npm / @ai-sdk/provider-utils
@ai-sdk/provider-utils
What changed in @ai-sdk/provider-utils 4 to 5, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-18.
2 breaking3 security5 new APIs and options5 behavior and defaults10 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli init@ai-sdk/provider-utils 520 changes
Breaking changes 2
Arrays passed directly as state are interpreted as decision state parts; wrap JSON arrays in an object or a json part.
The API previously named evaluate is renamed to decide.
New APIs and options 5
Adds the box decision question type with image bounds for TypeSafe AI.
Experimental decision state now supports ordered text, file, and JSON parts, and public state forms are normalized into parts before providers are called.
Image input is supported in OpenAI Decisions and language model adapters.
Adds the portable max reasoning level, widening LanguageModelV4CallOptions['reasoning'] and ReasoningLevel; exhaustive consumers must handle max.
Experimental streaming lifecycle callbacks were added for speech generation and transcription.
Behavior and default changes 5
Decision choice responses now accept exact criteria labels.
Decision file bytes are serialized as base64 in state attributes; model-call spans record normalized state parts, while outer spans retain public state inputs.
Bedrock Nova 2 maps portable xhigh to maxReasoningEffort: 'high' and returns a compatibility warning; Fireworks maps max to high and returns warnings for minimal, xhigh, and max in generation and streaming results.
Provider usage is propagated for speech generation and transcription telemetry.
Telemetry was added to speech generation and transcription.
Fixes and other changes 8
URL paths and query values now retain case sensitivity.
Shared state is labeled in language-model decision prompts.
TypeSafe AI preserves native JSON state when state contains one JSON part.
Rows are limited to 64 MB during batch result downloads.
Parallel tool calls are preserved when stream labels are missing or reused.
Hostname parts are validated using isValidHostnamePart.
Use a standards-compliant User-Agent header.
Fixes streamed tool calls with missing, blank, or repeated IDs.
@ai-sdk/provider-utils 45 changes
Security 3
Adds opt-in URL validation and credential origin handling for URL-based image responses, including redirect validation, unsafe header stripping, and dropping credentials on cross-origin redirects; existing unvalidated requests are preserved.
Default Node.js downloads retain DNS validation and connection pinning when frameworks or instrumentation wrap global fetch before or after the SDK loads.
Prevents SSRF in OAuth metadata discovery.
Fixes and other changes 2
Makes the lazy Undici import visible to deployment tracers.
Preserves streamed tool calls when their IDs and indices are unreliable.