fix(deps): update ai sdk (major) - #151
Conversation
dawsontoth
left a comment
dawsontoth
left a comment
There was a problem hiding this comment.
Approving. This is the AI SDK v4-spec bump done correctly — bumped as a set, which is what makes it safe.
What it does
ai ^6.0.79 -> ^7.0.0 (7.0.65)
@ai-sdk/google ^3.0.24 -> ^4.0.0 (4.0.44)
@ai-sdk/openai ^3.0.26 -> ^4.0.0 (4.0.41)
ollama-ai-provider-v2 ^3.3.0 -> ^4.0.0 (4.0.1)
@ai-sdk/anthropic ^4.0.0 (unchanged, already v4)
The spec-version gate passes
This repo's real risk on any @ai-sdk/* bump is lifecycle/getModel.ts, which wraps every provider in aisdk() from @openai/agents-extensions/ai-sdk — and that bridge hard-throws on an unexpected specificationVersion. Unit tests can't see it, because getModel.test.ts mocks both @ai-sdk/anthropic and the bridge, so all 345 tests pass regardless. Checked it directly instead.
Before (main) — mixed, because @ai-sdk/anthropic@4 was already ahead of its siblings:
| provider | spec |
|---|---|
| anthropic | v4 |
| google / openai / ollama | v3 |
That also left two copies of @ai-sdk/provider in the tree (3.0.14 hoisted + 4.0.7 nested under anthropic).
After (this branch) — uniform, one flattened provider copy:
| provider | spec |
|---|---|
| anthropic / google / openai / ollama | v4 |
@ai-sdk/provider dedupes to a single 4.0.7. That's the shape you want.
@openai/agents-extensions@0.14.3 stays put and explicitly admits this combination:
"peerDependencies": {
"@ai-sdk/provider": "^2.0.0 || ^3.0.0 || ^4.0.0",
"ai": "^6.0.0 || ^7.0.0"
}Verified past the type level, per the probe recipe — new Agent({ model: aisdk(...) }) + run() with invalid keys and OPENAI_AGENTS_DISABLE_TRACING=1:
anthropic -> APICallError | invalid x-api-key PASS
google -> APICallError | API key not valid. Please pass a valid API key. PASS
Reaching the provider's auth rejection is the pass signal — no Unsupported AI SDK specificationVersion. Same probe on main also passes, so to be clear: this is not fixing a live breakage, it's a clean forward move that removes the v3/v4 straddle and the duplicate @ai-sdk/provider.
Local verification
npm ci # exit 0
npm run lint # exit 0
npm run format # exit 0
npm run build # exit 0 (CI has no build job — checked manually)
npm run test # exit 0 53 files, 345 tests passing
npm run build matters most here given agent#145 and agent#150 both broke the build behind green checks. It's clean on this branch.
Note on the sibling PRs
- #148 (
chore(deps): update ai sdk, lockfile-only, keepsaion 6.x) is superseded by this — Renovate should auto-close it once this lands. Its contents are fine, just redundant. - #150 (
@openai/agents0.15) is independent and currently blocked on a build break; it does not interact with this PR. Merging this one does not depend on that being resolved. aiitself has no directimportanywhere in the source — it's carried as a declared dependency to satisfy theagents-extensionspeer range, so keeping it aligned (as this PR does) is the right maintenance move.
🤖 Verified locally by Claude Opus 5 via scheduled Renovate triage
|
🎉 This PR is included in version 0.16.40 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
1 participant
This PR contains the following updates:
^3.0.24→^4.0.0^3.0.26→^4.0.0^6.0.79→^7.0.0^3.3.0→^4.0.0Release Notes
vercel/ai (@ai-sdk/google)
v4.0.44Compare Source
Patch Changes
16650e9: feat(google): addgemini-3.7-flashmodelv4.0.43Patch Changes
8e90283: Preserve forced tool calls when strict function tools are configured.v4.0.42Patch Changes
7fbfc6d]v4.0.41Patch Changes
da78d58: fix(google): convert enum values to the Gemini schema format8a2482d: Preserve Google API error details inAPICallError.data.v4.0.40Compare Source
Patch Changes
401a4ba]v4.0.39Compare Source
Patch Changes
ad6a650]81cd026]v4.0.38Compare Source
Patch Changes
1937bef]v4.0.37Compare Source
Patch Changes
bbd9b31: chore: rename*TranslationModeland its related types to*SpeechTranslationModelfor consistencyv4.0.36Compare Source
Patch Changes
3469d0c]v4.0.35Compare Source
Patch Changes
2b60826]v4.0.34Compare Source
Patch Changes
1bec07d]v4.0.33Compare Source
Patch Changes
160ccdb]v4.0.32Compare Source
Patch Changes
79e133c: async APIs for generateVideo (poll, webhook)Adds an asynchronous start/status flow to the experimental video model
interface (
VideoModelV4): models may now implementdoStart,doStatus,and
handleWebhookOptioninstead of (or in addition to)doGenerate, andexperimental_generateVideoacceptspollandwebhookoptions toorchestrate completion via polling or webhooks. Polling configuration can use
a custom delay implementation for durable workflow compatibility.
Updated dependencies [
79e133c]v4.0.31Compare Source
Patch Changes
5fc7da5: chore: centralize empty language model usage creation in provider utilities.5fc7da5]93b2acd]v4.0.30Compare Source
Patch Changes
fa95504]v4.0.29Compare Source
Patch Changes
d8210b6: chore: centralize record type guards in provider-utilsd8210b6]b192878]v4.0.28Compare Source
Patch Changes
1659cd5]6a5bdff]v4.0.27Compare Source
Patch Changes
d2d9324: ForwardtopKthrough Google Interactions requests and warn when unsupported frequency or presence penalties are provided.8bedb2c: Allow fetch to derive the content length for Google file upload request bodies.v4.0.26Compare Source
Patch Changes
c49380c: feat: add experimental streaming speech translation models (openai.translation('gpt-realtime-translate')over the OpenAI Realtime translations WebSocket andgoogle.translation('gemini-3.5-live-translate-preview')over the Gemini Live API).connectToWebSocketin@ai-sdk/provider-utilsnow passes close code and reason toonClose(additive, optional parameter).0c464d9]c49380c]v4.0.25Compare Source
Patch Changes
1e2f324]v4.0.24Compare Source
Patch Changes
c57a353: fix(google): omit unsupported function call IDsv4.0.23Compare Source
Patch Changes
f126649: feat(provider/google): default unknown Gemini model IDs to the newest supported capabilitiesv4.0.22Compare Source
Patch Changes
66b7151: fix(provider/google): preserve Gemini Live lifecycle events5e5453c: Avoid missing thought-signature warnings and skip-validator injection for valid unsigned Gemini 3 parallel function calls in the same model response.v4.0.21Compare Source
Patch Changes
7c16f21: feat(google): addgemini-3.6-flashandgemini-3.5-flash-litemodelsv4.0.20Compare Source
Patch Changes
02ffdcb]76cb673]v4.0.19Compare Source
Patch Changes
a70b027: fix(provider/google): associate multiple code execution results with their tool calla3ce307: fix(provider/google): surface GeminiresponseIdasresponse-metadata(stream) andresponse.id(generate)v4.0.18Compare Source
Patch Changes
cd06458]v4.0.17Compare Source
Patch Changes
5b4a299: fix(provider/google): forward Vertex-only imageConfig options (personGeneration, prominentPeople, imageOutputOptions)v4.0.16Compare Source
Patch Changes
662ddfc: Allow google.interactions agent requests to include supported tools, including file_search.v4.0.15Compare Source
Patch Changes
31c7be8]v4.0.14Compare Source
Patch Changes
4be62c1: fix(provider-utils): validate provider-response URLs ingetFromApigetFromApinow has avalidateUrlflag. It is optional so existing callers keep compiling (omitting it behaves likefalse, i.e. no validation), but all AI SDK provider packages set it explicitly at every call site so each one makes a visible trust decision. Whentrue, the URL is routed throughfetchWithValidatedRedirects— the same guard used bydownloadBlob— which rejects private/loopback/link-local targets, re-validates every redirect hop, strips proxy/metadata/cookie request headers, and drops all caller headers except the user-agent on cross-origin redirects (custom API-key headers must not follow a redirect off-origin any more thanAuthorizationmay); blocked URLs throwDownloadError. It is enabled at the image/video/audio download and polling call sites where the URL comes from a provider response body; URLs built from developer-configured endpoints passvalidateUrl: falseand are unaffected.A new optional
credentialedOriginwithholds caller headers unless the URL is same-origin with it, so the API key is not sent to a response-supplied host on a different origin.A new optional
trustedOriginexempts URLs (and redirect hops) that are same-origin with the developer-configured provider endpoint from target validation, so self-hosted and localhost deployments whose response URLs point back at the configured host keep working; all other hops are still validated.Also closes range gaps in
validateDownloadUrl(IPv4224.0.0.0/4multicast and the TEST-NET documentation ranges192.0.2.0/24,198.51.100.0/24,203.0.113.0/24; IPv6 documentation ranges2001:db8::/32and3fff::/20), and follows only the fetch-spec redirect status codes (301/302/303/307/308) — aLocationheader on any other status is not followed. This guard performs string/literal checks only and does not resolve DNS; hostnames that resolve to private addresses and DNS rebinding remain out of scope and must be constrained at the network layer (or by injecting a Nodefetchthat pins the resolved IP at connect time) for server deployments handling untrusted URLs. Seecontributing/secure-url-handling.md.Updated dependencies [
4be62c1]Updated dependencies [
7805e4a]Updated dependencies [
cd12954]v4.0.12Compare Source
Patch Changes
e40118c: Forward text file references as documents when using the Google Interactions API.v4.0.11Compare Source
Patch Changes
17d66c5: Fix Google tool result conversion to send file data as inline data instead of JSON text on the legacy tool-result path.96d40bc: Expand standalone Googlethresholdprovider options into safety settings.0f93c57: feat (video): support video (not just image) reference inputs ininputReferencesfor reference-to-video generation0f93c57]v4.0.10Compare Source
Patch Changes
ac306ed]v4.0.9Compare Source
Patch Changes
7401c2c: Pass documented Gemini external HTTPS file URLs through without downloading them.v4.0.8Compare Source
Patch Changes
5c5c0f5: Add experimental streaming transcription support for transcription models, including OpenAIgpt-realtime-whisperand xAI WebSocket STT.5c5c0f5]v4.0.7Compare Source
Patch Changes
c6f5e62: Prevent prototype pollution when synchronously parsing provider JSON inputs and exposesecureJsonParsefrom provider-utils.bd8d172: Fix Google embedding batch size to respect the Gemini API limit of 100 requests per batch.c6f5e62]v4.0.6Compare Source
Patch Changes
d20f0dc: Addvertex.interactions()for the Gemini Interactions API on Vertex AI. Targets the location-scoped.../locations/{region}/interactionsresource using the existing Vertex OAuth credentials, enabling multimodal-output models such asgemini-omni-flash-preview(video output) through Vertex. TheGoogleInteractionsLanguageModelis now exported from@ai-sdk/google/internalfor provider reuse.v4.0.5Compare Source
Patch Changes
8c616f0]v4.0.4Compare Source
Patch Changes
dc1eb8d: Support Gemini Interactions video output. Parse video output blocks from the Google Interactions API into file parts (buffered and streaming), and surface the per-modality output token breakdown viaproviderMetadata.google.outputTokensByModality.v4.0.3Compare Source
Patch Changes
0274f34: feat (video): add first-classframeImagesandinputReferencescall options for video generation0274f34]v4.0.2Compare Source
Patch Changes
6a436e3]v4.0.1Compare Source
Patch Changes
ba6d510: chore: fix deprecated use of zod.passthrough()v4.0.0Compare Source
Major Changes
a3757d7: chore(provider/google): remove useless GenerativeAI affix from types and classes for consistencyf7d4f01: feat(provider): add support forreasoning-filetype for files that are part of reasoningef992f8: Remove CommonJS exports from all packages. All packages are now ESM-only ("type": "module"). Consumers usingrequire()must switch to ESMimportsyntax.c29a26f: feat(provider): add support for provider references and uploading files as supported per provider3887c70: feat(provider): add new top-level reasoning parameter to spec and support it ingenerateTextandstreamText8359612: Start v7 pre-release04e9009: chore: make provider implementations code patterns more consistent, including renaming certain exported symbolsFor all externally exported symbols that were renamed, the old names continue to work via deprecated aliases.
Patch Changes
7f04802: feat(provider/google): add support for managed agents in the Interactions API38fc777: Add AI Gateway hint to provider READMEsb71c0d7: feat(provider/google): support Google search grounding when usinggenerateImagewith Gemini6190649: chore(provider/google): remove obsolete Google image model55db546: fix(provider/google): fix Gemini service tier enum after upstream update9a0a618: fix(google): fixserviceTierto be correctly formatted for Vertex API00a0f36: feat(google, google-vertex): addedgemini-embedding-2,deep-research-max-preview-04-2026anddeep-research-preview-04-20269715ec7: feat(provider/google): add support for service tier parameter41da50c: fix(provider/google): supportfunctionCall.idwhen returned by Gemini API and provide matchingfunctionResponse.idadd4326: fix(provider/google): correct JSDoc for multimodal embedding content optiona8d70b6: fix(google): auto-injectskip_thought_signature_validatorfor Gemini 3 tool-call replays without a signature947cdab: Add Google realtime Live Translation provider options forgemini-3.5-live-translate-preview.4e825f3: feat(google): update Interactions API implementation to cater for upstream breaking changes coming May 26b563707: feat(provider/google): add Gemini text-to-speech (speech) model supporta05109d: feat(provider/google): preserve per-modality token details in usage datacfca634: fix(google): emit Vertex no-args streaming tool calls and preserve thoughtSignatureVertex emits a no-args function call as a single chunk shaped
{ functionCall: { name: 'X' } }with noargs, nopartialArgs, and nowillContinue. The streaming parser had no branch for this shape, so the call was dropped along with anythoughtSignatureit carried. For Gemini 3 thinking models this caused the next multi-turn step to 400 withmissing thought_signature. The unary (doGenerate) path had the same drop.Both paths now emit the call as a complete tool call with
'{}'input and propagatethoughtSignatureprovider metadata.Fixes #14847.
c9c4661: fix(provider/google): preserve groundingMetadata and urlContextMetadata when they arrive in a stream chunk before the finishReason chunk045d2e8: fix(google): readserviceTierfromusageMetadata.serviceTierin both generate and stream pathsThe previous implementation read
serviceTierfrom thex-gemini-service-tierresponse header, which is only populated on non-streaming responses. Gemini
streaming includes the value in
usageMetadata.serviceTieron every chunk, soproviderMetadata.google.serviceTierwas alwaysnullfor streams. Read fromusageMetadatafor both paths instead.19b95f9: fix(google): use VALIDATED function calling mode when any tool has strict:true2ce3c65: feat(provider/google-vertex): add Gemini text-to-speech (speech) model support5878b40: fix(google): prevent prototype pollution when streaming tool args46d1149: chore(provider-utils,google): fix grammar errors in error and warning messages6a26901: feat(google): addfileDatasupport to embedding model01fa606: feat(provider/google): support combining built-in tools with function calling on Gemini 35036db8: feat(google-vertex): add support for streaming tool arguments input9f0e36c: trigger release for all packages after provenance setupa2609df: fix(google): fix streaming tool call argsab43029: feat(provider/google): support multimodal content parts in embedding provider options82288b0: feat(provider/google): addgemini-embedding-2-previewand fix multimodal embedding support withembedManyb04e23e: feat(provider/google): add support for the Gemini Interactions API58a2ad7: fix: more precise default message for tool execution deniale59176c: chore(google): update v3 specs to v4ebbb0f2: fix(provider/google): fix lack of image consistency when using Interactions API in stateless modeaeda373: fix: only send provider credentials to same-origin response-supplied URLsSeveral provider clients followed a URL taken from the provider's API response (a polling/status URL or a final media URL such as
polling_url,urls.get,result_url,result.sample, orvideo.uri) and reused the authenticated headers — or appended?key=<API_KEY>— on that request. Because the host of the response-supplied URL was never validated, the long-lived API key was sent to whatever host the response named (a CDN in the benign case, or an attacker-chosen host if the provider response was tampered with), allowing credential exfiltration.A new
isSameOriginhelper is added to@ai-sdk/provider-utils, and the affected fetches in@ai-sdk/black-forest-labs,@ai-sdk/fireworks,@ai-sdk/replicate,@ai-sdk/gladia,@ai-sdk/fal, and@ai-sdk/googlenow attach credentials only when the followed URL is same-origin with the provider's configured API origin. Requests to a foreign origin are made without the credential.7fc6bd6: Raise minimum supported Node.js version to 22. Supported versions: 22, 24, and 26.0c4c275: trigger initial canary releasebdb9ea1: chore(google): remove now obsolete Interactions APIApi-Revisionheaderdb394ab: feat(provider/google): support cancelling long-running Interactions API agents via AbortSignal, and process their intermittent streamce769dd: feat(provider): add experimental Realtime API support for voice conversationsAdds first-class support for realtime (speech-to-speech) APIs:
Experimental_RealtimeModelV4spec in@ai-sdk/providerwith normalized event types and factoryopenai.experimental_realtime()/google.experimental_realtime()/xai.experimental_realtime()work in both server and browser.getToken()static method on each provider for server-side ephemeral token creationexperimental_getRealtimeToolDefinitionshelper for provider session tool definitionsexperimental_useRealtimehook in@ai-sdk/reactreturningUIMessage[](aligned withuseChat), withonToolCallandaddToolOutputfor client-driven tool executioninputAudioTranscriptionsession config for showing transcribed user audio messages when supported by the provider5b7e7c2: fix(google-vertex): don't send streamFunctionCallArguments for unary API calls and change default to false2edd14e: fix(provider/google): correctly mark reasoning files as such and fix related multi-turn errors9bd6512: feat(provider): change file part data property to be tagged with a type and remove the image part type258c093: chore: ensure consistent import handling and avoid import duplicates or cycles546cefe: feat(provider/google): addgemini-3.5-flash5463d0d: feat(provider): align tool result output content file part types with top-level message file part types55f0938: chore(provider/google): update available modelsb8396f0: trigger initial beta release84f36e0: fix(google): omit passing includeServerSideToolInvocations for Vertex tool_config90e2d8a: chore: fix unused vars not being flagged by our lint tooling4dac142: feat(google): add new finishMessage field in providerMetadataaeea161: feat(google): readserviceTierfromx-gemini-service-tierresponse header in Gemini API and use PayGo for Vertex18c1970: feat(provider/google): Add multimodal tool-result support for Google function responses.Tool results with
output.type = 'content'now map media parts intofunctionResponse.partsfor Google models, includingimage-data,file-data, and base64data:URLs in URL-style content parts.Remote HTTP(S) URLs in URL-style tool-result parts are not supported.
b3976a2: Add workflow serialization support to all provider models.@ai-sdk/provider-utils: NewserializeModel()helper that extracts only serializable properties from a model instance, filtering out functions and objects containing functions. Third-party provider authors can use this to add workflow support to their own models.All providers:
headersis now optional in provider config types. This is non-breaking — existing code that passesheaderscontinues to work. Custom provider implementations that construct model configs manually can now omitheaders, which is useful when models are deserialized from a workflow step boundary where auth is provided separately.All provider model classes now include
WORKFLOW_SERIALIZEandWORKFLOW_DESERIALIZEstatic methods, enabling them to cross workflow step boundaries without serialization errors.ff5eba1: feat: rollimage-*tool output types into their equivalentfile-*typesv3.0.110Compare Source
Patch Changes
31205a4]v3.0.109Compare Source
Patch Changes
71e94ad: feat(google): addgemini-3.7-flashmodelv3.0.108Compare Source
Patch Changes
dd7ecd7: Preserve forced tool calls when strict function tools are configured.v3.0.107Compare Source
Patch Changes
c29b64f: Preserve Google API error details inAPICallError.data.b2a4d5a]v3.0.106Compare Source
Patch Changes
2171d15]v3.0.105Compare Source
Patch Changes
dab0a08]v3.0.104Compare Source
Patch Changes
ee2bf30]vercel/ai (@ai-sdk/openai)
v4.0.41Compare Source
Patch Changes
59d6def: Reconstruct provider-executed shell calls when continuing OpenAI Responses with storage disabled.v4.0.40Patch Changes
e19a4a6: Avoid duplicate MCP approval request references when continuing stored OpenAI Responses.v4.0.39Patch Changes
7fbfc6d]v4.0.38Patch Changes
d302134: Keep client-executed function calls paired with their outputs when chaining OpenAI Responses with a previous response ID.v4.0.37Compare Source
Patch Changes
401a4ba]v4.0.36Compare Source
Patch Changes
6157098: fix(openai): serialize tool text outputs when an output schema is configured4cd4548: AcceptserviceTier: 'fast'on OpenAI chat and responses models. OpenAI renamed priority processing to Fast mode and acceptsservice_tier: 'fast'and'priority'interchangeably, so'fast'is now passed through verbatim and gated on the same model capability as'priority'.ad6a650]81cd026]v4.0.35Compare Source
Patch Changes
1937bef]v4.0.34Compare Source
Patch Changes
73d48d0: fix(provider/openai): correlate rotating Responses API item IDs by output indexbbd9b31: chore: rename*TranslationModeland its related types to*SpeechTranslationModelfor consistencyv4.0.33Compare Source
Patch Changes
e6a93c4: feat(openai): support batch APIs with experimental_startTextBatchv4.0.32Compare Source
Patch Changes
3469d0c]v4.0.31Compare Source
Patch Changes
2b60826]v4.0.30Compare Source
Patch Changes
1bec07d: Fix streamed tool calls with non-zero, non-contiguous, reused, or missing indexes.1bec07d]v4.0.29Compare Source
Patch Changes
160ccdb]v4.0.28Compare Source
Patch Changes
79e133c]v4.0.27Compare Source
Patch Changes
5fc7da5: chore: centralize empty language model usage creation in provider utilities.93b2acd: chore: centralize response metadata conversion5fc7da5]93b2acd]v4.0.26Compare Source
Patch Changes
f7c4a38: Serialize file upload expiry settings in the multipart field shape accepted by OpenAI.fa95504]v4.0.25Compare Source
Patch Changes
beaecb3: fix(provider/openai): resolve responses doStream at response.in_progress instead of first output tokenThe early-stream-error peek treated
response.in_progressas an unknown chunk, sodoStreamdid not resolve until the first output item arrived — delaying stream availability (and downstream TTFB for proxies/gateways) by the model's full time-to-first-token.response.in_progressis now modeled in the chunk schema and marks the request as accepted: the peek keeps watching for error frames for a short grace window (50ms) so quota/rate-limit errors flushed alongsideresponse.in_progressstill throw as retryableAPICallErrors, while healthy streams become available right after upstream acknowledges the request.b192878: feat: add experimental_toolCaller routing to generateText for code modeUpdated dependencies [
d8210b6]Updated dependencies [
b192878]v4.0.24Compare Source
Patch Changes
1659cd5]6a5bdff]v4.0.23Compare Source
Patch Changes
96a237d: Add blocked domain filters to the OpenAI and Azure Responses API web search tools.v4.0.22Compare Source
Patch Changes
c49380c: feat: add experimental streaming speech translation models (openai.translation('gpt-realtime-translate')over the OpenAI Realtime translations WebSocket andgoogle.translation('gemini-3.5-live-translate-preview')over the Gemini Live API).connectToWebSocketin@ai-sdk/provider-utilsnow passes close code and reason toonClose(additive, optional parameter).0c464d9]c49380c]v4.0.21Compare Source
Patch Changes
1e2f324]v4.0.20Compare Source
Patch Changes
1f6dd3a: Add OpenAI Responses Programmatic Tool Calling with hosted program tools, function caller controls, structured output schemas, and multi-step continuation support.v4.0.19Compare Source
Patch Changes
34c53c0: Apply reasoning, service tier, and image defaults to recognizable future OpenAI model family versions.v4.0.18Compare Source
Patch Changes
bc43dc2: Preserve stored tool search output item IDs from provider metadata.v4.0.17Compare Source
Patch Changes
02ffdcb]76cb673]v4.0.16Compare Source
Patch Changes
75f86f4: fix(provider/openai, provider/open-responses): throwConfiguration
📅 Schedule: (in timezone America/New_York)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.