chore(deps): bump @ai-sdk/provider-utils from 3.0.21 to 4.0.26

[dependabot]

Bumps @ai-sdk/provider-utils from 3.0.21 to 4.0.26.

Release notes

Sourced from @​ai-sdk/provider-utils's releases.

@​ai-sdk/provider-utils@​4.0.26

Patch Changes

• 7beadf0: feat(mcp): propagate the server name through dynamic tool parts

Changelog

Sourced from @​ai-sdk/provider-utils's changelog.

4.0.26

Patch Changes

• 7beadf0: feat(mcp): propagate the server name through dynamic tool parts

4.0.25

Patch Changes

• a727da4: chore: ensure consistent import handling and avoid import duplicates or cycles
• Updated dependencies [a727da4]
  • @​ai-sdk/provider@​3.0.10

4.0.24

Patch Changes

• a7f3c72: trigger release for all packages after provenance setup
• Updated dependencies [a7f3c72]
  • @​ai-sdk/provider@​3.0.9

4.0.23

Patch Changes

• 6247886: chore(provider-utils,google): fix grammar errors in error and warning messages

4.0.22

Patch Changes

• 0469aed: fix: allow inline data URLs in download validation

4.0.21

Patch Changes

• 055cd68: fix: publish v6 to latest npm dist tag

4.0.20

Patch Changes

• 64ac0fd: fix(security): validate redirect targets in download functions to prevent SSRF bypass

  Both downloadBlob and download now validate the final URL after following HTTP redirects, preventing attackers from bypassing SSRF protections via open redirects to internal/private addresses.

4.0.19

... (truncated)

Commits

• 8a46a3c Version Packages (#14875)
• 7beadf0 Backport: feat(mcp): propagate the server name through dynamic tool parts (#1...
• 8e650ab Version Packages (#14824)
• a727da4 backport of chore: ensure consistent import handling and avoid import duplica...
• 77a4e05 Version Packages (#14802)
• a7f3c72 Re-enable v6 releases (#14799)
• 426e567 Backport: fix: upgrade eventsource-parser to 3.0.8 (#14660)
• c3a057d Version Packages (#14153)
• 6247886 Backport: chore(provider-utils,google): fix grammar errors in error and warni...
• 8aefbbb Version Packages (#14078)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​ai-sdk/provider-utils since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Summary by cubic

Upgrade @ai-sdk/provider-utils to 4.0.26 for security hardening and reliability fixes. Includes stricter download redirect validation (SSRF protection), inline data URL support, and MCP server name propagation in dynamic tool parts.

• Dependencies
  • Bump @ai-sdk/provider-utils from 3.0.21 to 4.0.26

^{Written for commit a1dcc2a. Summary will update on new commits.}

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.

_{Tip: disable this comment in your organization's Code Review settings.}

[github-actions]

This PR doesn't fully meet our contributing guidelines and PR template.

What needs to be fixed:

• PR description is missing required template sections. Please use the PR template.

Please edit this PR description to address the above within 2 hours, or it will be automatically closed.

If you believe this was flagged incorrectly, please let a maintainer know.

[github-actions]

Thanks for your contribution!

This PR doesn't have a linked issue. All PRs must reference an existing issue.

Please:

1. Open an issue describing the bug/feature (if one doesn't exist)
2. Add Fixes #<number> or Closes #<number> to this PR description

See CONTRIBUTING.md for details.

[cubic-dev-ai]

No issues found across 1 file

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.