Skip to content

fix(deps): update dependency ai to v6 [security]#17

Open
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/npm-ai-vulnerability
Open

fix(deps): update dependency ai to v6 [security]#17
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/npm-ai-vulnerability

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Nov 8, 2025 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
ai (source) ^4.3.16 → ^6.0.0 age confidence

GitHub Vulnerability Alerts

CVE-2025-48985

A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists when uploading files. All users are encouraged to upgrade.

Release Notes

vercel/ai (ai)

v6.0.116

Compare Source

Patch Changes

v6.0.115

Compare Source

Patch Changes

v6.0.114

Compare Source

Patch Changes
  • 2291047: fix(ai): fix missing support for image thought signatures (e.g. for Gemini image models)

v6.0.113

Compare Source

Patch Changes
  • 70d3980: fix(ai): use errorMode 'text' in approval continuation to preserve tool error messages

v6.0.112

Compare Source

Patch Changes

v6.0.111

Compare Source

Patch Changes
  • 2129c82: feat(ai): register global telemetry integrations

v6.0.110

Compare Source

Patch Changes

v6.0.109

Compare Source

Patch Changes

v6.0.108

Compare Source

Patch Changes
  • 2a4f512: feat(ai): add telemetry interface and registry

v6.0.107

Compare Source

Patch Changes

v6.0.106

Compare Source

Patch Changes

v6.0.105

Compare Source

Patch Changes

v6.0.104

Compare Source

Patch Changes

v6.0.103

Compare Source

Patch Changes

v6.0.102

Compare Source

Patch Changes

v6.0.101

Compare Source

Patch Changes
  • 5230482: fix(ai): Don't create duplicate tool parts when models call non-existent tools

v6.0.100

Compare Source

Patch Changes
  • b7fba77: feat(ai): add event notifiers to core functions

v6.0.99

Compare Source

Patch Changes

v6.0.98

Compare Source

Patch Changes

v6.0.97

Compare Source

Patch Changes
  • ebfdad1: feat(ai): experimental callbacks in ToolLoopAgent

v6.0.96

Compare Source

Patch Changes
  • 30c9de6: feat(ai): experimental callbacks for streamText

v6.0.95

Compare Source

Patch Changes

v6.0.94

Compare Source

Patch Changes

v6.0.93

Compare Source

Patch Changes
  • d3769ec: feat(ai): add experimental callbacks in generateText

v6.0.92

Compare Source

Patch Changes

v6.0.91

Compare Source

Patch Changes

v6.0.90

Compare Source

Patch Changes
  • 98e83ab: Fix useChat status briefly flashing to submitted on page load when resume: true is set and there is no active stream to resume. The reconnectToStream check is now performed before setting status to submitted, so status stays ready when the server responds with 204 (no active stream).

v6.0.89

Compare Source

Patch Changes

v6.0.88

Compare Source

Patch Changes

v6.0.87

Compare Source

Patch Changes

v6.0.86

Compare Source

Patch Changes

v6.0.85

Compare Source

Patch Changes

v6.0.84

Compare Source

Patch Changes

  • 4024a3a: security: prevent unbounded memory growth in download functions

    The download() and downloadBlob() functions now enforce a default 2 GiB size limit when downloading from user-provided URLs. Downloads that exceed this limit are aborted with a DownloadError instead of consuming unbounded memory and crashing the process. The abortSignal parameter is now passed through to fetch() in all download call sites.

    Added download option to transcribe() and experimental_generateVideo() for providing a custom download function. Use the new createDownload({ maxBytes }) factory to configure download size limits.

  • Updated dependencies [4024a3a]

v6.0.83

Compare Source

Patch Changes

v6.0.82

Compare Source

Patch Changes

v6.0.81

Compare Source

Patch Changes
  • ee4beee: feat(ai): add onStepFinish callback to createUIMessageStream

v6.0.80

Compare Source

Patch Changes

v6.0.79

Compare Source

Patch Changes

v6.0.78

Compare Source

Patch Changes

  • 59fcf30: fix(ai): make experimental_context required in ToolLoopAgentOnFinishCallback

    This fixes a type inconsistency where ToolLoopAgentOnFinishCallback had experimental_context as optional while StreamTextOnFinishCallback and GenerateTextOnFinishCallback had it as required. Since ToolLoopAgent delegates to streamText/generateText, and both always pass experimental_context when invoking the callback, the types should match.

v6.0.77

Compare Source

Patch Changes

v6.0.76

Compare Source

Patch Changes

v6.0.75

Compare Source

Patch Changes

v6.0.74

Compare Source

Patch Changes
  • 471009b: fix(ai): pass reasoning text in telemetry

v6.0.73

Patch Changes

v6.0.72

Patch Changes

v6.0.71

Compare Source

Patch Changes

v6.0.70

Compare Source

Patch Changes

v6.0.69

Compare Source

Patch Changes
  • d659305: fix(ai): auto-populate originalMessages in createAgentUIStream

v6.0.68

Compare Source

Patch Changes
  • 8bf2660: chore(ai): export DefaultGeneratedFile

v6.0.67

Compare Source

Patch Changes

v6.0.66

Compare Source

Patch Changes

v6.0.65

Compare Source

Patch Changes

v6.0.64

Compare Source

Patch Changes
  • ce9daa3: Fixed 'reasoning part reasoning-0 not found' error by ensuring 'reasoning-start' event is emitted for empty thinking blocks (eg. )

v6.0.63

Patch Changes
  • be95579: fix(ui): respect Promise<false> when returned by sendAutomaticallyWhen

v6.0.62

Patch Changes

v6.0.61

Patch Changes

v6.0.60

Patch Changes
  • 5fc42fa: feat(ai): add experimental retention setting

v6.0.59

Patch Changes

v6.0.58

Patch Changes

v6.0.57

Patch Changes
  • 65865d8: Fix handling of error results in deferrable tools

v6.0.56

Patch Changes

v6.0.55

Patch Changes
  • 43a74df: chore(ai): add skill to README

v6.0.54

Patch Changes
  • 2f8ac87: docs(ai): fix incorrect and outdated jsdoc

v6.0.53

Patch Changes

v6.0.52

Patch Changes

v6.0.51

Patch Changes
  • ea0feb5: fix(ai): clean up step timeout when error occurs in streamText

v6.0.50

Compare Source

Patch Changes

v6.0.49

Patch Changes
  • ded661b: feat(ai): add onStepFinish to agent.generate and agent.stream

v6.0.48

Patch Changes

v6.0.47

Patch Changes

v6.0.46

v6.0.45

Patch Changes

v6.0.44

Compare Source

Patch Changes

v6.0.43

Compare Source

Patch Changes

  • 2dc9bfa: fix(ai): handle provider-executed tools and tool-approval-response in validation

    • Skip validation for tool calls with providerExecuted: true (deferred results)
    • Map approvalId to toolCallId for proper tool-approval-response handling
    • Filter out empty tool messages after content filtering
    • Fixes MissingToolResultError for async and approval-based tool flows

v6.0.42

Compare Source

Patch Changes

v6.0.41

Compare Source

Patch Changes

v6.0.40

Compare Source

Patch Changes
  • ab57783: Add usage information to onFinish callback in useChat

v6.0.39

Compare Source

Patch Changes

  • 4e28ba0: fix(ai): propagate providerMetadata during input-streaming state

    Provider-executed tools (like MCP tools) need to send metadata during the streaming phase, but the implementation only set callProviderMetadata when part.state === "input-available". This fix removes the overly-restrictive state check and adds callProviderMetadata to the input-streaming state types and schemas.

v6.0.38

Compare Source

Patch Changes

v6.0.37

Compare Source

Patch Changes

  • b5dab9b: fix(ai): maintain OpenTelemetry context across async generator yields

    Fixes an issue where OpenTelemetry context was lost at async generator yield boundaries, causing nested ToolLoopAgent spans to escape to the parent agent's level in observability platforms.

    The fix ensures that when recordSpan is used with async generators (e.g., in tool execution), the active context is explicitly maintained using context.with(), preventing span hierarchy corruption in nested agent scenarios.

    Closes #​11720

v6.0.36

Compare Source

Patch Changes

v6.0.35

Compare Source

Patch Changes
  • d7e7f1f: Add descriptive error messages for malformed UIMessageStream chunks.

v6.0.34

Compare Source

Patch Changes

v6.0.33

Compare Source

Patch Changes
  • 0ca078c: fix(ai): pass providerMetadata in smooth stream to preserve thinking tag

v6.0.32

Compare Source

Patch Changes
  • ec24401: chore(ai): include docs in npm package

v6.0.31

Compare Source

Patch Changes

v6.0.30

Compare Source

Patch Changes

v6.0.29

Compare Source

Patch Changes

v6.0.28

Compare Source

Patch Changes
  • d4486d2: fix(ai): do not cleanup AsyncIterableStream twice

v6.0.27

Compare Source

Patch Changes

v6.0.26

Compare Source

Patch Changes
  • 40d4997: feat(ai): add middleware for extracting JSON

v6.0.25

Compare Source

Patch Changes
  • b64f256: Add elementStream to streamText for streaming individual array elements when using output: Output.array().

v6.0.24

Compare Source

Patch Changes
  • 4f236c8: feat(ai): per-chunk timeouts for streamText

v6.0.23

Compare Source

Patch Changes
  • a4c680a: feat(ai): per-step timeouts for generateText and streamText
  • 8c6f067: feat(ai): support Intl.Segmenter in smoothStream

v6.0.22

Compare Source

Patch Changes
  • f0d29de: chore(ai): remove _internal.currentDate from streamText

v6.0.21

Compare Source

Patch Changes

  • 9667780: fix(ai): preserve rawInput in safeValidateUIMessages for output-error tool parts

    Fixes #​11406

v6.0.20

Compare Source

Patch Changes
  • f748c46: Updated Unified Provider Architecture section in README to describe AI Gateway as the default.

v6.0.19

Compare Source

Patch Changes

v6.0.18

Compare Source

Patch Changes
  • d6ec0e2: chore(ai): remove _internal.currentDate from generateText

v6.0.17

Compare Source

Patch Changes
  • af0955e: streamText should throw timeout error with proper cause when it times out

v6.0.16

Compare Source

Patch Changes
  • 81adf59: feat(ai): introduce timeout configuration object

v6.0.15

Compare Source

Patch Changes
  • 3a73fb3: Include abort reason in stream chunks and document the new field

v6.0.14

Compare Source

Patch Changes
  • 3f9453f: feat(ai): add timeout option to generateText, streamText, and Agent

v6.0.13

Compare Source

Patch Changes
  • e2c445d: feat(ai): smoothStream reasoning support

v6.0.12

Compare Source

Patch Changes

v6.0.11

Compare Source

Patch Changes

v6.0.10

Compare Source

Patch Changes
  • ae26f95: Add missing .catch() handler to executeToolCall promise in runToolsTransformation to prevent potential stream hang when the promise rejects.

v6.0.9

Compare Source

Patch Changes
  • 4e90233: feat(ui): add DirectChatTransport

v6.0.8

Compare Source

Patch Changes

v6.0.7

Compare Source

Patch Changes

v6.0.6

Compare Source

Patch Changes

v6.0.5

Compare Source

Patch Changes

v6.0.4

Compare Source

Patch Changes

v6.0.3

Compare Source

Patch Changes

v6.0.2

Compare Source

Patch Changes

v6.0.1

Compare Source

Patch Changes

v6.0.0

Compare Source

Major Changes
Minor Changes
Patch Changes

  • 0c3b58b: fix(provider): add specificationVersion to ProviderV3

  • 58920e0: fix(ai): do not drop custom headers in HttpChatTransport

  • a7da2b6: feat(agent): change output generics

  • 0adc679: feat(provider): shared spec v3

  • 50b70d6: feat(anthropic): add programmatic tool calling

  • 2d28066: chore(agent): limit agent call parameters

  • fca786b: feat(agent): configurable call options

  • 046aa3b: feat(provider): speech model v3 spec

  • e1f6e8e: feat(ai): add Output.json()

  • 8d9e8ad: chore(provider): remove generics from EmbeddingModelV3

    Before

    model.textEmbeddingModel('my-model-id');

    After

    model.embeddingModel('my-model-id');

  • b67d224: Fixes an issue where providerMetadata and providerExecuted were lost when tool input validation failed

  • ab6f01a: Improve ai gateway error message when api key is not present

  • 9388ff1: feat(ui): add isDataUIPart helper

  • dce03c4: feat: tool input examples

  • 2625a04: feat(openai); update spec for mcp approval

  • 37c58a0: This release introduces wrapEmbeddingModel, a new helper that brings embedding model customization capabilities similar to wrapLanguageModel.

  • 4e2b04d: fix(gateway): throw error with user-friendly message in non-production environments if AI_GATEWAY_API_KEY is not configured

  • ab1087b: feat(ai): chat.addToolResult() is now chat.addToolOutput()

  • bb10a89: fix(ai): mcp errors to be jsonrpc 2.0 compliant

  • 457f1c6: feat(ai): onFinish callback for generateText

  • 95f65c2: chore: use import * from zod/v4

  • 754df61: fix(ai): correct type field in arrayOutputStrategy from 'enum' to 'array'

  • 58920e0: refactor: consolidate header normalization across packages, remove duplicates, preserve custom headers

  • 954c356: feat(openai): allow custom names for provider-defined tools

  • 7fdd89d: feat(agent): export AgentCallParameters and AgentStreamParameters types

  • eca63f3: feat(ai): add OAuth for MCP clients + refactor to new package

    This change replaces

    import { experimental_createMCPClient } from 'ai';
import { Experimental_StdioMCPTransport } from 'ai/mcp-stdio';

    with

    import { experimental_createMCPClient } from '@&#8203;ai-sdk/mcp';
import { Experimental_StdioMCPTransport } from '@&#8203;ai-sdk/mcp/mcp-stdio';

  • 90e5bdd: chore(ai): restructure agent files

  • 42cf7ed: fix(agent): use tool.toModelOutput when available

  • 544d4e8: chore(specification): rename v3 provider defined tool to provider tool

  • 4812235: fix(ai): add missing export for LoadSettingError

  • 7f2c9b6: fix(ui): do not submit automatically when server return with error

  • 614599a: chore(ai): deprecate generateObject and streamObject

  • 0c4822d: feat: EmbeddingModelV3

  • e062079: chore(agent): move Agent.respond into createAgentStreamResponse function

  • 2b49dae: feat(agent): support UIMessageStreamOptions in createAgentStreamResponse

  • ee651d7: https://v6.ai-sdk.dev -> https://ai-sdk.dev

  • 5a4e732: Export parseJsonEventStream and uiMessageChunkSchema from "ai" package

  • f733285: fix(ai): only parse experimental_output in generateText when finishReason is stop

  • 9b83947: feat(ai): add convertDataPart option to convertToModelMessages

    Add optional convertDataPart callback for converting custom data parts (URLs, code files, etc.) to text or file parts that models can process. Fully type-safe using existing UIMessage generics.

  • 7eca093: fix(ai): update uiMessageChunkSchema to satisfy the UIMessageChunk type

  • 077aea3: feat(ai): stable structured output on generateText, streamText, and ToolLoopAgent

  • 9f20c87: chore: updated README

  • 521c537: feat(ai): Tool.needsApproval can be a function

  • 7169511: feat(agent): support context in onFinish callback

  • e8109d3: feat: tool execution approval

  • 03849b0: move DelayedPromise into provider utils

  • ed329cb: feat: Provider-V3

  • 22ef5c6: feat(ai): Output.text() is default output mode

  • 9ba4324: feat(ai): support SystemModelMessage[] in system and instructions properties

  • 3bd2689: feat: extended token usage

  • 293a6b7: Added a title to the tools

  • 7c3c216: fixed docs and exported NoSpeechGeneratedError

  • c62ecf0: feat(ai): add support for v2 specs in transcription and speech models

  • d1bdadb: Added experimental_rerank support

  • 703459a: feat: tool execution approval for dynamic tools

  • 3071620: fix header loss when statusText is undefined in writeHead

  • 7e4649f: fix(core): Fix image download behavior when the initial model is swapped out during prepareStep

  • 48454ab: fix(ai): handle backpressure in writeToServerResponse

  • e06b663: feat(agent): support experimental stream transforms

  • 83e5744: feat: support async Tool.toModelOutput

  • 8c98371: Extend addToolResult to support error results

  • b1405bf: feat(ai): send context into streamText / generateText onFinish callbacks

  • a5e152d: fix(ai): back version support for V2 providers

  • aa0515c: feat(ai): move Agent to stable

  • f6f0c5a: chore: remove zod from ui packages

  • 3ed5519: chore: rename ToolCallOptions to ToolExecutionOptions

  • eb8d1cb: fix not catching of empty arrays in validateUIMessage

  • e7d9b00: feat(agent): add optional name property to agent

  • d5b25ee: feat(ai): add Output.array()

  • d7bae86: feat(ai): add Output.choice()

  • 8dac895: feat: LanguageModelV3

  • a755db5: feat(ai): improve warnings with provider and model id

  • 1c2a4c1: fix(ai): remove outdated jsdoc param descriptions

  • 686103c: chore(ai): export ContentPart type

  • 0d6c0d8: chore(ai): remove deprecated CodeMessage type and related types and functions

  • 9b8d17e: fix(agent): move provider options to

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@coderabbitai
Copy link

coderabbitai bot commented Nov 8, 2025 •
edited
Loading

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

  • 🔍 Trigger a full review

Comment @coderabbitai help to get the list of available commands and usage tips.

@renovate renovate bot force-pushed the renovate/npm-ai-vulnerability branch 3 times, most recently from 14319b6 to 7a2abc5 Compare November 20, 2025 06:51
@renovate renovate bot force-pushed the renovate/npm-ai-vulnerability branch 2 times, most recently from a935a57 to c41afcd Compare December 5, 2025 23:11
@renovate renovate bot force-pushed the renovate/npm-ai-vulnerability branch 4 times, most recently from 66b29d4 to 0726482 Compare December 18, 2025 07:32
@renovate renovate bot force-pushed the renovate/npm-ai-vulnerability branch from 0726482 to 73d8ffc Compare December 31, 2025 07:24
@renovate renovate bot changed the title fix(deps): update dependency ai to v5 [security] fix(deps): update dependency ai to v6 [security] Dec 31, 2025
@renovate renovate bot force-pushed the renovate/npm-ai-vulnerability branch from 73d8ffc to 89ee48d Compare January 2, 2026 07:40
@renovate renovate bot changed the title fix(deps): update dependency ai to v6 [security] fix(deps): update dependency ai to v5 [security] Jan 2, 2026
@renovate renovate bot force-pushed the renovate/npm-ai-vulnerability branch from 89ee48d to 232ff70 Compare January 9, 2026 07:30
@renovate renovate bot changed the title fix(deps): update dependency ai to v5 [security] fix(deps): update dependency ai to v6 [security] Jan 9, 2026
@renovate renovate bot force-pushed the renovate/npm-ai-vulnerability branch from 232ff70 to cb19e59 Compare January 10, 2026 07:44
@renovate renovate bot changed the title fix(deps): update dependency ai to v6 [security] fix(deps): update dependency ai to v5 [security] Jan 10, 2026
@renovate renovate bot force-pushed the renovate/npm-ai-vulnerability branch from cb19e59 to 27a75e2 Compare January 20, 2026 06:48
@renovate renovate bot changed the title fix(deps): update dependency ai to v5 [security] fix(deps): update dependency ai to v6 [security] Jan 20, 2026
@renovate renovate bot force-pushed the renovate/npm-ai-vulnerability branch from 27a75e2 to 90f43b0 Compare January 21, 2026 07:42
@renovate renovate bot changed the title fix(deps): update dependency ai to v6 [security] fix(deps): update dependency ai to v5 [security] Jan 21, 2026
@renovate renovate bot force-pushed the renovate/npm-ai-vulnerability branch from 90f43b0 to ddf8c75 Compare January 24, 2026 19:36
@renovate renovate bot changed the title fix(deps): update dependency ai to v5 [security] fix(deps): update dependency ai to v6 [security] Jan 24, 2026
@renovate renovate bot force-pushed the renovate/npm-ai-vulnerability branch from ddf8c75 to 4236dca Compare January 25, 2026 14:53
@renovate renovate bot changed the title fix(deps): update dependency ai to v6 [security] fix(deps): update dependency ai to v5 [security] Jan 25, 2026
@renovate renovate bot force-pushed the renovate/npm-ai-vulnerability branch from 4236dca to 2bbfc71 Compare February 3, 2026 20:07
@renovate renovate bot changed the title fix(deps): update dependency ai to v5 [security] fix(deps): update dependency ai to v6 [security] Feb 3, 2026
@renovate renovate bot changed the title fix(deps): update dependency ai to v6 [security] fix(deps): update dependency ai to v5 [security] Feb 4, 2026
@renovate renovate bot force-pushed the renovate/npm-ai-vulnerability branch from 2bbfc71 to db235d0 Compare February 4, 2026 12:15
@renovate renovate bot force-pushed the renovate/npm-ai-vulnerability branch from db235d0 to d21c8fe Compare February 13, 2026 23:55
@renovate renovate bot changed the title fix(deps): update dependency ai to v5 [security] fix(deps): update dependency ai to v6 [security] Feb 13, 2026
@renovate renovate bot force-pushed the renovate/npm-ai-vulnerability branch from d21c8fe to 55ac031 Compare February 14, 2026 07:11
@renovate renovate bot changed the title fix(deps): update dependency ai to v6 [security] fix(deps): update dependency ai to v5 [security] Feb 14, 2026
@renovate renovate bot force-pushed the renovate/npm-ai-vulnerability branch from 55ac031 to c4b57c7 Compare February 16, 2026 19:49
@renovate renovate bot changed the title fix(deps): update dependency ai to v5 [security] fix(deps): update dependency ai to v6 [security] Feb 16, 2026
@renovate renovate bot force-pushed the renovate/npm-ai-vulnerability branch from c4b57c7 to 52e313f Compare February 17, 2026 04:03
@renovate renovate bot changed the title fix(deps): update dependency ai to v6 [security] fix(deps): update dependency ai to v5 [security] Feb 17, 2026
@renovate renovate bot force-pushed the renovate/npm-ai-vulnerability branch from 52e313f to 339ea40 Compare February 19, 2026 07:46
@renovate renovate bot changed the title fix(deps): update dependency ai to v5 [security] fix(deps): update dependency ai to v6 [security] Feb 19, 2026
@renovate renovate bot force-pushed the renovate/npm-ai-vulnerability branch from 339ea40 to 20a61e3 Compare February 20, 2026 07:10
@renovate renovate bot changed the title fix(deps): update dependency ai to v6 [security] fix(deps): update dependency ai to v5 [security] Feb 20, 2026
@renovate renovate bot force-pushed the renovate/npm-ai-vulnerability branch from 20a61e3 to 4dfa1a5 Compare March 8, 2026 11:00
@renovate renovate bot changed the title fix(deps): update dependency ai to v5 [security] fix(deps): update dependency ai to v6 [security] Mar 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants