Sign in
← AI PulseJul 29, 2026

Wire · news · Multi-source brief

Vercel AI SDK Updates Address Node.js Security and Model Call Settings

Vercel has released updates across its AI SDK packages, including @ai-sdk/langchain@3.0.42, @ai-sdk/hume@3.0.15, @ai-sdk/luma@3.0.16, and @ai-sdk/mcp@2.0.19, focusing on enhanced security for Node.js downloads and improved control over model call settings.

By Illumora Editorial

Source · Jul 29, 2026, 5:29 PM · On Illumora · Jul 29, 2026, 5:37 PM

Media from the primary source — shown here so you can stay on Illumora.

Synthesized from multiple allowlisted primaries on the same event. Lanes →

Brief drafted by Illumora’s editorial model from the linked primary source. Ops desk reviews flagged pieces. How we write →

Read the source →Vercel AI SDK Changelog — Release @ai-sdk/langchain@3.0.42: Version Packages (#18083) · vercel/ai
Save

Vercel has issued updates for several of its AI SDK packages, including @ai-sdk/langchain@3.0.42, @ai-sdk/hume@3.0.15, @ai-sdk/luma@3.0.16, and @ai-sdk/mcp@2.0.19. These releases, part of a broader ai@7.0.42 update, introduce security enhancements for Node.js environments and provide more granular control over model interactions.

Key Points

  • ai@7.0.42 includes changes to prevent validated Node.js downloads from accessing private or internal services through DNS aliases or DNS rebinding.
  • The update validates and pins every resolved address at connection time for Node.js downloads.
  • It fixes validated Node.js downloads when the HTTP connector requests a single DNS address.
  • The SDK now supports overriding model call settings for individual prepareStep invocations.
  • Provider metadata from empty text deltas in streamText is preserved.
  • Dependencies such as @ai-sdk/provider-utils@5.0.15, @ai-sdk/gateway@4.0.32, @ai-sdk/alibaba@2.0.19, @ai-sdk/openai-compatible@3.0.17, and @ai-sdk/amazon-bedrock@5.0.36 have been updated.

Context

According to the Vercel AI SDK Changelog, these updates were initiated by a Changesets release GitHub action. The changes aim to bolster the security posture of Node.js applications using the AI SDK by addressing potential vulnerabilities related to DNS resolution during downloads. Additionally, the updates enhance developer control over how models are invoked within the SDK.

Why It Matters

These updates are relevant for developers using the Vercel AI SDK, particularly those deploying applications on Node.js. The security fixes reduce the risk of DNS-related attacks, while the ability to override model call settings offers greater flexibility and precision in managing AI model interactions, potentially leading to more optimized and secure applications.

What To Do

  • Review the changelog for ai@7.0.42 to understand the full scope of changes.
  • Update your project dependencies to the latest versions of @ai-sdk/langchain, @ai-sdk/hume, @ai-sdk/luma, @ai-sdk/mcp, and other affected packages.
  • Test applications that perform validated Node.js downloads to ensure the new security measures do not introduce unexpected behavior.
  • Explore the new option to override model call settings for individual prepareStep invocations to fine-tune model behavior.

Keep Exploring

/studio?pack=foundation /techniques/system-user-separation /techniques/output-schema