chore(deps): bump ai from 5.0.210 to 7.0.22

[dependabot]

Bumps ai from 5.0.210 to 7.0.22.

Release notes

Sourced from ai's releases.

ai@7.0.22

Patch Changes

• 8f89c25: Add the Cartesia provider with Sonic 3.5 speech generation, Ink-Whisper batch transcription, and Ink 2 realtime transcription support.

ai@7.0.21

Patch Changes

• 308a519: chore: enforce consistent imports from zod/v4 instead of zod
• Updated dependencies [308a519]
• Updated dependencies [7fe53d2]
  • @​ai-sdk/gateway@​4.0.16

ai@7.0.20

Patch Changes

• b9ac19f: Flush compressed Node.js response chunks as they are piped so UI message and text streams remain incremental in Express and Next.js.
• a4186d6: Promote the repairToolCall option to stable, with a deprecated experimental_repairToolCall alias for backwards compatibility.

ai@6.0.224

Patch Changes

• Updated dependencies [982aa3e]
  • @​ai-sdk/gateway@​3.0.148

ai@6.0.223

Patch Changes

• Updated dependencies [a452291]
  • @​ai-sdk/gateway@​3.0.147

Changelog

Sourced from ai's changelog.

7.0.22

Patch Changes

• 8f89c25: Add the Cartesia provider with Sonic 3.5 speech generation, Ink-Whisper batch transcription, and Ink 2 realtime transcription support.

7.0.21

Patch Changes

• 308a519: chore: enforce consistent imports from zod/v4 instead of zod
• Updated dependencies [308a519]
• Updated dependencies [7fe53d2]
  • @​ai-sdk/gateway@​4.0.16

7.0.20

Patch Changes

• b9ac19f: Flush compressed Node.js response chunks as they are piped so UI message and text streams remain incremental in Express and Next.js.
• a4186d6: Promote the repairToolCall option to stable, with a deprecated experimental_repairToolCall alias for backwards compatibility.

7.0.19

Patch Changes

• be7f05a: Add fingerprintTools and detectToolDrift to detect MCP tool-definition drift ("rug pull"). Pin a tool set's server-controlled fields (string description, input schema, title) at trust time with fingerprintTools, then diff later fetches with detectToolDrift to catch injected descriptions or widened schemas before passing tools to the model. Baseline storage and the drift response remain the app's responsibility.

• ee55a07: Preserve tool approval signatures when approvals transition to responded.

• aad737d: Use own-property checks when resolving per-tool approvals so tool names and approval ids that match inherited object properties (e.g. constructor, toString, valueOf, __proto__) are treated as unconfigured/absent.

  • @ai-sdk/policy-opa: wrapMcpTools builds its per-tool map with a null prototype and reads supplied approvals via an own-property check, and shadow guards its per-tool map lookup the same way.
  • ai: tool and tool-context lookups keyed by a model- or client-supplied name now go through an own-property check (getOwn), so a name matching an inherited object property resolves to "no such tool"/"unconfigured" instead of a prototype value. This covers the approval path (per-tool approval resolution and replay re-validation) as well as tool-call parsing, execution, streaming callbacks, and UI message conversion/validation. The human-in-the-loop approval matching (collectToolApprovals) and streaming tool-name maps are built with a null prototype so a client-supplied id that matches an inherited property no longer slips past the "unknown approval" / "tool call not found" guards.

• 0f93c57: feat (video): support video (not just image) reference inputs in inputReferences for reference-to-video generation

• Updated dependencies [e12411e]

• Updated dependencies [5d894a7]

• Updated dependencies [fdb6d5d]

• Updated dependencies [0f93c57]

• Updated dependencies [d25a084]

  • @​ai-sdk/gateway@​4.0.15
  • @​ai-sdk/provider@​4.0.3
  • @​ai-sdk/provider-utils@​5.0.7

7.0.18

Patch Changes

• Updated dependencies [ac306ed]
  • @​ai-sdk/provider-utils@​5.0.6
  • @​ai-sdk/gateway@​4.0.14

... (truncated)

Commits

• b162ae4 Version Packages (#17106)
• 8f89c25 feat(provider/cartesia): add Sonic 3.5 and Ink support (#16815)
• c2913fb Version Packages (#17092)
• 308a519 chore: enforce consistent imports from zod/v4 instead of zod (#17090)
• 58d77ca Version Packages (#17043)
• a4186d6 feat(ai): promote repairToolCall option to stable (#16886)
• b9ac19f fix(ai): flush compressed Node.js streams per chunk (#17042)
• 405116e Version Packages (#16937)
• ee55a07 fix: preserve tool approval signatures when approvals are responded (#16589)
• be7f05a feat(ai): detect MCP tool-definition drift ("rug pull") (#16902)
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
supercli	Ready	Preview, Comment	Jul 13, 2026 1:09pm
supercli-client	Ready	Preview, Comment	Jul 13, 2026 1:09pm
supercli-docs	Ready	Preview, Comment	Jul 13, 2026 1:09pm