Dependabot: @ai-sdk/react 3.0.206 -> 4.0.67 blocked

[mogplex]

Dependabot PR #105 bumps @ai-sdk/react from ^3.0.206 to ^4.0.67. This is blocked because @ai-sdk/react v4 belongs to the AI SDK v7 release line, while this repo still pins the core ai package to ^6.0.240. The two packages are released in lockstep and cannot be mixed.

What breaks

1. Split AI SDK major lines in the dependency tree. After the bump, pnpm-lock.yaml contains two parallel copies of the AI SDK core:

   • @ai-sdk/provider@3.0.14 + @ai-sdk/provider-utils@4.0.41 + @ai-sdk/gateway@3.0.162 (from the direct ai@6.0.240)
   • @ai-sdk/provider@4.0.7 + @ai-sdk/provider-utils@5.0.27 + @ai-sdk/gateway@4.0.51 + newly added @ai-sdk/mcp@2.0.31 (pulled in by @ai-sdk/react@4.0.67)

   The direct dependency in package.json stays at "ai": "^6.0.240", so nothing reconciles these.

2. Cross-major type mixing in src/components/ai/search.tsx. That file imports the hook from the new major and the transport/types from the old major in the same module:

   import { useChat, type UseChatHelpers } from '@ai-sdk/react';            // v4 -> provider-utils@5 types
   import { DefaultChatTransport, type Tool, type UIToolInvocation } from 'ai'; // v6 -> provider-utils@4 types
   import type { ChatUIMessage, SearchTool } from '../../app/api/chat/route';

   and then combines them:

   const chat = useChat<ChatUIMessage>({
     id: 'search',
     transport: new DefaultChatTransport({ api: '/api/chat' }),
   });

   ChatUIMessage is defined in src/app/api/chat/route.ts as UIMessage<never, {...}> from ai@6, and DefaultChatTransport is the ai@6 implementation of the v6 ChatTransport interface. useChat from @ai-sdk/react@4 constrains its generic to the v7 UIMessage and its transport option to the v7 ChatTransport. These come from different @ai-sdk/provider-utils majors with changed UIMessagePart / ChatTransport shapes, so tsc --noEmit (the typecheck CI job, pnpm types:check) will fail on both the generic argument and the transport assignment. UseChatHelpers<ChatUIMessage> in the Context type has the same problem.

3. Runtime UI message stream protocol mismatch. src/app/api/chat/route.ts produces the stream with ai@6's streamText(...).toUIMessageStreamResponse(), while the client-side chat state machine and stream parser would now come from the v7 code path inside @ai-sdk/react@4. Even if types were forced to align, the wire protocol between the v6 server and v7 client is not guaranteed compatible.

Evidence

• package.json: @ai-sdk/react -> ^4.0.67, ai unchanged at ^6.0.240
• pnpm-lock.yaml: duplicate @ai-sdk/provider (3.x + 4.x), @ai-sdk/provider-utils (4.x + 5.x), @ai-sdk/gateway (3.x + 4.x); new @ai-sdk/mcp@2.0.31
• src/components/ai/search.tsx: mixes @ai-sdk/react v4 useChat/UseChatHelpers with ai v6 DefaultChatTransport, Tool, UIToolInvocation
• src/app/api/chat/route.ts: v6 server APIs convertToModelMessages, stepCountIs, streamText, toUIMessageStreamResponse, UIMessage
• .github/workflows/ci.yml: typecheck job runs pnpm types:check (tsc --noEmit) and build runs next build — both exercise the affected files

Additional constraint
@openrouter/ai-sdk-provider@2.9.1 resolves in the lockfile as 2.9.1(ai@6.0.240(zod@4.4.3))(zod@4.4.3), i.e. it peer-depends on the core ai package. Any move to the AI SDK v7 line also requires an @openrouter/ai-sdk-provider release that declares an ai@^7 peer, so this cannot be resolved by touching @ai-sdk/react alone.

Suggested remediation
Treat this as a coordinated AI SDK v6 -> v7 migration rather than a single-package bump:

1. Confirm @openrouter/ai-sdk-provider has a release supporting ai@^7.
2. In one PR, bump ai to ^7, @ai-sdk/react to ^4, and @openrouter/ai-sdk-provider to the v7-compatible version together.
3. Migrate the v7 breaking changes in src/app/api/chat/route.ts (streamText / convertToModelMessages / toUIMessageStreamResponse / UIMessage generics) and src/components/ai/search.tsx (useChat, DefaultChatTransport, UIToolInvocation tool-part states).
4. Verify pnpm lint, pnpm types:check, pnpm test, and pnpm build all pass, and confirm the lockfile has a single @ai-sdk/provider / @ai-sdk/provider-utils major.
5. Optionally add a Dependabot groups entry so ai, @ai-sdk/*, and @openrouter/ai-sdk-provider are always bumped in a single PR, preventing this split from recurring.

Node engine note: @ai-sdk/react@4 and the v7 core packages require node >=22; CI already uses Node 22, so the engine constraint itself is not a blocker.