/api/{ai,chat,completion}.post.ts,docs/modules/bx-assistant/*, and thechat/andeditor/examples.Caveat, stated rather than glossed
The AI features compile and prerender, but their runtime paths were not exercised.
docs:generateruns withNUXT_PUBLIC_USE_AI=falseand noDEEPSEEK_API_KEY, so the assistant is disabled during the build. A v7 behavioural change inside a request handler would not surface in any check run here. Worth a manual pass against a real key before relying on it.Ledger
cursor→6bcc97a6, entry added, log at.sync/log/6bcc97a6….md.pr/b24ui_shaarepending-merge, reconciled by the next commit in the queue.Remaining:
ccd48940(Windows path expectations — applies verbatim, ourcomponents.spec.tshas the same defect),f065438d(reka-ui 2.10.3),f3c2ac21(the Slider fix — applies, asRange; see #423),cf5f15e3andf6d188bd(showcase; the second has a schema half worth taking).Generated by Claude Code