chore(deps): bump ai from 6.0.224 to 7.0.22

[dependabot]

Bumps ai from 6.0.224 to 7.0.22.

Release notes

Sourced from ai's releases.

ai@7.0.22

Patch Changes

• 8f89c25: Add the Cartesia provider with Sonic 3.5 speech generation, Ink-Whisper batch transcription, and Ink 2 realtime transcription support.

ai@7.0.21

Patch Changes

• 308a519: chore: enforce consistent imports from zod/v4 instead of zod
• Updated dependencies [308a519]
• Updated dependencies [7fe53d2]
  • @​ai-sdk/gateway@​4.0.16

ai@7.0.20

Patch Changes

• b9ac19f: Flush compressed Node.js response chunks as they are piped so UI message and text streams remain incremental in Express and Next.js.
• a4186d6: Promote the repairToolCall option to stable, with a deprecated experimental_repairToolCall alias for backwards compatibility.

Changelog

Sourced from ai's changelog.

7.0.22

Patch Changes

• 8f89c25: Add the Cartesia provider with Sonic 3.5 speech generation, Ink-Whisper batch transcription, and Ink 2 realtime transcription support.

7.0.21

Patch Changes

• 308a519: chore: enforce consistent imports from zod/v4 instead of zod
• Updated dependencies [308a519]
• Updated dependencies [7fe53d2]
  • @​ai-sdk/gateway@​4.0.16

7.0.20

Patch Changes

• b9ac19f: Flush compressed Node.js response chunks as they are piped so UI message and text streams remain incremental in Express and Next.js.
• a4186d6: Promote the repairToolCall option to stable, with a deprecated experimental_repairToolCall alias for backwards compatibility.

7.0.19

Patch Changes

• be7f05a: Add fingerprintTools and detectToolDrift to detect MCP tool-definition drift ("rug pull"). Pin a tool set's server-controlled fields (string description, input schema, title) at trust time with fingerprintTools, then diff later fetches with detectToolDrift to catch injected descriptions or widened schemas before passing tools to the model. Baseline storage and the drift response remain the app's responsibility.

• ee55a07: Preserve tool approval signatures when approvals transition to responded.

• aad737d: Use own-property checks when resolving per-tool approvals so tool names and approval ids that match inherited object properties (e.g. constructor, toString, valueOf, __proto__) are treated as unconfigured/absent.

  • @ai-sdk/policy-opa: wrapMcpTools builds its per-tool map with a null prototype and reads supplied approvals via an own-property check, and shadow guards its per-tool map lookup the same way.
  • ai: tool and tool-context lookups keyed by a model- or client-supplied name now go through an own-property check (getOwn), so a name matching an inherited object property resolves to "no such tool"/"unconfigured" instead of a prototype value. This covers the approval path (per-tool approval resolution and replay re-validation) as well as tool-call parsing, execution, streaming callbacks, and UI message conversion/validation. The human-in-the-loop approval matching (collectToolApprovals) and streaming tool-name maps are built with a null prototype so a client-supplied id that matches an inherited property no longer slips past the "unknown approval" / "tool call not found" guards.

• 0f93c57: feat (video): support video (not just image) reference inputs in inputReferences for reference-to-video generation

• Updated dependencies [e12411e]

• Updated dependencies [5d894a7]

• Updated dependencies [fdb6d5d]

• Updated dependencies [0f93c57]

• Updated dependencies [d25a084]

  • @​ai-sdk/gateway@​4.0.15
  • @​ai-sdk/provider@​4.0.3
  • @​ai-sdk/provider-utils@​5.0.7

7.0.18

Patch Changes

• Updated dependencies [ac306ed]
  • @​ai-sdk/provider-utils@​5.0.6
  • @​ai-sdk/gateway@​4.0.14

... (truncated)

Commits

• b162ae4 Version Packages (#17106)
• 8f89c25 feat(provider/cartesia): add Sonic 3.5 and Ink support (#16815)
• c2913fb Version Packages (#17092)
• 308a519 chore: enforce consistent imports from zod/v4 instead of zod (#17090)
• 58d77ca Version Packages (#17043)
• a4186d6 feat(ai): promote repairToolCall option to stable (#16886)
• b9ac19f fix(ai): flush compressed Node.js streams per chunk (#17042)
• 405116e Version Packages (#16937)
• ee55a07 fix: preserve tool approval signatures when approvals are responded (#16589)
• be7f05a feat(ai): detect MCP tool-definition drift ("rug pull") (#16902)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
petdex	Ready	Preview, Comment	Jul 13, 2026 11:49am