chore(deps): bump ai from 6.0.235 to 7.0.37

[dependabot]

Bumps ai from 6.0.235 to 7.0.37.

Release notes

Sourced from ai's releases.

ai@7.0.37

Patch Changes

• Updated dependencies [0a7c7f4]
  • @​ai-sdk/gateway@​4.0.28

ai@7.0.36

Patch Changes

• 7fa85b2: fix(ai): use injective serialization for tool approval HMAC payload

  The tool approval signature (experimental_toolApprovalSecret) built its HMAC payload by joining fields with \n. Because fields such as toolName and toolCallId can themselves contain a newline, distinct field tuples could serialize to identical bytes, allowing a signed approval to verify against a different tuple. The payload is now serialized with JSON.stringify (with a versioned domain-separation prefix), which escapes delimiter/control characters and makes the encoding injective.

  Verification remains backwards compatible: a signature in the old format still verifies, but only when no field contains the \n delimiter (the condition that made the old format ambiguous), so a pending approval that straddles an upgrade is not rejected while the collision stays closed.

Changelog

Sourced from ai's changelog.

7.0.37

Patch Changes

• Updated dependencies [0a7c7f4]
  • @​ai-sdk/gateway@​4.0.28

7.0.36

Patch Changes

• 7fa85b2: fix(ai): use injective serialization for tool approval HMAC payload

  The tool approval signature (experimental_toolApprovalSecret) built its HMAC payload by joining fields with \n. Because fields such as toolName and toolCallId can themselves contain a newline, distinct field tuples could serialize to identical bytes, allowing a signed approval to verify against a different tuple. The payload is now serialized with JSON.stringify (with a versioned domain-separation prefix), which escapes delimiter/control characters and makes the encoding injective.

  Verification remains backwards compatible: a signature in the old format still verifies, but only when no field contains the \n delimiter (the condition that made the old format ambiguous), so a pending approval that straddles an upgrade is not rejected while the collision stays closed.

7.0.35

Patch Changes

• 7f6650b: Return response piping promises so callers can catch stream read and write errors.
• 106ea59: feat(ai): add per-step first content timeout for streaming generations
• Updated dependencies [2112ff1]
  • @​ai-sdk/gateway@​4.0.27

7.0.34

Patch Changes

• Updated dependencies [7c16f21]
  • @​ai-sdk/gateway@​4.0.26

7.0.33

Patch Changes

• 76cb673: fix: detect MP4 audio from its ftyp box during transcription
• e808fa5: fix(ai): preserve tool parts when tool call IDs repeat across steps
• 33647d7: Preserve provider options when combining consecutive tool messages.
• Updated dependencies [02ffdcb]

... (truncated)

Commits

• 3c98985 Version Packages (#17868)
• 54d4d7a Version Packages (#17796)
• 7fa85b2 fix(ai): use injective serialization for tool approval HMAC payload (#17493)
• 799faf7 Version Packages (#17653)
• 106ea59 feat: add a per-step first-content timeout for streaming generations (#17561)
• 7f6650b fix: server-response piping errors bypass caller catches (#17648)
• 4742a2b Version Packages (#17615)
• 0319ff3 Version Packages (#17553)
• e808fa5 fix: preserve tool parts when tool call IDs repeat across steps (#17586)
• 76cb673 fix: detect M4A/MP4 audio correctly during transcription (#17378)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Assignees

The following users could not be added as assignees: dome2-team. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
dome	Error		Jul 27, 2026 9:07am