chore: bump @ai-sdk/provider-utils to ^4.0.41 (CVE-2026-8769)

[devin-ai-integration]

Summary

CVE-2026-8769 affects @ai-sdk/provider-utils ≤ 3.0.97, and the 3.x line tops out at 3.0.31 (only 3.1.0 betas beyond it), so the direct dependency has to move to 4.x:

-"@ai-sdk/provider-utils": "^3.0.9"
+"@ai-sdk/provider-utils": "^4.0.41"

4.0.41 is what ai@6.0.238 itself depends on and it was already resolved in the lockfile as a second copy, so this just deduplicates onto the version the rest of the tree uses. It still depends on @ai-sdk/provider@3.0.14, so the @ai-sdk/provider: ^3.0.0 dependency is unchanged, and the imports used here (loadApiKey, withoutTrailingSlash, createJsonErrorResponseHandler, ParseResult, stream helpers) are source-compatible — tsc --noEmit and all 146 tests pass unchanged.

Stacked on #47: provider-utils 4.x still pins undici: ^5.29.0, so the undici override from that PR is still required.

Link to Devin session: https://app.devin.ai/sessions/2216f6167a274f5e86e5ff85a4f7b6f0
Requested by: @requesty-ditti

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[changeset-bot]

⚠️ No Changeset found

Latest commit: 19bfcc0

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

The merge-base changed after approval.