chore(deps): bump ai from 5.0.219 to 7.0.36

[dependabot]

Bumps ai from 5.0.219 to 7.0.36.

Release notes

Sourced from ai's releases.

ai@7.0.36

Patch Changes

• 7fa85b2: fix(ai): use injective serialization for tool approval HMAC payload

  The tool approval signature (experimental_toolApprovalSecret) built its HMAC payload by joining fields with \n. Because fields such as toolName and toolCallId can themselves contain a newline, distinct field tuples could serialize to identical bytes, allowing a signed approval to verify against a different tuple. The payload is now serialized with JSON.stringify (with a versioned domain-separation prefix), which escapes delimiter/control characters and makes the encoding injective.

  Verification remains backwards compatible: a signature in the old format still verifies, but only when no field contains the \n delimiter (the condition that made the old format ambiguous), so a pending approval that straddles an upgrade is not rejected while the collision stays closed.

ai@7.0.35

Patch Changes

• 7f6650b: Return response piping promises so callers can catch stream read and write errors.
• 106ea59: feat(ai): add per-step first content timeout for streaming generations
• Updated dependencies [2112ff1]
  • @​ai-sdk/gateway@​4.0.27

ai@7.0.34

Patch Changes

• Updated dependencies [7c16f21]
  • @​ai-sdk/gateway@​4.0.26

ai@7.0.33

Patch Changes

• 76cb673: fix: detect MP4 audio from its ftyp box during transcription
• e808fa5: fix(ai): preserve tool parts when tool call IDs repeat across steps
• 33647d7: Preserve provider options when combining consecutive tool messages.
• Updated dependencies [02ffdcb]
• Updated dependencies [76cb673]
  • @​ai-sdk/provider-utils@​5.0.12
  • @​ai-sdk/gateway@​4.0.25

ai@6.0.234

Patch Changes

• 1efdef8: fix(ai): bound media-type sniffing decode for ID3-prefixed input

  Media-type detection stripped ID3 tags before the ~18-byte prefix cap, decoding the entire base64 attachment (plus a full-size copy) whenever the data began with ID3/SUQz. This turned the intended O(1) sniff into an O(N) decode of the whole attachment. Detection now decodes at most a bounded prefix and skips the ID3 tag within that bound, keeping cost O(1) in input size on all paths (image, audio, and combined).

... (truncated)

Changelog

Sourced from ai's changelog.

7.0.36

Patch Changes

• 7fa85b2: fix(ai): use injective serialization for tool approval HMAC payload

  The tool approval signature (experimental_toolApprovalSecret) built its HMAC payload by joining fields with \n. Because fields such as toolName and toolCallId can themselves contain a newline, distinct field tuples could serialize to identical bytes, allowing a signed approval to verify against a different tuple. The payload is now serialized with JSON.stringify (with a versioned domain-separation prefix), which escapes delimiter/control characters and makes the encoding injective.

  Verification remains backwards compatible: a signature in the old format still verifies, but only when no field contains the \n delimiter (the condition that made the old format ambiguous), so a pending approval that straddles an upgrade is not rejected while the collision stays closed.

7.0.35

Patch Changes

• 7f6650b: Return response piping promises so callers can catch stream read and write errors.
• 106ea59: feat(ai): add per-step first content timeout for streaming generations
• Updated dependencies [2112ff1]
  • @​ai-sdk/gateway@​4.0.27

7.0.34

Patch Changes

• Updated dependencies [7c16f21]
  • @​ai-sdk/gateway@​4.0.26

7.0.33

Patch Changes

• 76cb673: fix: detect MP4 audio from its ftyp box during transcription
• e808fa5: fix(ai): preserve tool parts when tool call IDs repeat across steps
• 33647d7: Preserve provider options when combining consecutive tool messages.
• Updated dependencies [02ffdcb]
• Updated dependencies [76cb673]
  • @​ai-sdk/provider-utils@​5.0.12
  • @​ai-sdk/gateway@​4.0.25

7.0.32

Patch Changes

... (truncated)

Commits

• 54d4d7a Version Packages (#17796)
• 7fa85b2 fix(ai): use injective serialization for tool approval HMAC payload (#17493)
• 799faf7 Version Packages (#17653)
• 106ea59 feat: add a per-step first-content timeout for streaming generations (#17561)
• 7f6650b fix: server-response piping errors bypass caller catches (#17648)
• 4742a2b Version Packages (#17615)
• 0319ff3 Version Packages (#17553)
• e808fa5 fix: preserve tool parts when tool call IDs repeat across steps (#17586)
• 76cb673 fix: detect M4A/MP4 audio correctly during transcription (#17378)
• 7977f80 chore(ai): bump main bundle size limit to 650 KB (#17526)
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
supercli	Ready	Preview, Comment	Jul 23, 2026 4:53pm
supercli-client	Ready	Preview, Comment	Jul 23, 2026 4:53pm
supercli-docs	Ready	Preview, Comment	Jul 23, 2026 4:53pm