chore: bump ai sdk family and vitest

[ThomasK33]

Summary

Refresh the AI SDK family and Vitest to the newest versions that met the strict 24-hour npm publish-age rule at the bump. Only five package manifests and the pnpm lockfile change.

• npm publish timestamps fetched at 2026-09-26T21:01:27Z; manifests bumped immediately afterwards. All 15 added lockfile versions were ≥24.3 hours old at the lockfile audit (2026-09-26T21:02:53Z).
• @ai-sdk/provider stays 4.0.18 everywhere (one version in the lockfile; it is still the latest published 4.x), matching the published @coder/ai-sdk-provider 0.4.23 and @coder/ai-sdk-agent 0.12.1 that packages/effect consumes.
• vitest and @vitest/coverage-v8 move together; the transitive @vitest/mocker and @vitest/spy follow, and Vitest 5.0.2 swaps why-is-node-running 2.3.0 for 3.2.2 (dropping siginfo and stackback). No test changes were needed.
• Effect's published Coder pins, effect and @effect/ai are unchanged.
• No published peer ranges, engine floors, source, tests, examples, READMEs, changelogs, toolchain files, pnpm-workspace.yaml, or GitHub Action pins change.

Versions

Package	Old	New	Scope
ai	7.0.114	7.0.116	Direct dependency / dev dependency
@ai-sdk/anthropic	4.0.63	4.0.65	Direct dependency; Effect's published provider transitive dedupes in-range
@ai-sdk/openai-compatible	3.0.55	3.0.57	Direct dependency (provider)
@ai-sdk/provider-utils	5.0.47	5.0.49	Dev dependency (sandbox, effect)
@ai-sdk/harness	1.0.124	1.0.126	Dev dependency
@ai-sdk/harness-claude-code	1.0.128	1.0.130	Dev dependency
@ai-sdk/react	4.0.117	4.0.119	Dev dependency (exact pin, agent)
@ai-sdk/tui	1.0.115	1.0.117	Dev dependency
vitest	5.0.1	5.0.2	Dev dependency
@vitest/coverage-v8	5.0.1	5.0.2	Dev dependency
@ai-sdk/gateway	4.0.92	4.0.94	Transitive (from ai 7.0.116)
@ai-sdk/mcp	2.0.58	2.0.60	Transitive (from @ai-sdk/react 4.0.119)
@vitest/mocker, @vitest/spy	5.0.1	5.0.2	Transitive (from vitest 5.0.2)
why-is-node-running	2.3.0	3.2.2	Transitive (from vitest 5.0.2)

Adopted version	npm published at (UTC)
ai@7.0.116	2026-09-25T20:41:56.650Z
@ai-sdk/anthropic@4.0.65	2026-09-25T20:39:23.995Z
@ai-sdk/openai-compatible@3.0.57	2026-09-25T20:39:07.336Z
@ai-sdk/provider-utils@5.0.49	2026-09-25T20:39:53.868Z
@ai-sdk/harness@1.0.126	2026-09-25T20:42:08.701Z
@ai-sdk/harness-claude-code@1.0.130	2026-09-25T20:44:09.165Z
@ai-sdk/react@4.0.119	2026-09-25T20:39:13.236Z
@ai-sdk/tui@1.0.117	2026-09-25T20:39:59.666Z
@ai-sdk/gateway@4.0.94	2026-09-25T20:44:06.727Z
@ai-sdk/mcp@2.0.60	2026-09-25T20:40:49.552Z
vitest@5.0.2	2026-09-25T09:00:46.560Z
@vitest/coverage-v8@5.0.2	2026-09-25T08:59:28.643Z
@vitest/mocker@5.0.2	2026-09-25T09:00:15.785Z
@vitest/spy@5.0.2	2026-09-25T08:59:58.995Z
why-is-node-running@3.2.2	2025-01-08T15:02:27.953Z

Deferred: younger than 24 hours at the bump

None. Each adopted version is the newest published on its tracked major line; @ai-sdk/provider 4.0.18 is the latest published 4.x.

Out of scope and unchanged: TypeScript 7 (tracking issue #99), pnpm 12 (tracking issue #176), Node/mise toolchain, GitHub Actions, published peer ranges, and the engines.node floors. Recheck at the next daily dependency sweep.

Validation

All gates ran with an explicit PATH to the mise Node; node --version inside pnpm exec and every pnpm -r exec workspace reported v26.10.0.

Gate	Final local result
Age-guarded install (temporary minimumReleaseAge: 1440, exclusions only for the unchanged @coder/* pins) and pnpm dedupe	Passed; temporary pnpm-workspace.yaml edit restored, not committed
Frozen-lockfile reinstall, empty store and cache (repository config)	Passed; lockfile unchanged
Every added lockfile package age	Passed, 15 package versions; minimum age 24.3 h at audit
pnpm check	Passed: formatting, lint, typecheck
pnpm -r build	Passed
pnpm -r test	678 passed across 32 test files
pnpm publint	Passed
pnpm attw	Passed
coder whoami	Authenticated with ambient credentials on dogfood.cdr.dev (v2.37.3-devel+5dde49dffb)
cd packages/agent && npx vitest run test/e2e	7/7 passed, final dependency graph, 25.02 s (first run)
cd packages/effect && npx vitest run test/e2e	2/2 passed, final dependency graph, 9.09 s (first run)

---

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high

[ThomasK33]

@codex review

[ThomasK33]

@codex security review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-26T21:07:22.776594Z	d7f78d6	Manual request
🔒 Security Review	✅ Completed 2026-09-26T21:09:12.692360Z	d7f78d6	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: d7f78d6291

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: d7f78d6291

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.