@ai-sdk/anthropic 3.0.92 → 3.0.94

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @ai-sdk/anthropic
 
+## 3.0.94
+
+### Patch Changes
+
+- 0952964: Prevent prototype pollution when synchronously parsing provider JSON inputs and expose `secureJsonParse` from provider-utils.
+- 764baab: Normalize a bare `https://api.anthropic.com` base URL to include `/v1`.
+- Updated dependencies [0952964]
+  - @ai-sdk/provider-utils@4.0.36
+
+## 3.0.93
+
+### Patch Changes
+
+- 4241b49: fix(anthropic): forward `thinking: { type: 'disabled' }` to the API instead of stripping it
+
+  Previously, setting `providerOptions.anthropic.thinking = { type: 'disabled' }` was accepted by the schema but silently dropped from the outgoing request. For models that default thinking on (e.g. Sonnet 5), this left thinking enabled and could consume a small `max_tokens` budget entirely. The `disabled` value is now sent to the Anthropic Messages API.
+
 ## 3.0.92
 
 ### Patch Changes

package/dist/index.js

@@ -32,7 +32,7 @@ var import_provider4 = require("@ai-sdk/provider");
 var import_provider_utils26 = require("@ai-sdk/provider-utils");
 
 // src/version.ts
-var VERSION = true ? "3.0.92" : "0.0.0-test";
+var VERSION = true ? "3.0.94" : "0.0.0-test";
 
 // src/anthropic-messages-language-model.ts
 var import_provider3 = require("@ai-sdk/provider");
@@ -2707,7 +2707,7 @@ async function convertToAnthropicMessagesPrompt({
                     let errorInfo = {};
                     try {
                       if (typeof output.value === "string") {
-                        errorInfo = JSON.parse(output.value);
+                        errorInfo = (0, import_provider_utils14.secureJsonParse)(output.value);
                       } else if (typeof output.value === "object" && output.value !== null) {
                         errorInfo = output.value;
                       }
@@ -3465,6 +3465,7 @@ var AnthropicMessagesLanguageModel = class {
     });
     const thinkingType = (_e = anthropicOptions == null ? void 0 : anthropicOptions.thinking) == null ? void 0 : _e.type;
     const isThinking = thinkingType === "enabled" || thinkingType === "adaptive";
+    const sendThinking = isThinking || thinkingType === "disabled";
     let thinkingBudget = thinkingType === "enabled" ? (_f = anthropicOptions == null ? void 0 : anthropicOptions.thinking) == null ? void 0 : _f.budgetTokens : void 0;
     const thinkingDisplay = thinkingType === "adaptive" ? (_g = anthropicOptions == null ? void 0 : anthropicOptions.thinking) == null ? void 0 : _g.display : void 0;
     const maxTokens = maxOutputTokens != null ? maxOutputTokens : maxOutputTokensForModel;
@@ -3478,7 +3479,7 @@ var AnthropicMessagesLanguageModel = class {
       top_p: topP,
       stop_sequences: stopSequences,
       // provider specific settings:
-      ...isThinking && {
+      ...sendThinking && {
         thinking: {
           type: thinkingType,
           ...thinkingBudget != null && { budget_tokens: thinkingBudget },
@@ -4814,7 +4815,7 @@ var AnthropicMessagesLanguageModel = class {
                       let finalInput = contentBlock.input === "" ? "{}" : contentBlock.input;
                       if (contentBlock.providerToolName === "code_execution") {
                         try {
-                          const parsed = JSON.parse(finalInput);
+                          const parsed = (0, import_provider_utils15.secureJsonParse)(finalInput);
                           if (parsed != null && typeof parsed === "object" && "code" in parsed && !("type" in parsed)) {
                             finalInput = JSON.stringify({
                               type: "programmatic-tool-call",
@@ -5784,14 +5785,20 @@ var anthropicTools = {
 };
 
 // src/anthropic-provider.ts
+var ANTHROPIC_API_URL = "https://api.anthropic.com";
+var ANTHROPIC_API_VERSIONED_URL = `${ANTHROPIC_API_URL}/v1`;
+function normalizeBaseURL(baseURL) {
+  const baseURLWithoutTrailingSlash = (0, import_provider_utils26.withoutTrailingSlash)(baseURL);
+  return baseURLWithoutTrailingSlash === ANTHROPIC_API_URL ? ANTHROPIC_API_VERSIONED_URL : baseURLWithoutTrailingSlash;
+}
 function createAnthropic(options = {}) {
   var _a, _b;
-  const baseURL = (_a = (0, import_provider_utils26.withoutTrailingSlash)(
+  const baseURL = (_a = normalizeBaseURL(
     (0, import_provider_utils26.loadOptionalSetting)({
       settingValue: options.baseURL,
       environmentVariableName: "ANTHROPIC_BASE_URL"
     })
-  )) != null ? _a : "https://api.anthropic.com/v1";
+  )) != null ? _a : ANTHROPIC_API_VERSIONED_URL;
   const providerName = (_b = options.name) != null ? _b : "anthropic.messages";
   if (options.apiKey && options.authToken) {
     throw new import_provider4.InvalidArgumentError({