chore(deps): bump ai from 6.0.205 to 7.0.37

[dependabot]

Bumps ai from 6.0.205 to 7.0.37.

Release notes

Sourced from ai's releases.

ai@7.0.37

Patch Changes

• Updated dependencies [0a7c7f4]
  • @​ai-sdk/gateway@​4.0.28

ai@7.0.36

Patch Changes

• 7fa85b2: fix(ai): use injective serialization for tool approval HMAC payload

  The tool approval signature (experimental_toolApprovalSecret) built its HMAC payload by joining fields with \n. Because fields such as toolName and toolCallId can themselves contain a newline, distinct field tuples could serialize to identical bytes, allowing a signed approval to verify against a different tuple. The payload is now serialized with JSON.stringify (with a versioned domain-separation prefix), which escapes delimiter/control characters and makes the encoding injective.

  Verification remains backwards compatible: a signature in the old format still verifies, but only when no field contains the \n delimiter (the condition that made the old format ambiguous), so a pending approval that straddles an upgrade is not rejected while the collision stays closed.

ai@6.0.235

Patch Changes

• Updated dependencies [5d7b986]
  • @​ai-sdk/gateway@​3.0.157

Changelog

Sourced from ai's changelog.

7.0.37

Patch Changes

• Updated dependencies [0a7c7f4]
  • @​ai-sdk/gateway@​4.0.28

7.0.36

Patch Changes

• 7fa85b2: fix(ai): use injective serialization for tool approval HMAC payload

  The tool approval signature (experimental_toolApprovalSecret) built its HMAC payload by joining fields with \n. Because fields such as toolName and toolCallId can themselves contain a newline, distinct field tuples could serialize to identical bytes, allowing a signed approval to verify against a different tuple. The payload is now serialized with JSON.stringify (with a versioned domain-separation prefix), which escapes delimiter/control characters and makes the encoding injective.

  Verification remains backwards compatible: a signature in the old format still verifies, but only when no field contains the \n delimiter (the condition that made the old format ambiguous), so a pending approval that straddles an upgrade is not rejected while the collision stays closed.

7.0.35

Patch Changes

• 7f6650b: Return response piping promises so callers can catch stream read and write errors.
• 106ea59: feat(ai): add per-step first content timeout for streaming generations
• Updated dependencies [2112ff1]
  • @​ai-sdk/gateway@​4.0.27

7.0.34

Patch Changes

• Updated dependencies [7c16f21]
  • @​ai-sdk/gateway@​4.0.26

7.0.33

Patch Changes

• 76cb673: fix: detect MP4 audio from its ftyp box during transcription
• e808fa5: fix(ai): preserve tool parts when tool call IDs repeat across steps
• 33647d7: Preserve provider options when combining consecutive tool messages.
• Updated dependencies [02ffdcb]

... (truncated)

Commits

• 3c98985 Version Packages (#17868)
• 54d4d7a Version Packages (#17796)
• 7fa85b2 fix(ai): use injective serialization for tool approval HMAC payload (#17493)
• 799faf7 Version Packages (#17653)
• 106ea59 feat: add a per-step first-content timeout for streaming generations (#17561)
• 7f6650b fix: server-response piping errors bypass caller catches (#17648)
• 4742a2b Version Packages (#17615)
• 0319ff3 Version Packages (#17553)
• e808fa5 fix: preserve tool parts when tool call IDs repeat across steps (#17586)
• 76cb673 fix: detect M4A/MP4 audio correctly during transcription (#17378)
• Additional commits viewable in compare view

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
cheatcode	Error		Jul 22, 2026 12:58pm

[iamjr15]

Closing this scheduled version-update PR as part of the Dependabot policy cleanup. Security updates remain enabled; future minor and patch version updates will be grouped monthly, and major upgrades will be planned explicitly.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.