skills/composiohq__composio
1
0
Fork 0
mirror of https://github.com/ComposioHQ/composio.git synced 2026-09-22 11:46:35 +08:00
Code Issues Packages Projects Releases Wiki Activity
5,395 Commits 338 Branches 1,550 Tags
docs/auto-sdk-sync
Commit Graph

14 Commits

Author SHA1 Message Date
Alberto Schiabel 62e51e838f chore(deps): refresh safe dependencies and Effect v4 (#4538) 
## Summary

Refreshes the safe TypeScript, Python, and GitHub Actions dependency
surface in one maintainer-owned change. Effect 4 rc.115, Vitest 5, the
vendored Effect source, CLI migrations, and agent guidance move
together, while known incompatible boundaries stay pinned. The Effect v4
config schemas preserve unknown fields across `config.json` and
`user_data.json` read-update-write cycles.

Fixes #4535

## Changes

- Keeps Cloudflare Workers fixtures on Vitest 4 until
`@cloudflare/vitest-pool-workers` supports Vitest 5.
- Keeps Mastra on the Workers-compatible versions and AG2 below 1.0
because AG2 1.x no longer ships the imported `autogen` module.
- Removes the unused package-level `pnpm` dependency instead of changing
the repository's pinned pnpm 11 toolchain.
- Migrates the Effect CLI APIs, Eve callback contract, provider peer
ranges, and repository skills required by the selected upgrades.
- Preserves unknown CLI settings when `config.json` and `user_data.json`
are read, updated, and written back.
- Uses immutable SHA pins for the refreshed Claude Code actions and adds
release metadata for the affected published TypeScript packages.

## Type of change

- [x] Bug fix
- [ ] New feature
- [x] Refactor/Chore
- [x] Documentation
- [ ] Breaking change

## How Has This Been Tested?

- `pnpm install --frozen-lockfile` with pnpm 11.8.0
- `pnpm typecheck`
- `pnpm build:packages`
- `pnpm --filter @composio/cli test` — 1,400 passed, 1 skipped,
including targeted persistence regressions for `config.json` and
`user_data.json`
- Package tests — 28 workspace tasks passed
- Example typechecks/tests and all Cloudflare dry-runs
- Provider compatibility, experimental/Eve, Mastra, CLI keyring, and
JSON-schema Effect checks
- Agent-skill validation, routing validation, Effect skill example
compilation, and peer-dependency checks
- All three Python `uv lock --check` runs
- `nox -s tst_autogen`, `nox -s snt`, and `nox -s chk type_inference`
- Production dependency audit completed with the repository's three
existing ignored advisories

Docker CLI E2E was not run locally because the Docker daemon is
unavailable. The exact root lint command also enters the vendored Effect
submodule, whose checkout does not install its `@effect/oxc/oxlint`
plugin; scoped lint over the changed non-vendor files passed.

## Screenshots (if applicable)

Not applicable.

## Checklist

- [x] I have read the Code of Conduct and this PR adheres to it
- [ ] I ran linters/tests locally and they passed
- [x] I updated documentation as needed
- [x] I added tests or explain why not applicable
- [x] I added a changeset if this change affects published packages

The dependency migrations are covered by the focused and workspace
suites. Two targeted regression tests verify that CLI updates preserve
unknown fields in `config.json` and `user_data.json`.

## Additional context

The Connect client sync retains its existing `Bash(curl *)` permission
while moving the removed `allowed_tools` input to `claude_args`. A
separate hardening change should move logo downloads outside the
model-controlled shell boundary.

---

[![Compound
Engineering](https://img.shields.io/badge/Built_with-Compound_Engineering-6366f1)](https://github.com/EveryInc/compound-engineering-plugin)
 2026-09-21 15:23:42 +04:00
Alberto Schiabel 0abc629f5d refactor(cli): migrate to Effect 4 (4.0.0-rc.112) (#3901) 
Rebuilds the Effect v4 port on top of `next` at `effect@4.0.0-rc.112`
(the newest release that clears the repository's 3-day
`minimumReleaseAge` gate). The three v3-compatible preparation PRs
(#4358, #4359, #4360) already landed on `next`, so this PR is now only
the cutover.

## What changes

- Pins `effect`, `@effect/platform-bun`, and `@effect/vitest` to exact
`4.0.0-rc.112`; drops `@effect/cli`, `@effect/platform`,
`@effect/platform-node`, and the `toml` override that existed only for
`@effect/cli`. The `ts/vendor/effect` source oracle moves to the
`effect@4.0.0-rc.112` release commit.
- Services become `Context.Service` classes with explicit `Default`
layers; `Either` becomes `Result`; `ParseResult` becomes
`Schema.SchemaError`; platform modules come from `effect/FileSystem`,
`effect/Path`, `effect/PlatformError`, `effect/unstable/process`, and
`effect/unstable/http`.
- The runner drives `Command.runWith` with v4's default help and error
rendering. `CliError.ShowHelp` carries its own exit code, help for
non-explicit invocations renders on stderr, and "Did you mean?"
suggestions render. `command-introspection.ts` is gone: v4 renders the
resolved command's help and the "missing value" tip itself.
- `composio --version`, `composio -v`, and `composio version` print the
same bare semver (`GlobalFlag.Version` is not enabled; the flag
spellings are rewritten to the `version` command before parsing).
- Root `--log-level` is a shared flag applied after the subcommand tree
is attached, so `composio --log-level Debug <subcommand>` both parses
and takes effect.
- Every `Flag.boolean` carries an explicit default, because rc.112 makes
boolean flags required when omitted.
- A `Result` is not an `Effect` at runtime in rc.112 even though the
type checker accepts `yield*` on it (the fiber dies with "Not a valid
effect"); every `Result` is lifted with `Effect.fromResult`, and the
skill/AGENTS guidance says so.
- Every `ChildProcess.make` site passes `extendEnv: true`, because
rc.112 no longer inherits the parent environment by default.
- `--log-level` and `COMPOSIO_LOG_LEVEL` are exact-match on the
`LogLevel` names (`All`, `Fatal`, `Error`, `Warn`, `Info`, `Debug`,
`Trace`, `None`) with no case folding, per the earlier review decision;
README updated.
- Spawned children pass `extendEnv: true`, because rc.112's
`ChildProcess` no longer inherits the parent environment by default.
- ISO timestamps decode through `Schema.DateTimeUtcFromString`;
`Schema.DateTimeUtc` is no longer a string codec in rc.112.
- `ConfigProvider.fromEnv()` snapshots the environment at construction
in v4, so providers that must observe later changes are built per read
(`plugin-hint.ts`, `install.cmd.ts`, `config.ts`) and tests use a
live-env provider helper.
- `cli-keyring` and `json-schema-to-effect-schema` are ported alongside
(the latter on `Schema.makeFilter`).
- The `effect-v4` skill, the `cli-command` and `typescript-testing`
references, `ts/packages/cli/AGENTS.md`, and the oxlint config are
updated to the rc.112 reality. The skill's example checker
(`.agents/skills/effect-v4/scripts/check-examples.mjs`, lifted from
#3851) compiles every TypeScript block in the skill against the pinned
packages.
- The `js-yaml` overrides move to the 4.3.2 / 3.15.2 lines that
GHSA-2883-xcg3-v3hh requires; `pnpm audit --prod` is clean apart from
the already-ignored `extract-zip` advisory.

## Behaviour notes

- `composio <unknown> --help` now prints the root help with exit 0 (v4's
global `--help` handling); `composio <unknown>` without `--help` still
fails with the unknown-subcommand error.

## Validation

- `pnpm --filter @composio/cli typecheck` (src + test): 0 errors
- `pnpm --filter @composio/cli test`: 127 files, 1325 tests pass, 1
skipped; `validate:boundaries` and `validate:skills` pass
- `@composio/cli-keyring` and `@composio/json-schema-to-effect-schema`
typecheck, test, and build pass
- `pnpm validate:agent-skills` and `pnpm validate:skill-routing` pass
(19 skills)
- oxlint clean on `ts/packages/cli`, `cli-keyring`,
`json-schema-to-effect-schema`
- CLI bundle and standalone binary build; smoke-checked `version`,
`--version`, `-v`, `--help`, unknown subcommand, unrecognized flag,
missing flag value
- Docker CLI e2e suites pass against an image built from this branch:
`version`, `toolkits-list`, `toolkits-info`, `toolkits-search`,
`setup-plugins`, `run`. `whoami` (needs an API key), `install` (needs a
release dir), and `upgrade` (needs network) were not run.

No changeset: `@composio/cli` is Changesets-ignored and the ported
sibling packages are private. Human-facing notes are in
`ts/packages/cli/CHANGELOG.md`.

https://claude.ai/code/session_01AW7ZPhfZuni6PrCJ9X86DX
 2026-09-10 17:47:14 +02:00
Alberto Schiabel 705591451c chore(deps): upgrade CI actions and every outdated dependency (#4381) 
This PR:

- upgrades every CI action to its latest release (only
`changesets/action` had one: v2.1.1 -> v2.1.2, SHA-pinned) and every
outdated dependency across the pnpm workspace, the docs bun workspace,
and all three `uv.lock` files
- moves zod to 4.5.4 everywhere first-party — catalog, docs,
`@composio/json-schema-to-zod`, `@composio/claude-agent-sdk` and the
zod-v4 e2e fixtures; the `*-zod-v3` fixtures stay on 3.25.76 because
that is what they exercise
- moves `@mastra/core` 1.52.1 -> 1.53.0, which is the ceiling rather
than a preference: bisecting `ts/examples/mastra`'s `cf:dry-run` shows
1.54.0 moved the workspace/sandbox subsystem behind
`@mastra/core/agent`, which drags execa (-> `npm-run-path` ->
`unicorn-magic`) into the Workers bundle where esbuild cannot link it.
`@mastra/mcp` is capped at 1.17.2 for the same reason — 1.17.3 wants
`@mastra/core` >=1.64. The docs bun workspace mirrors that cap as an
explicit devDependency plus `overrides` entry, because bun does not
apply overrides to auto-installed peers
- clears every production advisory that has a published fix, so the
audit gate can run without `--ignore`, which does not filter a single
run: it writes the advisory into `auditConfig` and exits 0 whatever else
is outstanding, so the gate was passing over nine advisories
- `qs` -> >=6.16.0, `fast-uri` -> >=3.1.6, `toml` -> the 4.x line, all
via overrides in the existing `# temporary: … drop when` style
- `extract-zip` (GHSA-jmr9-qjv8-65gv) has no fixed version to move to —
2.0.1 is the newest release and GitHub records `first_patched_version`
as null — so it moves to `auditConfig.ignoreGhsas` pointing at the
`extractZipSafely` mitigation that already covers it
- GHSA-866g-f22w-33x8 (`@ai-sdk/provider-utils` 3.x, low) also has
nothing to move to: the advisory names 3.0.98 as patched but the 3.x
line stopped at 3.0.30 and GitHub records no fixed version. It only
enters the tree through `@mastra/core`, which is a peer or dev
dependency of every published package, so all flagged paths are private
examples and e2e fixtures. It goes in `ignoreGhsas` with that rationale
so the un-levelled `pnpm audit --prod` step stops posting a warning
comment on every PR
- widens `@composio/anthropic`'s `@anthropic-ai/sdk` peer range to
include `^0.124.0`, the line its devDependency now tests against (for a
`0.x` caret, `^0.120.0` excluded it); the package is in the changeset
for that reason
- adapts three call sites that upstream broke: `eve` 0.52 moved
`ApprovalContext` to `eve/tools/approval`, `@pierre/diffs` 1.4 gave
`FileDiffProps` a second type parameter, and `fumadocs-openapi` 11.4
fixed the undeclared-tag drop that a docs guard test asserted (the guard
now also asserts the page positively, so it cannot pass vacuously)
- drops the stale `hono` `minimumReleaseAgeExclude` entry (its comment
said to after 2026-08-06) and adds an `undici` `peerDependencyRules`
allowance for openai 7.10's new optional peer

## Context

Some upgrades were deliberately declined, each for a reason recorded
next to the pin:

- `vitest`/`@vitest/ui` stay on 4.1.11 —
`@cloudflare/vitest-pool-workers@0.22.0` (latest) peers on `vitest
^4.1.0`
- `undici` stays on `^7` in core — `pinnedDispatcher.node.ts` documents
that Node's `fetch` rejects undici 8 dispatchers
- the `pnpm` catalog entry stays on `^11` to match the mise-owned
toolchain
- `eve` stays on 0.27.6 in docs — 0.52 changes the `defineAgent` model
definition and the `useEveAgent` helpers, so `agent/agent.ts` and
`components/eve-chat.tsx` fail `types:check`; migrating the docs agent
is its own PR
- `@earendil-works/pi-coding-agent` stays on 0.84.4 — 0.85.x imports
`@earendil-works/pi-server` without declaring it, so `test/pi.test.ts`
fails to load

`declareOperationTags` is kept as a safety net rather than retired, even
though `fumadocs-openapi` 11.4 makes it redundant: removing it changes
how specs are normalised at sync time and is worth its own PR.

Verified locally: `pnpm build:packages`, `pnpm typecheck`, `pnpm test`,
`pnpm typecheck:examples`, `pnpm lint:examples`, `turbo cf:dry-run
--filter='./ts/examples/*'`, `pnpm peers check`, `pnpm audit --prod
--audit-level=high` (exit 0), frozen-lockfile installs for pnpm and bun,
docs `types:check` + 542 static tests, and Python `make chk` + `make
tst` (1790 passed).

https://claude.ai/code/session_018evFic47PFPXuB95uRE1aw
EOF -R ComposioHQ/composio
 2026-09-08 16:15:34 +02:00
jkomyno 9758571072 chore(deps-dev): update TypeScript tooling 2026-08-28 14:52:53 +02:00
dependabot[bot] c0c511bb4b chore(deps-dev): bump the npm-development group with 7 updates (#4133) 
Bumps the npm-development group with 7 updates:

| Package | From | To |
| --- | --- | --- |
|
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
| `26.1.2` | `26.2.0` |
| [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) |
`1.77.0` | `1.78.0` |
|
[oxlint-plugin-eslint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint)
| `1.77.0` | `1.78.0` |
| [turbo](https://github.com/vercel/turborepo) | `2.10.8` | `2.10.9` |
|
[chrome-devtools-mcp](https://github.com/ChromeDevTools/chrome-devtools-mcp)
| `1.6.0` | `1.7.0` |
|
[@earendil-works/pi-coding-agent](https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent)
| `0.83.0` | `0.84.1` |
| [eve](https://github.com/vercel/eve/tree/HEAD/packages/eve) | `0.29.5`
| `0.31.3` |

Updates `@types/node` from 26.1.2 to 26.2.0
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />

Updates `oxlint` from 1.77.0 to 1.78.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md">oxlint's
changelog</a>.</em></p>
<blockquote>
<h2>[1.78.0] - 2026-08-10</h2>
<h3>🚀 Features</h3>
<ul>
<li>ccb8fe8 linter/jsdoc: Implement <code>no-blank-blocks</code> rule
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25207">#25207</a>)
(Mikhail Baev)</li>
<li>d4a897c linter/eslint: Implement <code>one-var</code> rule (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/24470">#24470</a>)
(Cole Ellison)</li>
<li>5ab9340 linter/jsx-a11y/anchor-has-content: Add options to match
eslint (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/24571">#24571</a>)
(Cole Ellison)</li>
</ul>
<h3>🐛 Bug Fixes</h3>
<ul>
<li>9573937 linter/typescript: Validate <code>ban-ts-comment</code>
description_format (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25320">#25320</a>)
(Mikhail Baev)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/oxc-project/oxc/commit/c42d6397eab5b2d5bb2bd6746c57bc2a9cad21bd"><code>c42d639</code></a>
release(apps): oxlint v1.78.0 &amp;&amp; oxfmt v0.63.0 (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25473">#25473</a>)</li>
<li><a
href="https://github.com/oxc-project/oxc/commit/ccb8fe89db08123ff2b86d7fb2f39d0dd6c33df7"><code>ccb8fe8</code></a>
feat(linter/jsdoc): implement <code>no-blank-blocks</code> rule (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25207">#25207</a>)</li>
<li><a
href="https://github.com/oxc-project/oxc/commit/9573937df3cc01f29e1c65bc018ce378ec947e0e"><code>9573937</code></a>
fix(linter/typescript): validate <code>ban-ts-comment</code>
description_format (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25320">#25320</a>)</li>
<li><a
href="https://github.com/oxc-project/oxc/commit/d4a897ce2290bf853720b4fbf371304bfea2c980"><code>d4a897c</code></a>
feat(linter/eslint): implement <code>one-var</code> rule (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/24470">#24470</a>)</li>
<li><a
href="https://github.com/oxc-project/oxc/commit/5ab9340637eff80539bca89a494e162e94569358"><code>5ab9340</code></a>
feat(linter/jsx-a11y/anchor-has-content): add options to match eslint
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/24571">#24571</a>)</li>
<li>See full diff in <a
href="https://github.com/oxc-project/oxc/commits/oxlint_v1.78.0/npm/oxlint">compare
view</a></li>
</ul>
</details>
<br />

Updates `oxlint-plugin-eslint` from 1.77.0 to 1.78.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/oxc-project/oxc/releases">oxlint-plugin-eslint's
releases</a>.</em></p>
<blockquote>
<h2>oxlint v1.78.0 &amp; oxfmt v0.63.0</h2>
<h2>Table of Contents</h2>
<ul>
<li><a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/blob/HEAD/#oxlint-v1.78.0">Oxlint
v1.78.0</a></li>
<li><a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/blob/HEAD/#oxfmt-v0.63.0">Oxfmt
v0.63.0</a></li>
</ul>
<h2>Oxlint v1.78.0</h2>
<h3>🚀 Features</h3>
<ul>
<li>ccb8fe8 linter/jsdoc: Implement <code>no-blank-blocks</code> rule
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25207">#25207</a>)
(Mikhail Baev)</li>
<li>d4a897c linter/eslint: Implement <code>one-var</code> rule (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/24470">#24470</a>)
(Cole Ellison)</li>
<li>5ab9340 linter/jsx-a11y/anchor-has-content: Add options to match
eslint (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/24571">#24571</a>)
(Cole Ellison)</li>
</ul>
<h3>🐛 Bug Fixes</h3>
<ul>
<li>b746e00 linter/eslint/no-implicit-coercion: Preserve template
coercion whitespace (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25470">#25470</a>)
(camc314)</li>
<li>a92c541 linter: Preserve source text for JS plugin ignore fixes (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25280">#25280</a>)
(Norcleeh)</li>
<li>675c840 linter/eslint/prefer-promise-reject-errors: Handle
parenthesized calls (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25378">#25378</a>)
(camc314)</li>
<li>1703739 linter/unicorn/new-for-builtins: Ignore optional chains (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25411">#25411</a>)
(tanakalucky)</li>
<li>95ece63 linter/unicorn/prefer-code-point: Downgrade the auto-fix to
dangerous (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25412">#25412</a>)
(leemr)</li>
<li>c451a0e linter/vitest: Validate
<code>consistent-test-filename</code> regex patterns (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25408">#25408</a>)
(Mikhail Baev)</li>
<li>937825c react_compiler: Disable exhaustive memo validation by
default (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25417">#25417</a>)
(Boshen)</li>
<li>f0f7dae linter/eslint/no-unused-vars: Report invalid regex options
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25380">#25380</a>)
(Cameron)</li>
<li>44e73fd linter/unicorn/prefer-array-flat: Fix
<code>concat.apply</code> suggestions (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25373">#25373</a>)
(Cameron)</li>
<li>6846a9a linter/react/rules-of-hooks: Detect constructor callbacks
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25377">#25377</a>)
(camc314)</li>
<li>b247a9d linter/unicorn/new-for-builtins: Support
<code>Float16Array</code> (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25382">#25382</a>)
(tanakalucky)</li>
<li>19109cd linter/unicorn/error-message: Support
<code>SuppressedError</code> messages (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25375">#25375</a>)
(camc314)</li>
<li>9c13f5e linter: Assert token lookup invariants (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25368">#25368</a>)
(camc314)</li>
<li>bc35f83 linter/eslint/no-unused-vars: Bound catch parameter lookup
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25367">#25367</a>)
(camc314)</li>
<li>c159fb9 linter/unicorn/switch-case-braces: Bound token lookup (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25363">#25363</a>)
(camc314)</li>
<li>03b2eb2 linter/unicorn/no-static-only-class: Bound token lookup (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25361">#25361</a>)
(camc314)</li>
<li>0afc59e linter/unicorn/empty-brace-spaces: Bound token lookup (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25353">#25353</a>)
(camc314)</li>
<li>2963d98 linter/eslint/no-unreachable-loop: Do not report loops whose
body has a finally block (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25335">#25335</a>)
(Todor Andonov)</li>
<li>589e5fb linter/eslint/no-param-reassign: Validate
<code>ignorePropertyModificationsForRegex</code> property (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25346">#25346</a>)
(Mikhail Baev)</li>
<li>aae5d8b linter/eslint/no-throw-literal: False positive on variable
declared without initializer (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25275">#25275</a>)
(cjnoname)</li>
<li>6b1c479 oxlint: Normalize customized rule names (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25316">#25316</a>)
(camc314)</li>
<li>d494eb5 linter/unicorn/consistent-existence-index-check: Bound token
lookup (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25325">#25325</a>)
(camc314)</li>
<li>4266037 linter/typescript/prefer-namespace-keyword: Bound token
lookup (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25322">#25322</a>)
(camc314)</li>
<li>4745b4e linter/typescript/no-namespace: Bound token lookup (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25321">#25321</a>)
(camc314)</li>
<li>648a481 linter/eslint/one-var: Avoid joining exported declarations
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25314">#25314</a>)
(camc314)</li>
<li>9573937 linter/typescript: Validate <code>ban-ts-comment</code>
description_format (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25320">#25320</a>)
(Mikhail Baev)</li>
<li>ebf7d18 linter/typescript/consistent-type-definitions: Bound token
lookup (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25281">#25281</a>)
(camc314)</li>
<li>1501ccf linter/typescript/consistent-generic-constructors: Bound
token lookup (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25258">#25258</a>)
(camc314)</li>
</ul>
<h3>⚡ Performance</h3>
<ul>
<li>8f784f3 linter: Reduce rule config dispatch size (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25461">#25461</a>)
(Boshen)</li>
<li>2de4ec2 linter: Reduce visitor code size (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25441">#25441</a>)
(Boshen)</li>
<li>6fb7f47 linter/unicorn/prefer-export-from: Narrow
<code>ExportFromDeclaration</code> lookup (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25381">#25381</a>)
(camc314)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/oxc-project/oxc/commit/c42d6397eab5b2d5bb2bd6746c57bc2a9cad21bd"><code>c42d639</code></a>
release(apps): oxlint v1.78.0 &amp;&amp; oxfmt v0.63.0 (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25473">#25473</a>)</li>
<li>See full diff in <a
href="https://github.com/oxc-project/oxc/commits/apps_v1.78.0/npm/oxlint-plugin-eslint">compare
view</a></li>
</ul>
</details>
<br />

Updates `turbo` from 2.10.8 to 2.10.9
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/turborepo/releases">turbo's
releases</a>.</em></p>
<blockquote>
<h2>Turborepo v2.10.9</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Changelog</h3>
<ul>
<li>chore: Release Turborepo 2.10.8 by <a
href="https://github.com/github-actions"><code>@​github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13626">vercel/turborepo#13626</a></li>
<li>perf: Walk literal-prefix tree globs without wax compilation by <a
href="https://github.com/charpeni"><code>@​charpeni</code></a> in <a
href="https://redirect.github.com/vercel/turborepo/pull/13522">vercel/turborepo#13522</a></li>
<li>fix: Accept semver ranges in devEngines.packageManager.version by <a
href="https://github.com/bangseongbeom"><code>@​bangseongbeom</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13623">vercel/turborepo#13623</a></li>
<li>docs: Explain affected package invalidation reasons by <a
href="https://github.com/ghoullier"><code>@​ghoullier</code></a> in <a
href="https://redirect.github.com/vercel/turborepo/pull/13594">vercel/turborepo#13594</a></li>
<li>perf(lockfiles): Borrow field-name scalars in the pnpm fast parser
by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13648">vercel/turborepo#13648</a></li>
<li>perf(repository): Avoid discarded alias allocation in Relationship
by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13650">vercel/turborepo#13650</a></li>
<li>perf(lockfiles): Drop redundant human_name clone for pnpm v7/v9 by
<a href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13649">vercel/turborepo#13649</a></li>
<li>perf: Index workspace nodes by name in project_relationships by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13647">vercel/turborepo#13647</a></li>
<li>perf: Share resolution identity lists across identical workspace
closures by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13641">vercel/turborepo#13641</a></li>
<li>docs: Fix duplicated word in runtime dependencies guide summary by
<a href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13630">vercel/turborepo#13630</a></li>
<li>refactor: Remove turborepo-lsp dependency on turborepo-lib by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13631">vercel/turborepo#13631</a></li>
<li>perf: Index Bun nested lockfile entries by name for fallback
resolution by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13633">vercel/turborepo#13633</a></li>
<li>perf: Memoize framework inference per package during task hashing by
<a href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13634">vercel/turborepo#13634</a></li>
<li>perf: Avoid materializing transient declarations in
external_dependencies by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13646">vercel/turborepo#13646</a></li>
<li>perf: Enable shared closure DP for npm and yarn1 lockfiles by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13635">vercel/turborepo#13635</a></li>
<li>perf: Parse pnpm explicit-key entries in the lockfile fast path by
<a href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13640">vercel/turborepo#13640</a></li>
<li>perf: Parallelize resolution fingerprint hashing by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13642">vercel/turborepo#13642</a></li>
<li>perf: Build resolution identity lists in parallel by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13643">vercel/turborepo#13643</a></li>
<li>perf: Intern resolution identities as Arc&lt;str&gt; across closures
by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13645">vercel/turborepo#13645</a></li>
<li>fix: Compose affected tasks with package filters by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13656">vercel/turborepo#13656</a></li>
<li>docs: Explain worktree cache path isolation by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13657">vercel/turborepo#13657</a></li>
<li>fix: Upgrade brace-expansion to 5.0.9 by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13658">vercel/turborepo#13658</a></li>
<li>docs: Correct verified inaccuracies in the Turborepo Agent Skill by
<a href="https://github.com/charpeni"><code>@​charpeni</code></a> in <a
href="https://redirect.github.com/vercel/turborepo/pull/13644">vercel/turborepo#13644</a></li>
<li>chore: Update Next.js to 16.3.0 by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13659">vercel/turborepo#13659</a></li>
<li>fix: Don't use <code>eprintln!</code> in the panic hook by <a
href="https://github.com/molofsky"><code>@​molofsky</code></a> in <a
href="https://redirect.github.com/vercel/turborepo/pull/13637">vercel/turborepo#13637</a></li>
<li>fix: Invalidate only when Git ignore sources change by <a
href="https://github.com/smasato"><code>@​smasato</code></a> in <a
href="https://redirect.github.com/vercel/turborepo/pull/13632">vercel/turborepo#13632</a></li>
<li>docs: Update Geistdocs to 1.19.4 by <a
href="https://github.com/christopherkindl"><code>@​christopherkindl</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13680">vercel/turborepo#13680</a></li>
<li>docs: Exclude Turborepo from its own OSS products menu by <a
href="https://github.com/christopherkindl"><code>@​christopherkindl</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13681">vercel/turborepo#13681</a></li>
<li>docs: Use the geistdocs Turborepo logo in the navbar by <a
href="https://github.com/christopherkindl"><code>@​christopherkindl</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13682">vercel/turborepo#13682</a></li>
<li>docs: Update redirected vercel.com/nextjs.org links to current
targets by <a
href="https://github.com/molebox"><code>@​molebox</code></a> in <a
href="https://redirect.github.com/vercel/turborepo/pull/13685">vercel/turborepo#13685</a></li>
<li>refactor: Generalize native command arguments by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13664">vercel/turborepo#13664</a></li>
<li>refactor: Move native contracts to tasks by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13665">vercel/turborepo#13665</a></li>
<li>docs: Fix loadTransformers reference in turbo-codemod README by <a
href="https://github.com/latent-9"><code>@​latent-9</code></a> in <a
href="https://redirect.github.com/vercel/turborepo/pull/13683">vercel/turborepo#13683</a></li>
<li>refactor: Model native task execution explicitly by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13666">vercel/turborepo#13666</a></li>
<li>feat: Compose aggregate native task dependencies by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13667">vercel/turborepo#13667</a></li>
<li>fix: Respect aggregate task overrides by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13668">vercel/turborepo#13668</a></li>
<li>test: Stabilize watch task inputs regression test by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13686">vercel/turborepo#13686</a></li>
<li>feat: Parse Python quality tool declarations by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13669">vercel/turborepo#13669</a></li>
<li>feat: Resolve Python quality plans by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13670">vercel/turborepo#13670</a></li>
<li>refactor: Extract uv native task specs by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13671">vercel/turborepo#13671</a></li>
<li>feat: Synthesize Python quality tasks by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13672">vercel/turborepo#13672</a></li>
<li>test: Cover Python quality task commands by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13673">vercel/turborepo#13673</a></li>
<li>feat: Hash Python quality task inputs by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13674">vercel/turborepo#13674</a></li>
<li>test: Cover Python quality task graph by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13675">vercel/turborepo#13675</a></li>
<li>chore: Release Turborepo 2.10.9-canary.1 by <a
href="https://github.com/github-actions"><code>@​github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13687">vercel/turborepo#13687</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/turborepo/commit/33237d4be13d7b74768c2cf3353b19cfa8d1af7c"><code>33237d4</code></a>
publish 2.10.9 to registry</li>
<li><a
href="https://github.com/vercel/turborepo/commit/3b0e57f1289b2a6b3d6dd402bce928469d3b25fa"><code>3b0e57f</code></a>
fix: Prevent Windows process cleanup PID reuse (<a
href="https://redirect.github.com/vercel/turborepo/issues/13695">#13695</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/efe4e1bdf665f2950cf89d7968907de36c2f0737"><code>efe4e1b</code></a>
fix: Prune Bun wildcard workspace dev dependencies (<a
href="https://redirect.github.com/vercel/turborepo/issues/13694">#13694</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/a98e5cde97796088c6107684a64a40a967cd1ef0"><code>a98e5cd</code></a>
docs: Document dependency-driven Python tasks (<a
href="https://redirect.github.com/vercel/turborepo/issues/13676">#13676</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/c09a92f526b6dca9ea0243922f680803779759cd"><code>c09a92f</code></a>
chore: Release Turborepo 2.10.9-canary.1 (<a
href="https://redirect.github.com/vercel/turborepo/issues/13687">#13687</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/09bd548dddbff2a29086bdef7cb07b02d5e5458a"><code>09bd548</code></a>
test: Cover Python quality task graph (<a
href="https://redirect.github.com/vercel/turborepo/issues/13675">#13675</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/3584a5fb8edac9efc826fdea57e92088505fc76a"><code>3584a5f</code></a>
feat: Hash Python quality task inputs (<a
href="https://redirect.github.com/vercel/turborepo/issues/13674">#13674</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/0d43ff3cbf5ac8873c646a84b2fd7ae53097e08d"><code>0d43ff3</code></a>
test: Cover Python quality task commands (<a
href="https://redirect.github.com/vercel/turborepo/issues/13673">#13673</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/94708adc6bc19b41805741cc5a15ac5467a481cf"><code>94708ad</code></a>
feat: Synthesize Python quality tasks (<a
href="https://redirect.github.com/vercel/turborepo/issues/13672">#13672</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/e14f04ec6c2dc2791b0a3beb32df7515b31b3d4b"><code>e14f04e</code></a>
refactor: Extract uv native task specs (<a
href="https://redirect.github.com/vercel/turborepo/issues/13671">#13671</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/turborepo/compare/v2.10.8...v2.10.9">compare
view</a></li>
</ul>
</details>
<br />

Updates `chrome-devtools-mcp` from 1.6.0 to 1.7.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/releases">chrome-devtools-mcp's
releases</a>.</em></p>
<blockquote>
<h2>chrome-devtools-mcp: v1.7.0</h2>
<h2><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/compare/chrome-devtools-mcp-v1.6.0...chrome-devtools-mcp-v1.7.0">1.7.0</a>
(2026-08-10)</h2>
<h3>🎉 Features</h3>
<ul>
<li>add a utility function to check for localhost. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2454">#2454</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/c5ebf9e2023ec37c77d2ee355a345249ac91d192">c5ebf9e</a>)</li>
<li>Add get_heapsnapshot_object_details MCP tool (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2374">#2374</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/8432cb97a2a18f48afcb542f27dd88d7e5a11f36">8432cb9</a>)</li>
<li>Emit native contexts in snapshot summary (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2375">#2375</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/f78a911dc0ce843b08549560d0357712d3b18609">f78a911</a>)</li>
<li>Filter heap snapshot objects by native context (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2377">#2377</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/76fd2424984827802867672fcc8d0e0036f4a3af">76fd242</a>)</li>
<li><strong>telemetry:</strong> log devtools data. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2460">#2460</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/df2c753006ce77cdc8df8c7715d0b5c6675560d4">df2c753</a>)</li>
<li><strong>telemetry:</strong> log is_devtools_open with each tool
call. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2445">#2445</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/6f60eabf59dd197bcad244846ea5bbdd2e172286">6f60eab</a>)</li>
<li><strong>telemetry:</strong> report whether tool call is made on
localhost. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2455">#2455</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/6398b7e9a4ee91e50a1f1fd31aee45b0a80b14e4">6398b7e</a>)</li>
<li>update lighthouse to 13.4.1 (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2398">#2398</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/745ffe7132f8de97cba58b10e6501427fe254cfc">745ffe7</a>)</li>
</ul>
<h3>🛠️ Fixes</h3>
<ul>
<li>bound per-navigation network request retention (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2435">#2435</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/b08c73c8d8887813fdf358e81a43925b84ef10e4">b08c73c</a>)</li>
<li><strong>cli:</strong> validate session ids (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2475">#2475</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5ca9121d1805ba11215ddc36d6fb18d40403c1fc">5ca9121</a>)</li>
<li><strong>cli:</strong> warn about version mismatch between cli and
daemon (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2461">#2461</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/3afc44dac95757fcaa94e0e9296594bdf2ec97d1">3afc44d</a>)</li>
<li><strong>daemon:</strong> preserve hyphenated browser flags in arg
serialization and lazy daemon startup (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2405">#2405</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/d79f3ba24f3c38f7391ea7c9d886f9f7f404743c">d79f3ba</a>)</li>
<li>dispose heap snapshot workers on context teardown (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2428">#2428</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/f245c760570680fd808c8c034d138cf4a5c699e0">f245c76</a>)</li>
<li>do not throw synchronously when a CDP session is gone (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2466">#2466</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/ba4fe3eaa4c20e4e32ef6af3b78b4d9d9bbdc1d2">ba4fe3e</a>)</li>
<li>don't throw if Dialog was handled (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2437">#2437</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/574c3207ac5376f104960c5ba425dc4a2e0e3232">574c320</a>)</li>
<li>downscale viewport screenshots when no viewport is emulated (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2380">#2380</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/39c4140f119307bf9b4253ab368512a3aab6ebfc">39c4140</a>)</li>
<li>improve daemon lifecycle (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2360">#2360</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/3ee6a2710029f3718792da634c048bf4de90eaa6">3ee6a27</a>)</li>
<li>improve file writing (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2447">#2447</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/1da4bb06e2e598ec9cab9158e8d818aa8a344dc4">1da4bb0</a>)</li>
<li>include the tab id in <code>get_tab_id</code>'s text response (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2381">#2381</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/dcbaf495183a34d9bb0e3d9e8f3e566de6b425f8">dcbaf49</a>)</li>
<li><strong>memory:</strong> dispose the heap-snapshot worker when
loading fails (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2449">#2449</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/744738deaaa93e931628b8c42a38a317d0ae3c93">744738d</a>)</li>
<li><strong>performance:</strong> reset trace-running flag when
start_trace setup fails (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2420">#2420</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/40240c033f8ef91596b16e1b5b53974b385f8b5d">40240c0</a>)</li>
<li>regression after the <a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2443">#2443</a>
(<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2462">#2462</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/4c80ce46f3a456cbbc379a569506bcf44fc2bc48">4c80ce4</a>)</li>
<li>rename maxRetainedSize column (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2402">#2402</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/75c7048c80033d1826352f5f4464427e4235a526">75c7048</a>)</li>
<li><strong>screenshot:</strong> dispose element handle after
take_screenshot (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2422">#2422</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/fffb40e58bd5f7ff7e7110f07238b93d56f390ec">fffb40e</a>)</li>
<li>toggle lazy loading for source maps. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2486">#2486</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/8028bfe3abaecb67422530d05327c5ec72c53753">8028bfe</a>)</li>
<li><strong>wait:</strong> avoid 180s mutex stall when a dialog opens
during an action (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2427">#2427</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/b4e8f74ae5da327a5968c4836d9f5450a3bc2532">b4e8f74</a>)</li>
</ul>
<h3>📄 Documentation</h3>
<ul>
<li>Add devin cli install instruction to README (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2361">#2361</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/45262c0a5ca433e4d9d5700e3c1e006ac41f45f5">45262c0</a>)</li>
<li>correct the user data directory documentation (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2473">#2473</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5ddbffd0f364ecd073f4d42a56109950b1421a57">5ddbffd</a>)</li>
<li><strong>skills:</strong> update memory leak debugging skill to use
native MCP tools (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2436">#2436</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/99bd90a7881bea5161d4e6b5ab6da26c2a9a3721">99bd90a</a>)</li>
<li>Update Chrome requirement for categoryExperimentalWebmcp (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2163">#2163</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/354458e23ffd2d1aaaaf1486abb6eb793394797d">354458e</a>)</li>
<li>update security.md (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2362">#2362</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5012b077997618edeb2291d39d17553280f5b2a6">5012b07</a>)</li>
</ul>
<h3>🏗️ Refactor</h3>
<ul>
<li>clean up McpResponse.handle (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2392">#2392</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/348975d808aa0bb1f8a7795df36aa3ff738d6d42">348975d</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/blob/main/CHANGELOG.md">chrome-devtools-mcp's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/compare/chrome-devtools-mcp-v1.6.0...chrome-devtools-mcp-v1.7.0">1.7.0</a>
(2026-08-10)</h2>
<h3>🎉 Features</h3>
<ul>
<li>add a utility function to check for localhost. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2454">#2454</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/c5ebf9e2023ec37c77d2ee355a345249ac91d192">c5ebf9e</a>)</li>
<li>Add get_heapsnapshot_object_details MCP tool (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2374">#2374</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/8432cb97a2a18f48afcb542f27dd88d7e5a11f36">8432cb9</a>)</li>
<li>Emit native contexts in snapshot summary (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2375">#2375</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/f78a911dc0ce843b08549560d0357712d3b18609">f78a911</a>)</li>
<li>Filter heap snapshot objects by native context (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2377">#2377</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/76fd2424984827802867672fcc8d0e0036f4a3af">76fd242</a>)</li>
<li><strong>telemetry:</strong> log devtools data. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2460">#2460</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/df2c753006ce77cdc8df8c7715d0b5c6675560d4">df2c753</a>)</li>
<li><strong>telemetry:</strong> log is_devtools_open with each tool
call. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2445">#2445</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/6f60eabf59dd197bcad244846ea5bbdd2e172286">6f60eab</a>)</li>
<li><strong>telemetry:</strong> report whether tool call is made on
localhost. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2455">#2455</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/6398b7e9a4ee91e50a1f1fd31aee45b0a80b14e4">6398b7e</a>)</li>
<li>update lighthouse to 13.4.1 (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2398">#2398</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/745ffe7132f8de97cba58b10e6501427fe254cfc">745ffe7</a>)</li>
</ul>
<h3>🛠️ Fixes</h3>
<ul>
<li>bound per-navigation network request retention (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2435">#2435</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/b08c73c8d8887813fdf358e81a43925b84ef10e4">b08c73c</a>)</li>
<li><strong>cli:</strong> validate session ids (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2475">#2475</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5ca9121d1805ba11215ddc36d6fb18d40403c1fc">5ca9121</a>)</li>
<li><strong>cli:</strong> warn about version mismatch between cli and
daemon (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2461">#2461</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/3afc44dac95757fcaa94e0e9296594bdf2ec97d1">3afc44d</a>)</li>
<li><strong>daemon:</strong> preserve hyphenated browser flags in arg
serialization and lazy daemon startup (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2405">#2405</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/d79f3ba24f3c38f7391ea7c9d886f9f7f404743c">d79f3ba</a>)</li>
<li>dispose heap snapshot workers on context teardown (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2428">#2428</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/f245c760570680fd808c8c034d138cf4a5c699e0">f245c76</a>)</li>
<li>do not throw synchronously when a CDP session is gone (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2466">#2466</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/ba4fe3eaa4c20e4e32ef6af3b78b4d9d9bbdc1d2">ba4fe3e</a>)</li>
<li>don't throw if Dialog was handled (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2437">#2437</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/574c3207ac5376f104960c5ba425dc4a2e0e3232">574c320</a>)</li>
<li>downscale viewport screenshots when no viewport is emulated (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2380">#2380</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/39c4140f119307bf9b4253ab368512a3aab6ebfc">39c4140</a>)</li>
<li>improve daemon lifecycle (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2360">#2360</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/3ee6a2710029f3718792da634c048bf4de90eaa6">3ee6a27</a>)</li>
<li>improve file writing (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2447">#2447</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/1da4bb06e2e598ec9cab9158e8d818aa8a344dc4">1da4bb0</a>)</li>
<li>include the tab id in <code>get_tab_id</code>'s text response (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2381">#2381</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/dcbaf495183a34d9bb0e3d9e8f3e566de6b425f8">dcbaf49</a>)</li>
<li><strong>memory:</strong> dispose the heap-snapshot worker when
loading fails (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2449">#2449</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/744738deaaa93e931628b8c42a38a317d0ae3c93">744738d</a>)</li>
<li><strong>performance:</strong> reset trace-running flag when
start_trace setup fails (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2420">#2420</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/40240c033f8ef91596b16e1b5b53974b385f8b5d">40240c0</a>)</li>
<li>regression after the <a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2443">#2443</a>
(<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2462">#2462</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/4c80ce46f3a456cbbc379a569506bcf44fc2bc48">4c80ce4</a>)</li>
<li>rename maxRetainedSize column (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2402">#2402</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/75c7048c80033d1826352f5f4464427e4235a526">75c7048</a>)</li>
<li><strong>screenshot:</strong> dispose element handle after
take_screenshot (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2422">#2422</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/fffb40e58bd5f7ff7e7110f07238b93d56f390ec">fffb40e</a>)</li>
<li>toggle lazy loading for source maps. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2486">#2486</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/8028bfe3abaecb67422530d05327c5ec72c53753">8028bfe</a>)</li>
<li><strong>wait:</strong> avoid 180s mutex stall when a dialog opens
during an action (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2427">#2427</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/b4e8f74ae5da327a5968c4836d9f5450a3bc2532">b4e8f74</a>)</li>
</ul>
<h3>📄 Documentation</h3>
<ul>
<li>Add devin cli install instruction to README (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2361">#2361</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/45262c0a5ca433e4d9d5700e3c1e006ac41f45f5">45262c0</a>)</li>
<li>correct the user data directory documentation (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2473">#2473</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5ddbffd0f364ecd073f4d42a56109950b1421a57">5ddbffd</a>)</li>
<li><strong>skills:</strong> update memory leak debugging skill to use
native MCP tools (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2436">#2436</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/99bd90a7881bea5161d4e6b5ab6da26c2a9a3721">99bd90a</a>)</li>
<li>Update Chrome requirement for categoryExperimentalWebmcp (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2163">#2163</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/354458e23ffd2d1aaaaf1486abb6eb793394797d">354458e</a>)</li>
<li>update security.md (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2362">#2362</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5012b077997618edeb2291d39d17553280f5b2a6">5012b07</a>)</li>
</ul>
<h3>🏗️ Refactor</h3>
<ul>
<li>clean up McpResponse.handle (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2392">#2392</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/348975d808aa0bb1f8a7795df36aa3ff738d6d42">348975d</a>)</li>
<li>introduce Explicit resouce managent (using) (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2443">#2443</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5b25370c9cd779032c3c9dc9880eca7031c73005">5b25370</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/774d78f5eef5e610407a0c92fa6ec5ed74b027e8"><code>774d78f</code></a>
chore(main): release chrome-devtools-mcp 1.7.0 (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2363">#2363</a>)</li>
<li><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5ddbffd0f364ecd073f4d42a56109950b1421a57"><code>5ddbffd</code></a>
docs: correct the user data directory documentation (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2473">#2473</a>)</li>
<li><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/8028bfe3abaecb67422530d05327c5ec72c53753"><code>8028bfe</code></a>
fix: toggle lazy loading for source maps. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2486">#2486</a>)</li>
<li><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/d1e4d711aa520c67df045a2f805380e9b3307abd"><code>d1e4d71</code></a>
chore(deps): bump sigstore/cosign-installer from 4.1.0 to 4.1.2 in the
all gr...</li>
<li><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/744738deaaa93e931628b8c42a38a317d0ae3c93"><code>744738d</code></a>
fix(memory): dispose the heap-snapshot worker when loading fails (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2449">#2449</a>)</li>
<li><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/ca66d0f321a57473ae400fa5e82842d4bbffe210"><code>ca66d0f</code></a>
chore(dev-deps): bump devtools-frontend (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2498">#2498</a>)</li>
<li><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/2f375c7e592d15ee9d0e1d665a4600a8b20879d0"><code>2f375c7</code></a>
chore: fix Explicit resource management polyfill (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2496">#2496</a>)</li>
<li><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/830f78b8ce19f8ee1e1d8c4d812bd9d6e4f48c2f"><code>830f78b</code></a>
chore: re-use connection adapter and dispose devtools unvierse (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2465">#2465</a>)</li>
<li><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/4c96dca1f19711a80308bd0d608fb8d40e29d152"><code>4c96dca</code></a>
ci: add main branch (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2497">#2497</a>)</li>
<li><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/71d897b27e7936c1a8911d053e19d92ec2c46655"><code>71d897b</code></a>
chore: add a new profiler scenario for get_console_messages. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2491">#2491</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/compare/chrome-devtools-mcp-v1.6.0...chrome-devtools-mcp-v1.7.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `@earendil-works/pi-coding-agent` from 0.83.0 to 0.84.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/earendil-works/pi/releases">@​earendil-works/pi-coding-agent's
releases</a>.</em></p>
<blockquote>
<h2>v0.84.1</h2>
<h3>New Features</h3>
<ul>
<li><strong>Qwen Token Plan Individual</strong> — Use the built-in
provider for models documented for Individual subscriptions. See <a
href="https://github.com/earendil-works/pi/blob/v0.84.1/packages/coding-agent/docs/providers.md#api-keys">API
Keys</a>.</li>
<li><strong>Authentication readiness checks</strong> — Use <code>pi auth
check</code> to verify provider or model credentials, optionally
emitting the resolved credential.</li>
<li><strong>Improved fullscreen interaction</strong> — Select words and
paragraphs with multiple clicks and configure half-page transcript
scrolling. See <a
href="https://github.com/earendil-works/pi/blob/v0.84.1/packages/coding-agent/docs/keybindings.md#tui-fullscreen-viewport">TUI
Fullscreen Viewport</a>.</li>
<li><strong>Terminating blocked tool calls</strong> — Extension
<code>tool_call</code> handlers can stop all-terminating batches without
another model call. See <a
href="https://github.com/earendil-works/pi/blob/v0.84.1/packages/coding-agent/docs/extensions.md#tool-events">Tool
Events</a>.</li>
</ul>
<h3>Added</h3>
<ul>
<li>Added Qwen Token Plan Individual as a built-in provider with its
documented subscription model catalog and the shared international
<code>QWEN_TOKEN_PLAN_API_KEY</code>. See <a
href="https://github.com/earendil-works/pi/blob/v0.84.1/packages/coding-agent/docs/providers.md#api-keys">API
Keys</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7659">#7659</a>
by <a
href="https://github.com/arasovic"><code>@​arasovic</code></a>).</li>
<li>Added <code>pi auth check</code> provider/model auth preflight with
optional credential output (<a
href="https://redirect.github.com/earendil-works/pi/issues/7152">#7152</a>).</li>
<li>Added <code>terminate</code> support to blocked extension
<code>tool_call</code> events so all-terminating batches can skip the
automatic follow-up model call. See <a
href="https://github.com/earendil-works/pi/blob/v0.84.1/packages/coding-agent/docs/extensions.md#tool-events">Tool
Events</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7715">#7715</a>
by <a href="https://github.com/muyiyr"><code>@​muyiyr</code></a>).</li>
<li>Added inherited double-click word and whitespace selection,
granularity-aware drag selection, and triple-click paragraph selection
in fullscreen mode (<a
href="https://redirect.github.com/earendil-works/pi/issues/7725">#7725</a>,
<a
href="https://redirect.github.com/earendil-works/pi/pull/7733">#7733</a>
by <a href="https://github.com/volsa"><code>@​volsa</code></a>).</li>
<li>Added inherited unbound half-page transcript scrolling actions for
fullscreen mode. See <a
href="https://github.com/earendil-works/pi/blob/v0.84.1/packages/coding-agent/docs/keybindings.md#tui-fullscreen-viewport">TUI
Fullscreen Viewport</a> (<a
href="https://redirect.github.com/earendil-works/pi/issues/7735">#7735</a>).</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Softened the bash tool's <code>PI_*</code> environment guideline in
an attempt to reduce unnecessary inspection commands (<a
href="https://redirect.github.com/earendil-works/pi/issues/7128">#7128</a>).</li>
<li>Reduced worst-case automatic terminal theme detection delay from 200
ms to 100 ms by probing color-scheme and background support
concurrently.</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fixed Bun standalone binaries crashing on startup when the cwd
contains a <code>bunfig.toml</code> with <code>preload</code> by
compiling with <code>--no-compile-autoload-bunfig</code> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7685">#7685</a>
by <a
href="https://github.com/geril07"><code>@​geril07</code></a>).</li>
<li>Fixed extension TUI method wrappers recursing indefinitely when
delegating to the original method (<a
href="https://redirect.github.com/earendil-works/pi/issues/7731">#7731</a>).</li>
<li>Fixed right-click not pasting clipboard text in fullscreen mode on
Windows.</li>
<li>Fixed inherited <code>Agent.reset()</code> clearing transcript and
runtime state during active runs; it now rejects until the agent is idle
(<a
href="https://redirect.github.com/earendil-works/pi/pull/7717">#7717</a>
by <a
href="https://github.com/wesleyzhangwq"><code>@​wesleyzhangwq</code></a>).</li>
<li>Fixed inherited LaTeX relation, multiplication, and named-operator
spacing, and matrix composition with stacked fractions, operator limits,
and adjacent matrices.</li>
<li>Reduced inherited fullscreen mouse event volume under tmux, Zellij,
and GNU Screen by using button-motion tracking instead of all-motion
tracking.</li>
</ul>
<h2>v0.84.0</h2>
<h3>New Features</h3>
<ul>
<li><strong>Fullscreen TUI mode</strong> — Switch between regular and
fullscreen modes at runtime, with a sticky editor and footer,
independently scrollable transcript, and draggable scrollbars. See <a
href="https://github.com/earendil-works/pi/blob/v0.84.0/packages/coding-agent/docs/settings.md#ui--display">UI
&amp; Display</a>.</li>
<li><strong>Mermaid and LaTeX rendering</strong> — Render Mermaid
diagrams and terminal-friendly Unicode math in interactive transcripts.
See <a
href="https://github.com/earendil-works/pi/blob/v0.84.0/packages/coding-agent/docs/settings.md#markdown">Markdown
settings</a> and <a
href="https://github.com/earendil-works/pi/blob/v0.84.0/packages/tui/README.md#markdown">TUI
Markdown</a>.</li>
<li><strong>Per-directory context overrides</strong> — Use
<code>AGENTS.override.md</code> to replace context files for a specific
directory. See <a
href="https://github.com/earendil-works/pi/blob/v0.84.0/packages/coding-agent/docs/usage.md#context-files">Context
Files</a>.</li>
<li><strong>Advanced custom model sampling</strong> — Configure
arbitrary OpenAI-compatible <code>samplingParams</code> and opt-in vLLM
<code>thinking_token_budget</code> values. See <a
href="https://github.com/earendil-works/pi/blob/v0.84.0/packages/coding-agent/docs/models.md#sampling-parameters">Sampling
Parameters</a>.</li>
<li><strong>Baseten provider</strong> — Use built-in Baseten
authentication and model support. See <a
href="https://github.com/earendil-works/pi/blob/v0.84.0/packages/coding-agent/docs/providers.md#api-keys">API
Keys</a>.</li>
</ul>
<h3>Breaking Changes</h3>
<ul>
<li>
<p>Renamed the inherited pi-ai <code>ModelsStreamTransforms</code>
interface to <code>ModelsRequestTransforms</code> because its header
transformation now applies to all authenticated provider requests.</p>
</li>
<li>
<p>Changed JSON and RPC <code>message_update</code> events to emit only
<code>assistantMessageEvent</code> deltas, removing the cumulative
<code>message</code> and <code>assistantMessageEvent.partial</code>
fields that caused quadratic output growth. Clients that need partial
messages must assemble deltas between <code>message_start</code> and
<code>message_end</code>; the latter remains authoritative (<a
href="https://redirect.github.com/earendil-works/pi/issues/7290">#7290</a>).</p>
</li>
<li>
<p><code>ModelRegistry.getApiKeyAndHeaders()</code> now returns
<code>ProviderHeaders</code> with <code>string | null</code> values and
preserves <code>null</code> header-deletion markers. Extensions that
inspect returned headers must handle <code>null</code>; extensions
forwarding them to pi-ai streams should pass them through unchanged.
This prevents placeholder OpenAI credentials from being sent through
Cloudflare AI Gateway (<a
href="https://redirect.github.com/earendil-works/pi/issues/7030">#7030</a>).</p>
</li>
<li>
<p>Changed <code>ModelRegistry.refresh()</code> to accept
<code>ModelsRefreshOptions</code> and return
<code>ModelsRefreshResult</code> instead of discarding cancellation and
provider errors.</p>
</li>
<li>
<p>Changed <code>ModelRuntime.setRuntimeApiKey()</code> to accept auth
cancellation options rather than catalog refresh options. Call
<code>refresh({ providers: [providerId], signal })</code> separately
when remote freshness is required.</p>
</li>
<li>
<p>Required config-form extension OAuth <code>refreshToken(credentials,
signal)</code> callbacks to accept and honor a concrete abort
signal.</p>
</li>
<li>
<p>Replaced dynamic provider refresh context store access with the
read-only <code>context.stored</code> snapshot and generation-checked
<code>context.publish()</code> transaction.</p>
<p><strong>Providers built with <code>createProvider({ fetchModels
})</code>:</strong> no catalog-publication migration is required. Before
and after, return the fetched models and register the resulting
provider; <code>createProvider()</code> owns restoration, persistence,
and in-memory publication.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/CHANGELOG.md">@​earendil-works/pi-coding-agent's
changelog</a>.</em></p>
<blockquote>
<h2>[0.84.1] - 2026-08-07</h2>
<h3>New Features</h3>
<ul>
<li><strong>Qwen Token Plan Individual</strong> — Use the built-in
provider for models documented for Individual subscriptions. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#api-keys">API
Keys</a>.</li>
<li><strong>Authentication readiness checks</strong> — Use <code>pi auth
check</code> to verify provider or model credentials, optionally
emitting the resolved credential.</li>
<li><strong>Improved fullscreen interaction</strong> — Select words and
paragraphs with multiple clicks and configure half-page transcript
scrolling. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/keybindings.md#tui-fullscreen-viewport">TUI
Fullscreen Viewport</a>.</li>
<li><strong>Terminating blocked tool calls</strong> — Extension
<code>tool_call</code> handlers can stop all-terminating batches without
another model call. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/extensions.md#tool-events">Tool
Events</a>.</li>
</ul>
<h3>Added</h3>
<ul>
<li>Added Qwen Token Plan Individual as a built-in provider with its
documented subscription model catalog and the shared international
<code>QWEN_TOKEN_PLAN_API_KEY</code>. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#api-keys">API
Keys</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7659">#7659</a>
by <a
href="https://github.com/arasovic"><code>@​arasovic</code></a>).</li>
<li>Added <code>pi auth check</code> provider/model auth preflight with
optional credential output (<a
href="https://redirect.github.com/earendil-works/pi/issues/7152">#7152</a>).</li>
<li>Added <code>terminate</code> support to blocked extension
<code>tool_call</code> events so all-terminating batches can skip the
automatic follow-up model call. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/extensions.md#tool-events">Tool
Events</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7715">#7715</a>
by <a href="https://github.com/muyiyr"><code>@​muyiyr</code></a>).</li>
<li>Added inherited double-click word and whitespace selection,
granularity-aware drag selection, and triple-click paragraph selection
in fullscreen mode (<a
href="https://redirect.github.com/earendil-works/pi/issues/7725">#7725</a>,
<a
href="https://redirect.github.com/earendil-works/pi/pull/7733">#7733</a>
by <a href="https://github.com/volsa"><code>@​volsa</code></a>).</li>
<li>Added inherited unbound half-page transcript scrolling actions for
fullscreen mode. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/keybindings.md#tui-fullscreen-viewport">TUI
Fullscreen Viewport</a> (<a
href="https://redirect.github.com/earendil-works/pi/issues/7735">#7735</a>).</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Softened the bash tool's <code>PI_*</code> environment guideline in
an attempt to reduce unnecessary inspection commands (<a
href="https://redirect.github.com/earendil-works/pi/issues/7128">#7128</a>).</li>
<li>Reduced worst-case automatic terminal theme detection delay from 200
ms to 100 ms by probing color-scheme and background support
concurrently.</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fixed Bun standalone binaries crashing on startup when the cwd
contains a <code>bunfig.toml</code> with <code>preload</code> by
compiling with <code>--no-compile-autoload-bunfig</code> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7685">#7685</a>
by <a
href="https://github.com/geril07"><code>@​geril07</code></a>).</li>
<li>Fixed extension TUI method wrappers recursing indefinitely when
delegating to the original method (<a
href="https://redirect.github.com/earendil-works/pi/issues/7731">#7731</a>).</li>
<li>Fixed right-click not pasting clipboard text in fullscreen mode on
Windows.</li>
<li>Fixed inherited <code>Agent.reset()</code> clearing transcript and
runtime state during active runs; it now rejects until the agent is idle
(<a
href="https://redirect.github.com/earendil-works/pi/pull/7717">#7717</a>
by <a
href="https://github.com/wesleyzhangwq"><code>@​wesleyzhangwq</code></a>).</li>
<li>Fixed inherited LaTeX relation, multiplication, and named-operator
spacing, and matrix composition with stacked fractions, operator limits,
and adjacent matrices.</li>
<li>Reduced inherited fullscreen mouse event volume under tmux, Zellij,
and GNU Screen by using button-motion tracking instead of all-motion
tracking.</li>
</ul>
<h2>[0.84.0] - 2026-08-06</h2>
<h3>New Features</h3>
<ul>
<li><strong>Fullscreen TUI mode</strong> — Switch between regular and
fullscreen modes at runtime, with a sticky editor and footer,
independently scrollable transcript, and draggable scrollbars. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/settings.md#ui-display">UI
&amp; Display</a>.</li>
<li><strong>Mermaid and LaTeX rendering</strong> — Render Mermaid
diagrams and terminal-friendly Unicode math in interactive transcripts.
See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/settings.md#markdown">Markdown
settings</a> and <a
href="https://github.com/earendil-works/pi/blob/main/packages/tui/README.md#markdown">TUI
Markdown</a>.</li>
<li><strong>Per-directory context overrides</strong> — Use
<code>AGENTS.override.md</code> to replace context files for a specific
directory. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/usage.md#context-files">Context
Files</a>.</li>
<li><strong>Advanced custom model sampling</strong> — Configure
arbitrary OpenAI-compatible <code>samplingParams</code> and opt-in vLLM
<code>thinking_token_budget</code> values. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/models.md#sampling-parameters">Sampling
Parameters</a>.</li>
<li><strong>Baseten provider</strong> — Use built-in Baseten
authentication and model support. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#api-keys">API
Keys</a>.</li>
</ul>
<h3>Breaking Changes</h3>
<ul>
<li>Renamed the inherited pi-ai <code>ModelsStreamTransforms</code>
interface to <code>ModelsRequestTransforms</code> because its header
transformation now applies to all authenticated provider requests.</li>
<li>Changed JSON and RPC <code>message_update</code> events to emit only
<code>assistantMessageEvent</code> deltas, removing the cumulative
<code>message</code> and <code>assistantMessageEvent.partial</code>
fields that caused quadratic output growth. Clients that need partial
messages must assemble deltas between <code>message_start</code> and
<code>message_end</code>; the latter remains authoritative (<a
href="https://redirect.github.com/earendil-works/pi/issues/7290">#7290</a>).</li>
<li><code>ModelRegistry.getApiKeyAndHeaders()</code> now returns
<code>ProviderHeaders</code> with <code>string | null</code> values and
preserves <code>null</code> header-deletion markers. Extensions that
inspect returned headers must handle <code>null</code>; extensions
forwarding them to pi-ai streams should pass them through unchanged.
This prevents placeholder OpenAI credentials from being sent through
Cloudflare AI Gateway (<a
href="https://redirect.github.com/earendil-works/pi/issues/7030">#7030</a>).</li>
<li>Changed <code>ModelRegistry.refresh()</code> to accept
<code>ModelsRefreshOptions</code> and return
<code>ModelsRefreshResult</code> instead of discarding cancellation and
provider errors.</li>
<li>Changed <code>ModelRuntime.setRuntimeApiKey()</code> to accept auth
cancellation options rather than catalog refresh options. Call
<code>refresh({ providers: [providerId], signal })</code> separately
when remote freshness is required.</li>
<li>Required config-form extension OAuth <code>refreshToken(credentials,
signal)</code> callbacks to accept and honor a concrete abort
signal.</li>
<li>Replaced dynamic provider refresh context store access with the
read-only <code>context.stored</code> snapshot and generation-checked
<code>context.publish()</code> transac...

_Description has been truncated_

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-17 18:57:12 +02:00
jkomyno a59a409204 chore(cli): align Effect dependencies 2026-08-03 17:04:44 +05:30
jkomyno a850f2c1c1 chore(deps-dev): refresh development tooling 2026-08-03 17:04:43 +05:30
Alberto Schiabel 503b50ab02 chore(deps): refresh SDK, Python, and CI dependencies (#3955) 
This PR:

- splits https://github.com/ComposioHQ/composio/pull/3953 in two: this
PR carries every dependency and GitHub Actions bump **except** the docs
site, which follows in a stacked PR
- consolidates and supersedes Dependabot PRs #3915, #3916, and #3934
through #3942
- adopts TypeScript 7.0.2 for primary compilation while retaining the
`@typescript/typescript6` API lane that TypeScript-ESLint still
requires, following the upstream side-by-side guidance
- refreshes Python core and provider dependencies, lockfiles, and the
Ruff 0.16 lint configuration
- updates every GitHub Action with a verified newer official release,
including majors, while retaining immutable commit SHA pins and
migrating setup-uv cache pruning
- deletes four per-package `eslint.config.mjs` shims: under ESLint 10
the default per-file config lookup re-anchors the root config's globs
into each package, so `pnpm lint` stayed green while the CLI's
try/catch, `process.env` and node-builtin bans went unenforced
- bounds and documents the new `brace-expansion` and `@hono/node-server`
security overrides, raising the `@hono/node-server` floor to 2.0.10 to
clear GHSA-9mqv-5hh9-4cgg
- preserves intentional compatibility fixtures and lanes for AI SDK 6,
Zod 3, TypeScript 5.8, Mastra AI SDK 5, and Python provider constraints

## Context

The docs site is a separate Bun workspace with its own `bun.lock` and is
not a pnpm workspace member, so the two halves share no lockfile and no
build. Splitting them keeps the Fumadocs 11 migration (a breaking API
change with real refactoring) reviewable on its own, independently of
the mechanical version bumps here.

The `brace-expansion` override deliberately spans majors:
GHSA-mh99-v99m-4gvg (HIGH) is published as a single `<=5.0.7` range with
no 1.x or 2.x backport, so narrowing it to the 5.x line puts
`brace-expansion` 2.1.2 back under `core>minimatch>brace-expansion` and
`pnpm audit --prod --audit-level=high` exits 1. Verified both ways; the
trade-off it buys is recorded inline in `pnpm-workspace.yaml`.

Verified on this branch standalone: `pnpm install --frozen-lockfile`,
`pnpm lint`, `pnpm typecheck`, `pnpm build:packages`, `pnpm test` (963
tests, 26/26 tasks), and `pnpm audit --prod --audit-level=high`.
 2026-07-27 17:57:29 +05:30
sdkrelease[bot] 26f3c626e9 Release: update version (#3717) 
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to next, this PR will
be updated.


# Releases
## @composio/core@0.14.0

### Minor Changes

- fc17c37: Export the sensitive-file-upload denylist guard from the
package root so downstream packages share one implementation:
`assertSafeFileUploadPath`, `isBlockedSensitiveFileUploadPath`, and
`BUILTIN_FILE_UPLOAD_PATH_DENY_SEGMENTS`. The guard now routes its
filesystem access through the internal `#platform` abstraction (adding a
`realpathSync` platform method), so it is edge/workerd-safe and the
module carries no static `node:*` imports. Behavior on Node/Bun is
unchanged.
- 20a4711: `triggers.create` now resolves the connection from `user_id`
on the backend instead of client-side.

- The SDK no longer makes an extra `connectedAccounts.list()` call. When
`connectedAccountId` is omitted, the backend resolves the first active
connection for the user and the trigger's toolkit (ordered by most
recently created), matching tool execution.
- **Behavior change:** `create` no longer throws
`ComposioConnectedAccountNotFoundError` for a missing or invalid
connection. That case now surfaces as the backend error from the upsert
call. `ComposioTriggerTypeNotFoundError` (invalid slug) and
`ValidationError` (including empty `userId`) are still thrown
client-side.
- **Requires a backend that resolves the trigger connection from
`user_id` on upsert**
([ComposioHQ/platform#10932](https://github.com/ComposioHQ/platform/pull/10932)).
Self-hosted deployments must be on a version that includes it.

### Patch Changes

- 7125576: Normalize duplicate JSON Schema `required` entries before
provider tool schemas are emitted.
- 58bc93b: Refresh dependency ranges and lockfiles across the workspace.
- 4c3a321: Disable client retries on `tools.execute` and
`tools.proxyExecute`. These are non-idempotent writes, so a silent retry
after a read timeout could duplicate the side effect (e.g. send the same
email more than once). Both now route through a sibling client built
with `maxRetries: 0`; reads keep the default retry behaviour.
- b07fcad: Add an eve provider: `EveProvider` makes `session.tools()`
return eve-native `defineTool`s, `defineComposioTools` is the
replay-safe `step.started` resolver, and `(ctx, next)` hooks can
rewrite, deny, or transform Tool Router meta-tool calls.

Preserve successful local-tool results when the remote half of a mixed
`COMPOSIO_MULTI_EXECUTE_TOOL` batch fails at the transport layer, so
callers can see which side effects already completed before retrying.

- fa933a6: Fix the `homepage` links in these packages' `package.json`.
They pointed at `github.com/ComposioHQ/composio/tree/main/...`, but the
default branch is `next` and no `main` branch exists, so every link
404'd on npm and in editor tooltips. They now point at `tree/next/...`.
- 2ef40ce: Treat local file paths that begin with `http` as paths
instead of URLs, ensuring that upload allowlist and sensitive-file
denylist checks still run.
- e78ed31: Execute every parallel tool call in
`OpenAIProvider.handleToolCalls`. It previously only ran the first tool
call in each assistant message, so parallel tool calls (on by default)
dropped the rest and left their `tool_call_id`s unanswered, failing the
next request.

The calls are run sequentially, in the order the model returned them —
here "parallel" means the model issued several calls in one turn, not
that they execute concurrently — so each `tool_call_id` is answered
exactly once and the tool messages come back in a deterministic order.

Only the first choice is handled. Tool results are fed back into a
single assistant turn, so with `n > 1` iterating over every choice would
run each tool call once per choice and orphan the `tool_call_id`s from
the alternative completions.

- a0f37a7: Close two secret/SSRF exposure surfaces in the TypeScript
SDK:

- **SSRF guard on URL file inputs.** `composio.files.upload(url)` and
automatic file upload during tool execution previously did a raw
`fetch()` on user-supplied URLs with no guard. They now resolve the host
and refuse private, loopback, link-local (incl. the `169.254.169.254`
cloud-metadata endpoint), CGNAT, and reserved addresses, reject
non-`http(s)` schemes, and follow redirects manually so each hop is
re-validated (blocking a public URL that redirects into internal space).
Blocked requests throw `ComposioBlockedInternalUrlError`. Node-only;
behaviour for public URLs is unchanged.
- **Telemetry redaction.** Error telemetry previously shipped
`error.message` / `error.stack` verbatim. They are now passed through a
redactor that strips URL query strings, `Authorization` bearer/basic
credentials, and secret-like `key=value` pairs (API keys, tokens, client
secrets, passwords) before transport.

- 820abb9: Resolve toolkit version pins case-insensitively. Version maps
are keyed by normalized (lowercase) slugs, but `getToolkitVersion`
previously looked them up with the raw slug, so a pin configured under a
different casing (e.g. `{ GitHub: '20250101_00' }` or
`COMPOSIO_TOOLKIT_VERSION_GITHUB`) could silently fall back to
`'latest'`. Normalization is now centralized in a single
`normalizeToolkitSlug` helper used symmetrically on both the write
(map-building) and read (lookup) paths, so the two sides can no longer
drift. This mirrors the equivalent fix in the Python SDK.
- Updated dependencies [58bc93b]
- Updated dependencies [fa933a6]
  - @composio/json-schema-to-zod@0.2.1
## @composio/experimental@0.2.0

### Minor Changes

- b07fcad: Add an eve provider: `EveProvider` makes `session.tools()`
return eve-native `defineTool`s, `defineComposioTools` is the
replay-safe `step.started` resolver, and `(ctx, next)` hooks can
rewrite, deny, or transform Tool Router meta-tool calls.

Preserve successful local-tool results when the remote half of a mixed
`COMPOSIO_MULTI_EXECUTE_TOOL` batch fails at the transport layer, so
callers can see which side effects already completed before retrying.

### Patch Changes

- 58bc93b: Refresh dependency ranges and lockfiles across the workspace.
- fa933a6: Fix the `homepage` links in these packages' `package.json`.
They pointed at `github.com/ComposioHQ/composio/tree/main/...`, but the
default branch is `next` and no `main` branch exists, so every link
404'd on npm and in editor tooltips. They now point at `tree/next/...`.
## @composio/json-schema-to-zod@0.2.1

### Patch Changes

- 58bc93b: Refresh dependency ranges and lockfiles across the workspace.
- fa933a6: Fix the `homepage` links in these packages' `package.json`.
They pointed at `github.com/ComposioHQ/composio/tree/main/...`, but the
default branch is `next` and no `main` branch exists, so every link
404'd on npm and in editor tooltips. They now point at `tree/next/...`.
## @composio/anthropic@0.10.1

### Patch Changes

- 7125576: Normalize duplicate JSON Schema `required` entries before
provider tool schemas are emitted.
- 58bc93b: Refresh dependency ranges and lockfiles across the workspace.
- fa933a6: Fix the `homepage` links in these packages' `package.json`.
They pointed at `github.com/ComposioHQ/composio/tree/main/...`, but the
default branch is `next` and no `main` branch exists, so every link
404'd on npm and in editor tooltips. They now point at `tree/next/...`.
## @composio/claude-agent-sdk@0.10.1

### Patch Changes

- 58bc93b: Refresh dependency ranges and lockfiles across the workspace.
- fa933a6: Fix the `homepage` links in these packages' `package.json`.
They pointed at `github.com/ComposioHQ/composio/tree/main/...`, but the
default branch is `next` and no `main` branch exists, so every link
404'd on npm and in editor tooltips. They now point at `tree/next/...`.
## @composio/cloudflare@0.10.1

### Patch Changes

- 7125576: Normalize duplicate JSON Schema `required` entries before
provider tool schemas are emitted.
- fa933a6: Fix the `homepage` links in these packages' `package.json`.
They pointed at `github.com/ComposioHQ/composio/tree/main/...`, but the
default branch is `next` and no `main` branch exists, so every link
404'd on npm and in editor tooltips. They now point at `tree/next/...`.
## @composio/google@0.10.1

### Patch Changes

- 7125576: Normalize duplicate JSON Schema `required` entries before
provider tool schemas are emitted.
- fa933a6: Fix the `homepage` links in these packages' `package.json`.
They pointed at `github.com/ComposioHQ/composio/tree/main/...`, but the
default branch is `next` and no `main` branch exists, so every link
404'd on npm and in editor tooltips. They now point at `tree/next/...`.
## @composio/langchain@0.10.1

### Patch Changes

- 58bc93b: Refresh dependency ranges and lockfiles across the workspace.
- fa933a6: Fix the `homepage` links in these packages' `package.json`.
They pointed at `github.com/ComposioHQ/composio/tree/main/...`, but the
default branch is `next` and no `main` branch exists, so every link
404'd on npm and in editor tooltips. They now point at `tree/next/...`.
## @composio/llamaindex@0.10.1

### Patch Changes

- fa933a6: Fix the `homepage` links in these packages' `package.json`.
They pointed at `github.com/ComposioHQ/composio/tree/main/...`, but the
default branch is `next` and no `main` branch exists, so every link
404'd on npm and in editor tooltips. They now point at `tree/next/...`.
## @composio/mastra@0.10.2

### Patch Changes

- 58bc93b: Refresh dependency ranges and lockfiles across the workspace.
- fa933a6: Fix the `homepage` links in these packages' `package.json`.
They pointed at `github.com/ComposioHQ/composio/tree/main/...`, but the
default branch is `next` and no `main` branch exists, so every link
404'd on npm and in editor tooltips. They now point at `tree/next/...`.
## @composio/openai@0.10.1

### Patch Changes

- 7125576: Normalize duplicate JSON Schema `required` entries before
provider tool schemas are emitted.
- fa933a6: Fix the `homepage` links in these packages' `package.json`.
They pointed at `github.com/ComposioHQ/composio/tree/main/...`, but the
default branch is `next` and no `main` branch exists, so every link
404'd on npm and in editor tooltips. They now point at `tree/next/...`.
## @composio/openai-agents@0.10.1

### Patch Changes

- 7125576: Normalize duplicate JSON Schema `required` entries before
provider tool schemas are emitted.
- 58bc93b: Refresh dependency ranges and lockfiles across the workspace.
- fa933a6: Fix the `homepage` links in these packages' `package.json`.
They pointed at `github.com/ComposioHQ/composio/tree/main/...`, but the
default branch is `next` and no `main` branch exists, so every link
404'd on npm and in editor tooltips. They now point at `tree/next/...`.
## @composio/vercel@0.11.1

### Patch Changes

- fa933a6: Fix the `homepage` links in these packages' `package.json`.
They pointed at `github.com/ComposioHQ/composio/tree/main/...`, but the
default branch is `next` and no `main` branch exists, so every link
404'd on npm and in editor tooltips. They now point at `tree/next/...`.
## @composio/slim@0.14.0

### Patch Changes

- 58bc93b: Refresh dependency ranges and lockfiles across the workspace.
- fa933a6: Fix the `homepage` links in these packages' `package.json`.
They pointed at `github.com/ComposioHQ/composio/tree/main/...`, but the
default branch is `next` and no `main` branch exists, so every link
404'd on npm and in editor tooltips. They now point at `tree/next/...`.
- Updated dependencies [58bc93b]
- Updated dependencies [fa933a6]
  - @composio/json-schema-to-zod@0.2.1
## @composio/cli-keyring@0.2.1

### Patch Changes

- 58bc93b: Refresh dependency ranges and lockfiles across the workspace.
## @composio/ts-builders@0.2.1

### Patch Changes

- 58bc93b: Refresh dependency ranges and lockfiles across the workspace.

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-07-16 00:52:07 +04:00
Alberto Schiabel 58bc93b2d9 chore(deps): consolidate dependency updates (#3760) 
This PR:
- consolidates https://github.com/ComposioHQ/composio/pull/3733,
https://github.com/ComposioHQ/composio/pull/3735 through
https://github.com/ComposioHQ/composio/pull/3744, and
https://github.com/ComposioHQ/composio/pull/3752
- refreshes the pnpm workspace dependencies under the existing
`minimumReleaseAge` supply-chain gate
- keeps latest compatible pins for ESLint 9, AI SDK 6, and Cloudflare
workers types 4 where latest majors conflict with the current workspace
- keeps zod-v3 runtime fixtures on `zod@3.25.76` while bumping the
workspace catalog to zod 4
- bumps Python `composio-client` to `1.42.0` and refreshes `uv.lock`
- updates the SHA-pinned Claude and Codex workflow actions from the
Dependabot action group
- adds a patch changeset for the versioned package manifests touched by
dependency updates
- verifies the rollup with frozen pnpm/uv locks, peer checks, audit
threshold checks, typecheck, lint, builds, TypeScript tests, and Python
`nox -s chk`

## Context

`pnpm audit --prod --audit-level=moderate` passes. The remaining
production audit item is a low `@ai-sdk/provider-utils` advisory through
Mastra transitive dependencies; forcing it higher would require leaving
the compatible stable Mastra dependency path.
 2026-07-06 14:33:55 +04:00
sdkrelease[bot] 9764ce33ff Release: update version (#3616) 
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to next, this PR will
be updated.


# Releases
## @composio/core@0.12.0

### Minor Changes

- a0bef5d: Bump `@composio/client` to `0.1.0-alpha.74`.
- dfd7a08: Add per-request cancellation to public SDK methods via a new
`ComposioRequestOptions` (`{ signal?: AbortSignal }`) trailing argument,
plus a typed `ComposioRequestCancelledError` for detecting
caller-initiated aborts.

Without this, a slow `tools.get` or `tools.execute` had no way to be
cancelled — a 100s search would block the calling agent indefinitely.
The new shape:

  ```typescript
  try {
    const tools = await composio.tools.get(
      'user_1',
      { search: 'send email', limit: 50 },
      { signal: AbortSignal.timeout(5_000) }
    );
  } catch (err) {
    if (err instanceof ComposioRequestCancelledError) {
      return;
    }
    throw err;
  }
  ```

The signal is forwarded to the underlying `@composio/client` fetch. Any
abort error (`APIUserAbortError`, `AbortError`, or
`DOMException(name='AbortError')`) coming back is normalized to
`ComposioRequestCancelledError` so callers can `instanceof`-detect
cancellation without unwrapping nested causes. Catch-and-wrap paths in
`tools.execute` / `tools.getRawComposioToolBySlug` / `toolkits.get`
re-throw the cancellation error rather than remapping it to
`ComposioToolExecutionError` / `ComposioToolNotFoundError` /
`ComposioToolkitFetchError`.

  Wired through on:
- **Tools**: `get`, `getRawComposioTools`, `getRawComposioToolBySlug`,
`getRawToolRouterSessionTools`, `execute`, `executeSessionTool`,
`getToolsEnum`, `getInput`, `proxyExecute`
  - **Toolkits**: `get`, `listCategories`
- **AuthConfigs**: `list`, `create`, `get`, `update`, `delete`,
`updateStatus`, `enable`, `disable`
- **ConnectedAccounts**: `list`, `get`, `delete`, `refresh`,
`updateStatus`, `enable`, `disable`, `update`
- **Triggers**: `listActive`, `create`, `update`, `delete`, `enable`,
`disable`, `listTypes`, `getType`, `listEnum`
  - **MCP**: `create`, `list`, `get`, `delete`, `update`, `generate`
- **ToolRouter** (`composio.create` / `composio.use`,
`composio.toolRouter.create` / `.use`) — long-running session-creation
paths
- **ToolRouterSession**: `authorize`, `toolkits`, `search`, `execute`,
`proxyExecute`, `update`

  ### Custom-tool cooperative cancellation

Native tool execution is cancelled by the SDK (the underlying `fetch` is
aborted). Custom tools are different — the SDK can't preempt
user-supplied JavaScript. Two affordances are added so callers get
sensible behavior anyway:

1. **Pre-execute signal check**: if `signal.aborted` is true before the
user's `execute` runs, the SDK throws `ComposioRequestCancelledError`
and never invokes user code.
2. **Cooperative signal forwarding**: the same `AbortSignal` is exposed
via `SessionContext.signal` for Tool Router custom tools. Long-running
implementations can wire `ctx.signal` into their own `fetch` (or any
abortable IO) to abort mid-execution; the resulting `AbortError` is
normalized to `ComposioRequestCancelledError` by the SDK.

  ```typescript
  import { experimental_createTool } from '@composio/core';

const longRunningFetch = experimental_createTool('LONG_RUNNING_FETCH', {
    name: 'Long-running fetch',
    description: 'Fetches a URL with cooperative cancellation',
    inputParams: z.object({ url: z.string() }),
    execute: async (input, ctx) => {
// Pass ctx.signal into fetch so a session.execute(...) abort cancels
      // the in-flight HTTP request mid-flight.
      const resp = await fetch(input.url, { signal: ctx.signal });
      return { result: await resp.json() };
    },
  });
  ```

- 025a657: Drop CommonJS entrypoints and publish the TypeScript SDK
packages as ESM-only packages. This is a breaking change within the
existing 0.x release line: consumers must use Node.js 22.22.3 or newer.
CommonJS callers can only rely on Node's native `require(esm)` interop,
and the SDK no longer ships custom CommonJS compatibility machinery or
`.cjs` artifacts.
- 4b76dbf: Remove the deprecated `uuid` field from the auth config
retrieve/list response type.

The platform has removed the deprecated V1/V2 UUID-mirror field from V3
API responses (it was a mirror of the canonical nanoid `id`). The SDK no
longer reads or re-exposes `uuid` on `AuthConfigRetrieveResponse` (and
therefore on the items of `AuthConfigListResponse`).

This is technically a breaking change to the SDK response type:
consumers should use `id` instead of `uuid`. The `expectedInputFields`
field is unaffected — it remains a top-level field on the API response.

### Patch Changes

- 552859a: Expose `search` and `showDisabled` filters on
`authConfigs.list()`.
- 23f9053: Replace `chalk` with `picocolors` for colored error and log
output. The two render identically, but `picocolors` is a fraction of
the size (~0.8 kB gzipped vs chalk's much larger footprint), shrinking
the bundled package.
- 507318d: Add a provider-agnostic JSON-schema property-key sanitizer:
`sanitizeSchemaPropertyKeys(schema, policy)`,
`restoreOriginalKeys(value, mapping)`, `mappingHasRenames(mapping)`, and
the `KeyMapping` / `KeySanitizationPolicy` types.

Some providers constrain the characters and length of tool
`input_schema` property keys and reject the whole request on a single
violation. This utility rewrites offending keys to conforming aliases
(recursing through `properties`, array `items`/`prefixItems`, the
composition keywords `allOf`/`anyOf`/`oneOf` and
`not`/`if`/`then`/`else`, plus
`additionalProperties`/`patternProperties`/`$defs`/`contains`) and
records a schema-shaped reverse mapping so the original parameter names
can be restored before execution. The _constraint_ is injected as a
`KeySanitizationPolicy`, so the traversal, collision handling, prototype
safety, and depth cap stay provider-agnostic. The `@composio/anthropic`
provider now consumes it.

- 6a4cb54: Preserve root `$defs` / `definitions` blocks on tool
parameter schemas and dereference them in the Node file modifier, so
auto file upload/download detection works when `file_uploadable` or
`file_downloadable` is hidden behind an internal `$ref`.
- cbbad15: Improve Zod compatibility at the SDK schema boundary. Custom
tools now convert both `zod/v3` and Zod v4 schemas to JSON Schema
correctly instead of degrading Zod v4 object schemas to empty schemas.
`@composio/core` now exposes `jsonSchemaToZodShape` via
`@composio/core/utils/json-schema`, and the Claude Agent SDK provider
uses that core subpath instead of converting to a full Zod object and
casting `.shape` out of it.
- Updated dependencies [025a657]
  - @composio/json-schema-to-zod@0.2.0
## @composio/json-schema-to-zod@0.2.0

### Minor Changes

- 025a657: Drop CommonJS entrypoints and publish the TypeScript SDK
packages as ESM-only packages. This is a breaking change within the
existing 0.x release line: consumers must use Node.js 22.22.3 or newer.
CommonJS callers can only rely on Node's native `require(esm)` interop,
and the SDK no longer ships custom CommonJS compatibility machinery or
`.cjs` artifacts.
## @composio/anthropic@0.10.0

### Minor Changes

- 025a657: Drop CommonJS entrypoints and publish the TypeScript SDK
packages as ESM-only packages. This is a breaking change within the
existing 0.x release line: consumers must use Node.js 22.22.3 or newer.
CommonJS callers can only rely on Node's native `require(esm)` interop,
and the SDK no longer ships custom CommonJS compatibility machinery or
`.cjs` artifacts.

### Patch Changes

- 507318d: Harden the Anthropic tool property-key sanitizer:

- **Broader schema coverage.** Illegal keys are now sanitized wherever
they appear in a tool schema — under the composition keywords
(`allOf`/`anyOf`/`oneOf`, `not`/`if`/`then`/`else`), `prefixItems`
tuples, `additionalProperties`/`patternProperties`, and
`$defs`/`definitions` — not just top-level `properties` and array
`items`. Previously a single illegal key under one of these would still
400 the entire request. Renames inside composition keywords are restored
correctly (they fold into the value level they share).
- **`$ref` keys restored.** `wrapTool` now dereferences internal
`$ref`/`$defs` (leniently — a dangling ref degrades to a permissive
schema instead of throwing) before sanitizing, so keys reachable only
through a reference are both made compliant and restored. Only genuinely
dynamic positions (`additionalProperties`, `patternProperties`,
`contains`) remain rewrite-only.
- **Shared core implementation.** The traversal/restoration mechanism
now lives in `@composio/core` (`sanitizeSchemaPropertyKeys` /
`restoreOriginalKeys`); this provider supplies only the Anthropic key
constraint as a policy, reusing core's prototype-pollution guard and
depth cap.
- **Prototype-safe key restoration.** Reverse-mapping lookups and the
rebuilt argument object are now prototype-free, so a tool call whose
arguments use a key matching an `Object.prototype` member (`__proto__`,
`constructor`, `toString`, `hasOwnProperty`, …) no longer throws or
silently corrupts the payload sent to the backend. `Object.prototype` is
never mutated.
- **Depth cap.** Schema sanitization and key restoration now bound
recursion (matching core's JSON-schema walker) so a pathologically deep
schema or argument object fails with a clear error instead of
overflowing the stack.
- **Empty / all-illegal keys.** A property key that is empty (or made
entirely of stripped characters) now becomes a deterministic non-empty
alias instead of an empty string, which would itself have violated
Anthropic's `{1,64}` length bound.
- **Collision loop.** Replaced a latent non-terminating fixed point in
the alias collision resolver with a counter that always makes progress.
- **Observability.** The provider now emits `debug` logs when it
rewrites a tool's schema keys and when it restores them at execution
time, and the wrap-then-execute (same provider instance) contract for
key restoration is documented.

- c90ae95: Sanitize tool `input_schema` property keys that violate
Anthropic's `^[a-zA-Z0-9_.-]{1,64}$` constraint before sending tools to
the Messages API, then restore the original names when the tool is
executed.

A single non-conforming key previously made Anthropic reject the entire
`tools` array with HTTP 400, taking down every other tool in the same
request. This commonly happened with OneDrive's Microsoft Graph OData
parameters (`$top`, `$filter`, `@microsoft.graph.conflictBehavior`) and
with over-long flattened keys from tools such as Zoom. Offending keys
are now rewritten to conforming aliases (`$` → `dollar_`, `@` → `at_`,
any other illegal character → `_`, keys longer than 64 characters
truncated with a deterministic suffix), recursing through nested object
`properties` and array `items` schemas. The original parameter names are
restored before the call reaches the Composio backend, so the model sees
`dollar_top` while the backend still receives `$top`. Schemas whose keys
already conform are left unchanged.
## @composio/claude-agent-sdk@0.10.0

### Minor Changes

- 025a657: Drop CommonJS entrypoints and publish the TypeScript SDK
packages as ESM-only packages. This is a breaking change within the
existing 0.x release line: consumers must use Node.js 22.22.3 or newer.
CommonJS callers can only rely on Node's native `require(esm)` interop,
and the SDK no longer ships custom CommonJS compatibility machinery or
`.cjs` artifacts.

### Patch Changes

- cbbad15: Improve Zod compatibility at the SDK schema boundary. Custom
tools now convert both `zod/v3` and Zod v4 schemas to JSON Schema
correctly instead of degrading Zod v4 object schemas to empty schemas.
`@composio/core` now exposes `jsonSchemaToZodShape` via
`@composio/core/utils/json-schema`, and the Claude Agent SDK provider
uses that core subpath instead of converting to a full Zod object and
casting `.shape` out of it.
## @composio/cloudflare@0.10.0

### Minor Changes

- 025a657: Drop CommonJS entrypoints and publish the TypeScript SDK
packages as ESM-only packages. This is a breaking change within the
existing 0.x release line: consumers must use Node.js 22.22.3 or newer.
CommonJS callers can only rely on Node's native `require(esm)` interop,
and the SDK no longer ships custom CommonJS compatibility machinery or
`.cjs` artifacts.
## @composio/google@0.10.0

### Minor Changes

- 025a657: Drop CommonJS entrypoints and publish the TypeScript SDK
packages as ESM-only packages. This is a breaking change within the
existing 0.x release line: consumers must use Node.js 22.22.3 or newer.
CommonJS callers can only rely on Node's native `require(esm)` interop,
and the SDK no longer ships custom CommonJS compatibility machinery or
`.cjs` artifacts.
## @composio/langchain@0.10.0

### Minor Changes

- 025a657: Drop CommonJS entrypoints and publish the TypeScript SDK
packages as ESM-only packages. This is a breaking change within the
existing 0.x release line: consumers must use Node.js 22.22.3 or newer.
CommonJS callers can only rely on Node's native `require(esm)` interop,
and the SDK no longer ships custom CommonJS compatibility machinery or
`.cjs` artifacts.
## @composio/llamaindex@0.10.0

### Minor Changes

- 025a657: Drop CommonJS entrypoints and publish the TypeScript SDK
packages as ESM-only packages. This is a breaking change within the
existing 0.x release line: consumers must use Node.js 22.22.3 or newer.
CommonJS callers can only rely on Node's native `require(esm)` interop,
and the SDK no longer ships custom CommonJS compatibility machinery or
`.cjs` artifacts.
## @composio/mastra@0.10.0

### Minor Changes

- 025a657: Drop CommonJS entrypoints and publish the TypeScript SDK
packages as ESM-only packages. This is a breaking change within the
existing 0.x release line: consumers must use Node.js 22.22.3 or newer.
CommonJS callers can only rely on Node's native `require(esm)` interop,
and the SDK no longer ships custom CommonJS compatibility machinery or
`.cjs` artifacts.

### Patch Changes

- aaabf5e: Relax the Mastra provider output schema so real third-party
API responses are no longer rejected by Mastra's output validation
(which dropped the data and substituted an error). Before compilation
the output schema is made lenient: every typed node becomes nullable,
objects allow extra keys (`additionalProperties: true`), `enum`/`const`
are widened to also admit `null`, and `required` is dropped (APIs omit
unset fields rather than returning `null` for them). All of these only
widen what validates, so previously-valid output is unaffected.
## @composio/openai@0.10.0

### Minor Changes

- 025a657: Drop CommonJS entrypoints and publish the TypeScript SDK
packages as ESM-only packages. This is a breaking change within the
existing 0.x release line: consumers must use Node.js 22.22.3 or newer.
CommonJS callers can only rely on Node's native `require(esm)` interop,
and the SDK no longer ships custom CommonJS compatibility machinery or
`.cjs` artifacts.
## @composio/openai-agents@0.10.0

### Minor Changes

- 025a657: Drop CommonJS entrypoints and publish the TypeScript SDK
packages as ESM-only packages. This is a breaking change within the
existing 0.x release line: consumers must use Node.js 22.22.3 or newer.
CommonJS callers can only rely on Node's native `require(esm)` interop,
and the SDK no longer ships custom CommonJS compatibility machinery or
`.cjs` artifacts.
## @composio/vercel@0.10.0

### Minor Changes

- 025a657: Drop CommonJS entrypoints and publish the TypeScript SDK
packages as ESM-only packages. This is a breaking change within the
existing 0.x release line: consumers must use Node.js 22.22.3 or newer.
CommonJS callers can only rely on Node's native `require(esm)` interop,
and the SDK no longer ships custom CommonJS compatibility machinery or
`.cjs` artifacts.
## @composio/ts-builders@0.2.0

### Minor Changes

- 025a657: Drop CommonJS entrypoints and publish the TypeScript SDK
packages as ESM-only packages. This is a breaking change within the
existing 0.x release line: consumers must use Node.js 22.22.3 or newer.
CommonJS callers can only rely on Node's native `require(esm)` interop,
and the SDK no longer ships custom CommonJS compatibility machinery or
`.cjs` artifacts.
## @composio/cli@0.3.0

### Minor Changes

- a0bef5d: Bump `@composio/client` to `0.1.0-alpha.74`.
- 025a657: Drop CommonJS entrypoints and publish the TypeScript SDK
packages as ESM-only packages. This is a breaking change within the
existing 0.x release line: consumers must use Node.js 22.22.3 or newer.
CommonJS callers can only rely on Node's native `require(esm)` interop,
and the SDK no longer ships custom CommonJS compatibility machinery or
`.cjs` artifacts.

### Patch Changes

- 5f004ff: Drop `COMPOSIO_UPSERT_RECIPE` and `COMPOSIO_GET_RECIPE` from
the CLI meta-tool list. These slugs were removed from `@composio/client`
(alpha.74), so listing them broke the type-checked CLI build.
- 23f9053: Remove the unused `ansis` dependency from the CLI. Colored
output is already handled by `picocolors`, so `ansis` was a dead
production dependency that shipped with the package.
- 446c6f6: Fix virtual TypeScript file resolution used by CLI type
generation so in-memory imports resolve consistently during
transpilation and validation.
- Updated dependencies [552859a]
- Updated dependencies [a0bef5d]
- Updated dependencies [23f9053]
- Updated dependencies [dfd7a08]
- Updated dependencies [507318d]
- Updated dependencies [025a657]
- Updated dependencies [6a4cb54]
- Updated dependencies [4b76dbf]
- Updated dependencies [cbbad15]
  - @composio/core@0.12.0
  - @composio/json-schema-to-zod@0.2.0
  - @composio/ts-builders@0.2.0
  - @composio/cli-keyring@0.2.0
  - @composio/cli-local-tools@0.1.0
## @composio/cli-keyring@0.2.0

### Minor Changes

- 025a657: Drop CommonJS entrypoints and publish the TypeScript SDK
packages as ESM-only packages. This is a breaking change within the
existing 0.x release line: consumers must use Node.js 22.22.3 or newer.
CommonJS callers can only rely on Node's native `require(esm)` interop,
and the SDK no longer ships custom CommonJS compatibility machinery or
`.cjs` artifacts.
## @composio/cli-local-tools@0.1.0

### Minor Changes

- 025a657: Drop CommonJS entrypoints and publish the TypeScript SDK
packages as ESM-only packages. This is a breaking change within the
existing 0.x release line: consumers must use Node.js 22.22.3 or newer.
CommonJS callers can only rely on Node's native `require(esm)` interop,
and the SDK no longer ships custom CommonJS compatibility machinery or
`.cjs` artifacts.

### Patch Changes

- Updated dependencies [552859a]
- Updated dependencies [a0bef5d]
- Updated dependencies [23f9053]
- Updated dependencies [dfd7a08]
- Updated dependencies [507318d]
- Updated dependencies [025a657]
- Updated dependencies [6a4cb54]
- Updated dependencies [4b76dbf]
- Updated dependencies [cbbad15]
  - @composio/core@0.12.0

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-06-25 04:38:11 +04:00
Alberto Schiabel f8cd90ce5a chore(ts): adopt Node 24 and pnpm 11 toolchain (#3646) 
This PR:

- uses plain `tsdown` package scripts and a shared typed
`tsdown.config.base.ts` so Node 24 builds work without loader flags
- switches the repo dev/build toolchain to Node `24.17.0` and pnpm
`11.8.0` through `mise.toml`, `mise.lock`, and `pnpm-lock.yaml`
- marks the root package as ESM with `type: module`, matching the
TypeScript packages
- keeps Node `22.22.3` in the runtime/E2E matrices as the minimum
supported user runtime
- changes the TypeScript build workflow back to a single build on the
mise-managed toolchain and broadens path filters for
package-manager/build config files
- adds pnpm 11 build-script policy with `allowBuilds` and intentionally
ignored `sharp` builds
- enables tsdown ESM shims for the packaged CLI wrapper so `composio
--help` runs under Node 22 and Node 24

Verified locally:

- `CI=true pnpm install --frozen-lockfile`
- `pnpm lint`
- `pnpm run build:packages`
- `COMPOSIO_E2E_NODE_VERSION=22.22.3 pnpm --filter
@e2e-tests/node-esm-basic --filter @e2e-tests/node-cjs-basic run
test:e2e:node`
- `node ts/packages/cli/bin/composio.mjs --help` under Node `22.22.3`
and `24.17.0`
 2026-06-24 18:58:11 +04:00
Alberto Schiabel 025a657597 feat(ts): drop CommonJS support (#3494) 
This PR moves the TypeScript SDK support floor to the latest Node.js 22
release and uses that as the point where we stop carrying custom
CommonJS compatibility machinery. The e2e runtime coverage now exercises
the latest Node 22, Node 24, and Node 25 lines, so the SDK is tested
against the minimum supported version and the newer runtimes users are
likely to adopt next.

Because the SDK packages are still on `0.x`, the accompanying changeset
uses `minor` bumps while calling out that this is a breaking change
inside the existing 0.x line.

It also moves pnpm under mise on this Node 22 layer. That belongs here,
not in #3493, because the pinned `pnpm@10.28.2` requires Node.js
`>=22.13`. Removing Corepack is intentional: Node.js documents that
Corepack is no longer distributed starting with Node.js v25, so relying
on `corepack enable` would keep a toolchain dependency that is already
on the way out of the Node distribution.

## What changed

- Pins the local/toolchain Node.js floor to `22.22.3` in `mise.toml`,
`mise.lock`, `toolchain-versions.json`, and root `devEngines`.
- Pins pnpm in `mise.toml` as `"npm:pnpm" = "10.28.2"` and makes mise
the single source of truth for the pnpm version. Removes the root
`packageManager` / `devEngines.packageManager` Corepack pin entirely
(rather than keeping a second copy of the version that could drift) and
removes stale `packageManager` metadata from real TS packages/examples
and generators.
- Sets `dangerouslyDisablePackageManagerCheck: true` in `turbo.jsonc` so
Turbo discovers pnpm from `pnpm-lock.yaml` instead of requiring a
`packageManager` field. Without this, Turbo fails workspace resolution
(`Could not resolve workspaces -> Missing 'packageManager' field`),
which is the only reason the field would otherwise need to stay.
- Replaces `corepack enable` in the shared setup action with
mise-managed pnpm. The E2E Docker images install bun + pnpm directly
from `mise.toml`/`mise.lock` (with
`dangerouslyDisablePackageManagerCheck`-style separation: Node/Deno stay
on the base image as the test matrix axis and are disabled via
`MISE_DISABLE_TOOLS` so mise does not shadow them; the tool binaries are
symlinked into `/usr/local/bin`). No `BUN_VERSION`/`PNPM_VERSION` build
args are threaded from the host anymore, and bun+pnpm now carry
`mise.lock` checksum verification.
- Extends the install-time toolchain check to validate pnpm against mise
alongside Bun.
- Sets the Node E2E matrix and install fallback checks to `22.22.3`,
`24.16.0`, and `25.9.0`.
- Makes TS package builds ESM-only: `tsdown` now emits `.mjs` / `.d.mts`
only and uses the ATTW `esm-only` profile.
- Removes explicit `require` / `.cjs` / `.d.cts` package export paths
and internal import mappings from the public TS SDK packages.
- Marks public TS SDK packages as `type: module` where they were missing
it.
- Replaces the remaining runtime `require('pusher-js')` with dynamic ESM
import.
- Deletes the legacy CJS example.
- Reintroduces `node/cjs-basic` as a modern Node `require(esm)` interop
E2E: it verifies `require('@composio/core')` works through Node's native
ESM loader on Node 22, 24, and 25 while resolving to `dist/index.mjs`,
not a `.cjs` artifact.
- Removes `.cjs` / `.cts` handling from example validation and CLI
project-language detection.
- Updates provider scaffolding so newly generated providers are
ESM-only.
- Adds a minor changeset warning that CommonJS callers can only rely on
Node's native `require(esm)` interop and that custom CommonJS
compatibility machinery is gone.

## Bundled behavior changes

Two changes here are technically independent of the CommonJS removal but
ride along because they touch the same files and ship in the same
release cut. Calling them out explicitly so they are not missed in
review:

- **`PusherUtils` realtime channel auth (`@composio/core`).** Replacing
the runtime `require('pusher-js')` with a dynamic ESM `import()` was
done alongside conforming `channelAuthorization` to pusher-js's typed
`customHandler(params, callback)` contract. The previous `(authOptions)
=> Promise` shape did not match pusher-js's actual calling convention —
it read `endpoint`/`headers`/`params` off an argument that pusher-js
never passes — so this also fixes that latent mismatch. New unit tests
(`ts/packages/core/test/utils/pusher.test.ts`) cover the auth request
shape (endpoint, `x-api-key` header, JSON `socket_id`/`channel_name`
body) and the success / invalid-JSON / network-failure callback paths.
- **CLI meta-tool slug list (`@composio/cli`).** Drops
`COMPOSIO_UPSERT_RECIPE` and `COMPOSIO_GET_RECIPE` from
`META_TOOL_SLUG_LIST` in `tools-executor.ts`; `@composio/client`
alpha.74 removed those slugs from the `SessionExecuteMetaParams['slug']`
union. The list is declared `satisfies
ReadonlyArray<SessionExecuteMetaParams['slug']>`, so this is enforced at
compile time (`pnpm typecheck`) — keeping the stale slugs would be a
type error — and needs no separate runtime test.

## Verification

- Verified latest Node 22/24/25 releases from the official Node dist
index: `22.22.3`, `24.16.0`, `25.9.0`
(https://nodejs.org/dist/index.json).
- Verified Node docs state Corepack is no longer distributed starting
with Node.js v25:
https://nodejs.org/download/release/v22.22.3/docs/api/corepack.html
- `mise exec -- pnpm --version` -> `10.28.2`
- `mise exec -- pnpm install --frozen-lockfile`
- `mise exec -- bun run ts/scripts/pre-install/check-toolchain.ts`
- `mise exec -- pnpm --filter @e2e-tests/utils typecheck`
- `mise exec -- pnpm --filter @e2e-tests/node-cjs-basic typecheck`
- `mise exec -- pnpm --filter @e2e-tests/node-cjs-basic test:e2e:node`
- `mise exec -- pnpm --filter @e2e-tests/node-esm-basic typecheck`
- `mise exec -- pnpm --filter @composio/cli typecheck`
- `mise exec -- pnpm --filter @composio/cli test -- --runInBand`
- `mise exec -- pnpm --filter @composio/core typecheck`
- `mise exec -- pnpm --filter @composio/core exec vitest run
test/utils/pusher.test.ts`
- `mise exec -- pnpm run build:packages`
- `mise exec -- turbo run build --dry-run` resolves all workspace
packages with no root `packageManager` field (pnpm discovered from
`pnpm-lock.yaml`).
- `mise exec -- pnpm --filter @composio/cli exec vitest run
test/src/services/project-environment-detector.test.ts`
- `mise exec -- pnpm exec prettier --check ...`
- `docker build -f ts/e2e-tests/_utils/Dockerfile.node --build-arg
NODE_VERSION=24.16.0 -t composio-e2e-node:misecheck .` (also
`Dockerfile.deno` with `DENO_VERSION=2.6.7 NODE_MAJOR=22`) — both build
green; runtime resolves Node/Deno from the base image and pnpm 10.28.2 /
bun 1.3.10 from mise.
- `docker manifest inspect node:24.16.0-slim`
- `docker manifest inspect node:25.9.0-slim`
- `bash -n ts/scripts/create-provider.sh && git diff --check`
- `ruby -e "require 'yaml';
YAML.load_file('.github/workflows/ts.test-e2e.yml')"`
- Tracked example validation in a clean temporary tree: `Validated 21
example packages.`
 2026-06-19 22:22:17 +04:00
Rahul Tarak 9d7cf5aca2 feat(cli-keyring): add @composio/cli-keyring package (#3201) 
## Summary

- Cross-platform OS credential storage package for the Composio CLI,
structurally modeled on
[keyring-rs](https://github.com/open-source-cooperative/keyring-rs)
- **macOS FFI backend**: direct `SecItemCopyMatching` via `bun:ffi` —
**~1.4ms median reads** (vs 22ms subprocess). Writes delegate to
`/usr/bin/security -A` for reliable allow-any ACL
- **macOS subprocess fallback**: `/usr/bin/security` for Node/test
environments
- **Linux backend**: `secret-tool` subprocess with keyring-rs-compatible
attribute keys (`{service, username, target}`)
- All pointers as `bigint` (`FFIType.u64`) to handle CoreFoundation
tagged pointers above `2^53`
- `b64:` prefix encoding for cross-backend binary safety
- 11-variant `KeyringError` discriminated union matching
`keyring-core`'s error model
- Effect.ts integration via `@composio/cli-keyring/effect` subpath
export (optional peer dep)
- `dangerouslySaveApiKeyInUserConfig` escape hatch designed for the CLI
migration PR (next in stack)

## Benchmark (100 iterations, Apple Silicon)

| operation | subprocess | FFI | speedup |
|---|---|---|---|
| `getPassword` p50 | 19.95ms | **1.14ms** | **18×** |
| `getPassword` p99 | 88.72ms | **7.39ms** | **12×** |

## Test plan

- [x] 16 unit tests (errors, entry, shared encoding) — Node vitest
- [x] 4 E2E tests against real macOS keychain — gated on
`COMPOSIO_KEYRING_E2E=1`
- [x] 6 FFI-specific tests — gated on `typeof Bun !== 'undefined'` + E2E
flag
- [x] `publint` + `attw` clean
- [x] `bun build --compile` produces working standalone binary with FFI
reads

🤖 Generated with [Claude Code](https://claude.com/claude-code)

**Stack: 1/2** — next PR: `cli/keyring-migration` (wires this into the
CLI)

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-13 23:55:30 -07:00