@ai-sdk/anthropic 4.0.4 → 4.0.6

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # @ai-sdk/anthropic
 
+## 4.0.6
+
+### Patch Changes
+
+- c6f5e62: Prevent prototype pollution when synchronously parsing provider JSON inputs and expose `secureJsonParse` from provider-utils.
+- 679c52a: Normalize a bare `https://api.anthropic.com` base URL to include `/v1`.
+- Updated dependencies [c6f5e62]
+  - @ai-sdk/provider-utils@5.0.4
+
+## 4.0.5
+
+### Patch Changes
+
+- Updated dependencies [8c616f0]
+  - @ai-sdk/provider-utils@5.0.3
+
 ## 4.0.4
 
 ### Patch Changes

package/dist/index.js

@@ -128,6 +128,7 @@ import {
   postJsonToApi,
   resolve,
   resolveProviderReference as resolveProviderReference2,
+  secureJsonParse as secureJsonParse2,
   serializeModelOptions,
   WORKFLOW_SERIALIZE,
   WORKFLOW_DESERIALIZE
@@ -1982,11 +1983,12 @@ import {
   convertBase64ToUint8Array,
   convertToBase64,
   getTopLevelMediaType,
+  isNonNullable,
   parseProviderOptions,
   resolveFullMediaType,
   resolveProviderReference,
-  validateTypes as validateTypes2,
-  isNonNullable
+  secureJsonParse,
+  validateTypes as validateTypes2
 } from "@ai-sdk/provider-utils";
 
 // src/tool/code-execution_20250522.ts
@@ -2320,7 +2322,7 @@ function convertBytesDataToString(data) {
 function extractErrorValue(value) {
   try {
     if (typeof value === "string") {
-      return JSON.parse(value);
+      return secureJsonParse(value);
     } else if (typeof value === "object" && value !== null) {
       return value;
     }
@@ -2921,7 +2923,7 @@ async function convertToAnthropicPrompt({
                     let errorInfo = {};
                     try {
                       if (typeof output.value === "string") {
-                        errorInfo = JSON.parse(output.value);
+                        errorInfo = secureJsonParse(output.value);
                       } else if (typeof output.value === "object" && output.value !== null) {
                         errorInfo = output.value;
                       }
@@ -5057,7 +5059,7 @@ var AnthropicLanguageModel = class _AnthropicLanguageModel {
                       let finalInput = contentBlock.input === "" ? "{}" : contentBlock.input;
                       if (contentBlock.providerToolName === "code_execution") {
                         try {
-                          const parsed = JSON.parse(finalInput);
+                          const parsed = secureJsonParse2(finalInput);
                           if (parsed != null && typeof parsed === "object" && "code" in parsed && !("type" in parsed)) {
                             finalInput = JSON.stringify({
                               type: "programmatic-tool-call",
@@ -6289,17 +6291,23 @@ var AnthropicSkills = class {
 };
 
 // src/version.ts
-var VERSION = true ? "4.0.4" : "0.0.0-test";
+var VERSION = true ? "4.0.6" : "0.0.0-test";
 
 // src/anthropic-provider.ts
+var ANTHROPIC_API_URL = "https://api.anthropic.com";
+var ANTHROPIC_API_VERSIONED_URL = `${ANTHROPIC_API_URL}/v1`;
+function normalizeBaseURL(baseURL) {
+  const baseURLWithoutTrailingSlash = withoutTrailingSlash(baseURL);
+  return baseURLWithoutTrailingSlash === ANTHROPIC_API_URL ? ANTHROPIC_API_VERSIONED_URL : baseURLWithoutTrailingSlash;
+}
 function createAnthropic(options = {}) {
   var _a, _b;
-  const baseURL = (_a = withoutTrailingSlash(
+  const baseURL = (_a = normalizeBaseURL(
     loadOptionalSetting({
       settingValue: options.baseURL,
       environmentVariableName: "ANTHROPIC_BASE_URL"
     })
-  )) != null ? _a : "https://api.anthropic.com/v1";
+  )) != null ? _a : ANTHROPIC_API_VERSIONED_URL;
   const providerName = (_b = options.name) != null ? _b : "anthropic.messages";
   if (options.apiKey && options.authToken) {
     throw new InvalidArgumentError({