chore(deps): bump ai from 6.0.236 to 7.0.38

[dependabot]

Bumps ai from 6.0.236 to 7.0.38.

Release notes

Sourced from ai's releases.

ai@7.0.38

Patch Changes

• 7bd6bdd: Avoid synthesizing client tool errors for invalid provider-executed tool calls.
• 1e2f324: feat: add experimental speech translation model specification (Experimental_SpeechTranslationModelV4) and experimental_streamTranslate for streaming speech-to-speech translation
• Updated dependencies [d9d2a11]
• Updated dependencies [1e2f324]
  • @​ai-sdk/gateway@​4.0.29
  • @​ai-sdk/provider@​4.0.4
  • @​ai-sdk/provider-utils@​5.0.13

Changelog

Sourced from ai's changelog.

7.0.38

Patch Changes

• 7bd6bdd: Avoid synthesizing client tool errors for invalid provider-executed tool calls.
• 1e2f324: feat: add experimental speech translation model specification (Experimental_SpeechTranslationModelV4) and experimental_streamTranslate for streaming speech-to-speech translation
• Updated dependencies [d9d2a11]
• Updated dependencies [1e2f324]
  • @​ai-sdk/gateway@​4.0.29
  • @​ai-sdk/provider@​4.0.4
  • @​ai-sdk/provider-utils@​5.0.13

7.0.37

Patch Changes

• Updated dependencies [0a7c7f4]
  • @​ai-sdk/gateway@​4.0.28

7.0.36

Patch Changes

• 7fa85b2: fix(ai): use injective serialization for tool approval HMAC payload

  The tool approval signature (experimental_toolApprovalSecret) built its HMAC payload by joining fields with \n. Because fields such as toolName and toolCallId can themselves contain a newline, distinct field tuples could serialize to identical bytes, allowing a signed approval to verify against a different tuple. The payload is now serialized with JSON.stringify (with a versioned domain-separation prefix), which escapes delimiter/control characters and makes the encoding injective.

  Verification remains backwards compatible: a signature in the old format still verifies, but only when no field contains the \n delimiter (the condition that made the old format ambiguous), so a pending approval that straddles an upgrade is not rejected while the collision stays closed.

7.0.35

Patch Changes

• 7f6650b: Return response piping promises so callers can catch stream read and write errors.
• 106ea59: feat(ai): add per-step first content timeout for streaming generations
• Updated dependencies [2112ff1]
  • @​ai-sdk/gateway@​4.0.27

7.0.34

Patch Changes

... (truncated)

Commits

• 8fd84f0 Version Packages (#17983)
• 7bd6bdd fix: prevent orphaned Anthropic tool results after invalid provider-executed ...
• 1e2f324 feat(provider,ai): translation model spec + experimental_streamTranslate (#17...
• c391be3 docs: clarify that textStream does not surface error parts (#17994)
• 3c98985 Version Packages (#17868)
• 54d4d7a Version Packages (#17796)
• 7fa85b2 fix(ai): use injective serialization for tool approval HMAC payload (#17493)
• 799faf7 Version Packages (#17653)
• 106ea59 feat: add a per-step first-content timeout for streaming generations (#17561)
• 7f6650b fix: server-response piping errors bypass caller catches (#17648)
• Additional commits viewable in compare view

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

[krishagel]

🤖 pr-fix routine: blocked, same root cause as #1209/#1216

Both failing checks here have the identical signature already diagnosed on PR #1209:

1. Test, Lint, and Type Check and Validate CDK Infrastructure fail with:

   warn: Bun currently does not support nested "overrides"
      at /home/runner/work/aistudio/aistudio/package.json:272:15
   error: lockfile had changes, but lockfile is frozen
   note: try re-running without --frozen-lockfile and commit the updated lockfile
   

   Dependabot bumped root package.json (ai ~6.0.208 → ~7.0.27, a major version change) but did not regenerate root bun.lock, so bun install --frozen-lockfile rejects it in CI. I re-verified in this run: bun install in this routine's execution environment fails to resolve packages (@ai-sdk/*, @assistant-ui/*, @codemirror/*, etc. all fail to resolve) — no network egress to the npm registry from here, so the lockfile can't be regenerated by this routine.

2. claude-review fails with:

   Action failed with error: Workflow initiated by non-human actor: dependabot (type: Bot).
   Add bot to allowed_bots list or use '*' to allow all bots.
   

   Fixing this requires editing the claude-review GitHub Actions workflow config under .github/workflows/**, a protected path this autonomous routine is not permitted to touch.

No human review comments or REQUESTED_CHANGES are present — the only PR comment was an unrelated Codex usage-limit notice.

A human will need to either:

1. Run bun install locally at the repo root on this branch and push the updated bun.lock (note: this is a major version bump of the ai SDK — review the upgrade checklist per the check-sdk-version job before merging), or
2. Comment ·@·d·ependabot r·ecreate and see if a fresh PR includes the lockfile update, or
3. Add dependabot to the claude-review workflow's allowed_bots list, and/or update this routine's environment network allowlist to include the npm registry.

The routine will not pick this PR up again until a human removes the pr-fix-stuck label.

---

Generated by Claude Code

[krishagel]

🔬 Manual triage (pr-fix-stuck backlog sweep, 2026-07-27): the AI SDK v7 cluster (#1211, #1213–#1218) is deferred — labeled pr-fix-skip.

Why these PRs cannot merge individually: ai 7 and the @ai-sdk/* majors implement a new provider-specification version and must move together; any single bump leaves the workspace with incompatible peer/spec versions. A consolidated migration branch is the only viable route.

Scope of the consolidated migration (from the official v7 migration guide):

• ESM-only + Node 22+ (repo is fine on Node 26)
• Message format: system → instructions, system messages in messages rejected by default, {type:'image'} parts → canonical {type:'file', mediaType} shape — this cuts straight through the Nexus conversation persistence documented in docs/features/nexus-conversation-architecture.md (replay/tool-call UIMessage parts, convertToModelMessages)
• Streaming: result.fullStream → result.stream, response helpers (toUIMessageStreamResponse et al.) replaced by stateless 'ai' exports — affects lib/streaming/sdk-compatibility-adapter.ts, sse-event-types.ts, Assistant Architect SSE, and Nexus chat routes
• Lifecycle renames (onFinish → onEnd, onStepFinish → onStepEnd) — CLAUDE.md's Silent Failures section has hard-won rules about onFinish event.steps that must be re-derived for v7
• Usage/token accounting restructured (inputTokenDetails/outputTokenDetails), multi-step results accumulate differently (finalStep)
• ~46 files import ai, ~24 import @ai-sdk/* in this repo
• check-sdk-version CI guard requires the sdk-upgrade-approved label on any ai major bump

Why deferred rather than done now: this repo's own upgrade checklist requires exercising all streaming features (Assistant Architect execution, Nexus chat, tool calls) against live providers, and the local E2E harness gates the live-provider specs on real provider credentials. This machine has no provider credentials (all provider keys are empty in the settings store; no AWS profile), so the mandatory live verification cannot be run here. Landing a 70-file streaming migration without it would violate the do-not-break-functionality constraint.

When picked up: branch off fresh dev, migrate per the guide (npx @ai-sdk/codemod v7 handles most renames), read docs/features/nexus-conversation-architecture.md first, add sdk-upgrade-approved, run the full E2E suite including E2E_RUN_EXTERNAL=1 live-provider specs on a machine with provider credentials, then close #1211/#1213–#1218 as superseded.

Do not hand these back to the pr-fix routine.

[dependabot]

Superseded by #1570.