@lingo.dev/_compiler@0.12.14
megadose/holehe@lingo.dev/_compiler@0.12.14Sep 11, 2026by github-actions[bot]
Upgrading?
AI Summary
This patch release updates CSV parsing and AI SDK packages to clear security advisories, alongside a change in how system prompts are handled.
Key Highlights
- Clear npm audit advisories for csv-parse
- Clear npm audit advisories for AI SDK resource consumption
- System prompt structure changes
- Basic translator prompt handling update
Breaking Changes
- System prompt moves from messages array to system option
- System prompt JSON wrapping removed
New Features
- Security updates for CSV and AI SDK
- System prompt handling improvements
Full Release Notes
### Patch Changes
- [#2208](https://github.com/lingodotdev/lingo.dev/pull/2208) [`8dfdf49`](https://github.com/lingodotdev/lingo.dev/commit/8dfdf49b75cab1887376979c1ffd7093b11f9a75) Thanks [@cherkanovart](https://github.com/cherkanovart)! - Clear two `npm audit` advisories that surfaced through transitive dependencies.
`csv-parse` moves from 5.6.0 to 7.0.2, which patches GHSA-8cw4-87c7-c6xx (prototype replacement reachable through the `columns` option). None of the options renamed in csv-parse 6.0.0 were in use, so the CSV loaders are unchanged.
The AI SDK packages move to the latest release of the major they were already on, so that `@ai-sdk/provider-utils` resolves at or above 4.0.33 and clears GHSA-866g-f22w-33x8 (uncontrolled resource consumption). The SDK packages pin `@ai-sdk/provider-utils` to an exact version, so bumping them is the only way to reach it: `ai` goes to 6.0.280 and `@ai-sdk/anthropic`, `@ai-sdk/google`, `@ai-sdk/groq`, `@ai-sdk/mistral` and `@ai-sdk/openai` follow on their 3.x line.
The system prompt moves from a `{ role: "system" }` entry in `messages` to the `system` option on `generateText`. Since `ai` 6.0.170 the former makes the SDK print a prompt-injection warning on every BYOK run.
The basic translator also stops wrapping its system prompt in a serialized `{ role, content }` envelope before handing it over, so the provider now receives the prompt text on its own rather than a line of JSON quoting it. This is the one change here that alters what reaches the model.Related Repositories
public-apis/public-apis★ 491,198
A collective list of free APIs
NousResearch/hermes-agent★ 256,060
The agent that grows with you
yt-dlp/yt-dlp★ 200,237
A feature-rich command-line audio/video downloader
microsoft/markitdown★ 191,551
Python tool for converting files and office documents to Markdown.
Significant-Gravitas/AutoGPT★ 187,699
AutoGPT is the vision of accessible AI for everyone, to use and to build on. Our mission is to provide the tools, so that you can focus on what matters.