Skip to content

fix(deps): update dependency ai to v5 [security] #17

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

fix(deps): update dependency ai to v5 [security] #17

wants to merge 1 commit into from

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Nov 8, 2025 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
ai (source) ^4.3.16 -> ^5.0.0 age confidence

GitHub Vulnerability Alerts

CVE-2025-48985

A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists when uploading files. All users are encouraged to upgrade.

Release Notes

vercel/ai (ai)

v5.0.93

Compare Source

Patch Changes

v5.0.92

Compare Source

Patch Changes
  • 250edbd: Added finishReason on useChat onFinish callbck

v5.0.91

Compare Source

Patch Changes

v5.0.90

Compare Source

Patch Changes
  • 818b144: fix not catching of empty arrays in validateUIMessage

v5.0.89

Compare Source

Patch Changes
  • 7cfada6: feat(ai): chat.addToolResult() is now chat.addToolOutput()

v5.0.88

Compare Source

Patch Changes

v5.0.87

Compare Source

Patch Changes

v5.0.86

Compare Source

Patch Changes
  • 0f92046: fix(ui): Don't resend messages for providerExecuted tools in lastAssistantMessageIsCompleteWithToolCalls and lastAssistantMessageIsCompleteWithApprovalResponses

v5.0.85

Compare Source

Patch Changes

v5.0.84

Compare Source

Patch Changes
  • a017497: fix(ai): do not mutate middleware array argument when wrapping

v5.0.83

Compare Source

Patch Changes

v5.0.82

Compare Source

Patch Changes

v5.0.81

Compare Source

Patch Changes

v5.0.80

Compare Source

Patch Changes
  • c7688ec: fix(ai): correct type field in arrayOutputStrategy from 'enum' to 'array'

v5.0.79

Compare Source

Patch Changes

  • 22ab538: feat(ai): add OAuth for MCP clients + refactor to new package

    This change replaces

    import { experimental_createMCPClient } from 'ai';
import { Experimental_StdioMCPTransport } from 'ai/mcp-stdio';

    with

    import { experimental_createMCPClient } from '@​ai-sdk/mcp';
import { Experimental_StdioMCPTransport } from '@​ai-sdk/mcp/mcp-stdio';

v5.0.78

Compare Source

Patch Changes

v5.0.77

Compare Source

Patch Changes

  • 3568ebc: feat(ai): add convertDataPart option to convertToModelMessages

    Add optional convertDataPart callback for converting custom data parts (URLs, code files, etc.) to text or file parts that models can process. Fully type-safe using existing UIMessage generics.

v5.0.76

Compare Source

Patch Changes
  • 87b03d5: feat(ui): add isDataUIPart helper

v5.0.75

Compare Source

Patch Changes

v5.0.74

Compare Source

Patch Changes

v5.0.73

Compare Source

Patch Changes
  • 734c4c3: fix(ai): add missing export for LoadSettingError

v5.0.72

Compare Source

Patch Changes
  • 1b94257: fix(ui): do not submit automatically when server return with error

v5.0.71

Compare Source

Patch Changes
  • bc90c3c: feat(ai): add pruneMessages helper function

v5.0.70

Compare Source

Patch Changes

v5.0.69

Patch Changes
  • 1bacc1f: fix(ai): handle backpressure in writeToServerResponse

v5.0.68

Patch Changes

v5.0.67

Patch Changes

v5.0.66

Patch Changes

v5.0.65

Patch Changes

v5.0.64

Patch Changes
  • e33947b: fix(ai): mcp errors to be jsonrpc 2.0 compliant

v5.0.63

Patch Changes
  • 22609f8: fix(ai): only parse experimental_output in generateText when finishReason is stop
  • b552c94: fix(core): Fix image download behavior when the initial model is swapped out during prepareStep

v5.0.62

Compare Source

Patch Changes

v5.0.61

Compare Source

Patch Changes

v5.0.60

Patch Changes

v5.0.59

Patch Changes

v5.0.58

Patch Changes

v5.0.57

Patch Changes
  • c319849: fixed docs and exported NoSpeechGeneratedError

v5.0.56

Patch Changes
  • b1d8458: fix(ai): align logic of text-end with reasoning-end

v5.0.55

Patch Changes
  • 85da29e: fix(ai): remove outdated jsdoc param descriptions

v5.0.54

Patch Changes

v5.0.53

Patch Changes
  • d335191: Extend addToolResult to support error results

v5.0.52

Patch Changes
  • c56822d: fix(ai): update uiMessageChunkSchema to satisfy the UIMessageChunk type
  • 930399b: fix(ai): download files when intermediate file cannot be downloaded
  • Updated dependencies [7ca78f1]

v5.0.51

Patch Changes

v5.0.50

Patch Changes

v5.0.49

Compare Source

Patch Changes

v5.0.48

Compare Source

Patch Changes

v5.0.47

Compare Source

Patch Changes

v5.0.46

Compare Source

Patch Changes
  • c580fbd: Add safeValidateUIMessages utility to validate UI messages without throwing, returning a success/failure result object like Zod’s safeParse

v5.0.45

Compare Source

Patch Changes
  • 76024fc: fix(ai): fix static tool call and result detection when dynamic is undefined
  • 93d8b60: fix(ai): do not filter zero-length text parts that have provider options
  • d8eb31f: fix(ai): fix webp image detection from base64

v5.0.44

Compare Source

Patch Changes

v5.0.43

Compare Source

Patch Changes

v5.0.42

Compare Source

Patch Changes
  • de5c066: fix(ai): forwarded providerExecuted flag in validateUIMessages

v5.0.41

Compare Source

Patch Changes
  • cd91e4b: fix(ai): use correct type for reasoning outputs

v5.0.40

Compare Source

Patch Changes

v5.0.39

Compare Source

Patch Changes
  • a0a725f: feat (ai): export createGateway

v5.0.38

Compare Source

Patch Changes

v5.0.37

Compare Source

Patch Changes
  • d6785d7: feat (ai): add tool and agent helpers

v5.0.36

Compare Source

Patch Changes
  • ccc2ded: feat (ai): export gateway provider

v5.0.35

Compare Source

Patch Changes

v5.0.34

Compare Source

Patch Changes

v5.0.33

Compare Source

Patch Changes

v5.0.32

Compare Source

Patch Changes

v5.0.31

Compare Source

Patch Changes

v5.0.30

Compare Source

Patch Changes
  • 7fcc6be: feat(ai): throw InvalidArgumentError when messages is not provided

v5.0.29

Compare Source

Patch Changes
  • e0e9449: feat(ui): sent isAbort, isDisconnect, isError in useChat onFinish callback

v5.0.28

Compare Source

Patch Changes
  • 4b81e7d: fix(ai): remove vitest dependency from test exports
  • d68a4f2: feat(ai): log warnings

v5.0.27

Compare Source

Patch Changes
  • ca40fac: feat(ai): support custom download functions (experimental)

v5.0.26

Compare Source

Patch Changes

v5.0.25

Compare Source

Patch Changes

v5.0.24

Compare Source

Patch Changes

  • f8f3682: fix: call onFinish when stream is cancelled in toUIMessageStream

    Previously, onFinish was only called on normal stream completion. Now it's also called when the reader is cancelled (e.g., browser close, navigation), ensuring partial messages are persisted.

  • Updated dependencies [1b5a3d3]

  • Updated dependencies [c9994f9]

v5.0.23

Compare Source

Patch Changes
  • 5099b3d: fix(ai): make chat.addToolResult() compatible with dynamic tool calls
  • 7a2bf8d: fix(ai): support loop breaking behavior in async iterable stream
  • Updated dependencies [50e2029]
  • Updated dependencies [b8478f0]

v5.0.22

Compare Source

Patch Changes

v5.0.21

Compare Source

Patch Changes

v5.0.20

Compare Source

Patch Changes
  • 8a87693: fix(ai) Make sure warnings promise in streamObject is resolved and properly collects and passes warnings

v5.0.19

Compare Source

Patch Changes
  • 8da6e9c: fix(ai): use parsed tool input if possible when validation fails

v5.0.18

Compare Source

Patch Changes

v5.0.17

Compare Source

Patch Changes
  • 4176ecb: feat(ai): add reasoning text to generateObject result
  • 20f23f9: feat(ai): export LanguageModelMiddleware type

v5.0.16

Compare Source

Patch Changes

v5.0.15

Compare Source

Patch Changes

v5.0.14

Compare Source

Patch Changes
  • 7729e32: fix(ai): expand mp3 detection to support all mpeg frame headers

v5.0.13

Compare Source

Patch Changes

  • a7b2e66: Added providerOptions to agent stream and generate calls

  • 9bed210: extractReasoningMiddleware(): delay sending text-start chunk to prevent rendering final text before reasoning

    When wrapping a text stream in extractReasoningMiddleware(), delay queing the text-start chunk until either reasoning-start chunk was queued or the first text-delta chunk is about to be queued, whichever comes first.

    #​8036

v5.0.12

Compare Source

Patch Changes

v5.0.11

Compare Source

Patch Changes

v5.0.10

Compare Source

Patch Changes
  • 63a5dc5: fix(ai): convert user message text/file part provider metadata in convertToModelMessages

v5.0.9

Compare Source

Patch Changes
  • afd5c2a: fix(ai): preserve filename for file parts in convertToModelMessages

v5.0.8

Compare Source

Patch Changes

v5.0.7

Compare Source

Patch Changes
  • 8e72304: fix (ai): handle invalid tool calls

v5.0.6

Compare Source

Patch Changes
  • d983eee: feat(ai): allow passing model string for embeddings

v5.0.5

Compare Source

Patch Changes

v5.0.4

Compare Source

Patch Changes

v5.0.3

Compare Source

Patch Changes

v5.0.2

Compare Source

Patch Changes
  • 401d73e: fix (ai): support dynamic tool calls in lastAssistantMessageIsCompleteWithToolCalls
  • 69fde99: Set status to ready when reconnect stream is null

v5.0.1

Compare Source

Patch Changes
  • 4d0c108: fix(ai/ui): convert provider metadata for system messages to model messages

v5.0.0

Compare Source

Major Changes

  • e1cbf8a: chore(@​ai-sdk/rsc): extract to separate package

  • a847c3e: chore: rename reasoning to reasoningText etc

  • 13fef90: chore (ai): remove automatic conversion of UI messages to model messages

  • d964901: - remove setting temperature to 0 by default

    • remove null option from DefaultSettingsMiddleware
    • remove setting defaults for temperature and stopSequences in ai to enable middleware changes

  • 0a710d8: feat (ui): typed tool parts in ui messages

  • 9ad0484: feat (ai): automatic tool execution error handling

  • 63f9e9b: chore (provider,ai): tools have input/output instead of args,result

  • ab7ccef: chore (ai): change source ui message parts to source-url

  • d5f588f: AI SDK 5

  • ec78cdc: chore (ai): remove "data" UIMessage role

  • 6a83f7d: refactoring (ai): restructure message metadata transfer

  • db345da: chore (ai): remove exports of internal ui functions

  • 496bbc1: chore (ui): inline/remove ChatRequest type

  • 72d7d72: chore (ai): stable activeTools

  • 40acf9b: feat (ui): introduce ChatStore and ChatTransport

  • 98f25e5: chore (ui): remove managed chat inputs

  • 2d03e19: chore (ai): remove StreamCallbacks.onCompletion

  • da70d79: chore (ai): remove getUIText helper

  • c60f895: chore (ai): remove useChat keepLastMessageOnError

  • 0560977: chore (ai): improve consistency of generate text result, stream text result, and step result

  • 9477ebb: chore (ui): remove useAssistant hook (breaking change)

  • 1f55c21: chore (ai): send reasoning to the client by default

  • e7dc6c7: chore (ai): remove onResponse callback

  • 8b86e99: chore (ai): replace Message with UIMessage

  • 04d5063: chore (ai): rename default provider global to AI_SDK_DEFAULT_PROVIDER

  • 319b989: chore (ai): remove content from ui messages

  • 14c9410: chore: refactor file towards source pattern (spec)

  • a34eb39: chore (ai): remove data and allowEmptySubmit from ChatRequestOptions

  • f04fb4a: chore (ai): replace useChat attachments with file ui parts

  • f7e8bf4: chore (ai): flatten ui message stream parts

  • 257224b: chore (ai): separate TextStreamChatTransport

  • fd1924b: chore (ai): remove redundant mimeType property

  • 2524fc7: chore (ai): remove ui message toolInvocations property

  • 6fba4c7: chore (ai): remove deprecated experimental_providerMetadata

  • b4b4bb2: chore (ui): rename experimental_resume to resumeStream

  • 441d042: chore (ui): data stream protocol v2 with SSEs

  • ef256ed: chore (ai): refactor and use chatstore in svelte

  • 516be5b: ### Move Image Model Settings into generate options

    Image Models no longer have settings. Instead, maxImagesPerCall can be passed directly to generateImage(). All other image settings can be passed to providerOptions[provider].

    Before

    await generateImage({
  model: luma.image('photon-flash-1', {
    maxImagesPerCall: 5,
    pollIntervalMillis: 500,
  }),
  prompt,
  n: 10,
});

    After

    await generateImage({
  model: luma.image('photon-flash-1'),
  prompt,
  n: 10,
  maxImagesPerCall: 5,
  providerOptions: {
    luma: { pollIntervalMillis: 5 },
  },
});

    Pull Request: #​6180

  • a662dea: chore (ai): remove sendExtraMessageFields

  • d884051: feat (ai): simplify default provider setup

  • e8324c5: feat (ai): add args callbacks to tools

  • fafc3f2: chore (ai): change file to parts to use urls instead of data

  • 1ed0287: chore (ai): stable sendStart/sendFinish options

  • c7710a9: chore (ai): rename DataStreamToSSETransformStream to JsonToSseTransformStream

  • bfbfc4c: feat (ai): streamText/generateText: totalUsage contains usage for all steps. usage is for a single step.

  • 9ae327d: chore (ui): replace chat store concept with chat instances

  • 9315076: chore (ai): rename continueUntil to stopWhen. Rename maxSteps stop condition to stepCountIs.

  • 247ee0c: chore (ai): remove steps from tool invocation ui parts

  • 109c0ac: chore (ai): rename id to chatId (in post request, resume request, and useChat)

  • 954aa73: feat (ui): extended regenerate support

  • 33eb499: feat (ai): inject message id in createUIMessageStream

  • 901df02: feat (ui): use UI_MESSAGE generic

  • 4892798: chore (ai): always stream tool calls

  • c25cbce: feat (ai): use console.error as default error handler for streamText and streamObject

  • b33ed7a: chore (ai): rename DataStream_ to UIMessage_

  • ed675de: feat (ai): add ui data parts

  • 7bb58d4: chore (ai): restructure prepareRequest

  • ea7a7c9: feat (ui): UI message metadata

  • 0463011: fix (ai): update source url stream part

  • dcc549b: remove StreamTextResult.mergeIntoDataStream method
    rename DataStreamOptions.getErrorMessage to onError
    add pipeTextStreamToResponse function
    add createTextStreamResponse function
    change createDataStreamResponse function to accept a DataStream and not a DataStreamWriter
    change pipeDataStreamToResponse function to accept a DataStream and not a DataStreamWriter
    change pipeDataStreamToResponse function to have a single parameter

  • 35fc02c: chore (ui): rename RequestOptions to CompletionRequestOptions

  • 64f6d64: feat (ai): replace maxSteps with continueUntil (generateText)

  • 175b868: chore (ai): rename reasoning UI parts 'reasoning' property to 'text'

  • 60e2c56: feat (ai): restructure chat transports

  • 765f1cd: chore (ai): remove deprecated useChat isLoading helper

  • cb2b53a: chore (ai): refactor header preparation

  • e244a78: chore (ai): remove StreamData and mergeStreams

  • d306260: feat (ai): replace maxSteps with continueUntil (streamText)

  • 4bfe9ec: chore (ai): remove ui message reasoning property

  • 1766ede: chore: rename maxTokens to maxOutputTokens

  • 2877a74: chore (ai): remove ui message data property

  • 1409e13: chore (ai): remove experimental continueSteps

  • b32e192: chore (ai): rename reasoning to reasoningText, rename reasoningDetails to reasoning (streamText, generateText)

  • 92cb0a2: chore (ai): rename CoreMessage to ModelMessage

  • 2b637d6: chore (ai): rename UIMessageStreamPart to UIMessageChunk

Minor Changes
  • b7eae2d: feat (core): Add finishReason field to NoObjectGeneratedError
  • bcea599: feat (ai): add content to generateText result
  • 48d675a: feat (ai): add content to streamText result
  • c9ad635: feat (ai): add filename to file ui parts
Patch Changes

  • a571d6e: chore(provider-utils): move ToolResultContent to provider-utils

  • de2d2ab: feat(ai): add provider and provider registry middleware functionality

  • c22ad54: feat(smooth-stream): chunking callbacks

  • d88455d: feat (ai): expose http chat transport type

  • e7fcc86: feat (ai): introduce dynamic tools

  • da1e6f0: feat (ui): add generics to ui message stream parts

  • 48378b9: fix (ai): send null as tool output when tools return undefined

  • 5d1e3ba: chore (ai): remove provider re-exports

  • 93d53a1: chore (ai): remove cli

  • e90d45d: chore (rsc): move HANGING_STREAM_WARNING_TIME constant into @​ai-sdk/rsc package

  • b32c141: feat (ai): add array support to stopWhen

  • bc3109f: chore (ai): push stream-callbacks into langchain/llamaindex adapters

  • 0d9583c: fix (ai): use user-provided media type when available

  • 38ae5cc: feat (ai): export InferUIMessageChunk type

  • 10b21eb: feat(cli): add ai command line interface

  • 9e40cbe: Allow destructuring output and errorText on ToolUIPart type

  • 6909543: feat (ai): support system parameter in Agent constructor

  • 86cfc72: feat (ai): add ignoreIncompleteToolCalls option to convertToModelMessages

  • 377bbcf: fix (ui): tool input can be undefined during input-streaming

  • d8aeaef: feat(providers/fal): add transcribe

  • ae77a99: chore (ai): rename text and reasoning chunks in streamText fullstream

  • 4fef487: feat: support for zod v4 for schema validation

    All these methods now accept both a zod v4 and zod v3 schemas for validation:

    • generateObject()
    • streamObject()
    • generateText()
    • experimental_useObject() from @ai-sdk/react
    • streamUI() from @ai-sdk/rsc

  • b1e3abd: feat (ai): expose ui message stream headers

  • 4f3e637: fix (ui): avoid caching globalThis.fetch in case it is patched by other libraries

  • 14cb3be: chore(providers/llamaindex): extract to separate package

  • 1f6ce57: feat (ai): infer tool call types in the onToolCall callback

  • 16ccfb2: feat (ai): add readUIMessageStream helper

  • 225f087: fix (ai/mcp): prevent mutation of customEnv

  • ce1d1f3: feat (ai): export mock image, speech, and transcription models

  • fc0380b: feat (ui): resolvable header, body, credentials in http chat transport

  • 6622441: feat (ai): add static/dynamic toolCalls/toolResults helpers

  • 4048ce3: fix (ai): add tests and examples for openai responses

  • 6c42e56: feat (ai): validate ui stream data chunks

  • bedb239: chore (ai): make ui stream parts value optional when it's not required

  • 9b4d074: feat(streamObject): add enum support

  • c8fce91: feat (ai): add experimental Agent abstraction

  • 655cf3c: feat (ui): add onFinish to createUIMessageStream

  • 3e10408: fix(utils/detect-mimetype): add support for detecting id3 tags

  • d5ae088: feat (ui): add sendAutomaticallyWhen to Chat

  • ced8eee: feat(ai): re-export zodSchema from main package

  • c040e2f: fix (ui): inject generated response message id

  • d3960e3: selectTelemetryAttributes more robustness

  • faea29f: fix (provider/openai): multi-step reasoning with text

  • 66af894: fix (ai): respect content order in toResponseMessages

  • 332167b: chore (ai): move maxSteps into UseChatOptions

  • 6b1c55c: feat (ai): introduce GLOBAL_DEFAULT_PROVIDER

  • 5a975a4: feat (ui): update Chat tool result submission

  • 507ac1d: fix (ui/react): update messages immediately with the submitted user message

  • a166433: feat: add transcription with experimental_transcribe

  • 26735b5: chore(embedding-model): add v2 interface

  • c93a8bc: chore(ai): export AsyncIterableStream type from async-iterable-stream module

  • 0d2c085: feat (ai): support string model ids through gateway

  • 2b9bbcd: feat (ai): improve prompt validation error message

  • a8c8bd5: feat(embed-many): respect supportsParallelCalls & concurrency

  • [75c3396](https://redirect.github.com/v

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@coderabbitai
Copy link

coderabbitai bot commented Nov 8, 2025

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Comment @coderabbitai help to get the list of available commands and usage tips.

@renovate renovate bot force-pushed the renovate/npm-ai-vulnerability branch from 17f5ade to c0cf071 Compare November 15, 2025 11:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant