chore(deps)(deps): bump @ai-sdk/react from 3.0.210 to 4.0.34

[dependabot]

Bumps @ai-sdk/react from 3.0.210 to 4.0.34.

Release notes

Sourced from @​ai-sdk/react's releases.

@​ai-sdk/react@​4.0.34

Patch Changes

• Updated dependencies [70f18c3]
• Updated dependencies [cd06458]
• Updated dependencies [d84ea43]
  • ai@7.0.31
  • @​ai-sdk/provider-utils@​5.0.11
  • @​ai-sdk/mcp@​2.0.15

@​ai-sdk/react@​3.0.232

Patch Changes

• Updated dependencies [19093fd]
  • ai@6.0.230
  • @​ai-sdk/provider-utils@​4.0.40

Changelog

Sourced from @​ai-sdk/react's changelog.

4.0.34

Patch Changes

• Updated dependencies [70f18c3]
• Updated dependencies [cd06458]
• Updated dependencies [d84ea43]
  • ai@7.0.31
  • @​ai-sdk/provider-utils@​5.0.11
  • @​ai-sdk/mcp@​2.0.15

4.0.33

Patch Changes

• ai@7.0.30

4.0.32

Patch Changes

• ai@7.0.29

4.0.31

Patch Changes

• 48e7e78: Harden MCP Apps handling of server-supplied resource metadata and the host/iframe bridge:

  • Runtime-validate _meta.ui and drop malformed or non-string fields.
  • Gate iframe permissions deny-by-default via a new sandbox.allowedPermissions allowlist.
  • Derive a concrete postMessage target origin and validate inbound message origins.
  • Validate inbound bridge params: limit resources/read to ui:// resources and allow only https/http/mailto in ui/open-link.
  • Add fingerprintMCPAppResource / detectMCPAppResourceDrift for pinning and comparing app resources.

• Updated dependencies [48e7e78]

  • @​ai-sdk/mcp@​2.0.14

4.0.30

Patch Changes

• Updated dependencies [0bc8d4f]
  • ai@7.0.28

4.0.29

Patch Changes

• 519c72b: fix (react/mcp-apps): sanitize server-supplied CSP domains in getMCPAppCSP so values cannot inject extra directives, sources, or policies into the generated Content-Security-Policy

... (truncated)

Commits

• 9352ac1 Version Packages (#17417)
• 2667d27 Version Packages (#17351)
• 6427ca9 Version Packages (#17324)
• b8241a6 Version Packages (#17264)
• 48e7e78 fix(react/mcp): harden MCP Apps metadata handling and host/iframe bridge (#17...
• 3649694 Version Packages (#17251)
• 8b4f487 Version Packages (#17247)
• 519c72b Security hardening: sanitize MCP App CSP domains (#17192)
• 6976682 Version Packages (#17196)
• 2ba5f8a Version Packages (#17181)
• Additional commits viewable in compare view

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/@ai-sdk/gateway	4.0.23	Unknown	Unknown
npm/@ai-sdk/mcp	2.0.15	Unknown	Unknown
npm/@ai-sdk/provider	4.0.3	Unknown	Unknown
npm/@ai-sdk/provider-utils	5.0.11	Unknown	Unknown
npm/@ai-sdk/react	4.0.34	Unknown	Unknown
npm/@workflow/serde	4.1.0	Unknown	Unknown
npm/ai	7.0.31	Unknown	Unknown
npm/pkce-challenge	5.0.1	🟢 3.5	Details Check Score Reason Binary-Artifacts 🟢 10 no binaries found in the repo Code-Review ⚠️ 1 Found 1/10 approved changesets -- score normalized to 1 Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 2 dependency not pinned by hash detected -- score normalized to 2 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Security-Policy ⚠️ 0 security policy file not detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Packaging 🟢 10 packaging workflow detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/swr	2.4.2	🟢 5.7	Details Check Score Reason Maintained 🟢 10 18 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 6 Found 20/29 approved changesets -- score normalized to 6 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Packaging ⚠️ -1 packaging workflow not detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• package-lock.json

[dependabot]

Superseded by #232.