[Arnavkar]

PR Checklist

• The commit message follows our guidelines: https://voltagent.dev/docs/community/contributing/#commit-convention

Bugs / Features

• Related issue(s) linked
• Tests for the changes have been added
• Docs have been added / updated
• Changesets have been added (none: no published package changes)

What is the current behavior?

@ai-sdk/provider-utils@3 (reached via ollama-ai-provider-v2@^1.5.3) depends on undici@5, which has no patched 5.x release. The undici advisories published 2026-10-23 to 10-27 (e.g. GHSA-2m5v-pch6-74hx, GHSA-qrxm-fqhp-jwvm) are fixed first in 6.29.1 / 7.30.1.

What is the new behavior?

Adds a root pnpm.overrides entry, "@ai-sdk/provider-utils@3>undici": "^6.29.1", plus the matching overrides: block in pnpm-lock.yaml. ollama-ai-provider-v2 stays at ^1.5.3.

Notes for reviewers

• This only affects installs of this monorepo. pnpm overrides are not published with @voltagent/core, so consumers (e.g. Holly) still need the same override in their own root until core moves its Ollama dependency to an AI SDK 6 package.
• No effect on the current lockfile. It pins provider-utils@3.0.19, which predates the undici dependency (added in 3.0.31), so pnpm why undici shows a false clean here. It applies on a future re-resolution.
• provider-utils@3 only lazy-loads undici in its SSRF-safe download helper, which the Ollama provider never calls. A stress test of core 2.11.1 + ollama-ai-provider-v2@1.5.5 against undici 5.29.0 (generate, stream, 100 parallel streams, abort, retry, embedMany, agent + tool call) behaved the same.
• Verified pnpm install --frozen-lockfile passes. The lockfile diff is the 3-line overrides: block only; a full re-resolve adds unrelated optional-dependency churn, so I left it out.
• Remove the override once core's Ollama provider moves off provider-utils@3.

🤖 Generated with Claude Code

---

Summary by cubic

Fixes the unpatched undici@5 dependency in @ai-sdk/provider-utils@3 (reached via ollama-ai-provider-v2@^1.5.3) by overriding it to ^6.29.1, which contains the fixes for the October 2026 advisories.

• Adds a root pnpm.overrides entry and matching overrides: block in pnpm-lock.yaml; ollama-ai-provider-v2 stays at ^1.5.3.
• The override applies only to this monorepo's installs; consumers still need their own override until core moves off provider-utils@3.
• No effect on the current lockfile since it pins provider-utils@3.0.19, which predates the undici dependency; it applies on a future re-resolution.
• Remove the override once core's Ollama provider moves off provider-utils@3.

^{Written for commit 6d8a0d5. Summary will update on new commits.}

[changeset-bot]

⚠️ No Changeset found

Latest commit: 6d8a0d5

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn