[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@ai-sdk/provider-utils@4 (source)	4.0.35 → 4.0.61
@ai-sdk/provider@3 (source)	3.0.13 → 3.0.19
ai (source)	7.0.142 → 7.0.143

---

Release Notes

vercel/ai (@​ai-sdk/provider-utils@4)

v4.0.61

Compare Source

Patch Changes

• 5aa3086: feat(openai-compatible): support URL-based image responses

  Add opt-in URL validation and credential origin handling to getFromApi for URL-based image responses. Validate redirect targets, strip unsafe request headers, and drop credentials on cross-origin redirects while preserving existing unvalidated requests.

v4.0.60

Compare Source

Patch Changes

• Updated dependencies [739e9f6]
  • @​ai-sdk/provider@3.0.19

v4.0.59

Compare Source

Patch Changes

• d5e7d82: fix(provider-utils): keep case-sensitive url paths and query values

v4.0.58

Compare Source

Patch Changes

• 604b4d3: docs(provider-utils): clarify how ToolApprovalResponse.reason is handled for approved and denied tool calls

v4.0.57

Compare Source

Patch Changes

• a9cea74: Keep default Node.js downloads protected by DNS validation and connection pinning when frameworks or instrumentation wrap global fetch before or after the SDK loads.
• a9cea74: fix(mcp): prevent SSRF in OAuth metadata discovery
• a9cea74: fix(provider-utils): make lazy Undici import visible to deployment tracers

v4.0.56

Compare Source

Patch Changes

• 29dc427: fix(provider-utils): preserve streamed tool calls with unreliable IDs and indices

v4.0.55

Compare Source

Patch Changes

• 3983fea: fix(provider): preserve media types on tool result file URLs and match full MIME types exactly when checking native URL support.
• Updated dependencies [3983fea]
  • @​ai-sdk/provider@3.0.18

v4.0.54

Compare Source

Patch Changes

• 069a945: Fix Google embedMany calls with more than 100 values by keeping per-value multimodal content aligned across automatic batches, including text-only entries. Validate content length before sending requests and validate each batch's provider options after middleware transforms them.

• d1a36d2: fix(ai): execute manually approved tool inputs produced by schema transforms

  Preserve approved inputs during revalidation and reject histories whose reconstructed schema output differs, including signed approvals with missing original input. Validate transformed UI tool inputs against the reconstructed output before returning them as static tool parts.

• f7f36d2: chore: enable dead code lint rules

v4.0.53

Compare Source

Patch Changes

• Updated dependencies [da2e17b]
  • @​ai-sdk/provider@3.0.17

v4.0.52

Compare Source

Patch Changes

• 82e18b0: fix(provider-utils): avoid excessive memory usage when base64 encoding byte arrays

v4.0.51

Compare Source

Patch Changes

• Updated dependencies [1a4dbb1]
  • @​ai-sdk/provider@3.0.16

v4.0.50

Compare Source

Patch Changes

• cc23556: Mark transient network errors that occur while reading successful response bodies as retryable.

v4.0.49

Compare Source

Patch Changes

• 9a521b9: Split OpenAI and Azure OpenAI embedding requests by a conservative UTF-8 byte budget derived from their aggregate token limit, in addition to input count limits.

v4.0.48

Compare Source

Patch Changes

• 5642849: fix(provider-utils): allow imports in runtimes without a global fetch function

v4.0.47

Compare Source

Patch Changes

• 2d172fb: Preserve schema-valued additional properties when converting Zod 4 schemas.

v4.0.46

Compare Source

Patch Changes

• 31205a4: chore(provider-utils): upgrade undici to a maintained release

v4.0.45

Compare Source

Patch Changes

• b2a4d5a: Preserve streamed download size-limit errors when response cancellation fails.

v4.0.44

Compare Source

Patch Changes

• Updated dependencies [2171d15]
  • @​ai-sdk/provider@3.0.15

v4.0.43

Compare Source

Patch Changes

• dab0a08: fix(provider-utils): drop Function-constructor dynamic import shim rejected by Next.js Edge Runtime builds

v4.0.42

Compare Source

Patch Changes

• ee2bf30: fix(provider-utils): prevent Metro from parsing the Node 18 dynamic import fallback

v4.0.41

Compare Source

Patch Changes

• 9ecdefe: Prevent validated downloads on Node.js from reaching private or internal services through DNS aliases or DNS rebinding by validating and pinning every resolved address at connection time.

v4.0.40

Compare Source

Patch Changes

• 19093fd: fix(ai): call onInputStart before onInputAvailable during non-streaming tool calls

v4.0.39

Compare Source

Patch Changes

• 06fb54c: Accept callable Standard Schema validators that do not provide JSON Schema conversion.

v4.0.38

Compare Source

Patch Changes

• Updated dependencies [e1af05f]
  • @​ai-sdk/provider@3.0.14

v4.0.37

Compare Source

Patch Changes

• d559de9: Ensure the default empty tool input schema includes type: "object" for OpenAI-compatible providers that require object schemas.

v4.0.36

Compare Source

Patch Changes

• 0952964: Prevent prototype pollution when synchronously parsing provider JSON inputs and expose secureJsonParse from provider-utils.

vercel/ai (ai)

v7.0.143

Compare Source

Patch Changes

• 8a5233b: Generate default chat IDs on first access so useChat() can prerender without reading a random value when the ID is not used during rendering.
• 894e130: fix(ai): add experimental_lowMemory: true to streamText for single-consumer streaming without a replay buffer or retained final-content results, reducing memory retention.
• 0957554: Add box decision question type with image bounds for TypeSafe AI.
• Updated dependencies [0957554]
  • @​ai-sdk/provider@4.0.29
  • @​ai-sdk/provider-utils@5.0.62
  • @​ai-sdk/gateway@4.0.116

---

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one): 1

• coderabbit-review-active

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: Zoo-Code-Org/Zoo-Code/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 810b5692-25a9-4202-ac07-392420fd908c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Review status

This PR was opened by an automated account. A human maintainer must verify the change intent, provenance, and validation before merging.

Current step: The required review sequence passed. Remaining merge requirements apply.

Review-state labels are managed by this workflow; do not edit them manually. community-approved is managed the same way — do not add or remove it manually. It signals a fresh community code approval for the current head as an advisory priority only; maintainer review is still required.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!