@lingo.dev/_compiler@0.12.14

Kong/insomnia@lingo.dev/_compiler@0.12.14Sep 11, 2026by github-actions[bot]

Upgrading?

AI Summary

A patch release that updates dependencies to resolve security vulnerabilities in CSV parsing and AI SDK resource consumption, while changing the system prompt handling mechanism.

Key Highlights

  • Updated `csv-parse` to fix prototype replacement vulnerability.
  • Updated AI SDK packages to fix resource consumption.
  • Changed system prompt handling to improve prompt passing.

Breaking Changes

  • The system prompt handling change alters how prompts are passed to the model (removes JSON envelope wrapping).

New Features

  • Improved prompt injection warning behavior in AI SDK.
  • Basic translator now sends prompt text directly to provider instead of JSON envelope.

Full Release Notes

### Patch Changes

- [#2208](https://github.com/lingodotdev/lingo.dev/pull/2208) [`8dfdf49`](https://github.com/lingodotdev/lingo.dev/commit/8dfdf49b75cab1887376979c1ffd7093b11f9a75) Thanks [@cherkanovart](https://github.com/cherkanovart)! - Clear two `npm audit` advisories that surfaced through transitive dependencies.

  `csv-parse` moves from 5.6.0 to 7.0.2, which patches GHSA-8cw4-87c7-c6xx (prototype replacement reachable through the `columns` option). None of the options renamed in csv-parse 6.0.0 were in use, so the CSV loaders are unchanged.

  The AI SDK packages move to the latest release of the major they were already on, so that `@ai-sdk/provider-utils` resolves at or above 4.0.33 and clears GHSA-866g-f22w-33x8 (uncontrolled resource consumption). The SDK packages pin `@ai-sdk/provider-utils` to an exact version, so bumping them is the only way to reach it: `ai` goes to 6.0.280 and `@ai-sdk/anthropic`, `@ai-sdk/google`, `@ai-sdk/groq`, `@ai-sdk/mistral` and `@ai-sdk/openai` follow on their 3.x line.

  The system prompt moves from a `{ role: "system" }` entry in `messages` to the `system` option on `generateText`. Since `ai` 6.0.170 the former makes the SDK print a prompt-injection warning on every BYOK run.

  The basic translator also stops wrapping its system prompt in a serialized `{ role, content }` envelope before handing it over, so the provider now receives the prompt text on its own rather than a line of JSON quoting it. This is the one change here that alters what reaches the model.

Related Repositories