@lingo.dev/_compiler@0.12.14
lingodotdev/lingo.dev@lingo.dev/_compiler@0.12.14Sep 11, 2026by github-actions[bot]
Upgrading?
AI Summary
This patch release mirrors the dependency and security updates found in the main lingo.dev package. It updates transitive dependencies to clear npm audit advisories and adjusts system prompt logic to align with the latest AI SDK requirements.
Key Highlights
- Dependency updates: Updated `csv-parse` and AI SDK packages to resolve security advisories.
- Security fixes: Cleared GHSA-8cw4-87c7-c6xx (prototype replacement) and GHSA-866g-f22w-33x8 (resource consumption).
- System prompt logic: Updated to use the `system` option on `generateText` instead of a `{ role: "system" }` entry.
Full Release Notes
### Patch Changes
- [#2208](https://github.com/lingodotdev/lingo.dev/pull/2208) [`8dfdf49`](https://github.com/lingodotdev/lingo.dev/commit/8dfdf49b75cab1887376979c1ffd7093b11f9a75) Thanks [@cherkanovart](https://github.com/cherkanovart)! - Clear two `npm audit` advisories that surfaced through transitive dependencies.
`csv-parse` moves from 5.6.0 to 7.0.2, which patches GHSA-8cw4-87c7-c6xx (prototype replacement reachable through the `columns` option). None of the options renamed in csv-parse 6.0.0 were in use, so the CSV loaders are unchanged.
The AI SDK packages move to the latest release of the major they were already on, so that `@ai-sdk/provider-utils` resolves at or above 4.0.33 and clears GHSA-866g-f22w-33x8 (uncontrolled resource consumption). The SDK packages pin `@ai-sdk/provider-utils` to an exact version, so bumping them is the only way to reach it: `ai` goes to 6.0.280 and `@ai-sdk/anthropic`, `@ai-sdk/google`, `@ai-sdk/groq`, `@ai-sdk/mistral` and `@ai-sdk/openai` follow on their 3.x line.
The system prompt moves from a `{ role: "system" }` entry in `messages` to the `system` option on `generateText`. Since `ai` 6.0.170 the former makes the SDK print a prompt-injection warning on every BYOK run.
The basic translator also stops wrapping its system prompt in a serialized `{ role, content }` envelope before handing it over, so the provider now receives the prompt text on its own rather than a line of JSON quoting it. This is the one change here that alters what reaches the model.Related Repositories
The AI that really does things. Any OS. Any Platform. The lobster way. 🦞
Interactive roadmaps, guides and other educational content to help developers grow in their careers.
Reverse engineer anything with agents, from app behavior down to native binaries.
The open source coding agent.
Fair-code workflow automation platform with native AI capabilities. Combine visual building with custom code, self-host or cloud, 400+ integrations.