Bump ai from 7.0.35 to 7.0.37 in /node/vercel-ai

[dependabot]

Bumps ai from 7.0.35 to 7.0.37.

Release notes

Sourced from ai's releases.

ai@7.0.37

Patch Changes

• Updated dependencies [0a7c7f4]
  • @​ai-sdk/gateway@​4.0.28

ai@7.0.36

Patch Changes

• 7fa85b2: fix(ai): use injective serialization for tool approval HMAC payload

  The tool approval signature (experimental_toolApprovalSecret) built its HMAC payload by joining fields with \n. Because fields such as toolName and toolCallId can themselves contain a newline, distinct field tuples could serialize to identical bytes, allowing a signed approval to verify against a different tuple. The payload is now serialized with JSON.stringify (with a versioned domain-separation prefix), which escapes delimiter/control characters and makes the encoding injective.

  Verification remains backwards compatible: a signature in the old format still verifies, but only when no field contains the \n delimiter (the condition that made the old format ambiguous), so a pending approval that straddles an upgrade is not rejected while the collision stays closed.

Changelog

Sourced from ai's changelog.

7.0.37

Patch Changes

• Updated dependencies [0a7c7f4]
  • @​ai-sdk/gateway@​4.0.28

7.0.36

Patch Changes

• 7fa85b2: fix(ai): use injective serialization for tool approval HMAC payload

  The tool approval signature (experimental_toolApprovalSecret) built its HMAC payload by joining fields with \n. Because fields such as toolName and toolCallId can themselves contain a newline, distinct field tuples could serialize to identical bytes, allowing a signed approval to verify against a different tuple. The payload is now serialized with JSON.stringify (with a versioned domain-separation prefix), which escapes delimiter/control characters and makes the encoding injective.

  Verification remains backwards compatible: a signature in the old format still verifies, but only when no field contains the \n delimiter (the condition that made the old format ambiguous), so a pending approval that straddles an upgrade is not rejected while the collision stays closed.

Commits

• 3c98985 Version Packages (#17868)
• 54d4d7a Version Packages (#17796)
• 7fa85b2 fix(ai): use injective serialization for tool approval HMAC payload (#17493)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: node. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Chisanan232]

CI passes. Routine ai patch bump.