TL;DR

A critical security fix prevents API keys from being exposed to unintended origins when following provider-supplied URLs. Several providers were updated to include this fix.

Breaking

• Credential Security: Provider clients now restrict sending API credentials to same-origin URLs only, preventing potential key exposure when following redirects from provider responses. (This impacts providers like Replicate, Fireworks, Gladia, Fal, and Google.)

New

• Azure Deepseek Support: The @ai-sdk/azure package now supports the Deepseek model.
• Anthropic Claude-3 Fable: The @ai-sdk/anthropic package now supports the claude-fable-5 model and the fallbacks API parameter.

Fixes Worth Knowing

• Fixed an issue where API keys could be unintentionally sent to external origins when following URLs provided in provider responses. This impacts several providers.
• Gateway now correctly maps forbidden errors to GatewayForbiddenError.

Before You Upgrade

Review your provider configurations to ensure all response URLs are appropriately secured and only accessed from your intended origin.