FrameworksOfficial

AI SDK 7.0.172 makes remote file downloads explicit, tightening the SSRF boundary around structured generation

Vercel released AI SDK 7.0.172 on November 13. experimental_extract and experimental_decide no longer silently download remote file URLs through global fetch. Remote URLs now require an explicit experimental_download hook, while inline bytes, base64, and data URLs continue to work directly.

Event 2026-11-13Source published 2026-11-13Indexed 2026-11-13Verified 2026-11-13

Why it matters

Generative interfaces often pass uploads, tool results, and multimodal attachments into structured extraction or decision flows. Implicit downloads turn a file field into server-side network access. An explicit hook lets the host decide whether networking is allowed and apply DNS and address validation, limits, and audit controls.

A closer look

The official fix notes that prior literal-IP validation could not stop hostnames that resolve to private addresses. Applications must now inject a downloader for remote URLs and can use createDownload({fetch}) with a DNS-protected transport. A model's fetch setting does not cover core state downloads. Without a custom fetch, createDownload uses global fetch and provides no DNS protection.

Who this is for

Frontend, platform, and security teams using AI SDK 7 structured extraction, decision flows, multimodal attachments, or server-side generative UI.

Original sources

Revisions & corrections (1)

2026-11-13 — Verified official release and fix commit; distinct new event after the previous successful collection.

Related events

Frameworks2026-11-13

AG-UI LangGraph 0.0.46 reads native interrupt schemas, unwraps serialized tool results, and declares protocol version at run start

AG-UI released @ag-ui/langgraph 0.0.46 on November 13. The adapter reads Interrupt.response_schema on LangGraph 1.2.12 and later while retaining value-level fallbacks. It also unwraps outputs from serialized LangChain ToolMessage kwargs, skips tool-end events without a call ID, and declares protocolVersion on RUN_STARTED.

AG-UI official immutable November 13 releaseOfficial

Frameworks2026-11-13

AI SDK 7.0.173 freezes approved tool arguments and adds workflow approval policy plus layered timeouts

Vercel released AI SDK 7.0.173 on November 13. It prevents schema validation or input refinement from mutating approved tool arguments in place during approval replay. WorkflowAgent also gains toolApproval that can override a tool's needsApproval setting, plus total, step, first-chunk, and inter-chunk timeouts.

Vercel AI SDK official immutable releaseOfficial

Frameworks2026-11-13

assistant-ui's November 13 releases extend durable AG-UI across history ownership, concurrent threads, and cross-worker cancellation

assistant-ui released @assistant-ui/react-ag-ui 0.1.10 and Python assistant-stream 0.0.38 on November 13. Frontend fixes cover persistence of snapshot-selected answers, joined-step ordering, unique tool-call ownership, and streamless resume. The server adds compare-and-set thread claims, per-run context, SSE keepalive, and cross-worker cancellation.

assistant-ui immutable react-ag-ui and Python assistant-stream releasesOfficial