ai ai@7.0.171

Version 7.0.171 of the ai package, the core of Vercel's AI SDK, fixes a way a small malformed request could exhaust a server's memory. Chat apps built on the SDK usually receive the conversation from the browser as a list of UI messages, each made of parts such as text or tool calls, and check it with validateUIMessages, safeValidateUIMessages or the agent UI stream helpers before any model is called. Until this release, every part was checked against a combined schema of all 26 part schemas, and a part that matched none produced the errors of every one of them. According to the commit, a 7.5 KB request with 2,500 empty parts generated a 53.9 MB error message and exhausted a 128 MB heap, and metadata nested 700 arrays deep in a 1.5 KB request did the same. Now each part is checked only against the schema for its own type, validation stops at the first invalid message or part, and an invalid value in provider or tool metadata is reported as one issue. The pull request, which credits a report made through Vercel's HackerOne program, measured that 2,500-part request being rejected after about 4 ms of validation, and valid input got faster as well: 100,000 valid parts took 56 ms instead of about 1,045 ms. Any server that passes client-sent messages to these functions has a reason to upgrade. The same fix has also been merged into the version 6 and version 5 release branches through separate backports (v6, v5).

The release also changes a default that apps should check before upgrading. When a tool call fails during a multi-step run, the model receives the full error text, but toUIMessageStream and toUIMessageChunk used to send the client only "An error occurred." An app that stored those UI messages and converted them back with convertToModelMessages for the next turn therefore sent a tool result the model had never seen. Per the release notes, models that bind their reasoning to earlier messages, such as Anthropic models with preserved thinking, rejected that history with an HTTP 400 error, and other models carried on from an error they never received. UI messages now keep the model's error text, which means that text reaches the browser; for an invalid tool call it can contain the generated input, the input schema's validation messages or the names of the available tools. Apps that do not want those details shown can throw errors with safe messages from a tool's execute function, or set the new redactToolErrors: true option to restore the old masking. A custom onError handler keeps handling failed tool calls unless redactToolErrors is set to false, and errors in the stream itself are still masked by default.

A smaller change concerns file downloads. File inputs are now downloaded through the provider's configured fetch transport, and a new fetch option on createDownload lets developers route core downloads through guarded-fetch, which offers opt-in DNS validation on Node.js. The function createDownload returns can be passed as experimental_download to generateText and streamText, and that hook now also handles file URLs the model generates, so one hook covers all core downloads. The notes say the default URL checks do not resolve DNS and recommend the guarded transport or network egress controls when URLs come from untrusted sources. Azure image and Vertex tool-result downloads are now kept apart from the provider's authentication wrappers so that file hosts never receive Azure bearer tokens or Vertex Express Mode API keys. The release also adds an experimental extract API and an extraction model spec, which the notes describe in one line.