chore: override undici under @ai-sdk/provider-utils@3

Draft
AR
2d ago
+8-0

PR Checklist

Bugs / Features

  • Related issue(s) linked
  • Tests for the changes have been added
  • Docs have been added / updated
  • Changesets have been added (none: no published package changes)

What is the current behavior?

@ai-sdk/provider-utils@3 (reached via ollama-ai-provider-v2@^1.5.3) depends on undici@5, which has no patched 5.x release. The undici advisories published 2026-10-23 to 10-27 (e.g. GHSA-2m5v-pch6-74hx, GHSA-qrxm-fqhp-jwvm) are fixed first in 6.29.1 / 7.30.1.

What is the new behavior?

Adds a root pnpm.overrides entry, "@ai-sdk/provider-utils@3>undici": "^6.29.1", plus the matching overrides: block in pnpm-lock.yaml. ollama-ai-provider-v2 stays at ^1.5.3.

Notes for reviewers

  • This only affects installs of this monorepo. pnpm overrides are not published with @voltagent/core, so consumers (e.g. Holly) still need the same override in their own root until core moves its Ollama dependency to an AI SDK 6 package.
  • No effect on the current lockfile. It pins provider-utils@3.0.19, which predates the undici dependency (added in 3.0.31), so pnpm why undici shows a false clean here. It applies on a future re-resolution.
  • provider-utils@3 only lazy-loads undici in its SSRF-safe download helper, which the Ollama provider never calls. A stress test of core 2.11.1 + ollama-ai-provider-v2@1.5.5 against undici 5.29.0 (generate, stream, 100 parallel streams, abort, retry, embedMany, agent + tool call) behaved the same.
  • Verified pnpm install --frozen-lockfile passes. The lockfile diff is the 3-line overrides: block only; a full re-resolve adds unrelated optional-dependency churn, so I left it out.
  • Remove the override once core's Ollama provider moves off provider-utils@3.

šŸ¤– Generated with Claude Code

Summary by cubic

Fixes the unpatched undici@5 dependency in @ai-sdk/provider-utils@3 (reached via ollama-ai-provider-v2@^1.5.3) by overriding it to ^6.29.1, which contains the fixes for the October 2026 advisories.

  • Adds a root pnpm.overrides entry and matching overrides: block in pnpm-lock.yaml; ollama-ai-provider-v2 stays at ^1.5.3.
  • The override applies only to this monorepo's installs; consumers still need their own override until core moves off provider-utils@3.
  • No effect on the current lockfile since it pins provider-utils@3.0.19, which predates the undici dependency; it applies on a future re-resolution.
  • Remove the override once core's Ollama provider moves off provider-utils@3.