## Summary
Refreshes the safe TypeScript, Python, and GitHub Actions dependency
surface in one maintainer-owned change. Effect 4 rc.115, Vitest 5, the
vendored Effect source, CLI migrations, and agent guidance move
together, while known incompatible boundaries stay pinned. The Effect v4
config schemas preserve unknown fields across `config.json` and
`user_data.json` read-update-write cycles.
Fixes#4535
## Changes
- Keeps Cloudflare Workers fixtures on Vitest 4 until
`@cloudflare/vitest-pool-workers` supports Vitest 5.
- Keeps Mastra on the Workers-compatible versions and AG2 below 1.0
because AG2 1.x no longer ships the imported `autogen` module.
- Removes the unused package-level `pnpm` dependency instead of changing
the repository's pinned pnpm 11 toolchain.
- Migrates the Effect CLI APIs, Eve callback contract, provider peer
ranges, and repository skills required by the selected upgrades.
- Preserves unknown CLI settings when `config.json` and `user_data.json`
are read, updated, and written back.
- Uses immutable SHA pins for the refreshed Claude Code actions and adds
release metadata for the affected published TypeScript packages.
## Type of change
- [x] Bug fix
- [ ] New feature
- [x] Refactor/Chore
- [x] Documentation
- [ ] Breaking change
## How Has This Been Tested?
- `pnpm install --frozen-lockfile` with pnpm 11.8.0
- `pnpm typecheck`
- `pnpm build:packages`
- `pnpm --filter @composio/cli test` — 1,400 passed, 1 skipped,
including targeted persistence regressions for `config.json` and
`user_data.json`
- Package tests — 28 workspace tasks passed
- Example typechecks/tests and all Cloudflare dry-runs
- Provider compatibility, experimental/Eve, Mastra, CLI keyring, and
JSON-schema Effect checks
- Agent-skill validation, routing validation, Effect skill example
compilation, and peer-dependency checks
- All three Python `uv lock --check` runs
- `nox -s tst_autogen`, `nox -s snt`, and `nox -s chk type_inference`
- Production dependency audit completed with the repository's three
existing ignored advisories
Docker CLI E2E was not run locally because the Docker daemon is
unavailable. The exact root lint command also enters the vendored Effect
submodule, whose checkout does not install its `@effect/oxc/oxlint`
plugin; scoped lint over the changed non-vendor files passed.
## Screenshots (if applicable)
Not applicable.
## Checklist
- [x] I have read the Code of Conduct and this PR adheres to it
- [ ] I ran linters/tests locally and they passed
- [x] I updated documentation as needed
- [x] I added tests or explain why not applicable
- [x] I added a changeset if this change affects published packages
The dependency migrations are covered by the focused and workspace
suites. Two targeted regression tests verify that CLI updates preserve
unknown fields in `config.json` and `user_data.json`.
## Additional context
The Connect client sync retains its existing `Bash(curl *)` permission
while moving the removed `allowed_tools` input to `claude_args`. A
separate hardening change should move logo downloads outside the
model-controlled shell boundary.
---
[](https://github.com/EveryInc/compound-engineering-plugin)
## Summary
- Repairs runnable TypeScript and Python examples for current backend
requirements, including authenticated MCP endpoints, current transports,
valid tool identifiers, provider limits, and resource uniqueness.
- Replaces placeholder resource IDs with explicit `COMPOSIO_EXAMPLES_*`
configuration and makes failed examples exit loudly.
- Adds `scripts/examples-provision.mjs` as an idempotent provisioning
check for a disposable examples project.
## Scope
- This PR no longer changes the Python SDK runtime or generated-client
dependency.
- Python remains pinned to the published `composio-client==1.43.0` in
`pyproject.toml`, `setup.py`, and `uv.lock`.
- The owned 2.x client integration is deferred until that client
completes its release guarantees and is explicitly published.
- The scheduled live workflow and manifest remain deferred until their
runner is tracked.
## Verification
- `make chk`
- `make tst` (`927 passed, 33 skipped`)
- Hosted checks rerun against commit `12691aca7`.
This PR:
- splits https://github.com/ComposioHQ/composio/pull/3953 in two: this
PR carries every dependency and GitHub Actions bump **except** the docs
site, which follows in a stacked PR
- consolidates and supersedes Dependabot PRs #3915, #3916, and #3934
through #3942
- adopts TypeScript 7.0.2 for primary compilation while retaining the
`@typescript/typescript6` API lane that TypeScript-ESLint still
requires, following the upstream side-by-side guidance
- refreshes Python core and provider dependencies, lockfiles, and the
Ruff 0.16 lint configuration
- updates every GitHub Action with a verified newer official release,
including majors, while retaining immutable commit SHA pins and
migrating setup-uv cache pruning
- deletes four per-package `eslint.config.mjs` shims: under ESLint 10
the default per-file config lookup re-anchors the root config's globs
into each package, so `pnpm lint` stayed green while the CLI's
try/catch, `process.env` and node-builtin bans went unenforced
- bounds and documents the new `brace-expansion` and `@hono/node-server`
security overrides, raising the `@hono/node-server` floor to 2.0.10 to
clear GHSA-9mqv-5hh9-4cgg
- preserves intentional compatibility fixtures and lanes for AI SDK 6,
Zod 3, TypeScript 5.8, Mastra AI SDK 5, and Python provider constraints
## Context
The docs site is a separate Bun workspace with its own `bun.lock` and is
not a pnpm workspace member, so the two halves share no lockfile and no
build. Splitting them keeps the Fumadocs 11 migration (a breaking API
change with real refactoring) reviewable on its own, independently of
the mechanical version bumps here.
The `brace-expansion` override deliberately spans majors:
GHSA-mh99-v99m-4gvg (HIGH) is published as a single `<=5.0.7` range with
no 1.x or 2.x backport, so narrowing it to the 5.x line puts
`brace-expansion` 2.1.2 back under `core>minimatch>brace-expansion` and
`pnpm audit --prod --audit-level=high` exits 1. Verified both ways; the
trade-off it buys is recorded inline in `pnpm-workspace.yaml`.
Verified on this branch standalone: `pnpm install --frozen-lockfile`,
`pnpm lint`, `pnpm typecheck`, `pnpm build:packages`, `pnpm test` (963
tests, 26/26 tasks), and `pnpm audit --prod --audit-level=high`.
## What
Adds a **report-only** `Dead Code` CI workflow that surfaces
likely-orphaned code on every PR, across all three surfaces —
TypeScript, Python, and GitHub Actions. Follow-up to the root
`Dockerfile` cleanup (#3783) and the dead-code sweep in #3786: instead
of finding this stuff by hand, catch it automatically.
| Surface | Tool | Wiring |
|---|---|---|
| TypeScript | [**knip**](https://knip.dev) | `knip.json`; runs via
`pnpm dlx knip@5`. Finds unused files, exports, types, and dependencies.
|
| Python | [**vulture**](https://github.com/jendrikseipp/vulture) |
`dead_code` nox session + `make dead-code`; allowlist at
`python/config/vulture_allowlist.py`. Finds unused
functions/classes/variables (complements Ruff's F401/F841). |
| GitHub Actions | small bash script |
`.github/scripts/check-orphan-ci.sh` — flags reusable workflows and
composite actions with no callers. |
## Why report-only (not blocking)
Every job writes findings to the run's **Step Summary** and **never
fails the build**. These tools carry unavoidable false positives on a
library monorepo — public API surface, dynamic imports, import-map
targets (e.g. core's `#platform`), framework entry points. A red ❌ on
false positives would just train everyone to ignore the check. Once a
job's config is refined enough that a clean run is the steady state, it
can be flipped to blocking.
## Validation (ran each locally)
- **knip**: 0 unused *files* after scoping out the e2e-test workspaces
(knip crashes traversing `ts/e2e-tests/**` — pre-existing knip bug,
filed via `ignoreWorkspaces`) and build/docs artifacts. Export/dep
categories surface advisory items.
- **vulture**: clean run (report-only); allowlist suppresses the 3
`TYPE_CHECKING` re-exports in `custom_tool.py`; `build/`/`dist/`
excluded. Surfaces 4 genuine minor items (`bases`, `desc`×3).
- **orphan-CI script**: finds none — the repo has no orphaned CI
plumbing today.
- **Pinning**: `jk actions check` clean for this workflow;
`actions/checkout` is SHA-pinned, the two local composite actions need
no pin.
Local usage is documented under **Dead code detection** in
`CONTRIBUTING.md`.
## Note on scope
These cover TS/Python/GHA — they would *not* have caught the root
`Dockerfile` itself (an arbitrary root file no tool tracks). That class
stays a manual-review concern; the orphan-CI script is the closest
analogue for the CI surface.
## Summary
Agentic providers honor `schema_config={"skip_defaults": True}` for
`args_schema` (defaults stripped, fields become required) but were
**not** applying the same `skip_default` to the function
`__signature__`, so the wrapped tool's signature and `args_schema`
disagreed about which defaulted params were optional. The sibling
`llamaindex` provider already passed it to both.
**Supersedes #3727.** This is the polished version, now that the ag2
migration (#3729) landed and `composio-autogen` imports again — so the
autogen case uses a real import instead of the earlier source-load stub,
and the parity tests run in CI.
## Changes
- **langchain / langgraph** (original commit by @anxkhn): pass
`skip_default=self.skip_default` to
`get_signature_format_from_schema_params`.
- **autogen**: same one-line alignment. autogen builds **only**
`__signature__` (no `args_schema`), so it never had the *mismatch* — but
its signature still ignored `skip_defaults`. Aligned for consistency;
verified on the signature alone.
- **tests**: `TestAgenticSkipDefaultsParity` guards each provider with
`pytest.importorskip`; adds real-import autogen regression tests (no
stub).
- **CI + nox**: install `providers/autogen` in the unit-test job
(`py.test.yml`) and the nox `tst` session so the autogen parity tests
actually run, plus a **hard `import composio_autogen` smoke check** in
CI.
## Why the CI import guard (not just the tests)
The `importorskip`-guarded unit tests **skip** when a provider can't be
imported — which is the correct behavior for optional providers, but
means they'd *silently skip* if autogen broke on a fresh install
(exactly the failure that #3729 just fixed). The extra `python -c
"import composio_autogen"` in the import step is a **hard** check that
fails loudly, so a future dependency breakage can't slip through as a
green build.
`providers/langchain` + `providers/autogen` co-install cleanly
(verified: 59 packages, ag2 0.14.0, no conflict). langgraph continues to
skip in CI — its code path is identical to langchain's, which runs.
## Type of change
- [x] Bug fix
## How Has This Been Tested?
- Base venv (langchain only): langchain parity **passes**, langgraph +
autogen **skip** (no error).
- CI-mirror (langchain + autogen, editable): **4 passed, 2 skipped
(langgraph)** — autogen tests actually run and pass.
- Regression proof, each provider: reverting only the provider line
fails the skip-defaults case with `assert 5 is Parameter.empty`;
restoring passes. Verified for langchain **and** autogen.
- `ruff check`, `ruff format --check`, `mypy`, and full
`tests/test_provider.py` (29 passed, 4 skipped) → clean. `py.test.yml`
parses.
## Checklist
- [x] I ran linters/tests locally and they passed
- [x] I added tests: langchain/langgraph parity + regression, and
autogen parity that runs in CI
- [ ] Changeset: not applicable — Python-only change.
## Credits
Original fix by @anxkhn (#3713 → #3727), preserved as the first commit
and co-authored on the follow-up.
---------
Co-authored-by: Anas Khan <83116240+anxkhn@users.noreply.github.com>
This PR:
- replaces the duplicated repo-local skill set with the requested
canonical `.agents/skills` taxonomy and short router `SKILL.md` files
backed by first-level references
- makes `.claude/skills` a compatibility symlink to `.agents/skills` and
removes hand-maintained Claude skill/rule copies
- moves docs agent guidance and decisions into neutral
`docs/agent-guidance/` and `docs/decisions/`, with `docs/CLAUDE.md`
reduced to a shim
- retires CLI Cursor rules after migrating CLI design, Effect source,
and client-cache sync guidance into `AGENTS.md` and `cli-command`
- adds nested `AGENTS.md` files for TS, core, providers, e2e, Python,
Python providers, and docs
- adds `pnpm validate:agent-skills` to validate skill frontmatter,
taxonomy, references, symlink invariants, stale paths, and command names
- implements missing Python `tst` and `snt` nox sessions that existing
Makefile targets already exposed
- no changeset: repository guidance/tooling only, no published SDK
package behavior
## Verification
- `pnpm validate:agent-skills` -> `Validated 14 canonical agent skills
and guidance invariants.`
- `for skill in .agents/skills/*; do python
/Users/jkomyno/.codex/skills/.system/skill-creator/scripts/quick_validate.py
"$skill" || exit 1; done` -> 14x `Skill is valid!`
- `pnpm --dir ts/packages/cli validate:skills` -> `Validated
composio-cli skill builds for stable and beta.`
- `cd python && uv run nox --list` -> includes `tst` and `snt`
- `cd python && uv run nox -s snt` -> 18 passed
- `cd python && uv run nox -s tst -- tests/test_imports.py` -> 8 passed
- `git diff --check` / `git diff --cached --check` -> clean
- stale reference search for retired docs/Claude/Cursor paths -> no
matches
## Forward Tests
- TypeScript core bug: loaded `bug-fixing`, `typescript-sdk`,
`typescript-testing`; found correct root/ts/core `AGENTS.md` route.
- Python provider: loaded `python-providers`, `python-testing`; found
missing nox sessions, fixed here.
- CLI command: loaded `cli-command`; found recording/changeset wording
gaps, fixed here.
- Cross-SDK drift: loaded `cross-sdk-parity`; again found Python nox
drift, fixed here.
- Docs + decision: loaded `docs-decisions`; found decision
template/index and Twoslash path gaps, fixed here.
## Notes
The first normal `git commit` attempt hit a lint-staged/Git stash
limitation while replacing `.claude/skills/` with a symlink (`path ...
beyond a symbolic link`). The final commit used `--no-verify` after the
validators and formatting checks above passed.
Refreshes the Python SDK's core + provider dependency ranges and uv
locks to the **newest cutoff-compatible** versions, and makes the locks
self-consistent.
## What changed
- Bumps core + provider dependency ranges (`pyproject.toml` /
`setup.py`) and regenerates all three uv locks (root, `openai`,
`claude_agent_sdk`) to the newest available versions.
- Keeps `composio-client==1.41.0` (the current newest, released
2026-06-19).
- Caps `crewai>=0.134.0,<0.135.0`: crewai 1.x requires
`pydantic>=2.11.9,<2.13`, which conflicts with composio core's
`pydantic>=2.13.4`. Staying on crewai 0.x keeps the newest pydantic for
everything else; the provider only uses `crewai.tools.BaseTool`, which
is unaffected.
- Drops the one-shot `--exclude-newer` cutoff that had been recorded in
the lock `[options]` but was not backed by any `[tool.uv]` config — it
broke `uv lock --check` and held packages a few releases behind newest.
- Pins nox-installed tools/stubs in `noxfile.py` to the matching newest
versions.
## Resolution result
- Root lock: **161 upgrades, 0 downgrades** vs `next`.
- Provider locks: **0 downgrades** vs `next` (openai +14,
claude_agent_sdk +29).
## Verification
- `uv lock --check` — clean on all three locks.
- `uv run --frozen --all-packages pytest python/tests/test_imports.py` —
8/8 passing.
- `uv run --frozen nox -s chk` — ruff clean + mypy 0 issues across 80
source files.
Supersedes https://github.com/ComposioHQ/composio/pull/3622 (which was
opened from a fork).
Alberto Schiabel