ai 7.0.0-beta.2 → 7.0.0-beta.4

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # ai
 
+## 7.0.0-beta.4
+
+### Patch Changes
+
+- 5ceed7d: fix(ai): doStream should reflect transformed values
+
+## 7.0.0-beta.3
+
+### Patch Changes
+
+- 531251e: fix(security): validate redirect targets in download functions to prevent SSRF bypass
+
+  Both `downloadBlob` and `download` now validate the final URL after following HTTP redirects, preventing attackers from bypassing SSRF protections via open redirects to internal/private addresses.
+
+- Updated dependencies [531251e]
+  - @ai-sdk/provider-utils@5.0.0-beta.1
+  - @ai-sdk/gateway@4.0.0-beta.2
+
 ## 7.0.0-beta.2
 
 ### Patch Changes

package/dist/index.js

@@ -1370,7 +1370,7 @@ var import_provider_utils3 = require("@ai-sdk/provider-utils");
 var import_provider_utils4 = require("@ai-sdk/provider-utils");
 
 // src/version.ts
-var VERSION = true ? "7.0.0-beta.2" : "0.0.0-test";
+var VERSION = true ? "7.0.0-beta.4" : "0.0.0-test";
 
 // src/util/download/download.ts
 var download = async ({
@@ -1390,6 +1390,9 @@ var download = async ({
       ),
       signal: abortSignal
     });
+    if (response.redirected) {
+      (0, import_provider_utils3.validateDownloadUrl)(response.url);
+    }
     if (!response.ok) {
       throw new import_provider_utils3.DownloadError({
         url: urlText,
@@ -7597,24 +7600,12 @@ var DefaultStreamTextResult = class {
                           telemetry,
                           attributes: {
                             "ai.response.finishReason": stepFinishReason,
-                            "ai.response.text": {
-                              output: () => activeText
-                            },
-                            "ai.response.reasoning": {
-                              output: () => {
-                                const reasoningParts = recordedContent.filter(
-                                  (c) => c.type === "reasoning"
-                                );
-                                return reasoningParts.length > 0 ? reasoningParts.map((r) => r.text).join("\n") : void 0;
-                              }
-                            },
                             "ai.response.toolCalls": {
                               output: () => stepToolCallsJson
                             },
                             "ai.response.id": stepResponse.id,
                             "ai.response.model": stepResponse.modelId,
                             "ai.response.timestamp": stepResponse.timestamp.toISOString(),
-                            "ai.response.providerMetadata": JSON.stringify(stepProviderMetadata),
                             "ai.usage.inputTokens": stepUsage.inputTokens,
                             "ai.usage.outputTokens": stepUsage.outputTokens,
                             "ai.usage.totalTokens": stepUsage.totalTokens,
@@ -7632,8 +7623,6 @@ var DefaultStreamTextResult = class {
                         })
                       );
                     } catch (error) {
-                    } finally {
-                      doStreamSpan.end();
                     }
                     controller.enqueue({
                       type: "finish-step",
@@ -7651,6 +7640,28 @@ var DefaultStreamTextResult = class {
                       stepUsage
                     );
                     await stepFinish.promise;
+                    const processedStep = recordedSteps[recordedSteps.length - 1];
+                    try {
+                      doStreamSpan.setAttributes(
+                        await selectTelemetryAttributes({
+                          telemetry,
+                          attributes: {
+                            "ai.response.text": {
+                              output: () => processedStep.text
+                            },
+                            "ai.response.reasoning": {
+                              output: () => processedStep.reasoningText
+                            },
+                            "ai.response.providerMetadata": JSON.stringify(
+                              processedStep.providerMetadata
+                            )
+                          }
+                        })
+                      );
+                    } catch (error) {
+                    } finally {
+                      doStreamSpan.end();
+                    }
                     const clientToolCalls = stepToolCalls.filter(
                       (toolCall) => toolCall.providerExecuted !== true
                     );