@ai-sdk/provider-utils - npm Package Compare versions

Comparing version 4.0.42 to 4.0.43

CHANGELOG.md

 # @ai-sdk/provider-utils
 
+## 4.0.43
+
+### Patch Changes
+
+- dab0a08: fix(provider-utils): drop Function-constructor dynamic import shim rejected by Next.js Edge Runtime builds
+
 ## 4.0.42
@@ -4,0 +10,0 @@

package.json

 {
   "name": "@ai-sdk/provider-utils",
-  "version": "4.0.42",
+  "version": "4.0.43",
   "license": "Apache-2.0",
@@ -5,0 +5,0 @@ "sideEffects": false,

src/safe-node-fetch.ts

@@ -143,4 +143,4 @@ import type * as nodeDnsModule from 'node:dns';
 async function createSafeNodeFetch(): Promise<FetchFunction> {
-  // Node 20.16+ exposes getBuiltinModule; older supported Node versions use an
-  // indirect dynamic import that is hidden from browser bundle parsers.
+  // Load Node-only modules indirectly so browser bundlers do not pull undici
+  // and Node built-ins into the browser-facing provider-utils entry point.
   const [{ createRequire }, { lookup }] = await Promise.all([
@@ -178,19 +178,12 @@ loadNodeModule<NodeModule>('node:module'),
 
-  return builtinModule == null
-    ? ((await importNodeModule(id)) as T)
-    : (builtinModule as T);
-}
+  if (builtinModule == null) {
+    // There is no bundle-safe way to load Node built-ins without
+    // process.getBuiltinModule (Node <20.16): Metro rejects non-static
+    // import() expressions while parsing, and Next.js Edge Runtime rejects
+    // the Function-constructor shim during static analysis. Throw rather
+    // than ship either, matching the v7 implementation. See #18545, #18559.
+    throw new Error(`Node.js built-in module ${id} is unavailable`);
+  }
 
-let dynamicImport: ((specifier: string) => Promise<unknown>) | undefined;
-
-function importNodeModule(id: string): Promise<unknown> {
-  // Metro rejects non-static dynamic imports while parsing, even though this
-  // Node-only fallback is never executed in React Native. Construct the import
-  // function lazily so the distributed module contains no import expression for
-  // Metro to analyze and runtimes with process.getBuiltinModule avoid it.
-  dynamicImport ??= Function('specifier', 'return import(specifier)') as (
-    specifier: string,
-  ) => Promise<unknown>;
-
-  return dynamicImport(id);
+  return builtinModule as T;
 }
@@ -197,0 +190,0 @@

Fixed alerts

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Improved metrics

Number of medium supply chain risk alerts

85

-3.41%

Worsened metrics

Total package byte prevSize

988292

-0.09%

Lines of code

13444

-0.07%

No dependency changes