NewYour coding agent can read the release notes before it upgrades.Set up the MCP server →
npm · #1793 most downloaded on npm
Last release 4 days ago
30 Sep 2026
Ships on a steady schedule
a new release about every 8 days
Most releases are documented
notes for 49 of the last 60 stable releases
Nothing withdrawn
no release was ever pulled
2 years old
397 releases · first in 2024
8c65988: feat(ai): add telemetry to speech generation and transcription, including provider usage propagation and experimental streaming lifecycle cal
isValidHostnamePartede5b89: chore: migrate package builds from tsup to tsdown
One column per month.
c2511c1: fix: use standards-compliant User-Agent header
e3605f6: Fix streamed tool calls with missing, blank, or repeated IDs.
af9597b: Compile packages for ES2022 runtime target
fe07867: Fix Google embedMany calls with more than 100 values by keeping per-value multimodal content aligned across automatic batches, including text
fe07867: Fix Google embedMany calls with more than 100 values by keeping per-value multimodal content aligned across automatic batches, including text-only entries. Validate content length before sending requests and validate each batch's provider options after middleware transforms them.
a4b0940: fix(ai): execute manually approved tool inputs produced by schema transforms
Preserve approved inputs during revalidation and reject histories whose reconstructed schema output differs, including signed approvals with missing original input. Validate transformed UI tool inputs against the reconstructed output before returning them as static tool parts.
771e74b: chore: enable dead code lint rules
### Patch Changes - Updated dependencies [ffb0e76] - @ai-sdk/provider@4.0.18
2973485: fix(provider-utils): detect AVIF and HEIC images with variable ftyp box sizes
0455398: fix(provider-utils): make lazy Undici import visible to deployment tracers
215b25e: Default language-model evaluation adapters to reasoning: 'none', using each provider's existing reasoning mapping. Explicit reasoning setting
reasoning: 'none', using each provider's existing reasoning mapping. Explicit reasoning settings in providerOptions continue to override the default.openai.evaluationModel() and a shared structured language-model evaluation adapter in @ai-sdk/provider-utils/experimental-evaluation. Preserve exact labels and metadata, validate score bounds, and return prompted Boolean P(true) estimates validated to be in [0, 1]. Boolean estimates are not guaranteed to be calibrated; application code chooses thresholds.91c2128: feat(ai): add mid conversation tool discovery/updates for code-mode
### Patch Changes - Updated dependencies [5c0054d] - Updated dependencies [39535af] - @ai-sdk/provider@4.0.15
813bb36: fix(provider-utils): avoid detecting plain text prefixes as BMP or GIF images
### Patch Changes - Updated dependencies [9942196] - @ai-sdk/provider@4.0.13
### Patch Changes - Updated dependencies [912fb01] - @ai-sdk/provider@4.0.12
9e1d1b2: chore(provider-utils): fix test that can timeout
6bcc0f8: Update Undici to a version patched for CVE-2026-13697.
5190b67: feat(provider): extend the FilesV4 interface with optional getFileMetadata, downloadFile (streaming), and deleteFile operations, plus abortSi
getFileMetadata, downloadFile (streaming), and deleteFile operations, plus abortSignal/headers call options and a { type: 'stream' } upload data variant; upload results now expose byteSize, createdAt, and expiresAt (also surfaced by the core uploadFile() helper, which now forwards abortSignal/headers); add postMultipartStreamToApi (streaming multipart uploads with deterministic part ordering and failure-path stream teardown), deleteFromApi, and createBinaryStreamResponseHandler to provider-utils### Patch Changes - Updated dependencies [aa45741] - @ai-sdk/provider@4.0.9
90192f1: Mark transient network errors that occur while reading successful response bodies as retryable.
3e125ba: Allow manual tool approval statuses to include a reason and preserve it across core, model, and UI approval requests. OPA requires-approval d
requires-approval decisions now
surface their reason to human approvers. UI request chunks serialize the
optional reason, while UI messages retain it as approval.requestReason
separately from an approver's response reason.### Patch Changes - Updated dependencies [591d25b] - @ai-sdk/provider@4.0.8
b74971f: Preserve schema-valued additional properties when converting Zod 4 schemas.
e6087c9: fix: handle empty string tool call IDs
7fbfc6d: Preserve streamed download size-limit errors when response cancellation fails.
401a4ba: fix(provider-utils): allow imports in runtimes without a global fetch function
81cd026: Reduce bundle size by making internal Zod v4 imports tree-shakeable.
1937bef: fix(provider-utils): make URL regex checks stateless
### Patch Changes - Updated dependencies [3469d0c] - @ai-sdk/provider@4.0.6
2b60826: feat(provider-utils): support Blob request bodies in postToApi
1bec07d: Fix streamed tool calls with non-zero, non-contiguous, reused, or missing indexes.
160ccdb: Reduce bundle size by removing the runtime Zod 3 dependency.
### Patch Changes - Updated dependencies [79e133c] - @ai-sdk/provider@4.0.5
5fc7da5: chore: centralize empty language model usage creation in provider utilities.
fa95504: feat(ai): support experimental tool callers in ToolLoopAgent
d8210b6: chore: centralize record type guards in provider-utils
1659cd5: Prevent validated downloads on Node.js from reaching private or internal services through DNS aliases or DNS rebinding by validating and pinn
### Patch Changes - Updated dependencies [8c65988] - Updated dependencies [527a163] - @ai-sdk/provider@4.0.21 - @ai-sdk/provider-utils@5.0.53
openai.translation('gpt-realtime-translate') over the OpenAI Realtime translations WebSocket and google.translation('gemini-3.5-live-translate-preview') over the Gemini Live API). connectToWebSocket in @ai-sdk/provider-utils now passes close code and reason to onClose (additive, optional parameter).ede5b89: chore: migrate package builds from tsup to tsdown
c2511c1 : fix: use standards-compliant User-Agent header
02ffdcb: fix(provider-utils): bound media-type sniffing decode for ID3-prefixed input
Media-type detection stripped ID3 tags before the ~18-byte prefix cap, decoding the entire base64 attachment (plus a full-size copy) whenever the data began with ID3/SUQz. This turned the intended O(1) sniff into an O(N) decode of the whole attachment. Detection now decodes at most a bounded prefix and skips the ID3 tag within that bound, keeping cost O(1) in input size on all paths (image, audio, and combined).
76cb673: fix: detect MP4 audio from its ftyp box during transcription
525efc5 : feat(provider): advertise image model file and mask input support
525efc5: feat(provider): advertise image model file and mask input support
Use confirmed model IDs for capability declarations so unrecognized model names
remain unknown. Include Together AI FLUX.2 Pro and Flex single-image editing, and
allow asynchronous capability lookups and middleware overrides to resolve to
unknown.
Advertise QuiverAI Arrow 2 and Arrow 2 Telos file-input support, and mark Together
AI Gemini image inputs unsupported by the current single-image request mapping.
Updated dependencies [e3605f6]
Updated dependencies [525efc5]
onInputStart before onInputAvailable during non-streaming tool callsUpdated dependencies [ af9597b ]
4be62c1: fix(provider-utils): validate provider-response URLs in getFromApi
4be62c1: fix(provider-utils): validate provider-response URLs in getFromApi
getFromApi now has a validateUrl flag. It is optional so existing callers keep compiling (omitting it behaves like false, i.e. no validation), but all AI SDK provider packages set it explicitly at every call site so each one makes a visible trust decision. When true, the URL is routed through fetchWithValidatedRedirects — the same guard used by downloadBlob — which rejects private/loopback/link-local targets, re-validates every redirect hop, strips proxy/metadata/cookie request headers, and drops all caller headers except the user-agent on cross-origin redirects (custom API-key headers must not follow a redirect off-origin any more than Authorization may); blocked URLs throw DownloadError. It is enabled at the image/video/audio download and polling call sites where the URL comes from a provider response body; URLs built from developer-configured endpoints pass validateUrl: false and are unaffected.
A new optional credentialedOrigin withholds caller headers unless the URL is same-origin with it, so the API key is not sent to a response-supplied host on a different origin.
A new optional trustedOrigin exempts URLs (and redirect hops) that are same-origin with the developer-configured provider endpoint from target validation, so self-hosted and localhost deployments whose response URLs point back at the configured host keep working; all other hops are still validated.
Also closes range gaps in validateDownloadUrl (IPv4 224.0.0.0/4 multicast and the TEST-NET documentation ranges 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24; IPv6 documentation ranges 2001:db8::/32 and 3fff::/20), and follows only the fetch-spec redirect status codes (301/302/303/307/308) — a Location header on any other status is not followed. This guard performs string/literal checks only and does not resolve DNS; hostnames that resolve to private addresses and DNS rebinding remain out of scope and must be constrained at the network layer (or by injecting a Node fetch that pins the resolved IP at connect time) for server deployments handling untrusted URLs. See contributing/secure-url-handling.md.
7805e4a: Add experimental transcription-stream WebSocket envelope (standard doStream-over-WebSocket serialization): frame type constants, experimental_parseTranscriptionStreamClientFrame, experimental_serializeTranscriptionStreamPart, and experimental_parseTranscriptionStreamPart (all APIs are exported with experimental prefixes). serializeTranscriptionStreamPart returns undefined for payloads that are not JSON-serializable (callers drop the frame) and serializes cross-realm Error payloads by brand check.
cd12954: Reject empty OpenAI, Anthropic, and Replicate base URLs with a helpful AI SDK invalid argument error.
771e74b : chore: enable dead code lint rules
Updated dependencies [ ffb0e76 ]
StreamingToolCallTracker finalizing streaming tool calls on parsable partial JSON. Tool calls now only finalize during stream flush, restoring the behavior of #13137: a parsable argument buffer can still be the prefix of a longer argument string, so finalizing early could act on truncated tool inputs.### Patch Changes - Updated dependencies [8c65988] - Updated dependencies [527a163] - @ai-sdk/provider@4.0.21 - @ai-sdk/provider-utils@5.0.53
gpt-realtime-whisper and xAI WebSocket STT.Updated dependencies [ 2973485 ]
secureJsonParse from provider-utils.Updated dependencies [ 0455398 ]
Updated dependencies [ 215b25e ]
Updated dependencies [ 91c2128 ]
38fe0e5: BREAKING: Migrate language generation from the Sonar Chat Completions API to the Agent API. Replace Sonar model IDs and provider options with
986c6fd: feat(ai): change type of experimental_context from unknown to generic
b0c2869: chore(ai): remove deprecated media type part from ToolResultOutput
f7d4f01: feat(provider): add support for reasoning-file type for files that are part of reasoning
776b617: feat(provider): adding new 'custom' content type
ef992f8: Remove CommonJS exports from all packages. All packages are now ESM-only ("type": "module"). Consumers using require() must switch to ESM import syntax.
493295c: Remove the deprecated ToolCallOptions export.
Use ToolExecutionOptions instead.
c29a26f: feat(provider): add support for provider references and uploading files as supported per provider
3887c70: feat(provider): add new top-level reasoning parameter to spec and support it in generateText and streamText
61753c3: ### @ai-sdk/openai: remove redundant name argument from openai.tools.customTool()
openai.tools.customTool() no longer accepts a name field. the tool name is now derived from the sdk tool key (the object key in the tools object).
migration: remove the name property from customTool() calls. the object key is now used as the tool name sent to the openai api.
before:
tools: {
write_sql: openai.tools.customTool({
name: 'write_sql',
description: '...',
}),
}
after:
tools: {
write_sql: openai.tools.customTool({
description: '...',
}),
}
@ai-sdk/provider-utils: createToolNameMapping() no longer accepts the resolveProviderToolName parameterbefore: tool name can be set dynamically
const toolNameMapping = createToolNameMapping({
tools,
providerToolNames: {
"openai.code_interpreter": "code_interpreter",
"openai.file_search": "file_search",
"openai.image_generation": "image_generation",
"openai.local_shell": "local_shell",
"openai.shell": "shell",
"openai.web_search": "web_search",
"openai.web_search_preview": "web_search_preview",
"openai.mcp": "mcp",
"openai.apply_patch": "apply_patch",
},
resolveProviderToolName: (tool) =>
tool.id === "openai.custom"
? (tool.args as { name?: string }).name
: undefined,
});
after: tool name is static based on tools keys
const toolNameMapping = createToolNameMapping({
tools,
providerToolNames: {
'openai.code_interpreter': 'code_interpreter',
'openai.file_search': 'file_search',
'openai.image_generation': 'image_generation',
'openai.local_shell': 'local_shell',
'openai.shell': 'shell',
'openai.web_search': 'web_search',
'openai.web_search_preview': 'web_search_preview',
'openai.mcp': 'mcp',
'openai.apply_patch': 'apply_patch',
}
});
7e26e81: chore: rename experimental_context to context
8359612: Start v7 pre-release
5463d0d: feat(provider): align tool result output content file part types with top-level message file part types
2427d88: feat(ai): change Tool.sensitiveContext to telemetry.includeToolsContext and make it opt-in
785fe16: feat: distinguish provider-defined and provider-executed tools
ee798eb: chore(provider-utils): rename Experimental_Sandbox to Experimental_SandboxSession
531251e: fix(security): validate redirect targets in download functions to prevent SSRF bypass
Both downloadBlob and download now validate the final URL after following HTTP redirects, preventing attackers from bypassing SSRF protections via open redirects to internal/private addresses.
67df0a0: feat: add sensitiveContext property to Tool
105f95b: Ensure the default empty tool input schema includes type: "object" for OpenAI-compatible providers that require object schemas.
eea8d98: refactoring: rename tool execution events
d848405: feat: add optional abortSignal parameters to sandbox command execution
46d1149: chore(provider-utils,google): fix grammar errors in error and warning messages
1f509d4: fix(ai): force template check on 'kind' param
ca446f8: feat: flexible tool descriptions
3ae1786: fix: better context type inference
a7de9c9: fix: make sandbox experimental
9f0e36c: trigger release for all packages after provenance setup
befb78c: refactoring: remove real-time delays in unit tests
f634bac: feat(mcp): add new McpProviderMetadata type
2e17091: fix(types): move shared tool set utility types into provider-utils
Moved ToolSet, InferToolSetContext, and UnionToIntersection into @ai-sdk/provider-utils and updated ai internals to import them directly from there. This keeps the shared tool typing utilities colocated with the core tool type definitions.
ca39020: Add an optional workingDirectory parameter to sandbox command execution.
0458559: fix: deprecate needsApproval on Tool
5852c0a: refactoring(provider-utils): add controller as property to StreamingToolCallTracker
2e98477: fix: retain stack traces on async errors
add1126: refactoring: executeTool uses tool as parameter
aeda373: fix: only send provider credentials to same-origin response-supplied URLs
Several provider clients followed a URL taken from the provider's API response (a polling/status URL or a final media URL such as polling_url, urls.get, result_url, result.sample, or video.uri) and reused the authenticated headers — or appended ?key=<API_KEY> — on that request. Because the host of the response-supplied URL was never validated, the long-lived API key was sent to whatever host the response named (a CDN in the benign case, or an attacker-chosen host if the provider response was tampered with), allowing credential exfiltration.
A new isSameOrigin helper is added to @ai-sdk/provider-utils, and the affected fetches in @ai-sdk/black-forest-labs, @ai-sdk/fireworks, @ai-sdk/replicate, @ai-sdk/gladia, @ai-sdk/fal, and @ai-sdk/google now attach credentials only when the followed URL is same-origin with the provider's configured API origin. Requests to a foreign origin are made without the credential.
350ea38: refactoring: introduce Arrayable type
7fc6bd6: Raise minimum supported Node.js version to 22. Supported versions: 22, 24, and 26.
f807e45: Extract shared StreamingToolCallTracker class into @ai-sdk/provider-utils to deduplicate streaming tool call handling across OpenAI-compatible providers. Also adds missing generateId() fallback for toolCallId in Alibaba's doGenerate path and ensures all providers finalize unfinished tool calls during stream flush.
08d2129: feat(mcp): propagate the server name through dynamic tool parts
0c4c275: trigger initial canary release
6fd51c0: fix(provider): preserve error type prefix in getErrorMessage
69254e0: feat(ai): add toolMetadata for tool specific metdata
6c93e36: feat(provider-utils): add spawnCommand method to Experimental_Sandbox to allow for detached command execution
9bd6512: feat(provider): change file part data property to be tagged with a type and remove the image part type
258c093: chore: ensure consistent import handling and avoid import duplicates or cycles
375fdd7: fix: harden download URL SSRF guard against hostname and redirect bypasses
validateDownloadUrl and the file download helpers (downloadBlob, download) could be bypassed in several ways when handling untrusted URLs:
localhost., myhost.local.) skipped the localhost/.local blocklist.::127.0.0.1), IPv4-translated (::ffff:0:127.0.0.1), and NAT64 (64:ff9b::127.0.0.1, including the 64:ff9b:1::/48 local-use prefix) — were not decoded and checked against the private IPv4 ranges.fetch had already followed them, so the request to a redirect target (e.g. an internal/metadata address) had already been issued before the check ran.100.64.0.0/10, used by some cloud providers for internal traffic), benchmarking (198.18.0.0/15), IETF protocol assignments (192.0.0.0/24), the reserved 240.0.0.0/4 block (including the 255.255.255.255 broadcast address), and IPv6 site-local (fec0::/10) and multicast (ff00::/8).The validator now strips trailing dots before the hostname checks and fully expands IPv6 addresses to detect embedded private IPv4 targets. The download helpers now follow redirects manually (redirect: 'manual'), re-validating each hop before requesting it, so an unsafe redirect target is never fetched. When a redirect cannot be inspected because the runtime returns an opaque response, the helpers fail closed (reject the redirect) on the server; only in a real browser — where SSRF is not reachable (fetch is constrained by CORS and cannot reach a server's internal network or cloud-metadata endpoints) — is the redirect followed natively so legitimate redirected downloads keep working.
b6783da: refactoring: restructure Tool types
3015fc3: feat: sandbox shell execution abstraction
b8396f0: trigger initial beta release
daf6637: feat(provider-utils): add env option to spawn and run methods of Experimental_SandboxSession
a6617c5: feat(provider-utils): add readFile and writeFile plus convenience wrappers to Experimental_Sandbox abstraction
28dfa06: fix: support tools with optional context
083947b: feat(ai): separate toolsContext from context
bae5e2b: fix(security): re-validate tool approvals from client message history before execution
The approval-replay path in generateText/streamText (and WorkflowAgent.stream) reconstructed approved tool calls from the client-supplied messages array and executed them without re-validating input against the tool's schema or re-applying the approval policy. A client could forge an assistant message with a pre-approved tool-call part and have the server execute a tool with attacker-chosen arguments.
The replay path now validates HMAC signature (when experimental_toolApprovalSecret is configured), re-validates tool-call input against the tool's input schema, and re-resolves the approval policy before execution.
f617ac2: feat(provider-utils): narrow tool() return type to ExecutableTool<...> when execute is provided
90e2d8a: chore: fix unused vars not being flagged by our lint tooling
b4507d5: fix(provider-utils): cancel response body on download rejection to prevent socket leak
When a download was rejected early — because the Content-Length header exceeded the size limit, the response status was not ok, or a redirect resolved to a blocked URL — the fetch response body was left unconsumed and uncancelled. With WHATWG Fetch/undici this leaves the underlying TCP socket open instead of returning it to the connection pool, allowing an attacker-controlled origin to exhaust file descriptors and cause a denial of service. The body is now cancelled on all early-rejection paths in readResponseWithSizeLimit, download, and downloadBlob, and fetchWithValidatedRedirects cancels each redirect hop's body before following or rejecting the next hop.
e93fa91: rename Sandbox.executeCommand to Sandbox.runCommand
fc92055: feat(ai): automatic tool approval
b3976a2: Add workflow serialization support to all provider models.
@ai-sdk/provider-utils: New serializeModel() helper that extracts only serializable properties from a model instance, filtering out functions and objects containing functions. Third-party provider authors can use this to add workflow support to their own models.
All providers: headers is now optional in provider config types. This is non-breaking — existing code that passes headers continues to work. Custom provider implementations that construct model configs manually can now omit headers, which is useful when models are deserialized from a workflow step boundary where auth is provided separately.
All provider model classes now include WORKFLOW_SERIALIZE and WORKFLOW_DESERIALIZE static methods, enabling them to cross workflow step boundaries without serialization errors.
ff5eba1: feat: roll image-* tool output types into their equivalent file-* types
aeda373: fix: only send provider credentials to same-origin response-supplied URLs
aeda373: fix: only send provider credentials to same-origin response-supplied URLs
Several provider clients followed a URL taken from the provider's API response (a polling/status URL or a final media URL such as polling_url, urls.get, result_url, result.sample, or video.uri) and reused the authenticated headers — or appended ?key=<API_KEY> — on that request. Because the host of the response-supplied URL was never validated, the long-lived API key was sent to whatever host the response named (a CDN in the benign case, or an attacker-chosen host if the provider response was tampered with), allowing credential exfiltration.
A new isSameOrigin helper is added to @ai-sdk/provider-utils, and the affected fetches in @ai-sdk/black-forest-labs, @ai-sdk/fireworks, @ai-sdk/replicate, @ai-sdk/gladia, @ai-sdk/fal, and @ai-sdk/google now attach credentials only when the followed URL is same-origin with the provider's configured API origin. Requests to a foreign origin are made without the credential.
375fdd7: fix: harden download URL SSRF guard against hostname and redirect bypasses
validateDownloadUrl and the file download helpers (downloadBlob, download) could be bypassed in several ways when handling untrusted URLs:
localhost., myhost.local.) skipped the localhost/.local blocklist.::127.0.0.1), IPv4-translated (::ffff:0:127.0.0.1), and NAT64 (64:ff9b::127.0.0.1, including the 64:ff9b:1::/48 local-use prefix) — were not decoded and checked against the private IPv4 ranges.fetch had already followed them, so the request to a redirect target (e.g. an internal/metadata address) had already been issued before the check ran.100.64.0.0/10, used by some cloud providers for internal traffic), benchmarking (198.18.0.0/15), IETF protocol assignments (192.0.0.0/24), the reserved 240.0.0.0/4 block (including the 255.255.255.255 broadcast address), and IPv6 site-local (fec0::/10) and multicast (ff00::/8).The validator now strips trailing dots before the hostname checks and fully expands IPv6 addresses to detect embedded private IPv4 targets. The download helpers now follow redirects manually (redirect: 'manual'), re-validating each hop before requesting it, so an unsafe redirect target is never fetched. When a redirect cannot be inspected because the runtime returns an opaque response, the helpers fail closed (reject the redirect) on the server; only in a real browser — where SSRF is not reachable (fetch is constrained by CORS and cannot reach a server's internal network or cloud-metadata endpoints) — is the redirect followed natively so legitimate redirected downloads keep working.
b4507d5: fix(provider-utils): cancel response body on download rejection to prevent socket leak
When a download was rejected early — because the Content-Length header exceeded the size limit, the response status was not ok, or a redirect resolved to a blocked URL — the fetch response body was left unconsumed and uncancelled. With WHATWG Fetch/undici this leaves the underlying TCP socket open instead of returning it to the connection pool, allowing an attacker-controlled origin to exhaust file descriptors and cause a denial of service. The body is now cancelled on all early-rejection paths in readResponseWithSizeLimit, download, and downloadBlob, and fetchWithValidatedRedirects cancels each redirect hop's body before following or rejecting the next hop.
bae5e2b: fix(security): re-validate tool approvals from client message history before execution
bae5e2b: fix(security): re-validate tool approvals from client message history before execution
The approval-replay path in generateText/streamText (and WorkflowAgent.stream) reconstructed approved tool calls from the client-supplied messages array and executed them without re-validating input against the tool's schema or re-applying the approval policy. A client could forge an assistant message with a pre-approved tool-call part and have the server execute a tool with attacker-chosen arguments.
The replay path now validates HMAC signature (when experimental_toolApprovalSecret is configured), re-validates tool-call input against the tool's input schema, and re-resolves the approval policy before execution.
@ai-sdk/provider@4.0.0-canary.18
ee798eb: chore(provider-utils): rename Experimental_Sandbox to Experimental_SandboxSession
Experimental_Sandbox to Experimental_SandboxSessionenv option to spawn and run methods of Experimental_SandboxSession6c93e36: feat(provider-utils): add spawnCommand method to Experimental_Sandbox to allow for detached command execution
spawnCommand method to Experimental_Sandbox to allow for detached command executiontool() return type to ExecutableTool<...> when execute is provided7fc6bd6: Raise minimum supported Node.js version to 22. Supported versions: 22, 24, and 26.
28dfa06: fix: support tools with optional context
a7de9c9: fix: make sandbox experimental
105f95b: Ensure the default empty tool input schema includes type: "object" for OpenAI-compatible providers that require object schemas.
type: "object" for OpenAI-compatible providers that require object schemas.Your coding agent can read these notes before it upgrades. Set up the MCP server →