@ai-sdk/provider-utils 4.0.19 → 4.0.21

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @ai-sdk/provider-utils
 
+## 4.0.21
+
+### Patch Changes
+
+- 055cd68: fix: publish v6 to latest npm dist tag
+
+## 4.0.20
+
+### Patch Changes
+
+- 64ac0fd: fix(security): validate redirect targets in download functions to prevent SSRF bypass
+
+  Both `downloadBlob` and `download` now validate the final URL after following HTTP redirects, preventing attackers from bypassing SSRF protections via open redirects to internal/private addresses.
+
 ## 4.0.19
 
 ### Patch Changes

package/dist/index.js

@@ -28,8 +28,8 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/index.ts
-var src_exports = {};
-__export(src_exports, {
+var index_exports = {};
+__export(index_exports, {
   DEFAULT_MAX_DOWNLOAD_SIZE: () => DEFAULT_MAX_DOWNLOAD_SIZE,
   DelayedPromise: () => DelayedPromise,
   DownloadError: () => DownloadError,
@@ -92,7 +92,7 @@ __export(src_exports, {
   withoutTrailingSlash: () => withoutTrailingSlash,
   zodSchema: () => zodSchema
 });
-module.exports = __toCommonJS(src_exports);
+module.exports = __toCommonJS(index_exports);
 
 // src/combine-headers.ts
 function combineHeaders(...headers) {
@@ -488,6 +488,9 @@ async function downloadBlob(url, options) {
     const response = await fetch(url, {
       signal: options == null ? void 0 : options.abortSignal
     });
+    if (response.redirected) {
+      validateDownloadUrl(response.url);
+    }
     if (!response.ok) {
       throw new DownloadError({
         url,
@@ -672,7 +675,7 @@ function withUserAgentSuffix(headers, ...userAgentSuffixParts) {
 }
 
 // src/version.ts
-var VERSION = true ? "4.0.19" : "0.0.0-test";
+var VERSION = true ? "4.0.21" : "0.0.0-test";
 
 // src/get-from-api.ts
 var getOriginalFetch = () => globalThis.fetch;
@@ -999,7 +1002,7 @@ function visit(def) {
 }
 
 // src/to-json-schema/zod3-to-json-schema/options.ts
-var ignoreOverride = Symbol(
+var ignoreOverride = /* @__PURE__ */ Symbol(
   "Let zodToJsonSchema decide on which parser to use"
 );
 var defaultOptions = {
@@ -2177,7 +2180,7 @@ var zod3ToJsonSchema = (schema, options) => {
 };
 
 // src/schema.ts
-var schemaSymbol = Symbol.for("vercel.ai.schema");
+var schemaSymbol = /* @__PURE__ */ Symbol.for("vercel.ai.schema");
 function lazySchema(createSchema) {
   let schema;
   return () => {