Skip to content

chore: bump ai sdk family, oxc tooling, and tsx - #224

Merged
ThomasK33 merged 1 commit into
mainfrom
deps-batch-sep22b
Sep 23, 2026
Merged

chore: bump ai sdk family, oxc tooling, and tsx#224
ThomasK33 merged 1 commit into
mainfrom
deps-batch-sep22b

Conversation

@ThomasK33

@ThomasK33 ThomasK33 commented Sep 23, 2026

Copy link
Copy Markdown
Member

Summary

Complete the fixed daily dependency batch. No runtime, test, peer-dependency, CI, or mise changes.

Package Old → new npm published (UTC)
@ai-sdk/gateway 4.0.87 → 4.0.88 2026-09-21T19:19:33.650Z
@ai-sdk/harness-claude-code 1.0.121 → 1.0.122 2026-09-21T19:19:34.748Z
@ai-sdk/harness 1.0.117 → 1.0.118 2026-09-21T19:20:54.492Z
@ai-sdk/mcp 2.0.54 → 2.0.55 2026-09-21T19:19:43.223Z
@ai-sdk/react 4.0.110 → 4.0.111 2026-09-21T19:20:35.760Z
@ai-sdk/tui 1.0.108 → 1.0.109 2026-09-21T19:21:39.954Z
@oxlint/plugins 1.83.0 → 1.85.0 2026-09-21T15:32:42.566Z
ai 7.0.107 → 7.0.108 2026-09-21T19:20:56.344Z
oxfmt 0.68.0 → 0.70.0 2026-09-21T15:26:35.380Z
oxlint 1.83.0 → 1.85.0 2026-09-21T15:32:37.385Z
tsx 4.23.13 → 4.23.15 2026-09-20T07:22:17.792Z

@ai-sdk/provider remains 4.0.17 everywhere. @ai-sdk/anthropic remains 4.0.58. The Effect bridge's Coder pins and all peer dependencies are unchanged. Gateway and MCP changes are transitive, within their existing ranges; oxc platform bindings move with their parent packages.

Publish-age gate and deferred versions

npm view <package> time --json was rechecked at 2026-09-23T02:39:22.393538+00:00. All 49 adopted lockfile versions, including platform bindings, were at least 24 hours old. Newer releases remain outside this fixed batch even if they age past 24 hours during review.

Deferred versions and npm publish timestamps
Package Version npm published (UTC) Reason at audit
ai 7.0.109 2026-09-22T03:23:06.729Z under 24 hours
ai 7.0.110 2026-09-22T17:23:26.596Z under 24 hours
ai 7.0.111 2026-09-22T18:11:20.964Z under 24 hours
@ai-sdk/harness 1.0.119 2026-09-22T03:21:36.380Z under 24 hours
@ai-sdk/harness 1.0.120 2026-09-22T17:22:55.101Z under 24 hours
@ai-sdk/harness 1.0.121 2026-09-22T18:12:18.176Z under 24 hours
@ai-sdk/harness-claude-code 1.0.123 2026-09-22T03:20:58.087Z under 24 hours
@ai-sdk/harness-claude-code 1.0.124 2026-09-22T17:22:59.347Z under 24 hours
@ai-sdk/harness-claude-code 1.0.125 2026-09-22T18:09:47.773Z under 24 hours
@ai-sdk/react 4.0.112 2026-09-22T03:21:29.956Z under 24 hours
@ai-sdk/react 4.0.113 2026-09-22T17:22:18.484Z under 24 hours
@ai-sdk/react 4.0.114 2026-09-22T18:10:55.716Z under 24 hours
@ai-sdk/tui 1.0.110 2026-09-22T03:21:12.084Z under 24 hours
@ai-sdk/tui 1.0.111 2026-09-22T17:25:12.915Z under 24 hours
@ai-sdk/tui 1.0.112 2026-09-22T18:11:02.353Z under 24 hours
@ai-sdk/gateway 4.0.89 2026-09-22T17:22:02.666Z under 24 hours
@ai-sdk/anthropic 4.0.59 2026-09-22T03:22:15.100Z under 24 hours
@ai-sdk/anthropic 4.0.60 2026-09-22T17:22:23.606Z under 24 hours
node 26.10.0 2026-09-23T00:46:55.448Z outside the requested fixed batch; toolchain unchanged

Node stays 26.9.0 in mise; Node 26.10.0 is out of scope. The Node timestamp above is the npm package timestamp, not the upstream release-announcement timestamp.

Validation

  1. mise install and pnpm install --frozen-lockfile: passed with Node 26.9.0 / pnpm 11.27.0.
  2. pnpm format: passed. No formatter churn.
  3. pnpm check: passed. Zero oxlint warnings or errors; no lint fixes.
  4. pnpm -r build: passed.
  5. pnpm -r test: 640 passed (agent 369, Effect 45, provider 22, release tooling 13, sandbox 191).
  6. pnpm publint and pnpm attw: passed for provider and sandbox.
  7. coder whoami: passed using ambient deployment credentials. cd packages/agent && npx vitest run test/e2e: 7/7 passed on attempt 1, 25.27 seconds. The single-WebSocket multi-tool test passed (7.609 seconds). No second attempt or control checkout was needed.

Hands-on evidence

The attached terminal screenshot shows the passing live suite. The WebM is a recording of that same actual run, exported with accelerated timing (idle gaps compressed), not a second test run. Credentials were not printed. Raw logs and capture are preserved under the task's private ~/w43b-scratch/ evidence directory.

Merge gate

Require CI Required green, both Codex review loops clean for the exact head, zero unresolved threads, and a fresh thread audit after roughly six minutes of settled review summaries. Merge only through the queue.

Generated with xum • Model: coder:openai/gpt-6-astra • Thinking: high

Live e2e: all seven tests passed

live-1.webm

@ThomasK33
chore: bump ai sdk family, oxc tooling, and tsx
450e3bc 
Update only patch/minor versions published at least 24 hours before the bump.

Signed-off-by: Thomas Kosiewski <tk@coder.com>

---
_Generated with [`xum`](https://github.com/coder/xum) • Model: `coder:openai/gpt-6-astra` • Thinking: `high`_

Change-Id: If29e6769e17343d8d68965d74373793ad4dd7492
@ThomasK33

ThomasK33 commented Sep 23, 2026

Copy link
Copy Markdown
Member Author

@codex review

@ThomasK33

ThomasK33 commented Sep 23, 2026

Copy link
Copy Markdown
Member Author

@codex security review

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Sep 23, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-09-23T02:46:49.357537Z 450e3bc Manual request
🔒 Security Review ✅ Completed 2026-09-23T02:50:28.225155Z 450e3bc Manual request
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Sep 23, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. More of your lovely PRs please.

Reviewed commit: 450e3bc1ac

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Sep 23, 2026

Copy link
Copy Markdown

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 450e3bc1ac

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

@ThomasK33
ThomasK33 added this pull request to the merge queue Sep 23, 2026
@ThomasK33

ThomasK33 commented Sep 23, 2026

Copy link
Copy Markdown
Member Author

Readiness record for 450e3bc1ac9e633123bb71328e565048e2eca69f:

  1. All local gates passed: check, build, 640 tests, publint, attw. Live e2e 7/7 on attempt 1, including the single-WebSocket test. No formatter or lint churn.
  2. Codex code and security reviews both clean on this head: 1 round each, no retries or findings. A fully paginated final audit found zero review threads.
  3. Required and all CI cells passed. The final audit ran at 2026-09-23T02:57:28Z, 419 seconds after the last review-summary update (02:50:29Z).
  4. Independent readiness recommendation: ready with tracked next-batch dependency deferrals. Advisor recommendation: proceed after the settling audit. Review stopped because both exact-head loops were clean and no findings remained.
  5. Submitted to the merge queue with expectedHeadOid; admission succeeded at position 1. This is not yet a merge-completion claim. Queue and release-please results will be verified separately.

Newer dependency releases remain listed in the PR body for the next daily batch. Node 26.10.0 stays outside this dependency-only change.

Generated with xum • Model: coder:openai/gpt-6-astra • Thinking: high

Merged via the queue into main with commit ac198e3 Sep 23, 2026
6 checks passed
@ThomasK33
ThomasK33 deleted the deps-batch-sep22b branch September 23, 2026 02:59
@ThomasK33

ThomasK33 commented Sep 23, 2026

Copy link
Copy Markdown
Member Author

Merged through the merge queue at 2026-09-23T02:59:21Z as ac198e375ab560815cb79c3115d3a6a0c7668582. The landed tree exactly matches validated source 450e3bc1ac9e633123bb71328e565048e2eca69f; attribution is preserved.

Generated with xum • Model: coder:openai/gpt-6-astra • Thinking: high

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ThomasK33