Repository navigation
fix: upgrade Gemini SDK with continuation regressions - #2446
Open
groupthinking wants to merge 3 commits into
Open
groupthinking wants to merge 3 commits into
groupthinking wants to merge 3 commits into
Conversation
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars.
 |
github-actions
Bot
added
javascript
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
Contributor
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.OpenSSF ScorecardScorecard details
Scanned Files
|
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
Required exact-head CI, build, and security validation remain unconfirmed in the supplied evidence.
No open issues 🎉
What changed in this PR
Upgrades the direct Gemini SDK and adds offline regression coverage for continuation reliability, addressing #2445 without changing gateway routing or application behavior.
Changes:
- Raises root and web
@google/genaifloors to^2.30.0. - Pins the shared lockfile resolution to
2.30.0. - Adds 12 contract cases covering continuation, grounding, safety termination, error propagation, and request serialization.
| File | Description |
|---|---|
| package.json | Raises the root SDK dependency floor. |
| package-lock.json | Updates both dependency specs and the SDK resolution. |
| apps/web/src/lib/__tests__/gemini-sdk-continuation.test.ts | Adds offline tests using the real SDK with synthetic transport responses. |
| apps/web/package.json | Aligns the web SDK dependency floor. |
Review effort: Balanced
Owner
Author
|
Final implementation receipt — October 18, 2026 Head:
Next action: obtain approval identifying PR #2446 or this exact head under the current Watch exact-PR merge rule; then re-fetch head, checks, reviews, mergeability and use expected-head protection to merge. Do not infer production acceptance or live Gemini cost/latency from offline fixtures. No production deployment was initiated manually. |
9 of 10 tasks
Contributor
🔍 PR Validation |
github-actions
Bot
added
ci/cd
documentation
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #2445
Changes and behavior
Upgrade the direct Gemini SDK from 2.24.0 to 2.30.0 so automatic continuation recovers dropped hops, retains grounding references, stops on prompt feedback, and surfaces genuine provider/transport errors. Twelve offline regressions exercise the installed public SDK through controlled HTTP/SSE responses; Gemini 3.8 and older-model request parameters remain covered. The app's gateway routing, Studio feature flags and production handlers are unchanged.
Google's 2.30.0 changelog, continuation fix and grounding-reference fix are the primary SDK sources.
Refreshing against current main also exposed inherited npm advisory findings. This PR applies compatible direct updates and scoped overrides, preserves existing dependency majors and application behavior, and makes the npm audit job enforce the committed lock rather than tolerate findings. The eight-file scope is the root/web manifests and lockfile, the original SDK test, a package-runtime test, the audit workflow and its regression test, and the corresponding merge-policy paragraph.
The new runtime test covers actual MCP/Zod input-schema validation, native Sharp PNG processing, and each selected consumer's own Undici Agent/fetch pair against a loopback server. The MCP SDK is explicitly declared as a web development dependency because that test imports it; workspace-only Docker installs otherwise omitted the root-only development dependency during Next's typecheck. Tests and type checks remain enabled, and that declaration does not change any resolved package version.
The audit job checks the PR head, installs with declared npm 10.8.0 using
npm ci --ignore-scripts --no-audit --no-fund, fails on high/critical advisories or audit errors, and retains the same invocation's JSON report even on failure. Other scans retain their existing behavior.Dependency compatibility
@google/genai^2.30.0; original contract and lock object preservedThe Zod override deliberately advances Vercel's exact
4.1.11and Workflow's~4.3.6dependency constraints. Actual Vercel config parsing, Workflow run/queue validation, AI SDK schema conversion and MCP tool validation passed positive/negative tests with 4.6.7. This is a tested same-major override, not a claim that those narrow upstream pins accept the new version. Scoped fixes also cover body-parser, brace-expansion 1.x, Hono/node-server, fast-uri, ip-address and qs. Existing unrelated overrides remain intact.Security dependency evidence
035150cchecked that exact head, ran the locked fail-closed gate and reported zero findings at every severity. The downloaded JSON artifact matches the logged report and its provider archive digest.Executed validation
Local final SDK/security candidate: Node 24.20.0, actual clean installs under npm 10.8.0 and 11.19.0; 1,540 web tests passed / 28 skipped, full lint/typecheck and unchanged-config production build passed, Next generated 53 static pages, dependency tree valid, full npm audit zero. Independent Node 22.23.4 review passed 158 focused Gemini/package/workflow/security tests, six Python workflow/policy tests, 13 actual consumer-schema assertions, and actionlint v1.7.12.
For the two-entry workspace-dependency correction: a fresh isolated install using
npm@10.8.0 ci --workspace=apps/web --legacy-peer-deps --no-audit --no-fundinstalled 937 packages. The unchanged production Next build then passed compilation, typechecking and 53 static pages with the test files included. Twenty actual SDK/runtime regression tests passed and a fresh full npm audit remained zero. All other lockfile values, versions and integrity hashes are identical. The subsequent Linux Docker job at published head035150cindependently passed the actual workspace install, compilation, typechecking, all 53 static pages and image export.Hosted state and remaining limits
The reviewed published head is
035150c6216e7502ba9512e5e3a1fbbc4c6e0bac, compared with mainf258db8a6cc38c064ba4d7ca1baee02bedbd0534. All 28 observed check runs are terminal: 25 successful and three skipped, with no failed or pending check. CI's synthetic merged37ef226bafeae7d3e9f74896681f66f62b4b214has the same complete tree883303dcfadd75cfc8ca646cb4285e0c195c6735as the published head.The Trivy image scan completed under main's existing report-only policy (
exit-code: 0). Its downloaded image evidence artifact binds the image to035150cand contains 250 high/critical package findings: 249 HIGH and one CRITICAL across the OS, global/bundled Node packages and Python libraries. These remain tracked under #2396 and are not resolved by a zero-finding repository npm lock audit. No clean-container or production-readiness claim is made.Automatic Gemini continuation may issue additional provider requests when a continuation token is returned. Offline tests do not establish provider availability, cost, latency or gateway reliability. No live paid provider request, production deployment or merge was performed for this work. The Gemini 2.30 floor and regression suite must survive reconciliation with overlapping dependency PR #2444.