Skip to content

fix(deps): update dependency ai to v7 [security]#17

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/npm-ai-vulnerability
Open

fix(deps): update dependency ai to v7 [security]#17
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/npm-ai-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Nov 8, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
ai (source) ^4.3.16 → ^7.0.0 age confidence

Vercel’s AI SDK's filetype whitelists can be bypassed when uploading files

CVE-2025-48985 / GHSA-rwvc-j5jr-mgvh

More information

Details

A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists when uploading files. All users are encouraged to upgrade.

Severity

  • CVSS Score: 3.7 / 10 (Low)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

vercel/ai (ai)

v7.0.37

Compare Source

Patch Changes

v7.0.36

Compare Source

Patch Changes

  • 7fa85b2: fix(ai): use injective serialization for tool approval HMAC payload

    The tool approval signature (experimental_toolApprovalSecret) built its HMAC
    payload by joining fields with \n. Because fields such as toolName and
    toolCallId can themselves contain a newline, distinct field tuples could
    serialize to identical bytes, allowing a signed approval to verify against a
    different tuple. The payload is now serialized with JSON.stringify (with a
    versioned domain-separation prefix), which escapes delimiter/control characters
    and makes the encoding injective.

    Verification remains backwards compatible: a signature in the old format still
    verifies, but only when no field contains the \n delimiter (the condition
    that made the old format ambiguous), so a pending approval that straddles an
    upgrade is not rejected while the collision stays closed.

v7.0.35

Compare Source

Patch Changes
  • 7f6650b: Return response piping promises so callers can catch stream read and write errors.
  • 106ea59: feat(ai): add per-step first content timeout for streaming generations
  • Updated dependencies [2112ff1]

v7.0.34

Compare Source

Patch Changes

v7.0.33

Compare Source

Patch Changes

v7.0.32

Compare Source

Patch Changes
  • 6cd7c74: fix: correct the onToolCall callback result documentation
  • e35bcae: Allow UI message chunks to include fields added by newer server versions.
  • a4eb3f3: Propagate abort reasons when generation is cancelled during tool execution.
  • Updated dependencies [cefa3b1]
  • Updated dependencies [8fbb89c]

v7.0.31

Compare Source

Patch Changes

v7.0.30

Compare Source

Patch Changes

v7.0.29

Compare Source

Patch Changes

v7.0.28

Compare Source

Patch Changes
  • 0bc8d4f: Fix chat onFinish handling when overlapping requests clear the active response before a resume stream finishes.

v7.0.27

Compare Source

Patch Changes
  • ac01b79: Allow validating assistant UI messages with empty parts so persisted errored responses remain loadable.
  • 2696562: experimental_streamTranscribe result promises now resolve without consuming fullStream: accessing any result promise consumes the stream internally. Previously await result.text alone deadlocked on transform backpressure. Because live transcription streams can be unbounded, fullStream is explicitly single-consumer (no replay buffering): access it once, before any result promise, when both stream parts and final results are needed.
  • Updated dependencies [31c7be8]
  • Updated dependencies [4d096f6]

v7.0.26

Compare Source

Patch Changes
  • 27d294d: feat(ai): group orphaned tool calls after tool approvals under parent span

v7.0.25

Compare Source

Patch Changes
  • 7805e4a: Cancelling the experimental_streamTranscribe fullStream now also aborts a still-pending doStream setup, so a model whose doStream has not yet resolved is cancelled instead of leaking.
  • f8e82fd: Update the experimental_streamTranscribe unsupported-model error message now that gateway string model IDs can support streaming transcription.
  • Updated dependencies [4be62c1]
  • Updated dependencies [f8e82fd]
  • Updated dependencies [7805e4a]
  • Updated dependencies [cd12954]

v7.0.23

Compare Source

Patch Changes

v7.0.22

Compare Source

Patch Changes
  • 8f89c25: Add the Cartesia provider with Sonic 3.5 speech generation, Ink-Whisper batch transcription, and Ink 2 realtime transcription support.

v7.0.21

Compare Source

Patch Changes

v7.0.20

Compare Source

Patch Changes
  • b9ac19f: Flush compressed Node.js response chunks as they are piped so UI message and text streams remain incremental in Express and Next.js.
  • a4186d6: Promote the repairToolCall option to stable, with a deprecated experimental_repairToolCall alias for backwards compatibility.

v7.0.19

Compare Source

Patch Changes

  • be7f05a: Add fingerprintTools and detectToolDrift to detect MCP tool-definition drift ("rug pull"). Pin a tool set's server-controlled fields (string description, input schema, title) at trust time with fingerprintTools, then diff later fetches with detectToolDrift to catch injected descriptions or widened schemas before passing tools to the model. Baseline storage and the drift response remain the app's responsibility.

  • ee55a07: Preserve tool approval signatures when approvals transition to responded.

  • aad737d: Use own-property checks when resolving per-tool approvals so tool names and approval ids that match inherited object properties (e.g. constructor, toString, valueOf, __proto__) are treated as unconfigured/absent.

    • @ai-sdk/policy-opa: wrapMcpTools builds its per-tool map with a null prototype and reads supplied approvals via an own-property check, and shadow guards its per-tool map lookup the same way.
    • ai: tool and tool-context lookups keyed by a model- or client-supplied name now go through an own-property check (getOwn), so a name matching an inherited object property resolves to "no such tool"/"unconfigured" instead of a prototype value. This covers the approval path (per-tool approval resolution and replay re-validation) as well as tool-call parsing, execution, streaming callbacks, and UI message conversion/validation. The human-in-the-loop approval matching (collectToolApprovals) and streaming tool-name maps are built with a null prototype so a client-supplied id that matches an inherited property no longer slips past the "unknown approval" / "tool call not found" guards.

  • 0f93c57: feat (video): support video (not just image) reference inputs in inputReferences for reference-to-video generation

  • Updated dependencies [e12411e]

  • Updated dependencies [5d894a7]

  • Updated dependencies [fdb6d5d]

  • Updated dependencies [0f93c57]

  • Updated dependencies [d25a084]

v7.0.18

Compare Source

Patch Changes

v7.0.17

Compare Source

Patch Changes

v7.0.16

Compare Source

Patch Changes
  • a8f9b6d: Preserve signed tool approval metadata when recording approval responses.

v7.0.15

Compare Source

Patch Changes

v7.0.14

Compare Source

Patch Changes

v7.0.13

Compare Source

Patch Changes

v7.0.12

Compare Source

Patch Changes
  • ecfeb6f: Sort tool results by their tool call order when converting generation output to response messages.
  • a193137: Fix extractJsonMiddleware preserving leading whitespace in the final streamed text suffix when no markdown fence prefix was stripped.
  • Updated dependencies [c6f5e62]

v7.0.11

Compare Source

Patch Changes
  • 0a87626: fix(ai): replace dynamic import() with loadBuiltinModule for diagnostics_channel to fix React Native/Hermes builds

v7.0.10

Compare Source

Patch Changes

v7.0.9

Compare Source

Patch Changes

v7.0.8

Compare Source

Patch Changes

v7.0.7

Compare Source

Patch Changes
  • d598481: Fix: convertToModelMessages no longer emits an empty assistant message when a block contains only unknown data parts (e.g. a data part before step-start with no convertDataPart provided)

v7.0.6

Compare Source

Patch Changes

v7.0.5

Compare Source

Patch Changes

  • a2750db: fix(ai): prune orphaned tool-approval responses in pruneMessages

    When pruning a specific tool by name (toolCalls: [{ type, tools: [...] }]), pruneMessages left the tool's tool-approval-response in place while removing its tool-approval-request and tool-call. The tool name of an approval response was resolved per-message, but approval responses live in a separate tool message from their approval request, so the name could never be resolved and the response was always kept. Tool name resolution is now done across all messages, so approval requests and responses are pruned together.

v7.0.4

Compare Source

Patch Changes

v7.0.3

Compare Source

Patch Changes

v7.0.2

Compare Source

Patch Changes

v7.0.1

Compare Source

Patch Changes

v7.0.0

Compare Source

Major Changes

  • 986c6fd: feat(ai): change type of experimental_context from unknown to generic

  • b0c2869: chore(ai): remove deprecated media type part from ToolResultOutput

  • 1949571: feat(ai): make experimental_telemetry stable

  • 6542d93: feat(ai): change naming nomenclature for *TelemetryIntegration to *Telemetry

  • 31f69de: fix(ai): carry prepareStep message overrides forward across steps

  • 7c71ac6: fix(ai): limit response messages in StepResult to messages created in that step

  • cf93359: feat(ai): remove/refactor event data sent via callbacks

  • 776b617: feat(provider): adding new 'custom' content type

  • 34bd95d: feat(ai): add support for uploading provider skills using the provider references abstraction

  • 1f7db50: fix(ai): remove experimental_customProvider

  • 3debdb7: feat(ai): rename stepCountIs to isStepCount

  • fcc6869: refactor(ai/core): rename ModelCallStreamPart to LanguageModelStreamPart and align stream model call naming (streamLanguageModelCall, experimental_streamLanguageModelCall).

    This updates experimental low-level stream primitives to use "language model call" terminology consistently.

  • ef992f8: Remove CommonJS exports from all packages. All packages are now ESM-only ("type": "module"). Consumers using require() must switch to ESM import syntax.

  • 493295c: Remove the deprecated ToolCallOptions export.

    Use ToolExecutionOptions instead.

  • 116c89f: feat(ai): remove telemetry data from the user-facing event data

  • c29a26f: feat(provider): add support for provider references and uploading files as supported per provider

  • 3887c70: feat(provider): add new top-level reasoning parameter to spec and support it in generateText and streamText

  • 9bd6512: feat(provider): change file part data property to be tagged with a type and remove the image part type

  • 4b46062: refactoring(ai): extract tool callback invocation into separate function and forward chunks before callback invocation

  • 7e26e81: chore: rename experimental_context to context

  • 8359612: Start v7 pre-release

  • 5463d0d: feat(provider): align tool result output content file part types with top-level message file part types

  • 72223e7: chore(ai): remove deprecated isToolOrDynamicToolUIPart function

  • 57bf606: chore(ai): simplify unified telemetry creation

  • b3c9f6a: feat(ai): create new opentelemetry package (@​ai-sdk/otel)

  • b9cf502: refactoring(ai): delay tool execution in stream text until model call is finished

  • 5b8c58f: feat(ai): decouple otel from core functions

  • 4e095b0: fix(ai): reject system messages in messages or prompt by default (opt-in)

Patch Changes

  • e3d9c0e: Add allowSystemInMessages option to ToolLoopAgent.

    This exposes the same option that exists on streamText and generateText, whether role: "system" messages are allowed in the prompt or messages fields. When unset, system messages are rejected because they can create a prompt injection attack risk. Ideally, use the instructions option instead. Set to true to allow system messages, or false to explicitly reject them.

    const agent = new ToolLoopAgent({
  model,
  allowSystemInMessages: true,
});

await agent.generate({
  messages: [
    { role: "system", content: "Server context" },
    { role: "user", content: "Hello" },
  ],
});

    The option can also be returned from prepareCall for dynamic per-call configuration.

  • b56301c: feat(ai): decouple otel from generate/streamObject

  • 2427d88: feat(ai): change Tool.sensitiveContext to telemetry.includeToolsContext and make it opt-in

  • 38fc777: Add AI Gateway hint to provider READMEs

  • 023550e: Deprecate streamText result fullStream in favor of stream.

  • 38ca8dc: fix(gateway): enable retry support for gateway errors

  • 19736ee: feat(ai): rename onStepFinish to onStepEnd

  • 6d76710: fix URL of hero animation in README

  • 5ceed7d: fix(ai): doStream should reflect transformed values

  • 4757690: feat(ai): rename onObjectStepFinish to onObjectStepEnd

  • bc47739: chore(ai): cleanup telemetry event data

  • d1b3786: fix(ai): deprecate properties on result that have moved to finalStep

  • 382d53b: refactoring: rename context to runtimeContext

  • ff9ce30: feat(ai): introduce experimental callbacks for embed function

  • ee798eb: chore(provider-utils): rename Experimental_Sandbox to Experimental_SandboxSession

  • 4873966: chore(ai): allow general usage of logWarnings and emit them via Node API when available

  • e67d80e: fix: rename onFinish to onEnd

  • 7bf7d7f: feat(ai): enable:true for telemetry by default

  • 99bf941: feat(ai): extract streamModelCall function for streaming text generation

  • e95e38d: fix: Make generateText and streamText result usage report total usage across all steps and deprecate totalUsage.

  • 6a3793e: chore(ai): add optional ChatRequestOptions to addToolApprovalResponse and addToolOutput

  • 5f3749c: refactoring: rename toolNeedsApproval to toolApproval

  • 016e877: feat(ai): add instructions as the primary prompt option and deprecate system

  • 2fe1099: feat(ai): emit streaming chunks throught the onChunk callback

  • f319fde: feat(ai): validate tool context against contextSchema at runtime

    Tool execution and approval callbacks now validate each tool's toolsContext entry against its contextSchema. Invalid tool context now throws TypeValidationError with tool-context validation metadata in error.context.

  • 31ee822: refactoring(ai): extract filterActiveTools and expose it as experimental_filterActiveTools

  • b67525f: feat: instructions as prepareStep input

  • e68be55: fix(ai): skip stringifying text when streaming partial text

  • 1db29c8: feat(ai): break CallSettings apart into LanguageModelCallOptions and RequestOptions

  • 0a51f7d: fix(ai): enforce callOptionsSchema at runtime in ToolLoopAgent

    ToolLoopAgentSettings.callOptionsSchema was declared and documented as a runtime schema for options, but tool-loop-agent.ts never invoked it. Any invariant a developer encoded in the schema was silently bypassed at runtime, and unchecked options flowed straight into prepareCall and any instructions template that interpolated them.

    ToolLoopAgent.prepareCall now validates caller-supplied options against callOptionsSchema (when set) via safeValidateTypes, throwing InvalidArgumentError on failure before forwarding to prepareCall / generateText / streamText.

  • d1a8bed: fix(ui): export isDynamicToolUIPart from ai package

  • bcce2dd: feat(stream-text): expose standalone stream transformation helpers and deprecate the equivalent streamText result methods.

    The new toUIMessageChunk and toUIMessageStream helpers let you convert a streamText stream (or any compatible ReadableStream<TextStreamPart<TOOLS>>) into UI message chunks without going through the result object — useful for custom transports, tests, and other producers of TextStreamPart.

    result.toUIMessageStreamResponse(options) and result.pipeUIMessageStreamToResponse(response, options) can migrate by passing toUIMessageStream({ stream: result.stream, ...options }) to createUIMessageStreamResponse or pipeUIMessageStreamToResponse.

    The new toTextStream helper extracts text deltas from a streamText stream, so result.toTextStreamResponse(options) and result.pipeTextStreamToResponse(response, options) can migrate to createTextStreamResponse({ stream: toTextStream({ stream: result.stream }), ...options }) and pipeTextStreamToResponse({ response, stream: toTextStream({ stream: result.stream }), ...options }).

    result.toUIMessageStream, result.toUIMessageStreamResponse, result.pipeUIMessageStreamToResponse, result.toTextStreamResponse, and result.pipeTextStreamToResponse are now @deprecated. They still work in v7 and will be removed in the next major release. Migration snippets are in the v6 → v7 migration guide.

  • 2a74d43: Remove the deprecated experimental_prepareStep option from generateText.

    Use prepareStep instead.

  • 71d3022: fix(ai): unify generate text event callbacks

  • 6cca112: feat: add timeBetweenOutputTokensMs stats

  • fd4f578: fix(ai): exclude request and response bodies from text generation results by default to reduce memory usage.

  • 511902c: skip validation for tool parts in terminal states when tool schema is no longer registered

  • a5018ab: fix(ai): return schema-transformed elements in array output mode

    Previously final array output validation checked each element against the schema but returned the raw model output. Array output now returns the validated values so Zod transforms, coercions, defaults, and pipes are applied consistently with object output.

  • 531251e: fix(security): validate redirect targets in download functions to prevent SSRF bypass

    Both downloadBlob and download now validate the final URL after following HTTP redirects, preventing attackers from bypassing SSRF protections via open redirects to internal/private addresses.

  • eeefc3f: fix(ai): enforce timeout.stepMs for the whole step in streamText

    Previously streamText's step timer was cleared synchronously right after the step's stream was registered, before the stream produced anything, so stepMs never aborted a step that stalled before emitting content. The step timer now survives until the step's stream finishes or aborts, matching generateText. chunkMs/totalMs and normal step-finish cleanup are unchanged.

  • ec98264: feat(ai): allow multiple integrations to be registered at once

  • 43a6750: fix(ai): preserve allowSystemInMessages across streamText retries

  • 67df0a0: feat: add sensitiveContext property to Tool

  • b79b6a8: fix(ai): add approval guard for denied tool outputs

  • 81caa5d: fix(ai): remove ExtractLiteralUnion export

  • 4181cfe: fix(ai): harden getMediaTypeFromUrl against prototype-property collisions

    getMediaTypeFromUrl (used to infer media types for file-url / image-url parts) used ext in URL_EXTENSION_TO_MEDIA_TYPE against a plain object literal. A URL ending in .constructor therefore resolved through the prototype chain and returned the Object constructor function, violating the helper's : string return type and forwarding a non-string value to provider adapters.

    Switch to Object.hasOwn(...) so attacker-controlled extensions like .constructor cannot resolve to inherited Object.prototype keys.

  • 208d045: fix(ai): skip global telemetry registration when local integration defined

  • 5a6f514: feat(ai): support several tools in hasToolCall stop condition

  • ed74dae: fix(ui): make input optional on output-error tool and dynamic-tool UI message parts

    validateUIMessages rejected persisted assistant messages whose output-error tool parts had no input key. This happened for any errored tool call where the SDK set input: undefined (e.g. NoSuchToolError / InvalidToolInputError): JSON serialization stripped the undefined value, and Zod 4.4+ treats a missing z.unknown() key as a validation failure (previously it was implicitly optional). The schema now matches the runtime shape produced by process-ui-message-stream, so reloading a thread that contains an errored tool call no longer throws AI_TypeValidationError.

  • ca99fea: feat: expose finalStep on text generation results

  • 9b47dea: fix(ai): remove otel Tracer api from telemetry settings

  • 877bf12: fix(ai): flatten model attributes for telemetry

  • eea8d98: refactoring: rename tool execution events

  • d66ae02: Return validated elements from generateText array output

  • 5d0f18e: feat(ai): move opentelemetry to new package

  • 21d3d60: feat(harness): implement harness specification

  • 1582efa: chore(ai): remove the metadata field from the telemetry settings

  • 80d4dde: fix(ai): include tool input on tool result for provider executed dynamic tools

  • 98627e5: feat(ai): remove onChunk event from telemetry

  • 51ce232: feat(ai): add sensitiveRuntimeContext option

  • 82fc0ab: fix(ai): pass all stream text parts to onChunk

  • 1f509d4: fix(ai): force template check on 'kind' param

  • ca446f8: feat: flexible tool descriptions

  • 176466a: chore(provider): align V4 model return types to have their own definitions across all model interfaces

  • c0c8ca2: fix(ai): remove deprecated LanguageModelUsage properties

  • 75763b0: agents: tag outgoing requests with an ai-sdk-agent user-agent segment for usage attribution (tool-loop, workflow)

  • 6ec57f5: feat(ai): make the experimental lifecycle callbacks stable

  • 3ae1786: fix: better context type inference

  • a7de9c9: fix: make sandbox experimental

  • caf1b6f: feat(ai): introduce experimental callbacks for rerank function

  • 9f0e36c: trigger release for all packages after provenance setup

  • befb78c: refactoring: remove real-time delays in unit tests

  • 6866afe: fix(ai): fix lastAssistantMessageIsCompleteWithApprovalResponses to no longer ignore providerExecuted tool approvals

  • 29d8cf4: feat(ai): rename the core-event types

  • 2e17091: fix(types): move shared tool set utility types into provider-utils

    Moved ToolSet, InferToolSetContext, and UnionToIntersection into @ai-sdk/provider-utils and updated ai internals to import them directly from there. This keeps the shared tool typing utilities colocated with the core tool type definitions.

  • 210ed3d: feat(ai): pass result provider metadata across the stream

  • a3fd75b: feat(ai): expose Experimental_ModelCallStreamPart type

  • f4cc8eb: feat: add performance statistics

  • 2add429: fix(ai): skip passing invalid JSON inputs to response messages

  • 5588abd: feat(ai): add experimental_refineToolInput option to ToolLoopAgent, generateText, streamText

  • e80ada0: fix(ai): download tool-result file URLs

  • 58a2ad7: fix: more precise default message for tool execution denial

  • 62d6481: Post-publish release notifications now link to each package’s GitHub release and npm page.

  • 1fe058b: fix(anthropic): preserve the error code returned by model

  • 5c4d910: feat(ai): add new isLoopFinished stop condition helper for unlimited steps

  • e4182bd: chore: rm export of OutputInterface

  • 34fd051: feat(ai): add toolMs to timeout configuration

  • 72cb801: feat(ai): concurrent event notification

  • 2e98477: fix: retain stack traces on async errors

  • add1126: refactoring: executeTool uses tool as parameter

  • 81a284b: fix(ai): handle partial unicode escapes in fixJson

  • 76fd58c: fix: consider file outputs and tool calls for time to first output

  • 7392266: feat: move includeRawChunks to include.rawChunks

  • 69aeb0e: feat: add deprecated tool call lifecycle callback aliases for AI SDK 6 compatibility.

  • 37d69b2: feat(ai): access runtime context in tool approval functions

  • 1043274: feat(ai): add a ModelCall start/end event

  • 350ea38: refactoring: introduce Arrayable type

  • 7f59f04: feat(ai): add approval reason to automatic tool approvals

  • 7677c1e: feat(ai): allow tool approval functions to return undefined

  • 476e1ca: feat(ai): remove telemetry dependency on onChunk callback

  • 008271d: feat(openai-compatible): emit warning when using kebab-case instead of camelCase

  • 7fc6bd6: Raise minimum supported Node.js version to 22. Supported versions: 22, 24, and 26.

  • 594029e: feat(ai): wrap the model call in telemetry context

  • 426dbbb: fix(ai): reject streamText result promises with NoOutputGeneratedError when the model stream ends without producing any output. Previously such streams resolved with an empty step. Incomplete streams with partial output still resolve with the partial result.

  • 25a64f8: Remove deprecated experimental generateImage exports.

  • 75ef93e: remove the deprecated experimental_output alias and document the output migration for AI SDK 7

  • c26ca8d: Remove custom User-Agent header from HttpChatTransport to fix CORS preflight failures in Safari and Firefox

  • eaf849f: Rename rerank telemetry finish callback to onRerankEnd.

  • 664a0eb: feat (ai/core): support plain string model IDs in rerank() function

    The rerank() function now accepts plain model strings (e.g., 'cohere/rerank-v3.5') in addition to RerankingModel objects, matching the behavior of generateText, embed, and other core functions.

  • 08d2129: feat(mcp): propagate the server name through dynamic tool parts

  • 5faf71c: feat: introduce responseMessages on GenerateTextResult and StreamTextResult

  • 0c4c275: trigger initial canary release

  • 118b953: feat(ai): decouple otel from embed functions

  • 6fd51c0: fix(provider): preserve error type prefix in getErrorMessage

  • 1dca341: fix: rename telemetry onFinish to onEnd

  • ebd4da2: feat(ai): add missing usage attributes

  • bc67b4f: feat(ai): add experimental callbacks for structured outputs

  • f0b0b20: feat(ai): add per-tool timeout overrides via toolTimeouts

  • 2852a84: fix(ai): make input optional on input-streaming UIMessagePart variants

  • 2a9c144: feat(ai): add toolNeedsApproval option

  • ce769dd: feat(provider): add experimental Realtime API support for voice conversations

    Adds first-class support for realtime (speech-to-speech) APIs:

    • Experimental_RealtimeModelV4 spec in @ai-sdk/provider with normalized event types and factory
    • OpenAI, Google, and xAI realtime provider implementations
    • openai.experimental_realtime() / google.experimental_realtime() / xai.experimental_realtime() work in both server and browser
    • .getToken() static method on each provider for server-side ephemeral token creation
    • experimental_getRealtimeToolDefinitions helper for provider session tool definitions
    • experimental_useRealtime hook in @ai-sdk/react returning UIMessage[] (aligned with useChat), with onToolCall and addToolOutput for client-driven tool execution
    • inputAudioTranscription session config for showing transcribed user audio messages when supported by the provider

  • e3a0419: fix(ai): default missing embedding warnings to an empty array

  • f04adcb: feat(ai): refresh customProvider and createProviderRegistry to support file and skill upload abstractions

  • 876fd3e: fix(ai): limit tool execution time duration to actual tool execution

  • e311194: feat(ai): allow passing provider instance to uploadFile and uploadSkill as shorthand

  • 989d3d2: fix(ai): include generated files in OTEL response attributes

  • b5092f5: fix(ai): do not re-validate tool input for output-error parts in validateUIMessages

  • 6dd6b83: feat(ai): change sensitiveRuntimeContext to telemetry.includeRuntimeContext and make it opt-in

  • 69254e0: feat(ai): add toolMetadata for tool specific metdata

  • 79b2468: feat: add request.messages to StepResult

  • 6c93e36: feat(provider-utils): add spawnCommand method to Experimental_Sandbox to allow for detached command execution

  • 2605e5f: fix test mocks to return the first array-backed result on the first call

  • 258c093: chore: ensure consistent import handling and avoid import duplicates or cycles

  • f58f9bc: fix(ai): remove stopWhen from onStart event

  • 8565dcb: fix: rename onEmbedFinish to onEmbedEnd

  • 6abd098: split prepareToolsAndToolChoice() into prepareTools() and prepareToolChoice()

  • e1bfb9c: feat(ai): remove unnecessary data from events

  • 375fdd7: fix: harden download URL SSRF guard against hostname and redirect bypasses

    validateDownloadUrl and the file download helpers (downloadBlob, download) could be bypassed in several ways when handling untrusted URLs:

    • A fully-qualified hostname with a trailing dot (e.g. localhost., myhost.local.) skipped the localhost/.local blocklist.
    • IPv6 addresses that embed an IPv4 address in their last 32 bits — IPv4-compatible (::127.0.0.1), IPv4-translated (::ffff:0:127.0.0.1), and NAT64 (64:ff9b::127.0.0.1, including the 64:ff9b:1::/48 local-use prefix) — were not decoded and checked against the private IPv4 ranges.
    • Redirects were validated only after fetch had already followed them, so the request to a redirect target (e.g. an internal/metadata address) had already been issued before the check ran.
    • Several reserved/internal address ranges were not blocked: CGNAT (100.64.0.0/10, used by some cloud providers for internal traffic), benchmarking (198.18.0.0/15), IETF protocol assignments (192.0.0.0/24), the reserved 240.0.0.0/4 block (including the 255.255.255.255 broadcast address), and IPv6 site-local (fec0::/10) and multicast (ff00::/8).

    The validator now strips trailing dots before the hostname checks and fully expands IPv6 addresses to detect embedded private IPv4 targets. The download helpers now follow redirects manually (redirect: 'manual'), re-validating each hop before requesting it, so an unsafe redirect target is never fetched. When a redirect cannot be inspected because the runtime returns an opaque response, the helpers fail closed (reject the redirect) on the ser

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@coderabbitai

coderabbitai Bot commented Nov 8, 2025 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

  • 🔍 Trigger a full review

Comment @coderabbitai help to get the list of available commands and usage tips.

@renovate
renovate Bot force-pushed the renovate/npm-ai-vulnerability branch 3 times, most recently from 14319b6 to 7a2abc5 Compare November 20, 2025 06:51
@renovate
renovate Bot force-pushed the renovate/npm-ai-vulnerability branch 2 times, most recently from a935a57 to c41afcd Compare December 5, 2025 23:11
@renovate
renovate Bot force-pushed the renovate/npm-ai-vulnerability branch 4 times, most recently from 66b29d4 to 0726482 Compare December 18, 2025 07:32
@renovate
renovate Bot force-pushed the renovate/npm-ai-vulnerability branch from 0726482 to 73d8ffc Compare December 31, 2025 07:24
@renovate renovate Bot changed the title fix(deps): update dependency ai to v5 [security] fix(deps): update dependency ai to v6 [security] Dec 31, 2025
@renovate
renovate Bot force-pushed the renovate/npm-ai-vulnerability branch from 73d8ffc to 89ee48d Compare January 2, 2026 07:40
@renovate renovate Bot changed the title fix(deps): update dependency ai to v6 [security] fix(deps): update dependency ai to v5 [security] Jan 2, 2026
@renovate
renovate Bot force-pushed the renovate/npm-ai-vulnerability branch from 89ee48d to 232ff70 Compare January 9, 2026 07:30
@renovate renovate Bot changed the title fix(deps): update dependency ai to v5 [security] fix(deps): update dependency ai to v6 [security] Jan 9, 2026
@renovate
renovate Bot force-pushed the renovate/npm-ai-vulnerability branch from 232ff70 to cb19e59 Compare January 10, 2026 07:44
@renovate renovate Bot changed the title fix(deps): update dependency ai to v6 [security] fix(deps): update dependency ai to v5 [security] Jan 10, 2026
@renovate
renovate Bot force-pushed the renovate/npm-ai-vulnerability branch from cb19e59 to 27a75e2 Compare January 20, 2026 06:48
@renovate renovate Bot changed the title fix(deps): update dependency ai to v5 [security] fix(deps): update dependency ai to v6 [security] Jan 20, 2026
@renovate
renovate Bot force-pushed the renovate/npm-ai-vulnerability branch from 27a75e2 to 90f43b0 Compare January 21, 2026 07:42
@renovate renovate Bot changed the title fix(deps): update dependency ai to v6 [security] fix(deps): update dependency ai to v5 [security] Jan 21, 2026
@renovate
renovate Bot force-pushed the renovate/npm-ai-vulnerability branch from 90f43b0 to ddf8c75 Compare January 24, 2026 19:36
@renovate renovate Bot changed the title fix(deps): update dependency ai to v5 [security] fix(deps): update dependency ai to v6 [security] Jan 24, 2026
@renovate
renovate Bot force-pushed the renovate/npm-ai-vulnerability branch from ddf8c75 to 4236dca Compare January 25, 2026 14:53
@renovate renovate Bot changed the title fix(deps): update dependency ai to v6 [security] fix(deps): update dependency ai to v5 [security] Jan 25, 2026
@renovate
renovate Bot force-pushed the renovate/npm-ai-vulnerability branch from 4236dca to 2bbfc71 Compare February 3, 2026 20:07
@renovate renovate Bot changed the title fix(deps): update dependency ai to v5 [security] fix(deps): update dependency ai to v6 [security] Feb 3, 2026
@renovate renovate Bot changed the title fix(deps): update dependency ai to v6 [security] fix(deps): update dependency ai to v5 [security] Feb 4, 2026
@renovate
renovate Bot force-pushed the renovate/npm-ai-vulnerability branch from 2bbfc71 to db235d0 Compare February 4, 2026 12:15
@renovate
renovate Bot force-pushed the renovate/npm-ai-vulnerability branch from 20a61e3 to 4dfa1a5 Compare March 8, 2026 11:00
@renovate renovate Bot changed the title fix(deps): update dependency ai to v5 [security] fix(deps): update dependency ai to v6 [security] Mar 8, 2026
@renovate
renovate Bot force-pushed the renovate/npm-ai-vulnerability branch from 4dfa1a5 to c97d10c Compare March 31, 2026 10:12
@renovate
renovate Bot force-pushed the renovate/npm-ai-vulnerability branch 2 times, most recently from d444afd to 33d08e9 Compare April 19, 2026 04:16
@renovate
renovate Bot force-pushed the renovate/npm-ai-vulnerability branch 3 times, most recently from ae240c1 to 95ef009 Compare May 3, 2026 14:50
@renovate renovate Bot changed the title fix(deps): update dependency ai to v6 [security] fix(deps): update dependency ai to v5 [security] May 3, 2026
@renovate
renovate Bot force-pushed the renovate/npm-ai-vulnerability branch from 95ef009 to 6649e5b Compare May 13, 2026 03:00
@renovate renovate Bot changed the title fix(deps): update dependency ai to v5 [security] fix(deps): update dependency ai to v6 [security] May 13, 2026
@renovate
renovate Bot force-pushed the renovate/npm-ai-vulnerability branch from 6649e5b to 663cfb1 Compare May 14, 2026 07:48
@renovate renovate Bot changed the title fix(deps): update dependency ai to v6 [security] fix(deps): update dependency ai to v5 [security] May 14, 2026
@renovate
renovate Bot force-pushed the renovate/npm-ai-vulnerability branch from 663cfb1 to 469f439 Compare May 16, 2026 07:25
@renovate renovate Bot changed the title fix(deps): update dependency ai to v5 [security] fix(deps): update dependency ai to v6 [security] May 16, 2026
@renovate
renovate Bot force-pushed the renovate/npm-ai-vulnerability branch from 469f439 to b1d55ae Compare May 17, 2026 10:56
@renovate renovate Bot changed the title fix(deps): update dependency ai to v6 [security] fix(deps): update dependency ai to v5 [security] May 17, 2026
@renovate
renovate Bot force-pushed the renovate/npm-ai-vulnerability branch from b1d55ae to 6eaf182 Compare May 23, 2026 03:42
@renovate renovate Bot changed the title fix(deps): update dependency ai to v5 [security] fix(deps): update dependency ai to v6 [security] May 23, 2026
@renovate
renovate Bot force-pushed the renovate/npm-ai-vulnerability branch from 6eaf182 to 97b45f6 Compare May 24, 2026 11:15
@renovate renovate Bot changed the title fix(deps): update dependency ai to v6 [security] fix(deps): update dependency ai to v5 [security] May 24, 2026
@renovate
renovate Bot force-pushed the renovate/npm-ai-vulnerability branch from 97b45f6 to d1eec2d Compare May 30, 2026 20:05
@renovate renovate Bot changed the title fix(deps): update dependency ai to v5 [security] fix(deps): update dependency ai to v6 [security] May 30, 2026
@renovate
renovate Bot force-pushed the renovate/npm-ai-vulnerability branch 2 times, most recently from f8b02a7 to 57741d9 Compare June 6, 2026 19:17
@renovate renovate Bot changed the title fix(deps): update dependency ai to v6 [security] fix(deps): update dependency ai to v5 [security] Jun 6, 2026
@renovate
renovate Bot force-pushed the renovate/npm-ai-vulnerability branch from 57741d9 to 0d3704c Compare June 12, 2026 23:54
@renovate renovate Bot changed the title fix(deps): update dependency ai to v5 [security] fix(deps): update dependency ai to v6 [security] Jun 12, 2026
@renovate
renovate Bot force-pushed the renovate/npm-ai-vulnerability branch from 0d3704c to 496807a Compare June 14, 2026 07:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants