fix(deps): update dependency @ai-sdk/anthropic to v4 - #146
Conversation
be293fd to
ea4ef4f
Compare
dawsontoth
left a comment
dawsontoth
left a comment
There was a problem hiding this comment.
Blocked: this breaks every Claude model at runtime
@ai-sdk/anthropic@4 resolves @ai-sdk/provider@4.0.7, which stamps models with specificationVersion: 'v4'. But @openai/agents-extensions@0.13.4 — the version this branch keeps — hard-gates on the spec version:
// node_modules/@openai/agents-extensions/dist/ai-sdk/index.mjs:29
throw new UserError(`Unsupported AI SDK specificationVersion: ${...}. Only v2 and v3 are supported.`);lifecycle/getModel.ts:41 sends every claude-* model straight through that gate (aisdk(anthropic(modelName))), so it throws before any request is made.
Reproduced on this branch's head (ea4ef4f8), Node 24.17.0, after npm ci:
anthropic: raw model specificationVersion = v4
anthropic: aisdk() THREW UserError: Unsupported AI SDK specificationVersion: v4. Only v2 and v3 are supported.
google: raw model specificationVersion = v3 → aisdk() OK
openai: raw model specificationVersion = v3 → aisdk() OK
npm ls shows the split plainly — two @ai-sdk/provider majors in one tree:
+-- @ai-sdk/anthropic@4.0.36
| `-- @ai-sdk/provider@4.0.7
+-- @ai-sdk/google@3.0.103 -> @ai-sdk/provider@3.0.14 deduped
+-- @ai-sdk/openai@3.0.90 -> @ai-sdk/provider@3.0.14 deduped
`-- ai@6.0.238 -> @ai-sdk/provider@3.0.14 deduped
Why CI is green
lifecycle/getModel.test.ts mocks both sides of the seam — vi.mock('@ai-sdk/anthropic', ...) and vi.mock('@openai/agents-extensions/ai-sdk', ...) — so the real gate never runs. No test exercises a real provider object, and there is no build/type job that would notice either.
The fix: merge #143 first
@openai/agents-extensions@0.14.3 adds v4 support (peerDependencies: '@ai-sdk/provider': '^2.0.0 || ^3.0.0 || ^4.0.0', and the gate becomes Only v2, v3, and v4 are supported). I verified the combination locally — extensions 0.14.3 + @ai-sdk/anthropic@^4:
anthropic: raw model specificationVersion = v4 → aisdk() OK
getModel('claude-sonnet-4-5') → APICallError: invalid x-api-key (reached the real Anthropic API)
So the ordering is: land #143 (ideally together with #140, which aligns @openai/agents to the same 0.14.3 line), then rebase this PR and it's safe. Happy to re-review once that's in — the bump itself is fine, it just can't go first.
Worth adding a Renovate group so @ai-sdk/* + ai move as one set; a single-provider major in this family installs cleanly and passes CI while being broken at runtime.
dawsontoth
left a comment
dawsontoth
left a comment
There was a problem hiding this comment.
Clearing my block — #143 landed, and I've merged main in plus added the Renovate groups
My earlier changes-requested was conditional on #143 (@openai/agents-extensions ^0.14.0), which merged in 521330b. That was the blocker, and it's gone. Two commits pushed here:
- Merge of
main— the branch was 6 commits behind and still declared@openai/agents-extensions: ^0.13.0, so merging as-is would still have thrown. package.json auto-resolved cleanly (extensions/agents^0.14.0from main,@ai-sdk/anthropic: ^4.0.0from this branch). - The Renovate group rules you asked for.
I used a merge rather than a rebase so this stays a fast-forward on the existing branch — no history rewrite.
Re-verification on the new head (0b6c74c0, Node 24.17.0)
The spec-version gate that made this fatal now accepts v4:
anthropic: spec=v4 aisdk() OK
google: spec=v3 aisdk() OK
openai: spec=v3 aisdk() OK
and end-to-end through getModel() → Agent → run(), all three reach their real APIs (invalid-key errors = the request actually went out):
claude-sonnet-4-5: APICallError: invalid x-api-key
gemini-2.5-pro: APICallError: API key not valid. Please pass a valid API key.
gpt-5: APICallError: Incorrect API key provided: bad
@openai/agents-core resolves to a single 0.14.3 (no split). npm ci exit 0, dprint check clean, oxlint clean, npm run build succeeds including the DTS step, and 345/345 tests across 53 files — ink/main.test.tsx passed too, which is consistent with the hardening commits now on main.
Lockfile audit vs main: 1 major crossing (@ai-sdk/anthropic 3.0.104 → 4.0.38, the point of the PR), 3 additions, 0 removals. The two non-obvious entries both trace to the bump rather than to drift — @workflow/serde@4.1.0 is a new transitive of @ai-sdk/provider-utils@5.0.27, and top-level undici moves 7.20.0 → 7.29.0 to satisfy it (incidentally the version that patches CVE-2026-13697 and CVE-2026-16728). I also checked harper's nested optional react-native subtree survived the lockfile regeneration — it did, 1690 keys with react-native present, so this doesn't trip the npm ci landmine currently blocking #141.
The Renovate rules
{
"groupName": "AI SDK", "groupSlug": "ai-sdk",
"matchPackageNames": ["ai", "@ai-sdk/**", "ollama-ai-provider-v2"]
},
{
"groupName": "OpenAI Agents SDK", "groupSlug": "openai-agents",
"matchPackageNames": ["@openai/agents", "@openai/agents-extensions"]
}Both are appended after the existing all non-major dependencies rule so they take precedence for these packages, and neither sets matchUpdateTypes — that's deliberate, since the whole point is that a major has to move as a set. Renovate still splits major from non-major into separate PRs, so you'll get "AI SDK" and "AI SDK (major)" rather than one mega-PR. ollama-ai-provider-v2 is in the AI SDK group because it also depends on @ai-sdk/provider and ai.
Validated with renovate-config-validator ("Config validated successfully"), and the diff is 12 additive lines — no reformatting of the existing rules.
One consequence worth naming: these packages lose automerge, which the non-major group grants. Given a coordinated bump here is exactly the thing that installs green and breaks at runtime, I'd argue that's the right trade, but it's easy to add an automerge-on-non-major variant if you'd rather keep it.
Approving. Note this is my own pushed work, so a second pair of eyes on the two commits would be reasonable before merge.
Merging main brings @openai/agents-extensions up to ^0.14.0, which is what makes the @ai-sdk/anthropic v4 bump on this branch safe: extensions 0.13.x hard-rejects an AI SDK model whose specificationVersion is v4, and anthropic@4 emits exactly that, so every claude-* model threw before this merge. On 0.14.3 the gate accepts v4 and all three providers resolve again. The renovate.json rules stop these families being proposed one package at a time: - AI SDK (`ai`, `@ai-sdk/**`, ollama-ai-provider-v2) all have to land on the same @ai-sdk/provider major, since that major defines the model specificationVersion. A lone provider major installs cleanly and passes CI, then throws at runtime. - @openai/agents and @openai/agents-extensions each pin an exact @openai/agents-core, so bumping one alone leaves two agents-core majors in a single tree. They split in opposite directions on two consecutive cycles. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
0b6c74c to
a1ca5e8
Compare
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
|
🎉 This PR is included in version 0.16.38 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
1 participant
This PR contains the following updates:
^3.0.41→^4.0.0Release Notes
vercel/ai (@ai-sdk/anthropic)
v4.0.36Compare Source
Patch Changes
ad6a650]81cd026]v4.0.35Compare Source
Patch Changes
1937bef]v4.0.34Compare Source
Patch Changes
e6415bd: feat(anthropic): add text batch supportv4.0.33Compare Source
Patch Changes
3469d0c]v4.0.32Compare Source
Patch Changes
8b96941: Reject spliced Anthropic generations while allowing duplicate message start events for the active message.v4.0.30Compare Source
Patch Changes
1bec07d]v4.0.29Compare Source
Patch Changes
160ccdb]v4.0.28Compare Source
Patch Changes
9337ecd: Preserve Anthropic prompt-cache matches by replaying complete code-execution transcripts in their original wire shape.79e133c]v4.0.27Compare Source
Patch Changes
5fc7da5]93b2acd]v4.0.26Compare Source
Patch Changes
dc0c28e: Return visible summarized reasoning when generic reasoning enables adaptive thinking.fa95504]v4.0.25Compare Source
Patch Changes
d8210b6: chore: centralize record type guards in provider-utilsb192878: feat: add experimental_toolCaller routing to generateText for code moded8210b6]b192878]v4.0.24Compare Source
Patch Changes
1659cd5]6a5bdff]v4.0.23Compare Source
Patch Changes
0c464d9]c49380c]v4.0.22Compare Source
Patch Changes
1e2f324]v4.0.21Compare Source
Patch Changes
e29788d: fix(anthropic): report thinking tokens as reasoning token usagev4.0.20Compare Source
Patch Changes
cbdc990: feat (provider/anthropic): support fallbacks 'default' mode, which routes safety classifier refusals to Anthropic's recommended fallback model (adds the server-side-fallback-2026-07-01 beta automatically)cbdc990: feat (provider/anthropic): support mid-conversation tool changes via the toolChanges system message provider option, emitting tool_addition/tool_removal content blocks and the mid-conversation-tool-changes-2026-07-01 betacbdc990: feat (provider/anthropic): add claude-opus-5 model id with frontier-tier capabilities (128k output tokens, structured output, adaptive thinking, xhigh effort, sampling parameter rejection, thinking-disabled only at effort high or below)v4.0.19Compare Source
Patch Changes
01a596a: fix (provider/anthropic): use current-generation capability defaults for unrecognized Claude model IDs while retaining conservative defaults for legacy Claude and non-Claude models.v4.0.18Compare Source
Patch Changes
97de198: Warn when an unknown model uses the default 4096 max output token limit.v4.0.17Compare Source
Patch Changes
b72fc7c: fix(amazon-bedrock): sanitize unsupported JSON Schema constraints in native Anthropic structured output9218ebe: fix(provider/anthropic): warn when parallel tool use is requested with JSON tool structured output02ffdcb]76cb673]v4.0.16Compare Source
Patch Changes
afcf19c: fix(provider/anthropic): preserve web search citations when replaying assistant messagescd06458]v4.0.15Compare Source
Patch Changes
31c7be8]v4.0.14Compare Source
Patch Changes
4be62c1: fix(provider-utils): validate provider-response URLs ingetFromApigetFromApinow has avalidateUrlflag. It is optional so existing callers keep compiling (omitting it behaves likefalse, i.e. no validation), but all AI SDK provider packages set it explicitly at every call site so each one makes a visible trust decision. Whentrue, the URL is routed throughfetchWithValidatedRedirects— the same guard used bydownloadBlob— which rejects private/loopback/link-local targets, re-validates every redirect hop, strips proxy/metadata/cookie request headers, and drops all caller headers except the user-agent on cross-origin redirects (custom API-key headers must not follow a redirect off-origin any more thanAuthorizationmay); blocked URLs throwDownloadError. It is enabled at the image/video/audio download and polling call sites where the URL comes from a provider response body; URLs built from developer-configured endpoints passvalidateUrl: falseand are unaffected.A new optional
credentialedOriginwithholds caller headers unless the URL is same-origin with it, so the API key is not sent to a response-supplied host on a different origin.A new optional
trustedOriginexempts URLs (and redirect hops) that are same-origin with the developer-configured provider endpoint from target validation, so self-hosted and localhost deployments whose response URLs point back at the configured host keep working; all other hops are still validated.Also closes range gaps in
validateDownloadUrl(IPv4224.0.0.0/4multicast and the TEST-NET documentation ranges192.0.2.0/24,198.51.100.0/24,203.0.113.0/24; IPv6 documentation ranges2001:db8::/32and3fff::/20), and follows only the fetch-spec redirect status codes (301/302/303/307/308) — aLocationheader on any other status is not followed. This guard performs string/literal checks only and does not resolve DNS; hostnames that resolve to private addresses and DNS rebinding remain out of scope and must be constrained at the network layer (or by injecting a Nodefetchthat pins the resolved IP at connect time) for server deployments handling untrusted URLs. Seecontributing/secure-url-handling.md.cd12954: Reject empty OpenAI, Anthropic, and Replicate base URLs with a helpful AI SDKinvalid argument error.
Updated dependencies [
4be62c1]Updated dependencies [
7805e4a]Updated dependencies [
cd12954]v4.0.12Compare Source
Patch Changes
308a519: chore: enforce consistent imports fromzod/v4instead ofzodv4.0.11Compare Source
Patch Changes
0f93c57]v4.0.10Compare Source
Patch Changes
ac306ed]v4.0.9Compare Source
Patch Changes
2e45d9c: fix(anthropic): wrap invalid tool input in objectv4.0.8Patch Changes
0aa0ff3: fix(anthropic): forwardthinking: { type: 'disabled' }to the API instead of stripping itPreviously, setting
providerOptions.anthropic.thinking = { type: 'disabled' }(or top-levelreasoning: 'none') was accepted by the schema but silently dropped from the outgoing request. For models that default thinking on (e.g. Sonnet 5), this left thinking enabled and could consume a smallmax_tokensbudget entirely. Thedisabledvalue is now sent to the Anthropic Messages API.v4.0.7Patch Changes
5c5c0f5: Add experimental streaming transcription support for transcription models, including OpenAIgpt-realtime-whisperand xAI WebSocket STT.5c5c0f5]v4.0.6Patch Changes
c6f5e62: Prevent prototype pollution when synchronously parsing provider JSON inputs and exposesecureJsonParsefrom provider-utils.679c52a: Normalize a barehttps://api.anthropic.combase URL to include/v1.c6f5e62]v4.0.5Patch Changes
8c616f0]v4.0.4Patch Changes
c18018c: feat (provider/anthropic): addclaude-sonnet-5model idv4.0.3Compare Source
Patch Changes
0274f34]v4.0.2Patch Changes
dfffb27: fix(anthropic): correctly map delta type when code execution tools are usedv4.0.1Patch Changes
6a436e3]v4.0.0Compare Source
Major Changes
832f86f: fix(anthropic): remove cacheCreationInputTokens from providerMetadata34bd95d: feat(ai): add support for uploading provider skills using the provider references abstractionef992f8: Remove CommonJS exports from all packages. All packages are now ESM-only ("type": "module"). Consumers usingrequire()must switch to ESMimportsyntax.c29a26f: feat(provider): add support for provider references and uploading files as supported per provider3887c70: feat(provider): add new top-level reasoning parameter to spec and support it ingenerateTextandstreamText8359612: Start v7 pre-release04e9009: chore: make provider implementations code patterns more consistent, including renaming certain exported symbolsFor all externally exported symbols that were renamed, the old names continue to work via deprecated aliases.
Patch Changes
e02f041: feat(provider/anthropic): add support forclaude-opus-4-8648705c: fix(provider/anthropic): fix remaining errors with Anthropiccode_executiontool dynamic calls from latestweb_fetchorweb_search38fc777: Add AI Gateway hint to provider READMEsee798eb: chore(provider-utils): renameExperimental_SandboxtoExperimental_SandboxSessione748b35: chore: update v3 specs to v419c5ee2: fix(anthropic): reorder assistant content b/w client and provider tool use0ee8aec: feat (provider/anthropic): support passing metadata.user_idc012d57: feat(anthropic): sanitize the unsupported JSON schema validation properties8018480: feat(anthropic): add the new advisor toole5c4f40: Remove staleeffort-2025-11-24beta header — the extended thinking effort parameter is GA and no longer requires the beta flag. Vertex AI's strict validator was actively rejecting requests with this header.f57c702: fix(anthropic): allow both temperature and topP for non-Anthropic models using the Anthropic-compatible APIThe temperature/topP mutual exclusivity check now only applies to known Anthropic models (model IDs starting with
claude-). Non-Anthropic models using the Anthropic-compatible API (e.g. Minimax) can now send both parameters as required by their APIs.2610e84: feat(provider/anthropic): automatically use sandbox in bash toold848405: feat: add optionalabortSignalparameters to sandbox command execution87d1723: chore(anthropic): remove unnecessary messages affix from Anthropic symbols and files9f0e36c: trigger release for all packages after provenance setupacdbf84: Handle errors from anthropic websearch toolad0b376: fix(provider/anthropic): stop addingfine-grained-tool-streaming-2025-05-14beta forclaude-opus-4-758a2ad7: fix: more precise default message for tool execution denial21d1ee3: fix(anthropic): skip passing beta header for tool search tools1fe058b: fix(anthropic): preserve the error code returned by model7fc6bd6: Raise minimum supported Node.js version to 22. Supported versions: 22, 24, and 26.09bd27b: feat (provider/anthropic): add support for inference_geo provider option0c4c275: trigger initial canary release6fd51c0: fix(provider): preserve error type prefix in getErrorMessagee311194: feat(ai): allow passing provider instance touploadFileanduploadSkillas shorthand6c93e36: feat(provider-utils): addspawnCommandmethod toExperimental_Sandboxto allow for detached command execution9bd6512: feat(provider): change file part data property to be tagged with a type and remove the image part type258c093: chore: ensure consistent import handling and avoid import duplicates or cycles5463d0d: feat(provider): align tool result output content file part types with top-level message file part typesb8396f0: trigger initial beta release6b4d325: feat(provider/anthropic): add support forclaude-fable-5and thefallbacksAPI parameterf05a40d: fix(vertex): throw warning when strict: true for vertexAnthropica6617c5: feat(provider-utils): addreadFileandwriteFileplus convenience wrappers toExperimental_Sandboxabstractiona464505: fix(anthropic): propagate toModelOutput providerOption to anthropic tool results90e2d8a: chore: fix unused vars not being flagged by our lint toolingb3976a2: Add workflow serialization support to all provider models.@ai-sdk/provider-utils: NewserializeModel()helper that extracts only serializable properties from a model instance, filtering out functions and objects containing functions. Third-party provider authors can use this to add workflow support to their own models.All providers:
headersis now optional in provider config types. This is non-breaking — existing code that passesheaderscontinues to work. Custom provider implementations that construct model configs manually can now omitheaders, which is useful when models are deserialized from a workflow step boundary where auth is provided separately.All provider model classes now include
WORKFLOW_SERIALIZEandWORKFLOW_DESERIALIZEstatic methods, enabling them to cross workflow step boundaries without serialization errors.0d8f107: feat(provider/anthropic): add support for Opus 4.7 and relevant API enhancementsff5eba1: feat: rollimage-*tool output types into their equivalentfile-*typesv3.0.110Compare Source
Patch Changes
b2a4d5a]v3.0.109Compare Source
Patch Changes
2171d15]v3.0.108Compare Source
Patch Changes
dab0a08]v3.0.107Compare Source
Patch Changes
ee2bf30]v3.0.105Compare Source
Patch Changes
0a295e3: Preserve Anthropic prompt-cache matches by replaying complete code-execution transcripts in their original wire shape.Configuration
📅 Schedule: (in timezone America/New_York)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.