@ai-sdk/anthropic 3.0.93 → 3.0.94

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # @ai-sdk/anthropic
 
+## 3.0.94
+
+### Patch Changes
+
+- 0952964: Prevent prototype pollution when synchronously parsing provider JSON inputs and expose `secureJsonParse` from provider-utils.
+- 764baab: Normalize a bare `https://api.anthropic.com` base URL to include `/v1`.
+- Updated dependencies [0952964]
+  - @ai-sdk/provider-utils@4.0.36
+
 ## 3.0.93
 
 ### Patch Changes

package/dist/index.js

@@ -32,7 +32,7 @@ var import_provider4 = require("@ai-sdk/provider");
 var import_provider_utils26 = require("@ai-sdk/provider-utils");
 
 // src/version.ts
-var VERSION = true ? "3.0.93" : "0.0.0-test";
+var VERSION = true ? "3.0.94" : "0.0.0-test";
 
 // src/anthropic-messages-language-model.ts
 var import_provider3 = require("@ai-sdk/provider");
@@ -2707,7 +2707,7 @@ async function convertToAnthropicMessagesPrompt({
                     let errorInfo = {};
                     try {
                       if (typeof output.value === "string") {
-                        errorInfo = JSON.parse(output.value);
+                        errorInfo = (0, import_provider_utils14.secureJsonParse)(output.value);
                       } else if (typeof output.value === "object" && output.value !== null) {
                         errorInfo = output.value;
                       }
@@ -4815,7 +4815,7 @@ var AnthropicMessagesLanguageModel = class {
                       let finalInput = contentBlock.input === "" ? "{}" : contentBlock.input;
                       if (contentBlock.providerToolName === "code_execution") {
                         try {
-                          const parsed = JSON.parse(finalInput);
+                          const parsed = (0, import_provider_utils15.secureJsonParse)(finalInput);
                           if (parsed != null && typeof parsed === "object" && "code" in parsed && !("type" in parsed)) {
                             finalInput = JSON.stringify({
                               type: "programmatic-tool-call",
@@ -5785,14 +5785,20 @@ var anthropicTools = {
 };
 
 // src/anthropic-provider.ts
+var ANTHROPIC_API_URL = "https://api.anthropic.com";
+var ANTHROPIC_API_VERSIONED_URL = `${ANTHROPIC_API_URL}/v1`;
+function normalizeBaseURL(baseURL) {
+  const baseURLWithoutTrailingSlash = (0, import_provider_utils26.withoutTrailingSlash)(baseURL);
+  return baseURLWithoutTrailingSlash === ANTHROPIC_API_URL ? ANTHROPIC_API_VERSIONED_URL : baseURLWithoutTrailingSlash;
+}
 function createAnthropic(options = {}) {
   var _a, _b;
-  const baseURL = (_a = (0, import_provider_utils26.withoutTrailingSlash)(
+  const baseURL = (_a = normalizeBaseURL(
     (0, import_provider_utils26.loadOptionalSetting)({
       settingValue: options.baseURL,
       environmentVariableName: "ANTHROPIC_BASE_URL"
     })
-  )) != null ? _a : "https://api.anthropic.com/v1";
+  )) != null ? _a : ANTHROPIC_API_VERSIONED_URL;
   const providerName = (_b = options.name) != null ? _b : "anthropic.messages";
   if (options.apiKey && options.authToken) {
     throw new import_provider4.InvalidArgumentError({