build(deps): bump ai from 5.0.202 to 7.0.22

[dependabot]

Bumps ai from 5.0.202 to 7.0.22.

Release notes

Sourced from ai's releases.

ai@7.0.22

Patch Changes

• 8f89c25: Add the Cartesia provider with Sonic 3.5 speech generation, Ink-Whisper batch transcription, and Ink 2 realtime transcription support.

ai@7.0.21

Patch Changes

• 308a519: chore: enforce consistent imports from zod/v4 instead of zod
• Updated dependencies [308a519]
• Updated dependencies [7fe53d2]
  • @​ai-sdk/gateway@​4.0.16

ai@7.0.20

Patch Changes

• b9ac19f: Flush compressed Node.js response chunks as they are piped so UI message and text streams remain incremental in Express and Next.js.
• a4186d6: Promote the repairToolCall option to stable, with a deprecated experimental_repairToolCall alias for backwards compatibility.

ai@6.0.224

Patch Changes

• Updated dependencies [982aa3e]
  • @​ai-sdk/gateway@​3.0.148

ai@6.0.223

Patch Changes

• Updated dependencies [a452291]
  • @​ai-sdk/gateway@​3.0.147

ai@5.0.211

Patch Changes

• Updated dependencies [6a823a6]
• Updated dependencies [ed8b811]
• Updated dependencies [4f00314]
• Updated dependencies [8549807]
• Updated dependencies [3c89617]
  • @​ai-sdk/gateway@​2.0.110

Changelog

Sourced from ai's changelog.

7.0.22

Patch Changes

• 8f89c25: Add the Cartesia provider with Sonic 3.5 speech generation, Ink-Whisper batch transcription, and Ink 2 realtime transcription support.

7.0.21

Patch Changes

• 308a519: chore: enforce consistent imports from zod/v4 instead of zod
• Updated dependencies [308a519]
• Updated dependencies [7fe53d2]
  • @​ai-sdk/gateway@​4.0.16

7.0.20

Patch Changes

• b9ac19f: Flush compressed Node.js response chunks as they are piped so UI message and text streams remain incremental in Express and Next.js.
• a4186d6: Promote the repairToolCall option to stable, with a deprecated experimental_repairToolCall alias for backwards compatibility.

7.0.19

Patch Changes

• be7f05a: Add fingerprintTools and detectToolDrift to detect MCP tool-definition drift ("rug pull"). Pin a tool set's server-controlled fields (string description, input schema, title) at trust time with fingerprintTools, then diff later fetches with detectToolDrift to catch injected descriptions or widened schemas before passing tools to the model. Baseline storage and the drift response remain the app's responsibility.

• ee55a07: Preserve tool approval signatures when approvals transition to responded.

• aad737d: Use own-property checks when resolving per-tool approvals so tool names and approval ids that match inherited object properties (e.g. constructor, toString, valueOf, __proto__) are treated as unconfigured/absent.

  • @ai-sdk/policy-opa: wrapMcpTools builds its per-tool map with a null prototype and reads supplied approvals via an own-property check, and shadow guards its per-tool map lookup the same way.
  • ai: tool and tool-context lookups keyed by a model- or client-supplied name now go through an own-property check (getOwn), so a name matching an inherited object property resolves to "no such tool"/"unconfigured" instead of a prototype value. This covers the approval path (per-tool approval resolution and replay re-validation) as well as tool-call parsing, execution, streaming callbacks, and UI message conversion/validation. The human-in-the-loop approval matching (collectToolApprovals) and streaming tool-name maps are built with a null prototype so a client-supplied id that matches an inherited property no longer slips past the "unknown approval" / "tool call not found" guards.

• 0f93c57: feat (video): support video (not just image) reference inputs in inputReferences for reference-to-video generation

• Updated dependencies [e12411e]

• Updated dependencies [5d894a7]

• Updated dependencies [fdb6d5d]

• Updated dependencies [0f93c57]

• Updated dependencies [d25a084]

  • @​ai-sdk/gateway@​4.0.15
  • @​ai-sdk/provider@​4.0.3
  • @​ai-sdk/provider-utils@​5.0.7

7.0.18

Patch Changes

• Updated dependencies [ac306ed]
  • @​ai-sdk/provider-utils@​5.0.6
  • @​ai-sdk/gateway@​4.0.14

... (truncated)

Commits

• b162ae4 Version Packages (#17106)
• 8f89c25 feat(provider/cartesia): add Sonic 3.5 and Ink support (#16815)
• c2913fb Version Packages (#17092)
• 308a519 chore: enforce consistent imports from zod/v4 instead of zod (#17090)
• 58d77ca Version Packages (#17043)
• a4186d6 feat(ai): promote repairToolCall option to stable (#16886)
• b9ac19f fix(ai): flush compressed Node.js streams per chunk (#17042)
• 405116e Version Packages (#16937)
• ee55a07 fix: preserve tool approval signatures when approvals are responded (#16589)
• be7f05a feat(ai): detect MCP tool-definition drift ("rug pull") (#16902)
• Additional commits viewable in compare view

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	ai@​5.0.202 ⏵ 7.0.22	-12

View full report

[dependabot]

Superseded by #41.