ai 5.0.197 → 5.0.198

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # ai
 
+## 5.0.198
+
+### Patch Changes
+
+- b02267c: Harden UI message stream processing against prototype pollution from chunk IDs.
+
 ## 5.0.197
 
 ### Patch Changes

package/dist/index.js

@@ -778,7 +778,7 @@ function detectMediaType({
 var import_provider_utils2 = require("@ai-sdk/provider-utils");
 
 // src/version.ts
-var VERSION = true ? "5.0.197" : "0.0.0-test";
+var VERSION = true ? "5.0.198" : "0.0.0-test";
 
 // src/util/download/download.ts
 var download = async ({
@@ -3145,6 +3145,11 @@ function isDataUIMessageChunk(chunk) {
   return chunk.type.startsWith("data-");
 }
 
+// src/util/create-id-map.ts
+function createIdMap() {
+  return /* @__PURE__ */ Object.create(null);
+}
+
 // src/util/merge-objects.ts
 function mergeObjects(base, overrides) {
   if (base === void 0 && overrides === void 0) {
@@ -3559,9 +3564,9 @@ function createStreamingUIMessageState({
       role: "assistant",
       parts: []
     },
-    activeTextParts: {},
-    activeReasoningParts: {},
-    partialToolCalls: {}
+    activeTextParts: createIdMap(),
+    activeReasoningParts: createIdMap(),
+    partialToolCalls: createIdMap()
   };
 }
 function processUIMessageStream({
@@ -3937,8 +3942,8 @@ function processUIMessageStream({
               break;
             }
             case "finish-step": {
-              state.activeTextParts = {};
-              state.activeReasoningParts = {};
+              state.activeTextParts = createIdMap();
+              state.activeReasoningParts = createIdMap();
               break;
             }
             case "start": {