fix(deps): update dependency @mastra/core to ~0.18.0 - autoclosed

[renovate]

Coming soon: The Renovate bot (GitHub App) will be renamed to Mend. PRs from Renovate will soon appear from 'Mend'. Learn more here.

This PR contains the following updates:

Package	Change	Age	Confidence
@mastra/core (source)	~0.15.2 -> ~0.18.0

---

Release Notes

mastra-ai/mastra (@​mastra/core)

v0.18.0

Compare Source

Minor Changes

• Allow agent instructions to accept SystemMessage types (#​7987)

  Agents can now use rich instruction formats beyond simple strings:

  • CoreSystemMessage and SystemModelMessage objects with provider-specific options
  • Arrays of strings or system messages
  • Dynamic instructions returning any SystemMessage type

Patch Changes

• Agent type fixes (#​8072)

• Fixes for getStepResult in workflow steps (#​8065)

• fix: result object type inference when using structuredOutput and unify output/structuredOutput types with single OUTPUT generic (#​7969)

• feat: implement trace scoring with batch processing capabilities (#​8033)

• Fix selection of agent method based on model version (#​8001)

• show the tool-output stream in the playground for streamVNext (#​7983)

• Add scorer type, for automatic type inferrence when creating scorers for agents (#​8032)

• Get rid off swr one for all (#​7931)

• Fix PostgreSQL vector index recreation issue and add optional index configuration (#​8020)

  • Fixed critical bug where memory vector indexes were unnecessarily recreated on every operation
  • Added support for configuring vector index types (HNSW, IVFFlat, flat) and parameters

• Fix navigating between scores and entity types (#​8129)

• Delayed streamVNext breaking change notice by 1 week (#​8121)

• Tool hitl (#​8084)

• Updated dependencies [b61b8e0]:

  • @​mastra/schema-compat@​0.11.4

v0.17.1

Compare Source

Patch Changes

• Refactor agent.#execute fn workflow to make code easier to follow. (#​7964)

• fix workflow resuming issue in the playground (#​7988)

• feat: Add system option support to VNext methods (#​7925)

v0.17.0

Compare Source

Minor Changes

• Remove original AgentNetwork (#​7919)

• Fully deprecated createRun (now throws an error) in favour of createRunAsync (#​7897)

• Improved workspace dependency resolution during development and builds. This makes the build process more reliable when working with monorepos and workspace packages, reducing potential bundling errors and improving development experience. (#​7619)

Patch Changes

• dependencies updates: (#​7861)

  • Updated dependency hono@^4.9.7 ↗︎ (from ^4.9.6, in dependencies)

• Updated SensitiveDataFilter to be less greedy in its redacting (#​7840)

• clean up console logs in monorepo (#​7926)

• Update dependencies ai-v5 and @​ai-sdk/provider-utils-v5 to latest (#​7884)

• Added the ability to hide internal ai tracing spans (enabled by default) (#​7764)

• "refactored ai tracing to commonize types" (#​7744)

• Register server cache in Mastra (#​7946)

• feat: add requiresAuth option for custom API routes (#​7703)

  Added a new requiresAuth option to the ApiRoute type that allows users to explicitly control authentication requirements for custom endpoints.

  • By default, all custom routes require authentication (requiresAuth: true)
  • Set requiresAuth: false to make a route publicly accessible without authentication
  • The auth middleware now checks this configuration before applying authentication

  Example usage:

  const customRoutes: ApiRoute[] = [
    {
      path: '/api/public-endpoint',
      method: 'GET',
      requiresAuth: false, // No authentication required
      handler: async c => c.json({ message: 'Public access' }),
    },
    {
      path: '/api/protected-endpoint',
      method: 'GET',
      requiresAuth: true, // Authentication required (default)
      handler: async c => c.json({ message: 'Protected access' }),
    },
  ];

  This addresses issue #​7674 where custom endpoints were not being protected by the authentication system.

• Resumable streams (#​7949)

• Only log stream/generate deprecation warning once (#​7905)

• Add support for running the Mastra dev server over HTTPS for local development. (#​7871)

  • Add --https flag for mastra dev. This automatically creates a local key and certificate for you.

  • Alternatively, you can provide your own key and cert through server.https:

    // src/mastra/index.ts
    import { Mastra } from '@​mastra/core/mastra';
    import fs from 'node:fs';
    
    export const mastra = new Mastra({
      server: {
        https: {
          key: fs.readFileSync('path/to/key.pem'),
          cert: fs.readFileSync('path/to/cert.pem'),
        },
      },
    });

• refactored handling of internal ai spans to be more intelligent (#​7876)

• Improve error message when using V1 model with streamVNext (#​7948)

• prevent out-of-order span errors in ai-tracing DefaultExporter (#​7895)

• move ToolExecutionOptions and ToolCallOptions to a union type (ToolInvocationOptions) for use in createTool, Tool, and ToolAction (#​7914)

• avoid refetching on error when resolving a workflow in cloud (#​7842)

• fix scorers table link full row (#​7915)

• fix(core): handle JSON code blocks in structured output streaming (#​7864)

• Postgresql Storage Query Index Performance: Adds index operations and automatic indexing for Postgresql (#​7757)

• adjust the way we display scorers in agent metadata (#​7910)

• fix: support destructuring of streamVNext return values (#​7920)

• Fix VNext generate/stream usage tokens. They used to be undefined, now we are receiving the proper values. (#​7901)

• Add model fallbacks (#​7126)

• Add resource id to workflow run snapshots (#​7740)

• Fixes assistant message ids when using toUIMessageStream, preserves the original messageId rather than creating a new id for this message. (#​7783)

• Fixes multiple issues with stopWhen and step results. (#​7862)

• fix error message when fetching observability things (#​7956)

• Network stream class when calling agent.network() (#​7763)

• fix workflows runs fetching and displaying (#​7852)

• fix empty state for scorers on agent page (#​7846)

• Remove extraneous console.log (#​7916)

• Deprecate "output" in generate and stream VNext in favour of structuredOutput. When structuredOutput is used in tandem with maxSteps = 1, the structuredOutput processor won't run, it'll generate the output using the main agent, similar to how "output" used to work. (#​7750)

• Fix switch in prompt-injection (#​7951)

v0.16.3

Compare Source

Patch Changes

• dependencies updates: (#​7545)

  • Updated dependency hono@^4.9.6 ↗︎ (from ^4.8.12, in dependencies)

• Delayed deprecation notice for streamVNext() replacing stream() until Sept 23rd (#​7739)

• Fix onFinish callback in VNext functions to properly resolve the result (#​7733)

• support JSONSchema7 output option with generateVNext, streamVNext (#​7630)

• various improvements to input & output data on ai spans (#​7636)

• cleanup (#​7736)

• add network method (#​7704)

• Fix memory not being affected by agent output processors (#​7087). Output processors now correctly modify messages before they are saved to memory storage. The fix ensures that any transformations applied by output processors (like redacting sensitive information) are properly propagated to the memory system. (#​7647)

• Fix agent structuredOutput option types (#​7668)

• "added output to agent spans in ai-tracing" (#​7717)

• Ensure system messages are persisted in processedList (#​7715)

• AN Merge pt 1 (#​7702)

• Custom metadata for traces can now be set when starting agents or workflows (#​7689)

• Workflow & Agent executions now return traceId. (#​7663)

• fixed bugs in observability config parsing (#​7669)

• fix playground UI issue about dynmic workflow exec in agent thread (#​7665)

• Updated dependencies [779d469]:

  • @​mastra/schema-compat@​0.11.3

v0.16.2

Compare Source

Patch Changes

• Export server types (#​7657)

v0.16.1

Compare Source

Patch Changes

• Fixed ai tracing for workflows nested directly in agents (#​7599)

• Fixed provider defined tools for stream/generate vnext (#​7642)

• Made tracing context optional on tool execute() (#​7532)

• Fixed ai tracing context propagation in tool calls (#​7531)

• Call getMemoryMessages even during first turn in a thread when semantic recall scope is resource (#​7529)

• add usage and total usage to streamVNext onFinish callback (#​7598)

• Add prepareStep to generate/stream VNext options. (#​7646)

• Change to createRunAsync (#​7632)

• Fix type in worfklow (#​7519)

• Execute tool calls in parallel in generate/stream VNext methods (#​7524)

• Allow streamVNext and generateVNext to use structuredOutputs from the MastraClient (#​7597)

• Use workflow streamVNext in playground (#​7575)

• Revert "feat(mcp): add createMCPTool helper for proper execute types" (#​7513)

• Fix InvalidDataContentError when using image messages with AI SDK (#​7542)

  Resolves an issue where passing image content in messages would throw an InvalidDataContentError. The fix properly handles multi-part content arrays containing both text and image parts when converting between Mastra and AI SDK message formats.

• Flatten loop config in stream options and pass to loop options (#​7643)

• Pass mastra instance into MCP Server tools (#​7520)

• Fix image input handling for Google Gemini models in AI SDK V5 (#​7490)

  Resolves issue #​7362 where Gemini threw AI_InvalidDataContentError when receiving URLs in image parts. The fix properly handles V3 message file parts that contain both URL and data fields, ensuring URLs are passed as URLs rather than being incorrectly treated as base64 data.

• Vnext output schema injection (#​6990)

• removed duplicate 'float' switch case (#​7516)

• Fix issue with response message id consistency between stream/generate response and the message ids saveed in the DB. Also fixed the custom generatorId implementation to work with this. (#​7606)

v0.16.0

Compare Source

Minor Changes

• a01cf14: Add workflow graph in agent (workflow as tool in agent)

Patch Changes

• 8fbf79e: Fix this to be not set when workflow is a step

• fd83526: Stream agent events with workflow .streamVNext()

• d0b90ab: Fix output processors to run before saving messages to memory

• 6f5eb7a: Throw if an empty or whitespace-only threadId is passed when getting messages

• a9e50ee: Allow both workflow stream message formats for now

• 5397eb4: Add public URL support when adding files in Multi Modal

• c9f4e4a: Pass tracing context to scorer run

• 0acbc80: Add InferUITools and related type helpers for AI SDK compatibility

  Adds new type utility functions to help with type inference when using Mastra tools with the AI SDK's UI components:

  • InferUITools - Infers input/output types for a collection of tools
  • InferUITool - Infers input/output types for a single tool

  These type helpers allow developers to easily integrate Mastra tools with AI SDK UI components like useChat by providing proper type inference for tool inputs and outputs.

v0.15.3

Compare Source

Patch Changes

• ab48c97: dependencies updates:
  • Updated dependency zod-to-json-schema@^3.24.6 ↗︎ (from ^3.24.5, in dependencies)
• 85ef90b: Return nested workflow steps information in getWorkflowRunExecutionResult
• aedbbfa: Fixed wrapping of models with AI Tracing when used with structured output.
• ff89505: Add deprecation warnings and add legacy routes
• 637f323: Fix issue with some compilers and calling zod v4's toJSONSchema function
• de3cbc6: Update the package.json file to include additional fields like repository, homepage or files.
• c19bcf7: stopped recording event spans for llm_chunks in ai-observability
• 4474d04: fix: do not pass tracing context to score run
• 183dc95: Added a fix to prevent filtering out injected initial default user messages. Related to issue 7231
• a1111e2: Fixes #​7254 where the onFinish callback wasn't returning assistant messages when using format: 'aisdk' in streamVNext. The messageList was being updated with response messages but these weren't being passed to the user's onFinish callback.
• b42a961: New createMCPTool helper for correct types for MCP Server tools
• 61debef: Fix - add missing tool options to createTool
• 9beaeff: Create new @mastra/ai-sdk package to better support useChat()
• 29de0e1: MastraEmbeddingModel and ts hack
• f643c65: Support file download
• 00c74e7: Added a DefaultExporter for AI Tracing.
• fef7375: Fix tool validation when schema uses context or inputData reserved keys
• e3d8fea: Support Inngest flow control features for Mastra Inngest workflows
• 45e4d39: Try fixing the Attempted import error: 'z'.'toJSONSchema' is not exported from 'zod' error by tricking the compiler
• 9eee594: Fix passing providerOptions through in streamVNext, enabling reasoning-delta chunks to be receiving.
• 7149d8d: Add tripwire chunk to streamVNext full stream
• 822c2e8: Fix custom output (tool-output) in ai-sdk stream output
• 979912c: "Updated langfuse exporter to handle Event spans"
• 7dcf4c0: Ensure original stacktrace is preserved during workflow runs
• 4106a58: Fix image handling for Google Gemini and other providers when using streamVNext (fixes #​7362)
• ad78bfc: "pipes tracingContext through all ai items: agents, workflows, tools, processors, scorers, etc.."
• 0302f50: Some LLM providers (openrouter for ex) add response-metadata chunks after each text-delta, this was resulting in us flushing text deltas into parts after each delta, so our output messages (with streamVNext) would have a separate text part for each text delta, instead of one text part for the combined deltas
• 6ac697e: improveEmbeddingModelStuff
• 74db265: Adds handling for event-type spans to the default ai observability exporter
• 0ce418a: upgrade ai v5 versions to latest for core and memory
• af90672: Add maxSteps
• 8387952: Register scorers on mastra instance to override per agent generate call
• 7f3b8da: Automatically pipe writer to workflows as a tool.
  Also changed start, finish, step-output events to be workflow-start, workflow-finish and workflow-step-output
• 905352b: Support AISDK models for runExperiment
• 599d04c: follow up fix for scorers
• 56041d0: Don't set supportsStructuredOutputs for every v2 model
• 3412597: Pass provider options
• 5eca5d2: Fixed wrapped mastra class inside workflow steps.
• f2cda47: Fixed issue where multiple split messages were created with identical content
  instead of properly distributing different parts of the original message.
• 5de1555: Fixed tracingContext on tool executions in AI tracing
• cfd377a: fix default stream options onFinish being overridden
• 1ed5a3e: Support workflows for run experiments
• Updated dependencies [ab48c97]
• Updated dependencies [637f323]
• Updated dependencies [de3cbc6]
• Updated dependencies [45e4d39]
  • @​mastra/schema-compat@​0.11.2

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.