vercel/ai @ai-sdk/react@4.0.0

on GitHub

Major Changes

• ef992f8: Remove CommonJS exports from all packages. All packages are now ESM-only ("type": "module"). Consumers using require() must switch to ESM import syntax.
• 8359612: Start v7 pre-release

Patch Changes

• b567a6c: dependency updates

• 9f0e36c: trigger release for all packages after provenance setup

• 555c5de: fix(react): deny MCP App tool calls by default when allowedTools is omitted

  experimental_MCPAppRenderer's bridge only enforced the allowedTools allowlist when it was non-null, so omitting allowedTools skipped the check and forwarded every tools/call from the (untrusted) MCP App iframe to the host's callTool. A malicious or compromised MCP server could therefore invoke any tool the host wired up.

  Tool invocation from MCP App content is now deny-by-default: if allowedTools is not explicitly provided, all tools/call requests are rejected. To expose tools to an app, list them in handlers.allowedTools.

• 7fc6bd6: Raise minimum supported Node.js version to 22. Supported versions: 22, 24, and 26.

• 0c4c275: trigger initial canary release

• 611f621: feat(mcp): feat(mcp): add support for MCP Apps

• ce769dd: feat(provider): add experimental Realtime API support for voice conversations

  Adds first-class support for realtime (speech-to-speech) APIs:

  • Experimental_RealtimeModelV4 spec in @ai-sdk/provider with normalized event types and factory
  • OpenAI, Google, and xAI realtime provider implementations
  • openai.experimental_realtime() / google.experimental_realtime() / xai.experimental_realtime() work in both server and browser
  • .getToken() static method on each provider for server-side ephemeral token creation
  • experimental_getRealtimeToolDefinitions helper for provider session tool definitions
  • experimental_useRealtime hook in @ai-sdk/react returning UIMessage[] (aligned with useChat), with onToolCall and addToolOutput for client-driven tool execution
  • inputAudioTranscription session config for showing transcribed user audio messages when supported by the provider

• 258c093: chore: ensure consistent import handling and avoid import duplicates or cycles

• 03c9784: fix(react): fix toolMetadata mismatch

• b8396f0: trigger initial beta release

• 90e2d8a: chore: fix unused vars not being flagged by our lint tooling