Sign in
← AI PulseJul 29, 2026

Wire · news · Multi-source brief

Vercel AI SDK Updates Address Security and Model Control

Vercel has released updates to its AI SDK, including version 7.0.42 of the core ai package, which enhances security for Node.js downloads and adds control over model call settings.

By Illumora Editorial

Source · Jul 29, 2026, 5:29 PM · On Illumora · Jul 29, 2026, 5:37 PM

Media from the primary source — shown here so you can stay on Illumora.

Synthesized from multiple allowlisted primaries on the same event. Lanes →

Brief drafted by Illumora’s editorial model from the linked primary source. Ops desk reviews flagged pieces. How we write →

Read the source →Vercel AI SDK Changelog — Release @ai-sdk/harness-pi@1.0.48 · vercel/ai
Save

Vercel has updated its AI SDK, with the core ai package reaching version 7.0.42. These updates, released via the Changesets GitHub action, focus on security enhancements for Node.js environments and provide more granular control over model interactions.

Key Points

  • The ai package has been updated to version 7.0.42.
  • Validated downloads on Node.js now prevent access to private or internal services via DNS aliases or DNS rebinding.
  • Every resolved address is validated and pinned at connection time to enhance security.
  • A fix addresses validated Node.js downloads when the HTTP connector requests a single DNS address.
  • Support has been added for overriding model call settings for individual prepareStep invocations.
  • Provider metadata from empty text deltas in streamText is now preserved.
  • Dependent packages such as @ai-sdk/provider-utils, @ai-sdk/gateway, @ai-sdk/alibaba, @ai-sdk/openai-compatible, and @ai-sdk/amazon-bedrock have also been updated.

Context

According to Vercel, these updates were initiated by the Changesets release GitHub action. The changes aim to improve the robustness and security of the AI SDK, particularly for applications running on Node.js. The updates also provide developers with more flexibility in managing model interactions by allowing overrides for call settings.

Why It Matters

These updates are significant for developers using the Vercel AI SDK, as they enhance the security posture of applications by mitigating potential DNS-related vulnerabilities in Node.js environments. The added control over model call settings offers greater precision in how AI models are invoked, which can lead to more optimized and tailored AI application behavior.

What To Do

  • Review the updated security measures for Node.js downloads in the AI SDK documentation.
  • Test the new capability to override model call settings for individual prepareStep invocations.
  • Note the preservation of provider metadata from empty text deltas in streamText for streaming applications.
  • Compare the updated dependency versions for @ai-sdk/alibaba, @ai-sdk/openai-compatible, and @ai-sdk/amazon-bedrock in your projects.