ai 5.0.147 → 5.0.149

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # ai
 
+## 5.0.149
+
+### Patch Changes
+
+- c66afc5: fix(security): validate redirect targets in download functions to prevent SSRF bypass
+
+  `download` now validates the final URL after following HTTP redirects, preventing attackers from bypassing SSRF protections via open redirects to internal/private addresses.
+
+## 5.0.148
+
+### Patch Changes
+
+- Updated dependencies [392dc94]
+  - @ai-sdk/gateway@2.0.54
+
 ## 5.0.147
 
 ### Patch Changes
@@ -129,7 +144,7 @@
 
 - 20565b8: security: prevent unbounded memory growth in download functions
 
-  The `download()` and `downloadBlob()` functions now enforce a default 2 GiB size limit when downloading from user-provided URLs. Downloads that exceed this limit are aborted with a `DownloadError` instead of consuming unbounded memory and crashing the process. The `abortSignal` parameter is now passed through to `fetch()` in all download call sites.
+  The `download()` function now enforces a default 2 GiB size limit when downloading from user-provided URLs. Downloads that exceed this limit are aborted with a `DownloadError` instead of consuming unbounded memory and crashing the process. The `abortSignal` parameter is now passed through to `fetch()` in all download call sites.
 
   Added `download` option to `transcribe()` and `experimental_generateVideo()` for providing a custom download function. Use the new `createDownload({ maxBytes })` factory to configure download size limits.
 

package/dist/index.js

@@ -779,7 +779,7 @@ var import_provider_utils2 = require("@ai-sdk/provider-utils");
 var import_provider_utils3 = require("@ai-sdk/provider-utils");
 
 // src/version.ts
-var VERSION = true ? "5.0.147" : "0.0.0-test";
+var VERSION = true ? "5.0.149" : "0.0.0-test";
 
 // src/util/download/download.ts
 var download = async ({
@@ -799,6 +799,9 @@ var download = async ({
       ),
       signal: abortSignal
     });
+    if (response.redirected) {
+      (0, import_provider_utils2.validateDownloadUrl)(response.url);
+    }
     if (!response.ok) {
       throw new DownloadError({
         url: urlText,