Skip to content

chore(deps-dev): bump @ai-sdk/openai from 2.0.20 to 3.0.50 #782

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
dependabot wants to merge 1 commit into from
Closed

chore(deps-dev): bump @ai-sdk/openai from 2.0.20 to 3.0.50 #782

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@
},
"devDependencies": {
Copy link
Copy Markdown

@claude claude Bot Apr 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 This PR bumps @ai-sdk/openai from 2.x to 3.x, but the companion ai package remains at ^5 — these are incompatible: @ai-sdk/openai@3.0.50 depends on @ai-sdk/provider@3.0.8 and @ai-sdk/provider-utils@4.0.22, while ai@5.0.52 depends on @ai-sdk/provider@2.0.0 and @ai-sdk/provider-utils@3.0.9. All e2e tests in vercel-ai-sdk.e2e.test.ts that pass an openai() model to generateText/streamText/generateObject/streamObject/embed will fail at runtime due to the incompatible LanguageModel protocol across these major versions. Fix by also bumping ai to ^6 or ^7 (the versions @ai-sdk/openai@3.x was designed for, as shown in the PR release notes listing ai@7.0.0-beta.77/78), or revert @ai-sdk/openai to ^2.

Extended reasoning...

Root cause

This Dependabot PR bumps @ai-sdk/openai from 2.0.20 to 3.0.50 in devDependencies, but leaves ai pinned at ^5 (resolving to ai@5.0.52). These two packages share a common provider interface contract, and the versions are incompatible:

  • @ai-sdk/openai@3.0.50 depends on @ai-sdk/provider@3.0.8 and @ai-sdk/provider-utils@4.0.22
  • ai@5.0.52 depends on @ai-sdk/provider@2.0.0 and @ai-sdk/provider-utils@3.0.9

The pnpm lockfile confirms both major versions are installed side-by-side (not deduplicated), since they have different major versions and are not peer-resolved.

Incompatible interface versions

The @ai-sdk/provider package defines the LanguageModel protocol (the interface that generateText(), streamText(), generateObject(), and streamObject() call into). A major version bump from 2.x to 3.x indicates breaking interface changes. The addition of @standard-schema/spec@1.1.0 as a new required dependency in @ai-sdk/provider-utils@4.0.22 (absent from 3.x) specifically indicates breaking changes in schema handling — directly affecting generateObject, streamObject, and tool definitions.

Code path that triggers it

In tests/e2e/vercel-ai-sdk.e2e.test.ts, the tests do:

import { openai } from @ai-sdk/openai;   // from @ai-sdk/openai@3.x → implements provider@3.x interface
import { generateText, streamText, ... } from ai;  // from ai@5.x → expects provider@2.x interface

const result = await generateText({
  model: openai(gpt-4o-mini),  // LanguageModel from provider@3.x passed where provider@2.x expected
  ...
});

At runtime, generateText() (from ai@5.x) will call methods on the model object using the LanguageModelV1 interface defined in @ai-sdk/provider@2.x. If @ai-sdk/openai@3.x exposes a LanguageModelV2 (or otherwise changed specificationVersion / doGenerate / doStream / doEmbed signatures), the call will fail.

Confirmation from release notes

The PR's own release notes show that @ai-sdk/openai@3.x was released alongside ai@7.0.0-beta.77 and ai@7.0.0-beta.78 — meaning it was designed for ai@6.x or ai@7.x, not ai@5.x. @ai-sdk/anthropic was intentionally NOT bumped and stays at ^2, compatible with ai@5.x, highlighting this as an accidental mismatch.

Step-by-step proof

  1. pnpm install resolves @ai-sdk/openai to 3.0.50, which hard-depends on @ai-sdk/provider@3.0.8
  2. ai@5.0.52 hard-depends on @ai-sdk/provider@2.0.0 — these cannot deduplicate across a major version boundary
  3. Both are installed: node_modules/@ai-sdk/openai/node_modules/@ai-sdk/provider is v3.x; node_modules/ai/node_modules/@ai-sdk/provider is v2.x
  4. Test calls openai("gpt-4o-mini") → returns an object implementing LanguageModel from provider@3.x
  5. That object is passed to generateText({ model: ... }) from ai@5.x, which checks model.specificationVersion or calls model.doGenerate() per the provider@2.x API contract
  6. If the method signatures changed across the major version bump (as expected), the call throws or returns malformed results

Fix

Either:

  • Bump ai from ^5 to ^6 or ^7 alongside this PR (matching what @ai-sdk/openai@3.x was designed for)
  • Or revert @ai-sdk/openai to ^2 and wait for a coordinated upgrade

"@ai-sdk/anthropic": "^2",
"@ai-sdk/openai": "^2",
"@ai-sdk/openai": "^3",
"@eslint/js": "^9.32.0",
"@langchain/core": "^1.1.24",
"@langchain/langgraph": "^1.1.4",
Expand Down
37 changes: 29 additions & 8 deletions pnpm-lock.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading