build(deps): bump ai from 5.0.220 to 7.0.37

[dependabot]

Bumps ai from 5.0.220 to 7.0.37.

Release notes

Sourced from ai's releases.

ai@7.0.37

Patch Changes

• Updated dependencies [0a7c7f4]
  • @​ai-sdk/gateway@​4.0.28

ai@7.0.36

Patch Changes

• 7fa85b2: fix(ai): use injective serialization for tool approval HMAC payload

  The tool approval signature (experimental_toolApprovalSecret) built its HMAC payload by joining fields with \n. Because fields such as toolName and toolCallId can themselves contain a newline, distinct field tuples could serialize to identical bytes, allowing a signed approval to verify against a different tuple. The payload is now serialized with JSON.stringify (with a versioned domain-separation prefix), which escapes delimiter/control characters and makes the encoding injective.

  Verification remains backwards compatible: a signature in the old format still verifies, but only when no field contains the \n delimiter (the condition that made the old format ambiguous), so a pending approval that straddles an upgrade is not rejected while the collision stays closed.

ai@6.0.235

Patch Changes

• Updated dependencies [5d7b986]
  • @​ai-sdk/gateway@​3.0.157

Changelog

Sourced from ai's changelog.

7.0.37

Patch Changes

• Updated dependencies [0a7c7f4]
  • @​ai-sdk/gateway@​4.0.28

7.0.36

Patch Changes

• 7fa85b2: fix(ai): use injective serialization for tool approval HMAC payload

  The tool approval signature (experimental_toolApprovalSecret) built its HMAC payload by joining fields with \n. Because fields such as toolName and toolCallId can themselves contain a newline, distinct field tuples could serialize to identical bytes, allowing a signed approval to verify against a different tuple. The payload is now serialized with JSON.stringify (with a versioned domain-separation prefix), which escapes delimiter/control characters and makes the encoding injective.

  Verification remains backwards compatible: a signature in the old format still verifies, but only when no field contains the \n delimiter (the condition that made the old format ambiguous), so a pending approval that straddles an upgrade is not rejected while the collision stays closed.

7.0.35

Patch Changes

• 7f6650b: Return response piping promises so callers can catch stream read and write errors.
• 106ea59: feat(ai): add per-step first content timeout for streaming generations
• Updated dependencies [2112ff1]
  • @​ai-sdk/gateway@​4.0.27

7.0.34

Patch Changes

• Updated dependencies [7c16f21]
  • @​ai-sdk/gateway@​4.0.26

7.0.33

Patch Changes

• 76cb673: fix: detect MP4 audio from its ftyp box during transcription
• e808fa5: fix(ai): preserve tool parts when tool call IDs repeat across steps
• 33647d7: Preserve provider options when combining consecutive tool messages.
• Updated dependencies [02ffdcb]

... (truncated)

Commits

• 3c98985 Version Packages (#17868)
• 54d4d7a Version Packages (#17796)
• 7fa85b2 fix(ai): use injective serialization for tool approval HMAC payload (#17493)
• 799faf7 Version Packages (#17653)
• 106ea59 feat: add a per-step first-content timeout for streaming generations (#17561)
• 7f6650b fix: server-response piping errors bypass caller catches (#17648)
• 4742a2b Version Packages (#17615)
• 0319ff3 Version Packages (#17553)
• e808fa5 fix: preserve tool parts when tool call IDs repeat across steps (#17586)
• 76cb673 fix: detect M4A/MP4 audio correctly during transcription (#17378)
• Additional commits viewable in compare view