Skip to content

chore(deps): update dependency ai to v6#45

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/ai-6.x
Open

chore(deps): update dependency ai to v6#45
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/ai-6.x

Conversation

@renovate

@renovate renovate Bot commented Jan 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
ai (source) ^5.0.0 → ^6.0.0 age confidence

Release Notes

vercel/ai (ai)

v6.0.207

Compare Source

Patch Changes

  • 779f5cd: fix(provider-utils): cancel response body on download rejection to prevent socket leak

    When a download was rejected early — because the Content-Length header exceeded the size limit, the response status was not ok, or a redirect resolved to a blocked URL — the fetch response body was left unconsumed and uncancelled. With WHATWG Fetch/undici this leaves the underlying TCP socket open instead of returning it to the connection pool, allowing an attacker-controlled origin to exhaust file descriptors and cause a denial of service. The body is now cancelled on all early-rejection paths in readResponseWithSizeLimit, download, and downloadBlob, and fetchWithValidatedRedirects cancels each redirect hop's body before following or rejecting the next hop.

  • Updated dependencies [5bfde36]

  • Updated dependencies [779f5cd]

v6.0.206

Compare Source

Patch Changes

v6.0.205

Compare Source

Patch Changes

v6.0.204

Compare Source

v6.0.203

Compare Source

Patch Changes

  • f42aa79: fix: harden download URL SSRF guard against hostname and redirect bypasses

    validateDownloadUrl and the file download helpers (downloadBlob, download) could be bypassed in several ways when handling untrusted URLs:

    • A fully-qualified hostname with a trailing dot (e.g. localhost., myhost.local.) skipped the localhost/.local blocklist.
    • IPv6 addresses that embed an IPv4 address in their last 32 bits — IPv4-compatible (::127.0.0.1), IPv4-translated (::ffff:0:127.0.0.1), and NAT64 (64:ff9b::127.0.0.1, including the 64:ff9b:1::/48 local-use prefix) — were not decoded and checked against the private IPv4 ranges.
    • Redirects were validated only after fetch had already followed them, so the request to a redirect target (e.g. an internal/metadata address) had already been issued before the check ran.
    • Several reserved/internal address ranges were not blocked: CGNAT (100.64.0.0/10, used by some cloud providers for internal traffic), benchmarking (198.18.0.0/15), IETF protocol assignments (192.0.0.0/24), the reserved 240.0.0.0/4 block (including the 255.255.255.255 broadcast address), and IPv6 site-local (fec0::/10) and multicast (ff00::/8).

    The validator now strips trailing dots before the hostname checks and fully expands IPv6 addresses to detect embedded private IPv4 targets. The download helpers now follow redirects manually (redirect: 'manual'), re-validating each hop before requesting it, so an unsafe redirect target is never fetched. When a redirect cannot be inspected because the runtime returns an opaque response, the helpers fail closed (reject the redirect) on the server; only in a real browser — where SSRF is not reachable (fetch is constrained by CORS and cannot reach a server's internal network or cloud-metadata endpoints) — is the redirect followed natively so legitimate redirected downloads keep working.

  • 5291f7e: Harden stream text processing and middleware against prototype pollution from stream part IDs.

  • b4b575a: fix: redact server error details from UI message streams by default

    streamText(...).toUIMessageStream() and createUIMessageStream defaulted their onError callback to getErrorMessage, which serializes the raw error (error.toString() / JSON.stringify(error)) into the client-facing { type: 'error', errorText } chunk — and also into tool-output-error parts. The documented default was () => 'An error occurred.', so applications relying on the documented behavior were unknowingly streaming server exception details (internal hostnames, paths, provider request data, validation inputs) to end users.

    The default onError now returns the documented generic 'An error occurred.'. Raw error details are only emitted when the developer explicitly supplies an onError handler. This also redacts tool-output-error and invalid-tool-input error text by default; pass an onError to surface richer messages.

  • Updated dependencies [bfa5864]

  • Updated dependencies [f42aa79]

v6.0.202

Compare Source

Patch Changes

  • 942f2f8: fix(security): re-validate tool approvals from client message history before execution

    The approval-replay path in generateText/streamText reconstructed approved tool calls from the client-supplied messages array and executed them without re-validating input against the tool's schema or re-checking that the tool actually requires approval. A client could forge an assistant message with a pre-approved tool-call part and have the server execute a tool with attacker-chosen arguments.

    The replay path now verifies the HMAC signature (when experimental_toolApprovalSecret is configured), re-validates tool-call input against the tool's input schema, and re-resolves whether the tool requires approval before execution.

  • Updated dependencies [942f2f8]

v6.0.201

Compare Source

Patch Changes

  • 0c8c0ed: fix(ai): return schema-transformed elements in array output mode

    Previously final array output validation checked each element against the schema but returned the raw model output. Array output now returns the validated values so Zod transforms, coercions, defaults, and pipes are applied consistently with object output.

v6.0.200

Compare Source

Patch Changes
  • 14098e7: fix(ai): reject streamText result promises with NoOutputGeneratedError when the model stream ends without producing any output. Previously such streams resolved with an empty step. Incomplete streams with partial output still resolve with the partial result.
  • 2cabe9c: Harden UI message stream processing against prototype pollution from chunk IDs.

v6.0.199

Compare Source

Patch Changes

v6.0.198

Compare Source

Patch Changes

v6.0.197

Compare Source

v6.0.196

Compare Source

Patch Changes

v6.0.195

Compare Source

v6.0.194

Compare Source

v6.0.193

Compare Source

Patch Changes
  • af580ea: fix(ai): do not re-validate tool input for output-error parts in validateUIMessages

v6.0.192

Compare Source

Patch Changes

v6.0.191

Compare Source

Patch Changes

v6.0.190

Compare Source

Patch Changes

v6.0.189

Compare Source

Patch Changes
  • 356c3cf: fix(ai): make input optional on input-streaming UIMessagePart variants

v6.0.188

Compare Source

Patch Changes

  • c98715a: Add allowSystemInMessages option to ToolLoopAgent.

    This exposes the same option that exists on streamText and generateText, whether role: "system" messages are allowed in the prompt or messages fields. When unset, system messages are rejected because they can create a prompt injection attack risk. Ideally, use the instructions option instead. Set to true to allow system messages, or false to explicitly reject them.

    const agent = new ToolLoopAgent({
  model,
  allowSystemInMessages: true,
});

await agent.generate({
  messages: [
    { role: "system", content: "Server context" },
    { role: "user", content: "Hello" },
  ],
});

    The option can also be returned from prepareCall for dynamic per-call configuration.

v6.0.187

Compare Source

Patch Changes

v6.0.185

Compare Source

Patch Changes

v6.0.184

Compare Source

Patch Changes
  • 40fc5e4: fix(ai): default missing embedding warnings to an empty array

v6.0.183

Compare Source

Patch Changes

v6.0.182

Compare Source

Patch Changes
  • e76a29a: fix(ai): download tool-result file URLs

v6.0.180

Compare Source

Patch Changes

v6.0.178

Compare Source

Patch Changes
  • ac6f27e: fix(ai): update opentelemetry pinned version

v6.0.177

Compare Source

Patch Changes

v6.0.176

Compare Source

Patch Changes

v6.0.175

Compare Source

Patch Changes

v6.0.174

Compare Source

Patch Changes

v6.0.173

Compare Source

Patch Changes

v6.0.172

Compare Source

v6.0.171

Compare Source

Patch Changes

  • 48f842a: fix(ai): enforce callOptionsSchema at runtime in ToolLoopAgent

    ToolLoopAgentSettings.callOptionsSchema was declared and documented as a runtime schema for options, but tool-loop-agent.ts never invoked it. Any invariant a developer encoded in the schema was silently bypassed at runtime, and unchecked options flowed straight into prepareCall and any instructions template that interpolated them.

    ToolLoopAgent.prepareCall now validates caller-supplied options against callOptionsSchema (when set) via safeValidateTypes, throwing InvalidArgumentError on failure before forwarding to prepareCall / generateText / streamText.

  • a727da4: chore: ensure consistent import handling and avoid import duplicates or cycles

  • 5fee301: fix(mcp): prevent prototype pollution by using secureJsonParse

  • Updated dependencies [a727da4]

v6.0.170

Compare Source

Patch Changes
  • 19d587a: fix(ai): add allowSystemInMessages option and warn by default when system messages are found in prompt or messages

v6.0.169

Compare Source

v6.0.168

Compare Source

Patch Changes

v6.0.167

Compare Source

Patch Changes

v6.0.166

Compare Source

Patch Changes
  • b8d28f4: fix(ai): omit reasoning-start/end when sendReasoning is false

v6.0.165

Compare Source

Patch Changes

v6.0.164

Compare Source

Patch Changes

v6.0.163

Compare Source

Patch Changes

v6.0.162

Compare Source

Patch Changes

v6.0.161

Compare Source

Patch Changes

v6.0.160

Compare Source

Patch Changes

v6.0.159

Compare Source

Patch Changes

v6.0.158

Compare Source

Patch Changes
  • 295beba: fix(ai): fix lastAssistantMessageIsCompleteWithApprovalResponses to no longer ignore providerExecuted tool approvals

v6.0.157

Compare Source

Patch Changes
  • ff11aee: fix(ai): fix providerExecuted tool approvals being passed to language model twice

v6.0.156

Compare Source

Patch Changes

v6.0.155

Compare Source

Patch Changes
  • 06764c5: fix(ai): skip passing invalid JSON inputs to response messages

v6.0.154

Compare Source

Patch Changes

v6.0.153

Compare Source

Patch Changes

  • f152133: feat (ai/core): support plain string model IDs in rerank() function

    The rerank() function now accepts plain model strings (e.g., 'cohere/rerank-v3.5') in addition to RerankingModel objects, matching the behavior of generateText, embed, and other core functions.

v6.0.152

Compare Source

Patch Changes
  • d42076d: Add AI Gateway hint to provider READMEs

v6.0.151

Compare Source

Patch Changes

v6.0.150

Compare Source

Patch Changes

v6.0.149

Compare Source

Patch Changes

v6.0.148

Compare Source

Patch Changes

v6.0.147

Compare Source

Patch Changes

v6.0.146

Compare Source

Patch Changes

v6.0.145

Compare Source

Patch Changes

v6.0.144

Compare Source

Patch Changes

v6.0.143

Compare Source

Patch Changes

v6.0.142

Compare Source

Patch Changes

v6.0.141

Compare Source

Patch Changes

v6.0.140

Compare Source

Patch Changes

v6.0.139

Compare Source

Patch Changes

v6.0.138

Compare Source

Patch Changes

v6.0.137

Compare Source

Patch Changes

v6.0.136

Compare Source

Patch Changes

v6.0.135

Compare Source

Patch Changes
  • df6a330: chore(ai): remove all experimental agent events

v6.0.134

Compare Source

Patch Changes
  • ed6876b: chore(ai): remove all experimental embed events

v6.0.133

Compare Source

Patch Changes

v6.0.132

Compare Source

Patch Changes

v6.0.131

Compare Source

Patch Changes
  • 14f25f9: feat(ai): introduce experimental callbacks for embed function

v6.0.130

Compare Source

Patch Changes

v6.0.129

Compare Source

Patch Changes

v6.0.128

Compare Source

Patch Changes

v6.0.127

Compare Source

Patch Changes

v6.0.126

Compare Source

Patch Changes
  • 578615a: Remove custom User-Agent header from HttpChatTransport to fix CORS preflight failures in Safari and Firefox

v6.0.125

Compare Source

Patch Changes

v6.0.124

Patch Changes

v6.0.122

Compare Source

Patch Changes

v6.0.121

Compare Source

Patch Changes

v6.0.120

Compare Source

Patch Changes
  • 78c0e26: feat(ai): pass result provider metadata across the stream

v6.0.119

Compare Source

Patch Changes
  • ab286f1: fix(ai): doStream should reflect transformed values
  • d68b122: feat(ai): add missing usage attributes

v6.0.118

Compare Source

Patch Changes

  • 64ac0fd: fix(security): validate redirect targets in download functions to prevent SSRF bypass

    Both downloadBlob and download now validate the final URL after following HTTP redirects, preventing attackers from bypassing SSRF protections via open redirects to internal/private addresses.

  • Updated dependencies [64ac0fd]

v6.0.117

Compare Source

Patch Changes

v6.0.116

Compare Source

Patch Changes

v6.0.115

Compare Source

Patch Changes

v6.0.114

Compare Source

Patch Changes
  • 2291047: fix(ai): fix missing support for image thought signatures (e.g. for Gemini image models)

v6.0.113

Compare Source

Patch Changes
  • 70d3980: fix(ai): use errorMode 'text' in approval continuation to preserve tool error messages

v6.0.112

Compare Source

Patch Changes

v6.0.111

Compare Source

Patch Changes
  • 2129c82: feat(ai): register global telemetry integrations

v6.0.110

Compare Source

Patch Changes

v6.0.109

Compare Source

Patch Changes

v6.0.108

Compare Source

Patch Changes
  • 2a4f512: feat(ai): add telemetry interface and registry

v6.0.107

Compare Source

Patch Changes

v6.0.106

Compare Source

Patch Changes

v6.0.105

Compare Source

Patch Changes

v6.0.104

Compare Source

Patch Changes

v6.0.103

Compare Source

Patch Changes

v6.0.102

Compare Source

Patch Changes

v6.0.101

Compare Source

Patch Changes
  • 5230482: fix(ai): Don't create duplicate tool parts when models call non-existent tools

v6.0.100

Compare Source

Patch Changes
  • b7fba77: feat(ai): add event notifiers to core functions

v6.0.99

Compare Source

Patch Changes

v6.0.98

Compare Source

Patch Changes

v6.0.97

Compare Source

Patch Changes
  • ebfdad1: feat(ai): experimental callbacks in ToolLoopAgent

v6.0.96

Compare Source

Patch Changes
  • 30c9de6: feat(ai): experimental callbacks for streamText

v6.0.95

Compare Source

Patch Changes

v6.0.94

Compare Source

Patch Changes

v6.0.93

Compare Source

Patch Changes
  • d3769ec: feat(ai): add experimental callbacks in generateText

v6.0.92

Compare Source

Patch Changes

v6.0.91

Compare Source

Patch Changes

v6.0.90

Compare Source

Patch Changes
  • 98e83ab: Fix useChat status briefly flashing to submitted on page load when resume: true is set and there is no active stream to resume. The reconnectToStream check is now performed before setting status to submitted, so status stays ready when the server responds with 204 (no active stream).

v6.0.89

Compare Source

Patch Changes

v6.0.88

Compare Source

Patch Changes

v6.0.87

Compare Source

Patch Changes

v6.0.86

Compare Source

Patch Changes

v6.0.85

Compare Source

Patch Changes

v6.0.84

Compare Source

Patch Changes

  • 4024a3a: security: prevent unbounded memory growth in download functions

    The download() and downloadBlob() functions now enforce a default 2 GiB size limit when downloading from user-provided URLs. Downloads that exceed this limit are aborted with a DownloadError instead of consuming unbounded memory and crashing the process. The abortSignal parameter is now passed through to fetch() in all download call sites.

    Added download option to transcribe() and experimental_generateVideo() for providing a custom download function. Use the new createDownload({ maxBytes }) factory to configure download size limits.

  • Updated dependencies [4024a3a]

v6.0.83

Compare Source

Patch Changes

v6.0.82

Compare Source

Patch Changes

v6.0.81

Compare Source

Patch Changes
  • ee4beee: feat(ai): add onStepFinish callback to createUIMessageStream

[v6.0.80](https://redirect.github.com/vercel/ai/blob/HEAD/packages/ai/CHAN

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot force-pushed the renovate/ai-6.x branch 11 times, most recently from 1d230e2 to 9e5d379 Compare January 29, 2026 00:49
@renovate renovate Bot force-pushed the renovate/ai-6.x branch 10 times, most recently from cefb377 to 32e3819 Compare February 5, 2026 09:47
@renovate renovate Bot force-pushed the renovate/ai-6.x branch 9 times, most recently from 9272748 to 557e3ff Compare February 12, 2026 02:08
@renovate renovate Bot force-pushed the renovate/ai-6.x branch 9 times, most recently from f9def52 to b088118 Compare February 27, 2026 17:06
@renovate renovate Bot force-pushed the renovate/ai-6.x branch 9 times, most recently from fa61647 to 4c12105 Compare March 5, 2026 01:52
@renovate renovate Bot force-pushed the renovate/ai-6.x branch 7 times, most recently from 89b5758 to df329f6 Compare March 27, 2026 02:00
@renovate renovate Bot changed the title chore(deps): update dependency ai to v6 fix(deps): update dependency ai to v6 Mar 27, 2026
@renovate renovate Bot force-pushed the renovate/ai-6.x branch 2 times, most recently from bc09a47 to 82e1e9f Compare March 30, 2026 21:52
@renovate renovate Bot changed the title fix(deps): update dependency ai to v6 chore(deps): update dependency ai to v6 Mar 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants