fix(js): pin ai to v4 — unbreak main (broken by #13)

[achris7]

Hotfix — main is currently red. PR #13 merged a Dependabot bump of the ai devDependency to v5, but the Vercel AI SDK middleware targets the v4 interface (LanguageModelV1Middleware, usage.promptTokens). v5 removed/renamed those (LanguageModelV2Middleware, usage.inputTokens), so tsc/tsup fail:

src/middleware.ts(16,15): error TS2724: '"ai"' has no exported member named 'LanguageModelV1Middleware'.

Fix

• Pin ai devDependency back to ^4.0.0 (matches the unchanged >=4.0.0 <5.0.0 peer range); regenerate the lockfile → resolves ai@4.3.19.
• Add .github/dependabot.yml that ignores ai major updates (honored by security updates too), so this can't recur.

Verified

npm run build ✅ · tsc --noEmit ✅ · vitest run → 7 passed ✅ (ai@4.3.19).

Note / follow-up decision

Pinning to v4 means the middleware only supports consumers on ai v4. Since ai v5 is now the current major, new Vercel AI SDK users (on v5) can't use this middleware until it's migrated. That migration (rewrite against LanguageModelV2Middleware, rename usage fields, bump the peer range, update README/tests) is a real, deliberate change — worth doing if there's v5 demand, but not as an auto-bump. Flagging so it's a conscious choice, not a silent gap.

The dev-only jsondiffpatch advisory that triggered these bumps lives in ai's transitive dev tree (types/tests only, never shipped to consumers), so accepting it to keep the build working is the right trade.

Summary by CodeRabbit

• Chores
  • Updated AI SDK peer dependency compatibility to support v4.x versions
  • Configured automated weekly dependency checks with selective update policies

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: d73f8035-123c-4968-bae5-656ed0feca43

📥 Commits

Reviewing files that changed from the base of the PR and between 74f39e0 and b917277.

⛔ Files ignored due to path filters (1)

• js/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (2)

• .github/dependabot.yml
• js/package.json

---

📝 Walkthrough

Walkthrough

The ai peer dependency in js/package.json is downgraded from ^5.0.52 to ^4.0.0. A new .github/dependabot.yml is added to enable weekly npm dependency checks for the /js directory, capped at 5 open PRs, with an explicit ignore rule blocking semver-major updates to the ai package.

Changes

ai v4 SDK pin and Dependabot setup

Layer / File(s)	Summary
ai peerDep downgrade and Dependabot lockout js/package.json, .github/dependabot.yml	peerDependencies.ai is changed from ^5.0.52 to ^4.0.0, and a new Dependabot config schedules weekly npm checks for /js with a 5-PR open limit and an ignore rule for semver-major ai updates.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

• Floe-Labs/floe-guard#13: Directly inverts the change in this PR — that PR bumped devDependencies for ai from 4.3.19 to 5.0.52, while this PR rolls the peerDependencies constraint back to ^4.0.0.

Suggested labels

dependencies, javascript

🐇 Hoppin' back to version four,
No breaking changes knocking at my door.
Dependabot stands guard each week,
No major leaps — just the stable peak!
Nibble safe, dear SDK, nibble safe. 🌿

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/pin-ai-v4

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

Hotfix to restore the JS package build/publish pipeline by aligning the ai dependency back to the Vercel AI SDK v4 middleware interface and preventing future major auto-upgrades of ai via Dependabot.

Changes:

• Pin js devDependency ai back to ^4.0.0 to match the existing peer range (>=4.0.0 <5.0.0).
• Regenerate js/package-lock.json to resolve ai@4.3.19 and the corresponding v4 dependency tree.
• Add .github/dependabot.yml to ignore major updates for ai in /js.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.

File	Description
js/package.json	Downgrades/pins ai devDependency to v4 to restore TS build compatibility.
js/package-lock.json	Updates lockfile to reflect ai@4.3.19 and its transitive dependencies.
.github/dependabot.yml	Prevents Dependabot from proposing ai major bumps for the /js workspace.

Files not reviewed (1)

• js/package-lock.json: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.