ai 7.0.89 → 7.0.90

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # ai
 
+## 7.0.90
+
+### Patch Changes
+
+- Updated dependencies [4d25a08]
+- Updated dependencies [6bcc0f8]
+  - @ai-sdk/gateway@4.0.72
+  - @ai-sdk/provider-utils@5.0.36
+
 ## 7.0.89
 
 ### Patch Changes

package/dist/index.js

@@ -1176,7 +1176,7 @@ import {
 } from "@ai-sdk/provider-utils";
 
 // src/version.ts
-var VERSION = true ? "7.0.89" : "0.0.0-test";
+var VERSION = true ? "7.0.90" : "0.0.0-test";
 
 // src/util/download/download.ts
 var download = async ({

package/dist/internal/index.js

@@ -91,7 +91,7 @@ import {
 } from "@ai-sdk/provider-utils";
 
 // src/version.ts
-var VERSION = true ? "7.0.89" : "0.0.0-test";
+var VERSION = true ? "7.0.90" : "0.0.0-test";
 
 // src/util/download/download.ts
 var download = async ({

package/docs/02-foundations/02-providers-and-models.mdx

@@ -145,6 +145,7 @@ Here are the capabilities of popular models:
 | [OpenAI](/providers/ai-sdk-providers/openai)       | `gpt-5-codex`                               | <Check />   | <Check />         | <Check />  | <Check />      |
 | [OpenAI](/providers/ai-sdk-providers/openai)       | `gpt-5-chat-latest`                         | <Check />   | <Check />         | <Check />  | <Check />      |
 | [Anthropic](/providers/ai-sdk-providers/anthropic) | `claude-sonnet-5`                           | <Check />   | <Check />         | <Check />  | <Check />      |
+| [Anthropic](/providers/ai-sdk-providers/anthropic) | `claude-fable-5-1`                          | <Check />   | <Check />         | <Check />  | <Check />      |
 | [Anthropic](/providers/ai-sdk-providers/anthropic) | `claude-fable-5`                            | <Check />   | <Check />         | <Check />  | <Check />      |
 | [Anthropic](/providers/ai-sdk-providers/anthropic) | `claude-opus-4-8`                           | <Check />   | <Check />         | <Check />  | <Check />      |
 | [Anthropic](/providers/ai-sdk-providers/anthropic) | `claude-opus-4-7`                           | <Check />   | <Check />         | <Check />  | <Check />      |

package/docs/03-agents/07-workflow-agent.mdx

@@ -613,6 +613,21 @@ const agent = new WorkflowAgent({
 });
 ```
 
+Tool input callbacks (`onInputStart`, `onInputDelta`, and
+`onInputAvailable`) are also preserved by `WorkflowAgent`. The model call runs
+inside a durable step, while callback functions remain in the workflow
+context because arbitrary functions cannot cross the step boundary. As a
+result, `WorkflowAgent` records the callback events during the model step and
+replays them in order immediately after that step completes, before tool
+execution and step lifecycle callbacks. They do not run concurrently with
+model generation and cannot provide in-flight cancellation or backpressure.
+Each callback receives its tool's `toolsContext` entry after
+`contextSchema` validation.
+
+For highly fragmented tool inputs, `onInputDelta` replay data is part of the
+durable model-step result. Only configure `onInputDelta` when each generated
+delta is needed; omit it to avoid retaining delta replay data.
+
 The deprecated `experimental_onStart` and `experimental_onStepStart` names
 remain available for backwards compatibility. When both the stable and
 experimental name are provided in the same constructor or `stream()` call, the

package/docs/06-advanced/11-secure-url-fetching.mdx

@@ -17,6 +17,11 @@ To prevent that, the SDK validates every response-supplied URL before fetching
 it. This happens automatically inside the provider packages — you don't need to
 configure anything.
 
+For authenticated task-status polling, providers can construct the first URL
+from the configured API endpoint. The SDK trusts that configured origin for the
+initial request, but manually follows and validates every redirect away from it.
+MiniMax, Kling AI, and ByteDance video polling use this protected path.
+
 ## What the SDK protects against
 
 When the SDK fetches a URL taken from a provider response, it:
@@ -45,7 +50,8 @@ A blocked URL surfaces as a `DownloadError`.
 URLs that are same-origin with the provider endpoint **you configured** (e.g. a
 custom `baseURL` pointing at a self-hosted or `localhost` deployment) are
 exempt from these checks — they target exactly the host you told the SDK to
-talk to. Any redirect off that origin is still validated.
+talk to. This also applies to task-status polling. Any redirect off that origin
+is still validated before the redirected request is sent.
 
 ## DNS validation across runtimes
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai",
-  "version": "7.0.89",
+  "version": "7.0.90",
   "type": "module",
   "description": "AI SDK by Vercel - build apps like ChatGPT, Claude, Gemini, and more with a single interface for any model using the Vercel AI Gateway or go direct to OpenAI, Anthropic, Google, or any other model provider.",
   "license": "Apache-2.0",
@@ -42,20 +42,20 @@
     }
   },
   "dependencies": {
-    "@ai-sdk/gateway": "4.0.71",
+    "@ai-sdk/gateway": "4.0.72",
     "@ai-sdk/provider": "4.0.10",
-    "@ai-sdk/provider-utils": "5.0.35"
+    "@ai-sdk/provider-utils": "5.0.36"
   },
   "devDependencies": {
-    "@ai-sdk/amazon-bedrock": "5.0.71",
-    "@ai-sdk/deepseek": "3.0.38",
-    "@ai-sdk/google": "4.0.61",
-    "@ai-sdk/groq": "4.0.36",
-    "@ai-sdk/huggingface": "2.0.42",
-    "@ai-sdk/moonshotai": "3.0.44",
-    "@ai-sdk/openai": "4.0.55",
+    "@ai-sdk/amazon-bedrock": "5.0.72",
+    "@ai-sdk/deepseek": "3.0.39",
+    "@ai-sdk/google": "4.0.62",
+    "@ai-sdk/groq": "4.0.37",
+    "@ai-sdk/huggingface": "2.0.43",
+    "@ai-sdk/moonshotai": "3.0.45",
+    "@ai-sdk/openai": "4.0.56",
     "@ai-sdk/test-server": "2.0.1",
-    "@ai-sdk/xai": "4.0.52",
+    "@ai-sdk/xai": "4.0.53",
     "@edge-runtime/vm": "^5.0.0",
     "@smithy/eventstream-codec": "^4.3.3",
     "@smithy/util-utf8": "^4.3.3",