Sign in
← AI PulseJul 29, 2026

Wire · news · Multi-source brief

Vercel AI SDK Updates Node.js Download Validation and Model Call Settings

Vercel has released version 7.0.42 of its AI SDK, introducing enhanced security for Node.js downloads and new capabilities for overriding model call settings.

By Illumora Editorial

Source · Jul 29, 2026, 5:29 PM · On Illumora · Jul 29, 2026, 5:37 PM

Media from the primary source — shown here so you can stay on Illumora.

Synthesized from multiple allowlisted primaries on the same event. Lanes →

Brief drafted by Illumora’s editorial model from the linked primary source. Ops desk reviews flagged pieces. How we write →

Read the source →Vercel AI SDK Changelog — Release @ai-sdk/luma@3.0.16: Version Packages (#18083) · vercel/ai
Save

Vercel has updated its AI SDK to version 7.0.42, addressing security concerns related to Node.js downloads and expanding control over model interactions. The changes were released across several packages, including @ai-sdk/luma@3.0.16, @ai-sdk/langchain@3.0.42, @ai-sdk/harness-pi@1.0.48, and @ai-sdk/huggingface@2.0.17.

Key Points

  • AI SDK version 7.0.42 prevents Node.js validated downloads from accessing private or internal services.
  • This prevention is achieved by validating and pinning every resolved address during connection time.
  • The update fixes validated Node.js downloads when the HTTP connector requests a single DNS address.
  • Users can now override model call settings for individual prepareStep invocations.
  • Provider metadata from empty text deltas in streamText is now preserved.
  • Updated dependencies include @ai-sdk/provider-utils@5.0.15, @ai-sdk/gateway@4.0.32, @ai-sdk/alibaba@2.0.19, @ai-sdk/openai-compatible@3.0.17, and @ai-sdk/amazon-bedrock@5.0.36.

Context

According to Vercel, the updates enhance the security posture of Node.js environments by mitigating risks associated with DNS aliases and DNS rebinding. The ability to override model call settings provides developers with more granular control over how models are invoked within their applications.

Why It Matters

These updates offer developers using the Vercel AI SDK improved security against potential network vulnerabilities in Node.js environments and greater flexibility in managing model interactions. The changes can help ensure that applications remain secure while allowing for more precise control over AI model behavior.

What To Do

  • Review the AI SDK documentation for details on overriding model call settings in prepareStep invocations.
  • Note the updated dependency versions for @ai-sdk/provider-utils, @ai-sdk/gateway, @ai-sdk/alibaba, @ai-sdk/openai-compatible, and @ai-sdk/amazon-bedrock.
  • Test applications utilizing Node.js downloads to confirm the enhanced security measures.
  • Observe how provider metadata is preserved from empty text deltas in streamText for streaming applications.