Unverified50% confidenceSolutionExact time
When provider-utils is upgraded but the package.json of @ai-sdk/voyage still specifies a looser range (such as ^4.0.60) and the lockfile is not refreshed, the version actually installed may be an old provider-utils, causing a version mismatch problem.
1
Sources
50%
Confidence
Long-term
Relevance
10/16/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedIf a developer pins @ai-sdk/topaz@2.0.4, they indirectly get the behavior of provider-utils@4.0.61; patch-level updates usually do not change the public interface, but may fix streaming processing, type definitions or compatibility issues in edge cases.75% similarUnverified版本锁定文件（package-lock.json或yarn.lock）无法完全阻断供应链攻击，因为新建项目首次安装仍会拉取被污染版本，且自动化更新工具可能升级至恶意版本73% similarUnverified对于使用 @ai-sdk/typesafe-ai 的项目，3.0.18 属于低风险升级；建议留意 lock 文件中 provider 相关包版本是否被一并提升，避免多版本共存导致的类型不匹配72% similarVerifiedIt is recommended to upgrade related @ai-sdk/* packages as a group, since provider-utils has been synchronized to 5.0.49.71% similarUnverifiedEven if the version declaration of @ai-sdk/xai allows upward compatibility, as long as the lock file is not updated, the actually installed @ai-sdk/provider-utils may still be an old version; only running commands such as npm update will truly rewrite the lock file and pull the new version.71% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1048302API
curl https://kongchang.com/api/v1/knowledge/claims/1048302MCP
get_claim(id=1048302)