Security: Moderate severity vulnerabilities in AI SDK dependencies

[memaxo]

Running npm audit reveals moderate severity vulnerabilities in the AI SDK dependencies of @mastra/[email protected] and current stable version

1. nanoid < 3.3.8 vulnerability in:
   • @ai-sdk/provider-utils
   • @ai-sdk/anthropic
   • @ai-sdk/openai
   • anthropic-vertex-ai

The vulnerability allows predictable results in nanoid generation when given non-integer values (GHSA-mwcw-c2x4-8c55).

• Manually updating AI SDK dependencies to latest versions doesn't fully resolve the issue
• The vulnerability persists due to nested dependencies

Recommendation:

1. Update the AI SDK dependencies to use newer versions of nanoid
2. Consider making AI SDK dependencies optional for users who don't need AI features
3. Or provide a way to use Mastra core features without the AI dependencies

{
"@mastra/core": "^0.1.27-alpha.67",
"@ai-sdk/anthropic": "^1.1.2",
"@ai-sdk/openai": "^1.1.2",
"@ai-sdk/provider-utils": "^2.1.2",
"anthropic-vertex-ai": "^1.0.2"
}

Steps to Reproduce:

1. Install @mastra/[email protected] or latest stable 0.1.26
2. Run npm audit