# What changed in @ai-sdk/provider-utils

> 58 changes in @ai-sdk/provider-utils 3 to 5 from its official release notes, upgrade guides and advisories: 3 breaking, 3 security, 19 new APIs and options. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/@ai-sdk/provider-utils/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @ai-sdk/provider-utils 5

### Breaking changes

- Arrays passed directly as state are interpreted as decision state parts; wrap JSON arrays in an object or a json part. (5.0.57) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.57)
- The API previously named evaluate is renamed to decide. (5.0.54) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.54)
- Packages are compiled for an ES2022 runtime target, which may affect runtime compatibility. (5.0.49) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.49)

### Security

- Default Node.js downloads retain DNS validation and connection pinning when frameworks or instrumentation wrap global fetch before or after the SDK loads. (3.0.41, 4.0.57, 5.0.42) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%404.0.57), [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%403.0.41), [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.42)
- Prevents SSRF in OAuth metadata discovery. (3.0.41, 4.0.57, 5.0.40) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%404.0.57), [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%403.0.41), [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.40)

### New APIs and options

- Adds the box decision question type with image bounds for TypeSafe AI. (5.0.62) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.62)
- Experimental decision state now supports ordered text, file, and JSON parts, and public state forms are normalized into parts before providers are called. (5.0.57) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.57)
- Image input is supported in OpenAI Decisions and language model adapters. (5.0.57) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.57)
- Adds the portable max reasoning level, widening LanguageModelV4CallOptions['reasoning'] and ReasoningLevel; exhaustive consumers must handle max. (5.0.55) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.55)
- Experimental streaming lifecycle callbacks were added for speech generation and transcription. (5.0.53) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.53)
- Adds a shared structured language-model evaluation adapter for Choice, Score, and Boolean evaluations, preserving exact labels and metadata, validating score bounds, and returning prompted Boolean P(true) estimates validated to be in [0, 1]. (5.0.43) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.43)
- Code-mode supports discovering and updating tools during a conversation. (5.0.42) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.42)
- Upload results now expose the file's byte size. (5.0.35) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.35)
- Upload results now expose the file's creation time. (5.0.35) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.35)
- Adds an optional file deletion operation to FilesV4. (5.0.35) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.35)
- Adds an optional streaming file download operation to FilesV4. (5.0.35) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.35)
- Upload results now expose the file's expiration time. (5.0.35) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.35)
- Adds abortSignal as a FilesV4 call option so calls can receive an abort signal. (5.0.35) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.35)
- Adds headers as a FilesV4 call option. (5.0.35) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.35)
- Adds a `{ type: 'stream' }` variant for upload data. (5.0.35) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.35)
- Adds an optional FilesV4 operation for retrieving file metadata. (5.0.35) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.35)
- Adds streaming multipart uploads with deterministic part ordering and failure-path stream teardown. (5.0.35) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.35)
- UI messages retain the approval request's reason separately from an approver's response reason. (5.0.32) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.32)
- Manual tool approval statuses can include a reason, which is preserved across core, model, and UI approval requests and surfaced for OPA requires-approval decisions. (5.0.32) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.32)

### Performance

- Avoids excessive memory usage when base64 encoding byte arrays. (3.0.37, 4.0.52, 5.0.37) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%404.0.52), [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%403.0.37), [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.37)

### Behavior and default changes

- Decision choice responses now accept exact criteria labels. (5.0.59) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.59)
- Decision file bytes are serialized as base64 in state attributes; model-call spans record normalized state parts, while outer spans retain public state inputs. (5.0.57) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.57)
- Bedrock Nova 2 maps portable xhigh to maxReasoningEffort: 'high' and returns a compatibility warning; Fireworks maps max to high and returns warnings for minimal, xhigh, and max in generation and streaming results. (5.0.55) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.55)
- Provider usage is propagated for speech generation and transcription telemetry. (5.0.53) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.53)
- Telemetry was added to speech generation and transcription. (5.0.53) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.53)
- Language-model evaluation adapters now default to reasoning: 'none' using each provider's existing reasoning mapping; explicit providerOptions reasoning settings still override it. (5.0.43) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.43)

### Fixes and other changes

- URL paths and query values now retain case sensitivity. (4.0.59, 5.0.60) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.60), [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%404.0.59)
- Shared state is labeled in language-model decision prompts. (5.0.57) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.57)
- TypeSafe AI preserves native JSON state when state contains one JSON part. (5.0.57) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.57)
- Rows are limited to 64 MB during batch result downloads. (5.0.55) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.55)
- Parallel tool calls are preserved when stream labels are missing or reused. (5.0.55) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.55)
- Hostname parts are validated using isValidHostnamePart. (5.0.53) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.53)
- Use a standards-compliant User-Agent header. (5.0.51) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.51)
- Fixes streamed tool calls with missing, blank, or repeated IDs. (5.0.50) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.50)
- Prompt conversion preserves original opaque URI strings in tagged file URLs. (5.0.49) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.49)
- Prompt conversion matches supported URL MIME types exactly so unsupported subtypes are not forwarded to providers. (5.0.49) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.49)
- Keeps per-value multimodal content aligned across automatic batches, including text-only entries, and validates content length and provider options after middleware transforms. (4.0.54, 5.0.47) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.47), [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%404.0.54)
- Executes manually approved tool inputs produced by schema transforms, preserves approved inputs during revalidation, and rejects histories whose reconstructed output differs. (5.0.47) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.47)
- Audio detection now recognizes AAC audio with ADTS headers. (5.0.45) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.45)
- Image detection now handles AVIF and HEIC images with variable ftyp box sizes. (5.0.45) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.45)
- Following validated redirects no longer waits for response clone cancellation. (5.0.45) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.45)
- Makes the lazy Undici import visible to deployment tracers. (3.0.41, 4.0.57, 5.0.44) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%404.0.57), [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%403.0.41), [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.44)
- Avoids crashing when DOMException is not a global constructor. (5.0.42) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.42)
- Plain text prefixes are no longer detected as BMP or GIF images. (5.0.40) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.40)
- The core uploadFile() helper now forwards abortSignal to the provider call. (5.0.35) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.35)
- The core uploadFile() helper now forwards headers to the provider call. (5.0.35) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.35)
- Transient network errors while reading successful response bodies are now marked retryable. (4.0.50, 5.0.33) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%404.0.50), [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%405.0.33)

## @ai-sdk/provider-utils 4

### Security

- Adds opt-in URL validation and credential origin handling for URL-based image responses, including redirect validation, unsafe header stripping, and dropping credentials on cross-origin redirects; existing unvalidated requests are preserved. (4.0.61) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%404.0.61)

### Fixes and other changes

- Preserves streamed tool calls when their IDs and indices are unreliable. (3.0.40, 4.0.56) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%404.0.56), [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%403.0.40)
- Matches full MIME types exactly when checking native URL support. (4.0.55) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%404.0.55)
- Preserves media types on file URLs in tool results. (4.0.55) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%404.0.55)
- Preserves approved inputs during revalidation, rejects histories whose reconstructed schema output differs, and validates transformed UI tool inputs against the reconstructed output. (4.0.54) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%404.0.54)

## @ai-sdk/provider-utils 3

### Fixes and other changes

- Transient network errors while reading successful response bodies are now marked retryable, including for AI Gateway responses. (3.0.36) — [release notes](https://github.com/vercel/ai/releases/tag/%40ai-sdk/provider-utils%403.0.36)