Skip to content

chore(deps): align dependencies with upstream, including two majors - #425

Merged
IgorShevchik merged 1 commit into
mainfrom
sync/nuxt-6bcc97a
Aug 18, 2026
Merged

chore(deps): align dependencies with upstream, including two majors#425
IgorShevchik merged 1 commit into
mainfrom
sync/nuxt-6bcc97a

Conversation

@IgorShevchik

Copy link
Copy Markdown
Collaborator

Port of nuxt/ui@6bcc97a6 (nuxt/ui#6849). First of six in the current queue.

Taken as an alignment to upstream's versions rather than a replay of the deltas, per instruction — this fork had drifted behind on several packages, so what upstream shipped as a non-major batch includes two major jumps here.

package ours before now note
ai ^6.0.214 ^7.0.66 major
@ai-sdk/vue ^3.0.214 ^4.0.66 major
@regle/core, @regle/rules ^1.28.0 ^1.29.1 we were behind upstream's pre-image too
@nuxtjs/mcp-toolkit ^0.18.1 ^0.19.0
@unhead/vue, magic-string, motion-v, ohash, vue-component-type-helpers, vue-tsc, @shikijs/types, shiki, vue-component-meta patch/minor, matched upstream

Per PORTING.md §2 the manifests mirror across all b24ui playgrounds, not the two upstream has. playgrounds/demo carries ai, @ai-sdk/vue and vue-tsc and moves with the rest — its vue-tsc sat further behind than everything else at ^3.3.7, which only a per-playground pass finds. playgrounds/repl carries none of them.

One bump held back: nuxt-schema-org

Stays at ^6.2.1. Not a judgement call — the newer versions do not run:

[error] (0 , _kit3.useModuleLogger) is not a function
    at setup (nuxt-schema-org@6.2.9/dist/module.mjs:98:46)

The cause is transitive, not direct, and finding that out took two wrong guesses worth recording:

  1. First read was "nuxt-schema-org@6.2.9 is broken against @nuxt/kit@4.5.2". Checking every published version 6.2.16.2.9 against the 98 names our kit exports showed none of them import a missing symbol — so the direct dependency is fine.
  2. Pinning 6.2.7 then failed one function earlier, on setupNitroRuntimeCompatibility. That is what identified the real constraint: nuxt-site-config. Any bump above 6.2.1 drags it from 4.0.8 to 4.2.3, and 4.2.3 is what calls both functions.

Neither exists in @nuxt/kit@4.5.2, and 4.5.2 is the newest published 4.x — there is no Nuxt version available today that would fix this.

Upstream has the same defect and does not see it. Their lockfile at this commit resolves nuxt-schema-org@6.2.9 on the same @nuxt/kit ^4.5.2. It stays latent because neither CI builds the docs site; here it surfaced in dev:prepare, which prepares docs/ too.

One mechanical note for the next porter: restoring the caret alone was not enough. ^6.2.1 is satisfied by 6.2.7, so pnpm kept the newer resolution and the failure persisted. The lockfile had to be restored from HEAD before reinstalling — after which the manifest entry is byte-identical to before and the resolution is back to 6.2.1 with nuxt-site-config@4.0.8.

Verify (CI=true)

dev:prepare (all four apps) · lint · typecheck · test · build · docs:generate — all green. Tests 6546 passed | 6 skipped across 288 files. 1240 routes prerendered.

typecheck carries the weight for the two majors: it runs nuxt typecheck over docs/, and every ai / @ai-sdk/vue call site lives there — docs/server/api/{ai,chat,completion}.post.ts, docs/modules/bx-assistant/*, and the chat/ and editor/ examples.

Caveat, stated rather than glossed

The AI features compile and prerender, but their runtime paths were not exercised. docs:generate runs with NUXT_PUBLIC_USE_AI=false and no DEEPSEEK_API_KEY, so the assistant is disabled during the build. A v7 behavioural change inside a request handler would not surface in any check run here. Worth a manual pass against a real key before relying on it.

Ledger

cursor6bcc97a6, entry added, log at .sync/log/6bcc97a6….md. pr/b24ui_sha are pending-merge, reconciled by the next commit in the queue.

Remaining: ccd48940 (Windows path expectations — applies verbatim, our components.spec.ts has the same defect), f065438d (reka-ui 2.10.3), f3c2ac21 (the Slider fix — applies, as Range; see #423), cf5f15e3 and f6d188bd (showcase; the second has a schema half worth taking).


Generated by Claude Code

Port of nuxt/ui@6bcc97a6 (#6849).

Taken as an alignment to upstream's versions rather than a replay of the
deltas, because this fork had drifted behind on several packages. What
upstream shipped as a non-major batch therefore includes two major jumps
here: `ai` ^6.0.214 -> ^7.0.66 and `@ai-sdk/vue` ^3.0.214 -> ^4.0.66. The
other twelve are patch or minor.

Per PORTING.md §2 the manifests mirror across all b24ui playgrounds, not
the two upstream has. `playgrounds/demo` carries `ai`, `@ai-sdk/vue` and
`vue-tsc` and moves with the rest; its `vue-tsc` sat further behind than
everything else at ^3.3.7, which only a per-playground pass finds.
`playgrounds/repl` carries none of them.

`nuxt-schema-org` is held at ^6.2.1. Not a judgement call — the newer
versions do not run:

    [error] (0 , _kit3.useModuleLogger) is not a function
        at setup (nuxt-schema-org@6.2.9/dist/module.mjs:98:46)

The cause is transitive. Every published `nuxt-schema-org` from 6.2.1 to
6.2.9 imports only symbols `@nuxt/kit@4.5.2` exports — all nine checked
against the 98 exported names, none missing. What breaks is
`nuxt-site-config`, which any bump above 6.2.1 drags from 4.0.8 to 4.2.3,
and 4.2.3 calls `useModuleLogger` and `setupNitroRuntimeCompatibility`.
Neither exists in `@nuxt/kit@4.5.2`, which is the newest published 4.x, so
no Nuxt version available today fixes it. Pinning 6.2.7 was tried first and
fails one function earlier, which is what identified `nuxt-site-config` as
the constraint rather than `nuxt-schema-org` itself.

Upstream carries the same defect and does not see it: their lockfile at
this commit resolves `nuxt-schema-org@6.2.9` on the same `@nuxt/kit`
`^4.5.2`. It stays latent because neither CI builds the docs site — here it
surfaced in `dev:prepare`, which prepares `docs/` as well.

Restoring the caret alone was not enough: ^6.2.1 is satisfied by 6.2.7, so
pnpm kept the newer resolution. The lockfile had to be restored from HEAD
before reinstalling, after which the manifest entry is byte-identical to
before and the resolution is back to 6.2.1 with nuxt-site-config 4.0.8.

Verify (CI=true): dev:prepare across all four apps · lint · typecheck ·
test (6546 passed, 6 skipped, 288 files) · build · docs:generate (1240
routes) — all green. typecheck carries the weight for the two majors, since
every `ai` / `@ai-sdk/vue` call site lives under `docs/`.

One caveat, stated rather than glossed: the AI features compile and
prerender, but their runtime paths were not exercised. `docs:generate` runs
with NUXT_PUBLIC_USE_AI=false and no DEEPSEEK_API_KEY, so a v7 behavioural
change inside a request handler would not surface in any check run here.
@IgorShevchik
IgorShevchik merged commit e5c7e65 into main Aug 18, 2026
1 check passed
@IgorShevchik
IgorShevchik deleted the sync/nuxt-6bcc97a branch August 18, 2026 04:13
IgorShevchik pushed a commit that referenced this pull request Aug 19, 2026
#425 took `ai` from ^6.0.214 to ^7.0.66 and left the DeepSeek provider
behind. `ai@7` resolves `@ai-sdk/provider@4`; `@ai-sdk/deepseek@2.0.38` and
`@ai-sdk/mcp@1.0.52` implement `@ai-sdk/provider@3`. Two majors of the
provider spec in one tree, with the assistant talking across the gap.

Bumped to ^3.0.28 and 2.0.32, in `docs/` and in both Nuxt playgrounds —
they declare `@ai-sdk/deepseek` too, and fixing only `docs/` would have
left the same mismatch in place. The lockfile now resolves a single
`@ai-sdk/provider@4.0.7`, down from two.

`@ai-sdk/mcp` is pinned exactly rather than with a caret, and that is the
second finding. Reaching for the newest, `2.0.33`, published the previous
day, made pnpm **silently append it to `minimumReleaseAgeExclude`** in
`pnpm-workspace.yaml` instead of refusing — a supply-chain policy waived by
a line that reads as ordinary config. `2.0.32` carries the same
`@ai-sdk/provider@4.0.7`, so the newer release bought nothing; the
exclusion list is back to the single entry it had before.

Nothing in the gate could have caught the version mismatch, which is the
part worth recording. The provider packages peer-depend on `zod`, not on
`ai`, so pnpm stays quiet. `typecheck` passes because the provider is still
a valid module. `docs:generate` runs with NUXT_PUBLIC_USE_AI=false and no
DEEPSEEK_API_KEY, so the request path is never exercised. The break would
have first appeared to a user.

`dep-parity.json` could not have caught it either, by construction: it
records only packages both trees declare, and `@ai-sdk/deepseek` and
`@ai-sdk/mcp` are fork-only — this fork's assistant runs on DeepSeek, so
upstream's `chore(deps)` batches never mention them. §2 now carries that as
an invariant, with the check to run when `ai` moves a major, and the
`minimumReleaseAgeExclude` trap alongside it.

Also corrects the record. #425 described the version gap as accidental
drift. It was not: six ledger entries show the v6 line was a deliberate
deferral — `c8e810ca` reads "ai (v6 line, deferred v7), @ai-sdk/vue (v3)"
and `229b64f6` reads "ai+@ai-sdk/* (v6 line + DeepSeek)" — deferred for
exactly the coupling that then broke. The bump was still the right call and
was made on instruction, but it ended a considered decision rather than
correcting an oversight.

Found while checking why upstream's `CLAUDE.md` commit did not apply here,
which surfaced the `.gitignore` entry added in `b55bd3e7` and, in that
commit's body, the deferral note.

Verify (CI=true): pnpm install --frozen-lockfile · dev:prepare across all
four apps · lint · typecheck · test (6708 passed, 6 skipped, 294 files) ·
build · docs:generate (1240 routes) — all green. The load-bearing check is
not the suite but the resolution: one `@ai-sdk/provider` version across the
whole lockfile.
IgorShevchik pushed a commit that referenced this pull request Aug 19, 2026
#425 took `ai` from ^6.0.214 to ^7.0.66 and left the DeepSeek provider
behind. `ai@7` resolves `@ai-sdk/provider@4`; `@ai-sdk/deepseek@2.0.38` and
`@ai-sdk/mcp@1.0.52` implement `@ai-sdk/provider@3`. Two majors of the
provider spec in one tree, with the assistant talking across the gap.

Bumped to ^3.0.28 and 2.0.32, in `docs/` and in both Nuxt playgrounds —
they declare `@ai-sdk/deepseek` too, and fixing only `docs/` would have
left the same mismatch in place. The lockfile now resolves a single
`@ai-sdk/provider@4.0.7`, down from two.

`@ai-sdk/mcp` is pinned exactly rather than with a caret, and that is the
second finding. Reaching for the newest, `2.0.33`, published the previous
day, made pnpm **silently append it to `minimumReleaseAgeExclude`** in
`pnpm-workspace.yaml` instead of refusing — a supply-chain policy waived by
a line that reads as ordinary config. `2.0.32` carries the same
`@ai-sdk/provider@4.0.7`, so the newer release bought nothing; the
exclusion list is back to the single entry it had before.

Nothing in the gate could have caught the version mismatch, which is the
part worth recording. The provider packages peer-depend on `zod`, not on
`ai`, so pnpm stays quiet. `typecheck` passes because the provider is still
a valid module. `docs:generate` runs with NUXT_PUBLIC_USE_AI=false and no
DEEPSEEK_API_KEY, so the request path is never exercised. The break would
have first appeared to a user.

`dep-parity.json` could not have caught it either, by construction: it
records only packages both trees declare, and `@ai-sdk/deepseek` and
`@ai-sdk/mcp` are fork-only — this fork's assistant runs on DeepSeek, so
upstream's `chore(deps)` batches never mention them. §2 now carries that as
an invariant, with the check to run when `ai` moves a major, and the
`minimumReleaseAgeExclude` trap alongside it.

Also corrects the record. #425 described the version gap as accidental
drift. It was not: six ledger entries show the v6 line was a deliberate
deferral — `c8e810ca` reads "ai (v6 line, deferred v7), @ai-sdk/vue (v3)"
and `229b64f6` reads "ai+@ai-sdk/* (v6 line + DeepSeek)" — deferred for
exactly the coupling that then broke. The bump was still the right call and
was made on instruction, but it ended a considered decision rather than
correcting an oversight.

Found while checking why upstream's `CLAUDE.md` commit did not apply here,
which surfaced the `.gitignore` entry added in `b55bd3e7` and, in that
commit's body, the deferral note.

Verify (CI=true): pnpm install --frozen-lockfile · dev:prepare across all
four apps · lint · typecheck · test (6708 passed, 6 skipped, 294 files) ·
build · docs:generate (1240 routes) — all green. The load-bearing check is
not the suite but the resolution: one `@ai-sdk/provider` version across the
whole lockfile.
IgorShevchik added a commit that referenced this pull request Aug 19, 2026
…438)

#425 took `ai` from ^6.0.214 to ^7.0.66 and left the DeepSeek provider
behind. `ai@7` resolves `@ai-sdk/provider@4`; `@ai-sdk/deepseek@2.0.38` and
`@ai-sdk/mcp@1.0.52` implement `@ai-sdk/provider@3`. Two majors of the
provider spec in one tree, with the assistant talking across the gap.

Bumped to ^3.0.28 and 2.0.32, in `docs/` and in both Nuxt playgrounds —
they declare `@ai-sdk/deepseek` too, and fixing only `docs/` would have
left the same mismatch in place. The lockfile now resolves a single
`@ai-sdk/provider@4.0.7`, down from two.

`@ai-sdk/mcp` is pinned exactly rather than with a caret, and that is the
second finding. Reaching for the newest, `2.0.33`, published the previous
day, made pnpm **silently append it to `minimumReleaseAgeExclude`** in
`pnpm-workspace.yaml` instead of refusing — a supply-chain policy waived by
a line that reads as ordinary config. `2.0.32` carries the same
`@ai-sdk/provider@4.0.7`, so the newer release bought nothing; the
exclusion list is back to the single entry it had before.

Nothing in the gate could have caught the version mismatch, which is the
part worth recording. The provider packages peer-depend on `zod`, not on
`ai`, so pnpm stays quiet. `typecheck` passes because the provider is still
a valid module. `docs:generate` runs with NUXT_PUBLIC_USE_AI=false and no
DEEPSEEK_API_KEY, so the request path is never exercised. The break would
have first appeared to a user.

`dep-parity.json` could not have caught it either, by construction: it
records only packages both trees declare, and `@ai-sdk/deepseek` and
`@ai-sdk/mcp` are fork-only — this fork's assistant runs on DeepSeek, so
upstream's `chore(deps)` batches never mention them. §2 now carries that as
an invariant, with the check to run when `ai` moves a major, and the
`minimumReleaseAgeExclude` trap alongside it.

Also corrects the record. #425 described the version gap as accidental
drift. It was not: six ledger entries show the v6 line was a deliberate
deferral — `c8e810ca` reads "ai (v6 line, deferred v7), @ai-sdk/vue (v3)"
and `229b64f6` reads "ai+@ai-sdk/* (v6 line + DeepSeek)" — deferred for
exactly the coupling that then broke. The bump was still the right call and
was made on instruction, but it ended a considered decision rather than
correcting an oversight.

Found while checking why upstream's `CLAUDE.md` commit did not apply here,
which surfaced the `.gitignore` entry added in `b55bd3e7` and, in that
commit's body, the deferral note.

Verify (CI=true): pnpm install --frozen-lockfile · dev:prepare across all
four apps · lint · typecheck · test (6708 passed, 6 skipped, 294 files) ·
build · docs:generate (1240 routes) — all green. The load-bearing check is
not the suite but the resolution: one `@ai-sdk/provider` version across the
whole lockfile.

Co-authored-by: Shevchik Igor <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants