ai ai@6.0.328

Version 6.0.328 of `ai`, the core package of Vercel's AI SDK for building AI features in TypeScript, is a maintenance release on the older version 6 line, and its one functional change is a security fix. The SDK can record telemetry: traces of each `generateText` or `streamText` call that an application sends to an observability tool. Those traces include the definitions of the tools the model was given. Some OpenAI tools can carry secrets inside their definitions. The MCP tool, which connects a model to a remote MCP server, can include an authorization value and request headers, and the Code Interpreter and shell tools can include what the notes call domain-secret values. According to the release notes, these values are now redacted from the tool definitions recorded in telemetry, while the arguments the application passes and the request sent to OpenAI stay unchanged, so the tools keep working.

The fix implies that earlier 6.x releases wrote these values into recorded telemetry. The applications affected are those on version 6 that use these OpenAI tools with telemetry turned on. Upgrading stops new traces from containing the values, but it does not remove anything an observability backend has already stored, so those teams may want to check their trace data and rotate any credentials found there. The rest of the release is dependency updates, to `@ai-sdk/provider-utils` 4.0.66 and `@ai-sdk/gateway` 3.0.234.