build(deps): bump the ai-sdk group across 1 directory with 3 updates

[dependabot]

Bumps the ai-sdk group with 3 updates in the / directory: @ai-sdk/google, @ai-sdk/openai and ai.

Updates @ai-sdk/google from 3.0.80 to 4.0.18

Release notes

Sourced from @​ai-sdk/google's releases.

@​ai-sdk/google@​4.0.18

Patch Changes

• Updated dependencies [cd06458]
  • @​ai-sdk/provider-utils@​5.0.11

Changelog

Sourced from @​ai-sdk/google's changelog.

4.0.18

Patch Changes

• Updated dependencies [cd06458]
  • @​ai-sdk/provider-utils@​5.0.11

4.0.17

Patch Changes

• 5b4a299: fix(provider/google): forward Vertex-only imageConfig options (personGeneration, prominentPeople, imageOutputOptions)

4.0.16

Patch Changes

• 662ddfc: Allow google.interactions agent requests to include supported tools, including file_search.

4.0.15

Patch Changes

• Updated dependencies [31c7be8]
  • @​ai-sdk/provider-utils@​5.0.10

4.0.14

Patch Changes

• 4be62c1: fix(provider-utils): validate provider-response URLs in getFromApi

  getFromApi now has a validateUrl flag. It is optional so existing callers keep compiling (omitting it behaves like false, i.e. no validation), but all AI SDK provider packages set it explicitly at every call site so each one makes a visible trust decision. When true, the URL is routed through fetchWithValidatedRedirects — the same guard used by downloadBlob — which rejects private/loopback/link-local targets, re-validates every redirect hop, strips proxy/metadata/cookie request headers, and drops all caller headers except the user-agent on cross-origin redirects (custom API-key headers must not follow a redirect off-origin any more than Authorization may); blocked URLs throw DownloadError. It is enabled at the image/video/audio download and polling call sites where the URL comes from a provider response body; URLs built from developer-configured endpoints pass validateUrl: false and are unaffected.

  A new optional credentialedOrigin withholds caller headers unless the URL is same-origin with it, so the API key is not sent to a response-supplied host on a different origin.

  A new optional trustedOrigin exempts URLs (and redirect hops) that are same-origin with the developer-configured provider endpoint from target validation, so self-hosted and localhost deployments whose response URLs point back at the configured host keep working; all other hops are still validated.

  Also closes range gaps in validateDownloadUrl (IPv4 224.0.0.0/4 multicast and the TEST-NET documentation ranges 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24; IPv6 documentation ranges 2001:db8::/32 and 3fff::/20), and follows only the fetch-spec redirect status codes (301/302/303/307/308) — a Location header on any other status is not followed. This guard performs string/literal checks only and does not resolve DNS; hostnames that resolve to private addresses and DNS rebinding remain out of scope and must be constrained at the network layer (or by injecting a Node fetch that pins the resolved IP at connect time) for server deployments handling untrusted URLs. See contributing/secure-url-handling.md.

• Updated dependencies [4be62c1]

• Updated dependencies [7805e4a]

• Updated dependencies [cd12954]

  • @​ai-sdk/provider-utils@​5.0.9

4.0.13

Patch Changes

• Updated dependencies [e193290]

... (truncated)

Commits

• 9352ac1 Version Packages (#17417)
• 74bfdf0 docs: fix Google provider documentation links (#17368)
• b8241a6 Version Packages (#17264)
• 5b4a299 fix(provider/google): forward Vertex-only imageConfig options (personGenerati...
• 3649694 Version Packages (#17251)
• 662ddfc fix: google.interactions agents dropping File Search tools (#16593)
• 6976682 Version Packages (#17196)
• cb68fa6 Version Packages (#17175)
• cc3ab3a Version Packages (#17172)
• 4be62c1 fix(provider-utils): route provider-response URLs through the download-URL gu...
• Additional commits viewable in compare view

Updates @ai-sdk/openai from 3.0.67 to 4.0.16

Release notes

Sourced from @​ai-sdk/openai's releases.

@​ai-sdk/openai@​4.0.16

Patch Changes

• 75f86f4: fix(provider/openai, provider/open-responses): throw a descriptive error when the Responses API returns a 200 with no output

  A successful (200) Responses body missing the output array previously threw an opaque output is not iterable TypeError from doGenerate. Both providers now surface a clear APICallError ("Responses API returned no output …"), including the incomplete-details reason (and status, for open-responses) when present. When the body includes a response.error, its message is surfaced first so upstream error details aren't masked by the generic fallback. This makes malformed/incomplete upstream responses actionable instead of a cryptic crash.

• Updated dependencies [cd06458]

  • @​ai-sdk/provider-utils@​5.0.11

@​ai-sdk/openai@​3.0.86

Patch Changes

• Updated dependencies [19093fd]
  • @​ai-sdk/provider-utils@​4.0.40

Changelog

Sourced from @​ai-sdk/openai's changelog.

4.0.16

Patch Changes

• 75f86f4: fix(provider/openai, provider/open-responses): throw a descriptive error when the Responses API returns a 200 with no output

  A successful (200) Responses body missing the output array previously threw an opaque output is not iterable TypeError from doGenerate. Both providers now surface a clear APICallError ("Responses API returned no output …"), including the incomplete-details reason (and status, for open-responses) when present. When the body includes a response.error, its message is surfaced first so upstream error details aren't masked by the generic fallback. This makes malformed/incomplete upstream responses actionable instead of a cryptic crash.

• Updated dependencies [cd06458]

  • @​ai-sdk/provider-utils@​5.0.11

4.0.15

Patch Changes

• 0063c2d: Add the client-executed OpenAI Responses API computer tool with batched actions and screenshot outputs.

4.0.14

Patch Changes

• Updated dependencies [31c7be8]
  • @​ai-sdk/provider-utils@​5.0.10

4.0.13

Patch Changes

• 7805e4a: Fix realtime transcription auth header handling: per-call authorization headers now override configuration headers regardless of header-key casing (last case-variant wins), and the Bearer scheme is matched case-insensitively.
• cd12954: Reject empty OpenAI, Anthropic, and Replicate base URLs with a helpful AI SDK invalid argument error.
• Updated dependencies [4be62c1]
• Updated dependencies [7805e4a]
• Updated dependencies [cd12954]
  • @​ai-sdk/provider-utils@​5.0.9

4.0.12

Patch Changes

• e193290: Add connectToWebSocket to @ai-sdk/provider-utils: a shared WebSocket connect layer (constructor resolution, header hygiene, abort wiring, message decoding) analogous to postToApi for HTTP. The openai and xai streaming transcription models now use it instead of hand-rolled connects. For openai and xai this also means WebSocket constructor failures now surface as stream errors instead of throwing synchronously from doStream, an already-aborted signal no longer constructs a socket, and the caller's audio stream is cancelled on pre-open failures. Messages are processed in order with close handling deferred behind pending frames, audio send loops apply backpressure via the socket's bufferedAmount, and failed sends cancel the caller's audio stream.
• e193290: Fix streaming transcription over header-capable WebSocket implementations: the realtime WebSocket handshake sent the api key in both the openai-insecure-api-key subprotocol and the Authorization header, which OpenAI rejects ("You must only send one of protocol api key and Authorization header"). The Authorization header is now stripped when the subprotocol carries the key.
• e193290: Strip undefined header values before the streaming transcription WebSocket constructor (header-capable implementations like ws throw on undefined values).
• Updated dependencies [e193290]
  • @​ai-sdk/provider-utils@​5.0.8

4.0.11

Patch Changes

... (truncated)

Commits

• 9352ac1 Version Packages (#17417)
• 75f86f4 fix(provider/openai, provider/open-responses): guard Responses API responses ...
• b8241a6 Version Packages (#17264)
• 0063c2d feat: add OpenAI Responses API computer tool support (#17290)
• 6976682 Version Packages (#17196)
• cb68fa6 Version Packages (#17175)
• cd12954 fix: reject empty OpenAI, Anthropic, and Replicate base URLs with a helpful e...
• 7805e4a feat(provider-utils): experimental transcription-stream WebSocket envelope (#...
• cc3ab3a Version Packages (#17172)
• e193290 fix: streaming transcription WebSocket fixes + shared connect layer (#17093)
• Additional commits viewable in compare view

Updates ai from 6.0.195 to 7.0.31

Release notes

Sourced from ai's releases.

ai@7.0.31

Patch Changes

• 70f18c3: fix(ai): emit denied tool output state for client-rejected approvals
• cd06458: fix(ai): call onInputStart before onInputAvailable during non-streaming tool calls
• Updated dependencies [cd06458]
  • @​ai-sdk/provider-utils@​5.0.11
  • @​ai-sdk/gateway@​4.0.23

ai@6.0.230

Patch Changes

• 19093fd: fix(ai): call onInputStart before onInputAvailable during non-streaming tool calls
• Updated dependencies [19093fd]
  • @​ai-sdk/provider-utils@​4.0.40
  • @​ai-sdk/gateway@​3.0.153

Changelog

Sourced from ai's changelog.

7.0.31

Patch Changes

• 70f18c3: fix(ai): emit denied tool output state for client-rejected approvals
• cd06458: fix(ai): call onInputStart before onInputAvailable during non-streaming tool calls
• Updated dependencies [cd06458]
  • @​ai-sdk/provider-utils@​5.0.11
  • @​ai-sdk/gateway@​4.0.23

7.0.30

Patch Changes

• Updated dependencies [341616a]
• Updated dependencies [70fc45c]
  • @​ai-sdk/gateway@​4.0.22

7.0.29

Patch Changes

• Updated dependencies [7069785]
• Updated dependencies [4bf9ac2]
  • @​ai-sdk/gateway@​4.0.21

7.0.28

Patch Changes

• 0bc8d4f: Fix chat onFinish handling when overlapping requests clear the active response before a resume stream finishes.

7.0.27

Patch Changes

• ac01b79: Allow validating assistant UI messages with empty parts so persisted errored responses remain loadable.
• 2696562: experimental_streamTranscribe result promises now resolve without consuming fullStream: accessing any result promise consumes the stream internally. Previously await result.text alone deadlocked on transform backpressure. Because live transcription streams can be unbounded, fullStream is explicitly single-consumer (no replay buffering): access it once, before any result promise, when both stream parts and final results are needed.
• Updated dependencies [31c7be8]
• Updated dependencies [4d096f6]
  • @​ai-sdk/provider-utils@​5.0.10
  • @​ai-sdk/gateway@​4.0.20

7.0.26

Patch Changes

• 27d294d: feat(ai): group orphaned tool calls after tool approvals under parent span

7.0.25

... (truncated)

Commits

• 9352ac1 Version Packages (#17417)
• 70f18c3 fix: transition client-denied tool approvals to output-denied (#17438)
• cd06458 fix: ensure tool input lifecycle callbacks start before input becomes availab...
• 2667d27 Version Packages (#17351)
• 6427ca9 Version Packages (#17324)
• 3649694 Version Packages (#17251)
• 0bc8d4f fix: prevent Chat resume-stream onFinish errors when requests overlap (#16620)
• 6976682 Version Packages (#17196)
• 2696562 fix(ai): streamTranscribe result promises resolve without consuming fullStrea...
• ac01b79 fix: UI message validation rejects persisted assistant responses with empty p...
• Additional commits viewable in compare view