skills/composiohq__composio
1
0
Fork 0
mirror of https://github.com/ComposioHQ/composio.git synced 2026-09-22 11:46:35 +08:00
Code Issues Packages Projects Releases Wiki Activity
4,788 Commits 338 Branches 1,550 Tags
@composio/cli@0.3.3
Commit Graph

4788 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Alberto Schiabel 862c071750 fix(json-schema): support object arguments with dynamic keys (#4081) 
This PR:
- fixes #4023, where Python provider Pydantic models silently reduced
property-less object arguments such as
`METABASE_POST_API_CARD.dataset_query` to `{}`
- fixes #4064, where the Zod and Effect converters rejected the same
free-form object content
- fixes #4022, where Google Gemini rejected nested property-bearing
schemas that omitted `type: "object"`
- supersedes https://github.com/ComposioHQ/composio/pull/4037 with
complete Python handling for open, closed, pattern-constrained, and
schema-valued dynamic keys
- supersedes https://github.com/ComposioHQ/composio/pull/4065 with one
cross-SDK contract covering Zod, Effect, Python, CLI validation, and
provider boundaries
- supersedes https://github.com/ComposioHQ/composio/pull/4077 by
incorporating its complete-schema Claude Agent SDK registration and root
constraint handling
- supersedes https://github.com/ComposioHQ/composio/pull/4047 with its
corrected Google-only normalization, including property-map and
reserved-key safety
- keeps https://github.com/ComposioHQ/composio/pull/4094 as a stacked
Python-provider follow-up because framework serialization and CrewAI
error handling are downstream of schema conversion
- includes minor Changesets for `@composio/core`,
`@composio/json-schema-to-zod`, and `@composio/claude-agent-sdk`; the
fixed release group also bumps `@composio/slim`, and `@composio/google`
carries a patch Changeset

A tool argument declared as a bare `{ "type": "object" }` could be
rejected, reduced to `{}`, or lose its root constraints depending on the
SDK boundary. This PR makes TypeScript and Python agree on free-form
objects and dynamic keys, and protects that agreement with a shared
corpus.

## Relationship to other work

### Superseded PRs

- #4037 fixes the narrow Python property-less-object reproduction by
allowing Pydantic extras, but does not enforce `patternProperties`,
schema-valued `additionalProperties`, or closed-object rejection. This
PR preserves the reported Metabase payload while enforcing the complete
object contract.
- #4065 fixes property-less objects in the Zod and Effect converters.
This PR incorporates that behavior, expands the dynamic-key semantics,
and proves parity with Python and the provider-facing paths.
- #4077 preserves root constraints through `ToolSchema.parse` and the
Claude Agent SDK. This PR incorporates that work and tests it against
the same cross-SDK corpus.
- #4047 targets #4022. This PR incorporates its Google schema
normalization with a structure-aware walker that preserves property
maps, instance values, and reserved keys.

### Follow-up and adjacent PRs

- #4094 is intentionally separate and stacked on this PR. This PR
defines which arguments a JSON Schema accepts and what
Pydantic/Zod/Effect preserve. #4094 handles the later framework boundary
where CrewAI, LangChain, and LangGraph serialize an already-validated
model, restoring aliases, distinguishing absent values from explicit
nulls and defaults, preserving dynamic extras, and returning structured
CrewAI validation failures.
- #4093 is the narrower CrewAI-only proposal for #4092. #4094
incorporates that fix and broadens it to the two other providers that
use the same generated Pydantic models, so #4093 is not duplicated here.

Keeping #4094 separate leaves this PR focused on the shared cross-SDK
conversion contract. It also isolates provider-specific framework hooks
and Python error-shape behavior, which have a different compatibility
and test surface and do not require TypeScript Changesets.

## What changed

- Property-less object schemas are open by default. Their content is
accepted and preserved at the root, in nested objects, and in array
items. An explicit `additionalProperties: false` still closes them.
- Objects that declare `properties` remain strict when
`additionalProperties` is omitted. This is Composio's established
tool-input behavior.
- `ToolSchema.parse` now accepts bare object roots, keeps root
`patternProperties`, accepts schema-valued `additionalProperties`, and
exposes optional `properties` in its public type.
- The Zod and Effect converters apply every matching `patternProperties`
schema. A schema-valued `additionalProperties` applies only to keys not
claimed by a declared property or pattern.
- Python validates dynamic values with Draft 7 JSON Schema before
Pydantic materializes defaults. This avoids coercive or incomplete
Pydantic representations changing whether input is accepted.
- Python supports local JSON Pointer references in dynamic-key schemas.
Unresolved, external, and anchored references fail during model
construction instead of silently weakening validation.
- Accepted Python dynamic keys remain available through both
`model_dump()` and attribute access, which is required by agentic
providers such as LangChain.
- Gemini now exposes free-form object arguments as `Dict[str, Any]` in
the generated callable signature.
- `@composio/google` adds missing object types before emitting Google
GenAI declarations while preserving property maps and instance-valued
schema annotations.
- The Claude Agent SDK provider registers the complete object schema
instead of a raw property map, so root rules reach MCP validation.
- The Effect converter reports dynamic-key schema defects while
compiling the schema, rather than as input errors blaming the arguments.
`@cfworker/json-schema` compiles `patternProperties` keys and resolves
`$ref` lazily, so the defect previously reached the caller as an input
validation failure. The scope matches Python's: `patternProperties`
keys, and references inside a `patternProperties` or schema-valued
`additionalProperties` subschema, followed transitively. References
elsewhere stay with the interpreter, so a dangling reference in a branch
validation never visits keeps working.

## Behavior changes

Three existing fail-open paths now reject invalid input:

1. Python agentic providers reject unknown keys when an object declares
properties and omits `additionalProperties`, instead of dropping those
keys. This also covers a property-less object that sets
`additionalProperties: false`, which Python previously left to
Pydantic's default `extra="ignore"`.
2. The Claude Agent SDK provider rejects undeclared arguments through
MCP validation instead of stripping them and running the tool.
3. The CLI rejects a tool schema whose `patternProperties` key is not a
valid regular expression, or whose dynamic-key subschema carries an
unresolvable reference, when it compiles the schema. This can fail a
call that previously succeeded: the interpreter surfaced such a defect
only if validation descended into that part of the schema, so a payload
that stayed out of the affected branch ran against a schema that could
not fully validate it.

Gemini is affected differently: it uses `json_schema_to_pydantic_type`
to build a callable signature, but does not use `json_schema_to_model`,
so the agentic-provider unknown-key behavior does not apply.

## Cross-SDK contract

The TypeScript and Python fixtures contain the same 24 cases and are
required to remain byte-identical:

```text
ts/packages/core/test/fixtures/json-schema-conversion/object-cases.json
python/tests/fixtures/json-schema-conversion/object-cases.json
```

The corpus covers open and closed objects, overlapping patterns,
schema-valued additional properties, empty schemas, enums, nested strict
containers, false schemas, type unions, local references, JSON integer
semantics, default materialization, and intentional Composio strictness.

Each case has one shared acceptance result. Converter-specific expected
outputs are separate because Zod and Pydantic materialize defaults while
Effect validates without transforming output. Any acceptance difference
requires an explicit divergence reason.

The decoding rules and the cross-language invariants have one
definition. `@composio/core` owns the loader at
`ts/packages/core/test/fixtures/json-schema-conversion/corpus.ts`, and
the Zod, Effect, and CLI suites re-export it rather than each carrying a
copy. It reads the corpus through `resolveJsonModule`, which is already
enabled in every consumer, so no test project needs `@types/node` to
load a fixture.

## Releases and documentation

- Three explicit minor Changesets cover `@composio/core`,
`@composio/json-schema-to-zod`, and `@composio/claude-agent-sdk`.
- `@composio/core` and `@composio/slim` are a fixed Changesets group, so
the core Changeset automatically schedules the matching minor release of
`@composio/slim`; no duplicate slim Changeset is required.
- `@composio/google` has a patch Changeset and requires `@composio/core
>=0.16.0 <1.0.0`, preventing installation with older Core versions that
lack the shared normalizer.
- `@composio/json-schema-to-effect-schema` is private. The CLI and CLI
local tools are excluded from Changesets, so the CLI's user-facing fix
is recorded in `ts/packages/cli/CHANGELOG.md`.
- Python does not use Changesets. It now declares `jsonschema>=4.23.0`
directly in both package metadata sources, and the generated `uv.lock`
is refreshed with the repository-pinned uv version.
- The docs changelog distinguishes Python agentic-provider behavior,
Gemini signature behavior, and Claude Agent SDK registration behavior.

## Verification

Local verification after the final implementation:

- Python: `nox -s tst` (`1002 passed, 34 skipped`) and `nox -s chk`
- Gemini provider: `32 passed` with the provider installed editable
- TypeScript: core `1088`, Zod `118`, Effect `65`, Claude Agent SDK
`24`, Google `14`, and focused CLI validation `9`
- Affected TypeScript typechecks
- `pnpm validate:changesets` and Changesets status against the PR exact
`next` base
- Detached Changesets versioning and a strict-peer packed consumer:
Core/Slim `0.16.0`, Google `0.10.2`, Zod `0.3.0`, and Claude Agent SDK
`0.11.0`
- Python sdist and wheel build, with both artifacts passing `twine
check`
- Prettier, Ruff formatting, `uv lock --check`, byte-identical fixture
comparison, and `git diff --check`
Closes #4022, #4023, and #4064.
@composio/cli@0.3.3 @composio/cli@0.3.3-beta.347 		2026-08-11 10:30:25 +02:00
sergioperezcheco a2f6b9699b fix(json-schema): integrate Google object type normalization 
Co-authored-by: jkomyno <alberto@composio.dev>
 2026-08-10 22:01:09 +02:00
jkomyno bd28575994 docs(changelog): correct TypeScript release versions 2026-08-10 21:31:04 +02:00
Alberto Schiabel 1af694baee Merge branch 'next' into fix/cross-sdk-json-schema-object-conversion 2026-08-10 21:23:10 +02:00
Alberto Schiabel 7f4b40fa1b fix(docs): prevent data sync branch fetch races (#4106) 
This PR:

- closes #4102
- disables Git 2.54 automatic maintenance for the docs data update job
while actions/checkout lacks the upstream fix
- prevents background maintenance from racing the shallow fetch of
docs/auto-update-data before create-pull-request pushes it
- keeps the change limited to the affected workflow
- verifies the workflow with actionlint v1.7.12
 2026-08-10 19:49:42 +02:00
jkomyno 49dcd5da66 test(docs): remove redundant data sync workflow test 2026-08-10 19:37:43 +02:00
jkomyno 45cdee6c9c fix(docs): prevent data sync branch fetch races 2026-08-10 19:00:13 +02:00
Alberto Schiabel 0e6b59ba14 perf(cli): resolve toolkits from local knowledge, not the catalog (#4056) 
This PR:

- builds on top of https://github.com/ComposioHQ/composio/pull/4055
- resolves a tool's toolkit against what the CLI already knows — the
slugs baked in at build time
(https://github.com/ComposioHQ/composio/pull/4055) plus the ones this
machine has learned since — so the common case costs one small local
file read and no network. Every tool execution needed the toolkit, and
the catalog was ~800 KB and ~2 s of the wall time of a command that then
does one small API call
- resolves that local knowledge once per run: `Effect.cached` on the
catalog service means one file read, one parse, and one lookup set per
process, where a single `composio execute` resolves a toolkit four times
over (bootstrap telemetry, the execute context, the connection check,
the execution itself) and `--parallel` multiplies that by the number of
tools
- falls through to the catalog only for a slug that matches nothing
known, which is what a toolkit released after the binary looks like, and
records what it finds in `known-toolkit-slugs.json` — so it costs a
fetch once rather than every run. The recording forks at most once per
run: every miss in a run merges the same memoized fetch, so later forks
could only rewrite an identical file
- refreshes learned slugs in the background once they are older than a
week, which bounds how long a brand-new toolkit can be mistaken for a
shorter one sharing its prefix
- gives that background refresh ten seconds, then abandons it. A
successful command ends when the event loop drains, not on an explicit
`process.exit`, so an unbounded background fetch would hold the exiting
`composio` process open until the network answered — visible to `&&`
chains, `$(...)`, and CI step timing. An abandoned refresh costs a fetch
on a later run, nothing more
- keeps `FORCE_USE_CACHE` semantics intact: the learned file is derived
data, not saved API responses, so it is read unconditionally. That
distinction is documented in the module and in the README
- cannot fail a command — a missing, unreadable, or corrupt file means
"nothing learned yet", and an unreachable catalog still degrades to the
first-underscore guess
- writes cache files through a temp file and a rename, so an interrupted
run leaves the previous cache intact instead of a truncated
`toolkits.json` the next run reads back as a parse failure
- drops the `toolkit` field from the cached tool model, which nothing
reads once resolution goes through the catalog service
- measured on a logged-in binary: `composio execute
GOOGLE_ANALYTICS_RUN_REPORT --dry-run` goes from ~8.0-8.6 s before the
stack, to ~3.4-4.3 s after
https://github.com/ComposioHQ/composio/pull/4054, to ~1.7-2.0 s here —
startup and the tool-schema fetch only
- no visible command surface changed, so no VHS recording

## Summary

Resolution now reads like this, with the catalog reached only on a
genuine miss:

```mermaid
graph TD
    A[tool slug] --> B{session meta tool?}
    B -->|yes| C[no toolkit]
    B -->|no| D[baked slugs + learned slugs]
    D --> E{longest prefix match?}
    E -->|yes| F[toolkit slug]
    E -->|no| G[fetch catalog]
    G -->|match| H[toolkit slug, slug remembered]
    G -->|unreachable| I[first-underscore guess]
```

Twelve tests cover the branches: baked hit and learned hit with zero
fetches, first run seeding the file, a miss that fetches and persists,
an unreachable catalog degrading to the guess, a corrupt file tolerated,
a stale file refreshing in the background, a fresh file not refreshing,
meta tools resolving to nothing without a fetch, the same run answering
from its memo instead of re-reading the file, and a second recording in
one run never reaching the file.
@composio/cli@0.3.3-beta.346 		2026-08-10 17:38:35 +02:00
Alberto Schiabel ba52db09bb chore(cli): bake the toolkit slug catalog into the CLI (#4055) 
This PR:

- builds on top of https://github.com/ComposioHQ/composio/pull/4054
- checks in `src/generated/toolkit-slugs.ts` — the 1070 toolkit slugs
the CLI knows without asking the API. Resolving a tool slug to its
toolkit needs the catalog, but the catalog is ~800 KB of metadata to
learn ~11 KB of slugs
- adds `scripts/generate-toolkit-slugs.ts` (`pnpm --filter @composio/cli
generate:toolkit-slugs`), which paginates the production catalog, keeps
`native` toolkits, sorts and dedupes. It authenticates with
`COMPOSIO_API_KEY` (CI) or `COMPOSIO_USER_API_KEY` + `COMPOSIO_ORG_ID`
(a logged-in developer); both paths verified against production
- gates the write: fewer than 1000 slugs, a malformed slug, or a missing
staple (`github`, `gmail`, `google_analytics`) aborts before touching
the file, so a bad or wrong-scoped credential fails loudly instead of
overwriting a good list with a partial catalog
- adds `.github/workflows/cli.update-toolkit-slugs.yml`, a weekly cron
that opens a refresh PR when the catalog moves. `workflow_dispatch` only
works once this lands on the default branch
- warns during binary builds when the baked list is older than two
weeks, and never fails on it — a stale list is slow, never wrong,
because the backend does not remove toolkits
- adds a guard test: sorted, unique, lowercase-slug-shaped, staples
present, no network
- nothing reads the list yet;
https://github.com/ComposioHQ/composio/pull/4055 wires it into
resolution
- internal only — no changelog entry, no visible command surface, no VHS
recording

## Context

On the cron secret: `docs-update-data.yml` documents
`secrets.COMPOSIO_API_KEY` as staging-scoped and uses its own
`secrets.COMPOSIO_DOCS_API_KEY` for production reads. This workflow uses
the shared secret as decided, and the sanity gate is what makes that
safe to try — a wrong-scoped key 401s, writes nothing, and opens no PR.
The alternative is named in a comment next to the `env:` block, one line
to swap if the first run fails.

## Follow-up folded in

The toolkit-slug shape now has one definition: `TOOLKIT_SLUG_PATTERN`
lives in `src/models/toolkits.ts` and is shared by the schema, the
generation script's sanity gate, and the generated-output guard test.
@composio/cli@0.3.3-beta.345 		2026-08-10 17:37:59 +02:00
Alberto Schiabel 0245945a43 perf(cli): fetch the toolkit catalog once per process (#4054) 
This PR:

- builds on top of https://github.com/ComposioHQ/composio/pull/4053
- memoizes the toolkit catalog for the lifetime of the cached repository
layer with `Effect.cached`. A single command asks for the full list
several times — toolkit resolution, validation, telemetry — and the file
cache only answers when `FORCE_USE_CACHE` is set, so the default path
paid for the same ~800 KB two-page download up to four times
- fixes a doubling underneath it: `createCachedEffect` wrapped its whole
body — cache lookup and the underlying request alike — in one `catchAll`
that fell back to re-running the request, so a request that failed on
its own was immediately sent again and failed the same way. Cache
concerns now degrade to a cache miss on their own, and the request runs
exactly once with its failure passed straight through
- `Effect.cached` memoizes the outcome rather than only the success, so
a failed fetch stays failed for the process. That is the right trade for
a one-shot CLI, where retrying a broken network per call only multiplies
the wait before the same error surfaces
- adds a counting-repository test stub and four tests: one fetch for N
sequential callers, one for N concurrent callers, one attempt for a
failing fetch, and a `FORCE_USE_CACHE` hit served with zero fetches
(that last one passes against the old implementation too, so it pins
existing behavior rather than blessing the rewrite)
- measured on a logged-in binary: `composio execute
GOOGLE_ANALYTICS_RUN_REPORT --dry-run` goes from ~8.0-8.6 s to ~3.4-4.3
s
- no visible command surface changed, so no VHS recording
@composio/cli@0.3.3-beta.344 		2026-08-10 17:37:32 +02:00
Alberto Schiabel 5eefadf57b fix(cli): resolve multi-word toolkits from tool slugs (#4053) 
This PR:

- closes https://github.com/ComposioHQ/composio/issues/4049
- resolves a tool's toolkit by matching the tool slug against the known
toolkit list, longest underscore-bounded prefix first, instead of
splitting on the first underscore — `GOOGLE_ANALYTICS_RUN_REPORT`
belongs to `google_analytics`, not `google`, and the old split picked
the wrong connected account
- routes every call site (execute, listen, tools-executor, file uploads,
error overrides, telemetry) through one Effect resolver,
`toolkitFromToolSlug`, so they cannot disagree
- keeps the first-underscore split as `guessToolkitFromToolSlug`, used
only when the toolkit list cannot be loaded
- fixes a second miss that the old split hid: `COMPOSIO_SEARCH_TOOLS` is
a session meta tool, but `composio_search` is a real linkable toolkit,
so matching against the real catalog made a failed meta call tell users
to link an app that had nothing to do with it. The meta tool slugs move
out of `tools-executor.ts` into `src/utils/meta-tool-slugs.ts`, and
resolution answers "no toolkit" for them before any prefix matching
- no visible command surface changed, so no VHS recording

## Context

This is correct but not yet fast: resolution still reads the toolkit
catalog, which is ~800 KB over two pages. Three stacked PRs follow that
make the common case cost no network at all.
@composio/cli@0.3.3-beta.343 		2026-08-10 17:36:38 +02:00
jkomyno 5350b00d90 perf(cli): resolve toolkits from local knowledge, not the catalog 
Every tool execution had to know which toolkit the tool belongs to, and
the only reliable source was the toolkit catalog — ~800 KB and ~2 s of
the wall time of a command that then does one small API call.

Match against what the CLI already knows instead: the slugs baked in at
build time, plus the ones this machine has learned since, kept in
`known-toolkit-slugs.json`. A slug that matches nothing known still
falls through to the catalog — that is what a toolkit released after the
binary looks like — and what it finds is remembered, so it costs a fetch
once rather than every run. Learned slugs older than a week trigger a
background refresh; that bounds how long a brand-new toolkit can be
mistaken for a shorter one sharing its prefix.

The file is derived data rather than saved API responses, so it is read
regardless of FORCE_USE_CACHE, which keeps its meaning. Nothing here can
fail a command: a missing, unreadable, or corrupt file means "nothing
learned yet", and an unreachable catalog still degrades to the
first-underscore guess.

Cache writes also move to a temp file and a rename, so an interrupted
run leaves the previous cache intact instead of a truncated file that
the next run reads back as a parse failure.
 2026-08-10 17:12:58 +02:00
jkomyno bf3efaa270 chore(cli): bake the toolkit slug catalog into the CLI 
Resolving a tool slug to its toolkit needs the catalog, but the catalog
is ~800 KB of metadata to learn ~11 KB of slugs. Check the slugs in as
generated source so the CLI starts out knowing them.

Adds the generator (paginates the production catalog, keeps native
toolkits, sorts and dedupes), the checked-in list, a guard test, and a
weekly workflow that opens a refresh PR when the catalog moves. The
generator refuses to write a list that is short, malformed, or missing
staple toolkits, so a bad or wrong-scoped credential aborts before
overwriting a good list. The binary build warns when the list is older
than two weeks, and never fails on it.

Nothing reads the list yet.
 2026-08-10 17:12:58 +02:00
jkomyno 4a764c100a perf(cli): fetch the toolkit catalog once per process 
A single command can ask for the full toolkit list several times —
toolkit resolution, validation, telemetry — and the file cache only
answers when FORCE_USE_CACHE is set, so the default path paid for the
same ~800 KB two-page download up to four times.

Memoize the lookup for the lifetime of the cached repository layer. The
first caller pays and the rest await the same result. Effect.cached
memoizes the outcome rather than only the success, so a failed fetch
stays failed for the process: the right trade for a one-shot CLI, where
retrying a broken network per call only multiplies the wait before the
same error surfaces.

That surfaced a second doubling underneath. The caching helper wrapped
its whole body — cache lookup and the underlying request alike — in one
catchAll that fell back to re-running the request, so a request that
failed on its own was immediately sent again and failed the same way.
Cache concerns now degrade to a miss on their own, and the request runs
exactly once with its failure passed straight through.
 2026-08-10 17:12:58 +02:00
jkomyno 5a74b4aade fix(cli): resolve multi-word toolkits from tool slugs 
Tool slugs carry no delimiter between the toolkit and the action, so
splitting on the first underscore resolved GOOGLE_ANALYTICS_RUN_REPORT to
`google` instead of `google_analytics` and picked the wrong connected
account.

Match the tool slug against the known toolkit list instead, longest
underscore-bounded prefix first, and keep the old split as the fallback
for when that list is unavailable. Routed through a new Effect resolver
so every call site (execute, listen, tools-executor, file uploads, error
overrides, telemetry) shares one answer.

Matching against the real catalog exposes a second miss the old split
hid: `COMPOSIO_SEARCH_TOOLS` is a session meta tool, but `composio_search`
is a real linkable toolkit, so a failed meta call told users to link an
app that had nothing to do with it. The meta tool slugs move out of
tools-executor into src/utils/meta-tool-slugs.ts, and resolution answers
'no toolkit' for them before any prefix matching.

Fixes https://github.com/ComposioHQ/composio/issues/4049
 2026-08-10 17:12:58 +02:00
Alberto Schiabel c625edc0f7 fix(core): reuse fetched schemas for provider execution (#4103) 
Reuse fetched raw tool schemas for provider-wrapped execution while preserving modifier isolation, runtime validation, and unknown-slug fallback behavior.

Refresh the Python 3.12.13 mise lock entries required by the Audit freshness gate.

Co-authored-by: breezeFur <voidexl@outlook.com>
@composio/cli@0.3.3-beta.342 		2026-08-10 13:34:20 +02:00
jkomyno 6c08f17637 test(json-schema): share one corpus loader across the SDK test suites 
The loader was copied into four packages, identical but for one path constant.
Core now owns it and the Zod, Effect, and CLI suites re-export it.

It also read its fixture with node:fs, which pulled @types/node into the Zod and
Effect test typechecks for the first time and broke them against the Node 26 line
the workspace was pinned to. That had been worked around by centralizing
@types/node on a Node 24 catalog entry across ten manifests. resolveJsonModule is
already enabled in every consumer, so a static JSON import removes the node:fs
dependency and the whole detour with it: the catalog entry, the pnpm override, the
per-package types fields, and 171 lines of lockfile churn are all reverted.
 2026-08-08 00:22:29 +05:30
jkomyno 8ccd0ceb4f docs(changelog): drop the per-call claim from the CLI compile failure 
compileToolInputSchema still runs inside validateToolInputArgumentsWithDefinition,
so the failure fires on every invocation. What changed is the diagnosis, not the
frequency. Line 153 already made only the diagnosis claim; this aligns line 88 and
the matching CLI changelog line with it.
 2026-08-08 00:22:22 +05:30
jkomyno 8afda50611 docs(changelog): split the wrap-time failure story by SDK and list slim 
The previous wording claimed both SDKs surfaced an invalid dynamic-key
schema only when validation descended into it. That is the CLI's lazy
interpreter; Python never read the keywords, so the defect never surfaced
and the new raise is unconditional at wrap time, not payload-dependent.

Also add @composio/slim to the versions table: it is public and in the
fixed Changesets group with @composio/core, so it ships this fix at the
same minor.
 2026-08-07 23:37:34 +05:30
jkomyno 3d56a02ff9 docs(changelog): say that early schema-defect failure can fail a previously passing call 
Both SDKs surfaced an invalid dynamic-key schema only when validation
descended into it, so a payload that stayed out of the affected branch
ran against a schema that could not fully validate it. Failing at the
schema is the point, but it is a behavior change and the entry framed it
as affecting only already-failing input.
 2026-08-07 23:26:07 +05:30
jkomyno 9c29abb5c7 docs(changelog): note that an explicit additionalProperties: false still closes a property-less object 
The open-by-default claim and the Backward Compatibility carve-out both
read as unconditional for objects that name no properties. An explicit
additionalProperties: false closes such an object, and Python raises on
unknown keys it previously dropped through Pydantic's default
extra="ignore" - the same drop-to-raise transition already documented
for objects that declare properties.
 2026-08-07 23:07:27 +05:30
jkomyno 1ebdedd1cd docs(changelog): record the CLI schema compile failure 
The wrap-time paragraph named only Python. The CLI now fails the same way
on the two defects its validator can detect, so both the dynamic-keys
section and Backward Compatibility say which SDK does what, and note that
a reference outside a dynamic-key subschema is still left alone.
 2026-08-07 22:41:54 +05:30
jkomyno 26315ead21 fix(json-schema-to-effect-schema): reject dynamic-key schema defects at construction 
@cfworker/json-schema compiles patternProperties keys and resolves $ref
lazily, inside validate. A defect in the schema therefore surfaced once
per call through the same channel as a genuine input failure, telling the
caller their arguments were wrong when the tool's schema was broken.

Check both eagerly, scoped to what the Python SDK rejects while wrapping
a tool: patternProperties keys, and references inside a patternProperties
or schema-valued additionalProperties subschema, followed transitively
through the schemas they resolve to. References elsewhere stay with the
interpreter, so a dangling reference in a branch validation never visits
keeps working.

The filter keeps its catch for the one throw that depends on the instance
rather than the schema - a bigint, symbol, function, or undefined input.
Rethrowing from there would escape Schema.decodeUnknown as a defect
instead of a typed parse error.
 2026-08-07 22:41:50 +05:30
jkomyno 90c312a011 docs(changelog): name Python dynamic-key validation as a call-time change 
The Backward Compatibility carve-out claimed objects declaring no
properties were unaffected. On next, the Python converter read neither
patternProperties nor schema-valued additionalProperties, so those
objects became empty Pydantic models and every dynamic key was dropped
in silence. Those keys are now validated and can raise ValidationError.

Document it as the third call-time behavior change, with before/after,
narrow the carve-out to objects with no dynamic-key constraints, and
note that the prior 'unrelated pattern' behavior was TypeScript-only.
 2026-08-07 22:25:37 +05:30
sdkrelease[bot] 13cba53b1d Release: update version (#4038) 
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to next, this PR will
be updated.


# Releases
## @composio/core@0.15.0

### Minor Changes

- 1503786: Replace the loose JSON Schema property type with a recursive,
type-safe definition.

`JSONSchemaProperty` (re-exported from `@composio/core` and reachable
through
`Tool.input_parameters` / `Tool.output_parameters`) is now a concrete
recursive
interface instead of effectively `any`. Runtime behavior is unchanged,
but
  consumer code that indexed into it without narrowing (for example
`schema.properties.foo.type` or `schema.default.someField`) may see new
type
errors: `properties` entries are now possibly `undefined` and `default`
/
`enum` values are `unknown`. Narrow with optional chaining or explicit
type
  guards when upgrading.

### Patch Changes

- 2ac6ad3: Bound the background npm version check so registry outages
cannot leave the request pending indefinitely.
- 5105612: Match sensitive upload path segments using the target
filesystem's actual case sensitivity so case-insensitive mounts cannot
bypass the denylist without over-blocking distinct paths on
case-sensitive mounts.
- 051c8c5: Redact secrets that appear inside JSON payloads in telemetry
error text. The key/value rule required the separator to follow the key
name directly, so a serialized body such as `{"api_key": "..."}` — the
shape error messages usually carry — was sent unredacted.
- e5c9ada: Refresh the OpenAI runtime dependency to version 7.
- ecd0861: Release unread response bodies on the paths the SDK knowingly
abandons: cancel every intermediate redirect body in `ssrfSafeFetch`,
and the response body before throwing on `!response.ok` in both
URL-upload call sites, instead of leaving them for the garbage collector
to reclaim.
- 2a6a051: Remove the unused internal `isNewerVersion` helper.
- Updated dependencies [1503786]
  - @composio/json-schema-to-zod@0.2.2
## @composio/openai@0.11.0

### Minor Changes

- e5c9ada: Add support for OpenAI versions 6 and 7.
## @composio/experimental@0.2.2

### Patch Changes

- 4ceaede: Refresh the TypeBox runtime dependency.
## @composio/json-schema-to-zod@0.2.2

### Patch Changes

- 1503786: Model the parser-supported `min`, `max`, and `example` JSON
Schema extensions in the exported recursive schema type.
## @composio/slim@0.15.0

### Patch Changes

- e5c9ada: Refresh the OpenAI runtime dependency to version 7.
- Updated dependencies [1503786]
  - @composio/json-schema-to-zod@0.2.2

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@composio/json-schema-to-zod@0.2.2 @composio/experimental@0.2.2 @composio/core@0.15.0 @composio/openai@0.11.0 @composio/slim@0.15.0 py@0.18.2 		2026-08-07 22:16:46 +05:30
Alberto Schiabel b9a715e055 fix(e2e): pack core's workspace dependency in the openai-zod4 fixture (#4097) 
The `openai-zod4-compat` E2E fixture fails on every release branch that
bumps an internal workspace package. It is currently blocking the Python
0.18.2 / TypeScript 0.15.0 train
(https://github.com/ComposioHQ/composio/pull/4038).

## Root cause

The fixture packs `@composio/core` and `@composio/openai` and installs
the tarballs. `pnpm pack` rewrites `@composio/core`'s `workspace:*`
dependency on `@composio/json-schema-to-zod` to the exact workspace
version, so the tarball carries a hard pin:

```json
"@composio/json-schema-to-zod": "0.2.2"
```

On `next` that pin points at an already-published version, so the
install resolves from the registry and the fixture passes. On a release
branch it points at the version about to be published, which does not
exist yet:

```
npm error code ETARGET
npm error notarget No matching version found for @composio/json-schema-to-zod@0.2.2.
```

The setup step then exits non-zero and all 7 assertions fail with empty
output. That is exactly what
https://github.com/ComposioHQ/composio/pull/4038 shows:
`@composio/json-schema-to-zod` is bumped to `0.2.2` there, which is the
first release train to bump an internal dependency of `@composio/core`
since this fixture was added.

## Fix

Pack `@composio/json-schema-to-zod` alongside the other two and install
all three tarballs. npm satisfies core's pin from the top-level tarball,
so the fixture resolves entirely from local builds and no longer depends
on publication order. Behavior on `next` is unchanged — it just prefers
the local build over the identical published one.

## Verification

Reproduced and fixed against the release branch
(`changeset-release/next` @ `8068225d7`, core `0.15.0` /
json-schema-to-zod `0.2.2`) in a local worktree, since Docker was not
available to run the containerized suite here:

- packing core alone and running the fixture's install command
reproduces the ETARGET failure verbatim
- packing all three and installing them succeeds;
`node_modules/@composio/json-schema-to-zod` resolves to `0.2.2` and
`@composio/core`'s pin is satisfied locally
- `node ts/scripts/validate-changesets.mjs` passes; no changeset needed,
the fixture is a private package

CI runs the real containerized suite on this PR.
 2026-08-07 22:04:34 +05:30
jkomyno 191d919eef fix(python): harden dynamic schema validation 2026-08-07 21:56:39 +05:30
Alberto Schiabel c337e5696e chore(sdk): prepare Python 0.18.2 and TypeScript 0.15.0 releases (#4095) 
Prepares the next SDK train: Python `composio` `0.18.2` and the
TypeScript packages that the pending Changesets will publish
(`@composio/core` and `@composio/slim` `0.15.0`, `@composio/openai`
`0.11.0`, `@composio/experimental` and `@composio/json-schema-to-zod`
`0.2.2`).

No CLI release is part of this train.

## What this PR does

- bumps Python core and all 13 provider packages to `0.18.2`, including
`python/composio/__version__.py` and the root plus per-provider
`uv.lock` files
- adds `docs/content/changelog/08-07-26-sdk-releases.mdx`, the combined
customer-facing changelog for both SDKs
- documents `@composio/core` `0.15.0` in that entry so the generated
release PR passes the release-workflow guard
- leaves the pending Changesets untouched; the generated release PR
remains responsible for npm versioning and publication

## Release sequence

1. Merge this PR.
2. Let Changesets regenerate the "Release: update version" PR, wait for
it to go green, then merge it. Merging publishes the TypeScript
packages.
3. Tag the resulting `next` commit `py@0.18.2` to publish the Python
packages to PyPI.

## Notes

- The root `uv.lock` diff carries ~28 lines of marker-annotation churn
beyond the version bumps. That is the repo-pinned `uv` `0.8.19`
normalising markers the committed lockfile had recorded differently; no
dependency versions change.
- `@composio/mastra` and the TypeScript providers are unchanged: their
declared peer ranges still accept `@composio/core` `0.15.0`, so
Changesets does not bump them.

## Verification

- `pnpm test:release-workflow` — passes (Python package, runtime, and
provider versions agree; both SDK versions documented in the changelog)
- `uv run pytest tests/` in `python/` — 925 passed, 35 skipped
- `uv run --package composio python -c "import composio"` — reports
`0.18.2`
- `bun test tests/static/` in `docs/` — 195 pass, 1 pre-existing failure
(`getLLMText — version pointer`, also fails on a clean tree)
- `bun run types:check` in `docs/` — MDX generation and route typegen
succeed; the final `tsc` step could not run locally because
`typescript-7` is absent from `docs/node_modules`
 2026-08-07 21:35:55 +05:30
jkomyno 3fef432dc0 fix: fail closed on invalid dynamic schemas 2026-08-07 21:03:08 +05:30
jkomyno 436e0a811f docs(changelog): match the reference and rejection claims to the code 2026-08-07 19:43:21 +05:30
jkomyno ecd9217d5d docs(changelog): qualify the reference guarantee for dynamic keys 2026-08-07 19:39:12 +05:30
jkomyno 1f94167595 fix(python): walk only schema positions when checking dynamic refs 
The dynamic-key reference walker descended into every nested dict, so a
$ref-shaped value stored under const, default, enum, or examples was
treated as a schema reference and raised while the tool was wrapped.
Restrict the walk to Draft 7 schema positions.
 2026-08-07 19:39:06 +05:30
LHMQ878 051c8c5357 fix(telemetry): redact secrets inside JSON payloads (#4043) 
## Summary

Telemetry error text is redacted before it leaves the process, but the
key/value rule only matches when the separator follows the key name
directly:

```
\b(authorization|api[-_]?key|...|pwd)\b(\s*[:=]+\s*)(["']?)([^\s"',}&]+)\3
```

In JSON — and in a Python `dict` repr — the key's own closing quote sits
between the name and the colon, so `{"api_key": "..."}` never matches
and the value is sent verbatim. That is the shape error messages usually
carry: an API error envelope, a rejected request body echoed back, or an
f-string interpolating a config dict. Both SDKs share the pattern and
both are affected.

The fix moves the optional quote into the separator group
(`(["']?\s*[:=]+\s*)`). The key name, separator, and quoting are all
preserved in the output; only the value is replaced.

Measured with `redact_sensitive_text` / `redactSensitiveText` directly,
before and after:

| input | before | after |
|---|---|---|
| `api_key=sk-1` | redacted | redacted |
| `api_key: "sk-1"` | redacted | redacted |
| `x-api-key: sk-live-hdr` | redacted | redacted |
| `{"api_key": "sk-live-abc"}` | **leaks** | `{"api_key": "[REDACTED]"}`
|
| `{"api_key":"sk-live-abc"}` | **leaks** | redacted |
| `{"api_key" : "sk-live-abc"}` | **leaks** | redacted |
| `{"refresh_token":"rt-abc.def-123"}` | **leaks** | redacted |
| `{"x-api-key":"sk-hdr","user":"bob"}` | **leaks** | redacted,
`"user":"bob"` kept |
| `{'client_secret': 'cs-live-abc'}` | **leaks** | redacted |
| `the password field is required` | untouched | untouched |
| `no separator here "api_key" and nothing else` | untouched | untouched
|

The end-to-end path in Python is `composio/core/models/base.py:60-61`,
which passes `str(e)` and `traceback.format_exc()` through the redactor
into the telemetry `error` field. A tool failure whose message
interpolates the rejected request body — `Error executing tool: request
body was rejected: {"toolkit": "GMAIL", "arguments": {"api_key": "...",
...}}` — leaked the customer's key today.

## Changes

- `python/composio/utils/redaction.py`,
`ts/packages/core/src/telemetry/redact.ts`: allow a quote between the
key name and the separator.
- Tests on both sides for JSON, minified JSON, spaced-colon JSON, dict
repr, the realistic serialized-payload shape, key/quote preservation,
and no-false-positive cases.
- Changeset for `@composio/core`.

## Type of change

- [x] Bug fix

## How Has This Been Tested?

Node 24.13.0 / pnpm 11.8.0 / Python 3.10.20 (uv), Windows.

- `uv run pytest tests/test_redaction.py` — 13 passed. With
`redaction.py` reverted and the new tests kept, 9 of them fail; the 4
that still pass are the pre-existing test plus the three
no-false-positive controls.
- `npx vitest run test/telemetry/redact.test.ts` in `ts/packages/core` —
10 passed. With `redact.ts` reverted, the 3 new cases fail.
- Full Python suite: 913 passed, same 4 failures as on `next` unchanged
(3 are `ModuleNotFoundError: composio_langchain` from providers not
installed in my env; 1 is `test_empty_name_safe_fails_at_write_time`,
which expects `IsADirectoryError` but Windows raises `PermissionError`
when opening a directory). Collection 944 → 956, exactly the 12 tests
added.
- Full `@composio/core` vitest: 798 passed / 2 failed, byte-identical to
the unchanged baseline (794 passed / same 2 failed — both Windows
path-and-symlink cases). 11 test files fail to load in both runs because
I installed with `--ignore-scripts`; the repo's `preinstall` hook
doesn't run in my shell.
- `ruff format --check` and `ruff check` clean on the two Python files;
`prettier --write` applied to the two TypeScript files.

## Checklist

- [x] I have read the Code of Conduct and this PR adheres to it
- [x] I ran linters/tests locally and they passed
- [ ] I updated documentation as needed — no user-facing behavior change
to document
- [x] I added tests or explain why not applicable
- [x] I added a changeset if this change affects published packages

## Additional context

This is defence-in-depth, so it stays deliberately narrow: same denylist
of key names, same value character class, no new rules. Bare-prefix
secrets (`sk-...`, `ghp_...`) and PEM blocks are still not matched by
either SDK — worth a separate look, but widening the pattern is a
different risk trade-off than closing a shape the rule already intends
to cover.
 2026-08-07 19:14:49 +05:30
jkomyno 4f009baa69 fix(python): resolve nested dynamic refs from document root 2026-08-07 19:11:18 +05:30
jkomyno 5a8e0e358a fix(core): accept widened object schemas in strict helper 2026-08-07 19:06:27 +05:30
Alberto Schiabel 6e0a9db3c7 feat(docs): make coding agents reach for REST API v3.1 (#4079) 
This PR:

- fixes
[UXE-233](https://linear.app/composio/issue/UXE-233/docs-should-explicitly-direct-agents-to-use-v31-apis)
- makes the agent-facing Markdown channels publish concrete REST v3.1
base URLs and endpoint tables while preserving the supported v3.0
reference tree
- centralizes `REST_VERSION_GUIDANCE`, `TOOL_VERSION_GUIDANCE`, and
raw-spec path matching in `lib/api-version-guidance.ts`
- renders `ApiBaseUrl` and `ApiEndpointsTable` in authored MDX and adds
an explicit version pointer to generated OpenAPI operation Markdown
- separates current and legacy REST references in `llms.txt`, excludes
v3.0 page bodies from `llms-full.txt`, and adds v3.1 selection guidance
to Context7
- validates serialized `ApiEndpointsTable` payloads with Zod before
generation while preserving forward-compatible fields
- addresses review feedback for the renamed authentication page,
SDK-reference pointer scope, generator validation behavior, and stale
OpenAPI tool-version descriptions

## Context

REST v3.0 is superseded but remains supported for existing integrations.
This PR changes what new agent-generated code discovers first; it does
not require existing v3.0 callers to migrate.

Authenticated read-only probes against the deployed API confirmed that
the affected v3 endpoints default to `00000000_00`, while their v3.1
counterparts default to `latest`. `POST /tools/scopes/required` is
available only on v3.1 and defaults to `latest`.

This PR does not move public URLs. A future `/reference/v3/` to
`/reference/v3.0/` migration remains separate because it has independent
compatibility and search-indexing risk.

## Verification

- `bun test tests/static/`
- `bun run build`
- `bun run test:integration`
- `bun run types:check`
- `bun run lint`

## Review follow-up

The version-default guidance is intentionally limited to the five
verified tool endpoints. v3.1 is a structural superset of v3, so this PR
does not claim route parity. Static coverage rejects broad non-tool
parity wording in both the shared guidance and Context7 rules.
 2026-08-07 18:48:00 +05:30
jkomyno 8d4bb3bf7e chore: merge next into json schema conversion fix 2026-08-07 18:44:34 +05:30
dependabot[bot] 0c4c5a360a chore(deps): bump the npm-production group across 1 directory with 17 updates (#4090) 
Bumps the npm-production group with 17 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
|
[@anthropic-ai/claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-typescript)
| `0.3.220` | `0.3.221` |
| [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai) | `6.0.235` |
`6.0.241` |
| [@google/genai](https://github.com/googleapis/js-genai) | `2.13.0` |
`2.15.0` |
| [@langchain/core](https://github.com/langchain-ai/langchainjs) |
`1.2.3` | `1.2.4` |
|
[@langchain/langgraph](https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core)
| `1.4.8` | `1.4.9` |
| [typebox](https://github.com/sinclairzx81/typebox) | `1.3.9` |
`1.3.10` |
| [@ai-sdk/mcp](https://github.com/vercel/ai/tree/HEAD/packages/mcp) |
`2.0.22` | `2.0.24` |
|
[@ai-sdk/openai](https://github.com/vercel/ai/tree/HEAD/packages/openai)
| `4.0.27` | `4.0.29` |
|
[@cloudflare/vitest-pool-workers](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers)
| `0.18.8` | `0.20.1` |
| [@cloudflare/workers-types](https://github.com/cloudflare/workerd) |
`5.20260801.1` | `5.20260804.1` |
|
[@mastra/core](https://github.com/mastra-ai/mastra/tree/HEAD/packages/core)
| `1.52.1` | `1.55.0` |
|
[@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk)
| `1.26.0` | `1.30.0` |
| [hono](https://github.com/honojs/hono) | `4.12.31` | `4.13.0` |
| [pnpm](https://github.com/pnpm/pnpm/tree/HEAD/pnpm11/pnpm) | `11.17.0`
| `11.20.0` |
|
[publint](https://github.com/publint/publint/tree/HEAD/packages/publint)
| `0.3.22` | `0.3.23` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.1` | `4.23.5` |
|
[wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler)
| `4.114.0` | `4.118.0` |


Updates `@anthropic-ai/claude-agent-sdk` from 0.3.220 to 0.3.221
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/releases">@​anthropic-ai/claude-agent-sdk's
releases</a>.</em></p>
<blockquote>
<h2>v0.3.221</h2>
<h2>What's changed</h2>
<ul>
<li>Improved <code>skills</code> option validation: malformed names
(delimiters or control characters) and wildcard-form names are rejected
with a clear error; use <code>skills: 'all'</code> to enable every
skill</li>
<li>Fixed external MCP servers passed via the <code>mcpServers</code>
option not being connected before the first turn, which caused the model
to emit tool calls as literal text</li>
</ul>
<h2>Update</h2>
<pre lang="sh"><code>npm install @anthropic-ai/claude-agent-sdk@0.3.221
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.221
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.221
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.221
</code></pre>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/blob/main/CHANGELOG.md">@​anthropic-ai/claude-agent-sdk's
changelog</a>.</em></p>
<blockquote>
<h2>0.3.221</h2>
<ul>
<li>Improved <code>skills</code> option validation: malformed names
(delimiters or control characters) and wildcard-form names are rejected
with a clear error; use <code>skills: 'all'</code> to enable every
skill</li>
<li>Fixed external MCP servers passed via the <code>mcpServers</code>
option not being connected before the first turn, which caused the model
to emit tool calls as literal text</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/31fbbfd403b3289933abc297e66cec775301e15e"><code>31fbbfd</code></a>
chore: Update CHANGELOG.md</li>
<li>See full diff in <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/compare/v0.3.220...v0.3.221">compare
view</a></li>
</ul>
</details>
<br />

Updates `ai` from 6.0.235 to 6.0.241
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/ai/blob/ai@6.0.241/packages/ai/CHANGELOG.md">ai's
changelog</a>.</em></p>
<blockquote>
<h2>6.0.241</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [7e50c52]
<ul>
<li><code>@​ai-sdk/gateway</code><a
href="https://github.com/3"><code>@​3</code></a>.0.163</li>
</ul>
</li>
</ul>
<h2>6.0.240</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [b28367e]
<ul>
<li><code>@​ai-sdk/gateway</code><a
href="https://github.com/3"><code>@​3</code></a>.0.162</li>
</ul>
</li>
</ul>
<h2>6.0.239</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [d3d9e0b]
<ul>
<li><code>@​ai-sdk/gateway</code><a
href="https://github.com/3"><code>@​3</code></a>.0.161</li>
</ul>
</li>
</ul>
<h2>6.0.238</h2>
<h3>Patch Changes</h3>
<ul>
<li>9ecdefe: Prevent validated downloads on Node.js from reaching
private or internal services through DNS aliases or DNS rebinding by
validating and pinning every resolved address at connection time.</li>
<li>26d10c0: support overriding model call settings for individual
<code>prepareStep</code> invocations</li>
<li>7767170: Preserve provider metadata from empty text deltas in
<code>streamText</code>.</li>
<li>Updated dependencies [9ecdefe]</li>
<li>Updated dependencies [87fb433]
<ul>
<li><code>@​ai-sdk/provider-utils</code><a
href="https://github.com/4"><code>@​4</code></a>.0.41</li>
<li><code>@​ai-sdk/gateway</code><a
href="https://github.com/3"><code>@​3</code></a>.0.160</li>
</ul>
</li>
</ul>
<h2>6.0.237</h2>
<h3>Patch Changes</h3>
<ul>
<li>f6020d7: Avoid synthesizing client tool errors for invalid
provider-executed tool calls.</li>
<li>Updated dependencies [de438f5]
<ul>
<li><code>@​ai-sdk/gateway</code><a
href="https://github.com/3"><code>@​3</code></a>.0.159</li>
</ul>
</li>
</ul>
<h2>6.0.236</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [8418710]
<ul>
<li><code>@​ai-sdk/gateway</code><a
href="https://github.com/3"><code>@​3</code></a>.0.158</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/ai/commit/5b4cf0ef925c6dfac12167e9e986e2e2e796e68e"><code>5b4cf0e</code></a>
Version Packages (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18345">#18345</a>)</li>
<li><a
href="https://github.com/vercel/ai/commit/b878ce998fbe53bb27d8124b59c94cb9c109899b"><code>b878ce9</code></a>
Version Packages (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18314">#18314</a>)</li>
<li><a
href="https://github.com/vercel/ai/commit/fbb507af0398516dc4db212a6dcdfff48744a4fd"><code>fbb507a</code></a>
Version Packages (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18280">#18280</a>)</li>
<li><a
href="https://github.com/vercel/ai/commit/6e37b23980716390f878881f0e39a878295d1dd4"><code>6e37b23</code></a>
v6.0: docs: document GenerateTextResult.output getter errors (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18252">#18252</a>)</li>
<li><a
href="https://github.com/vercel/ai/commit/006a2f87a3ca3409973d1a11ed21002b37d38c74"><code>006a2f8</code></a>
Version Packages (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18089">#18089</a>)</li>
<li><a
href="https://github.com/vercel/ai/commit/2deee5b27ec31ba38a2e2b20966fe1a868b5f117"><code>2deee5b</code></a>
v6.0: docs: clarify generateText text aggregation and empty-string
behavior (...</li>
<li><a
href="https://github.com/vercel/ai/commit/26d10c0b30ca68d5c7b618b8d54b06ae01930a68"><code>26d10c0</code></a>
[v6.0] feat: support per-step model call setting overrides in
prepareStep (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/1">#1</a>...</li>
<li><a
href="https://github.com/vercel/ai/commit/9ecdefe4eb4db14c76bcc7c04813663d2012fb8e"><code>9ecdefe</code></a>
[v6] fix(provider-utils): prevent DNS alias SSRF in validated downloads
(<a
href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18095">#18095</a>)</li>
<li><a
href="https://github.com/vercel/ai/commit/776717089720a00a29a7b72b86f7bdc54ea8c0bd"><code>7767170</code></a>
[v6.0] fix: preserve provider metadata from empty streamText text deltas
(<a
href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18">#18</a>...</li>
<li><a
href="https://github.com/vercel/ai/commit/98d8c433aa6a0d3ec05c201e0355f876c6349c47"><code>98d8c43</code></a>
Version Packages (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18028">#18028</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/ai/commits/ai@6.0.241/packages/ai">compare
view</a></li>
</ul>
</details>
<br />

Updates `@google/genai` from 2.13.0 to 2.15.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/js-genai/releases">@​google/genai's
releases</a>.</em></p>
<blockquote>
<h2>v2.15.0</h2>
<h2><a
href="https://github.com/googleapis/js-genai/compare/v2.14.0...v2.15.0">2.15.0</a>
(2026-07-30)</h2>
<h3>Features</h3>
<ul>
<li>add environment resource (<a
href="https://github.com/googleapis/js-genai/commit/2c911befbf839fc250a296783cbedbd3b668a9f7">2c911be</a>)</li>
<li>Support GoogleMaps Tool grounding_types places and routing (<a
href="https://github.com/googleapis/js-genai/commit/52655c192848942d2d866c3b256de27c94583f78">52655c1</a>)</li>
<li>Support per-request retryOptions in the JS GenAI SDK API Client (<a
href="https://github.com/googleapis/js-genai/commit/124b606bc5be0d5e70673dc28e16e739c9a25d7c">124b606</a>)</li>
<li>Wire environment service into genai sdk (<a
href="https://github.com/googleapis/js-genai/commit/70d79389536821f1323ae5016f63ee95afa6b48a">70d7938</a>)</li>
</ul>
<h2>v2.14.0</h2>
<h2><a
href="https://github.com/googleapis/js-genai/compare/v2.13.0...v2.14.0">2.14.0</a>
(2026-07-28)</h2>
<h3>Features</h3>
<ul>
<li>[GenerateContentConfig] Add
GenerationConfig.audio_transcription_config and
Part.audio_transcription. (<a
href="https://github.com/googleapis/js-genai/commit/4b2e67aebbb713321c095ccad34618f2a98fdd7d">4b2e67a</a>)</li>
<li>Add flat <code>language_codes</code> field to
<code>AudioTranscriptionConfig</code>. (<a
href="https://github.com/googleapis/js-genai/commit/cc808ebcbe76beb8e54fd5ca24ac358643104853">cc808eb</a>)</li>
<li>Allow api key + proj/location for enterprise mode (<a
href="https://github.com/googleapis/js-genai/commit/9c0540a26694e6a2896a433e43d1bac963af10e5">9c0540a</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>add deprecation warnings to Imagen generate_images, edit_images,
generate_videos (if using prompt/text/image args),
LiveConnectConfig.GenerationConfig which will be removed in the next
major version (<a
href="https://github.com/googleapis/js-genai/commit/bb6610199a76f7a99e28ed77974e6a3af21a52b1">bb66101</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/js-genai/blob/main/CHANGELOG.md">@​google/genai's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/googleapis/js-genai/compare/v2.14.0...v2.15.0">2.15.0</a>
(2026-07-30)</h2>
<h3>Features</h3>
<ul>
<li>add environment resource (<a
href="https://github.com/googleapis/js-genai/commit/2c911befbf839fc250a296783cbedbd3b668a9f7">2c911be</a>)</li>
<li>Support GoogleMaps Tool grounding_types places and routing (<a
href="https://github.com/googleapis/js-genai/commit/52655c192848942d2d866c3b256de27c94583f78">52655c1</a>)</li>
<li>Support per-request retryOptions in the JS GenAI SDK API Client (<a
href="https://github.com/googleapis/js-genai/commit/124b606bc5be0d5e70673dc28e16e739c9a25d7c">124b606</a>)</li>
<li>Wire environment service into genai sdk (<a
href="https://github.com/googleapis/js-genai/commit/70d79389536821f1323ae5016f63ee95afa6b48a">70d7938</a>)</li>
</ul>
<h2><a
href="https://github.com/googleapis/js-genai/compare/v2.13.0...v2.14.0">2.14.0</a>
(2026-07-28)</h2>
<h3>Features</h3>
<ul>
<li>[GenerateContentConfig] Add
GenerationConfig.audio_transcription_config and
Part.audio_transcription. (<a
href="https://github.com/googleapis/js-genai/commit/4b2e67aebbb713321c095ccad34618f2a98fdd7d">4b2e67a</a>)</li>
<li>Add flat <code>language_codes</code> field to
<code>AudioTranscriptionConfig</code>. (<a
href="https://github.com/googleapis/js-genai/commit/cc808ebcbe76beb8e54fd5ca24ac358643104853">cc808eb</a>)</li>
<li>Allow api key + proj/location for enterprise mode (<a
href="https://github.com/googleapis/js-genai/commit/9c0540a26694e6a2896a433e43d1bac963af10e5">9c0540a</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>add deprecation warnings to Imagen generate_images, edit_images,
generate_videos (if using prompt/text/image args),
LiveConnectConfig.GenerationConfig which will be removed in the next
major version (<a
href="https://github.com/googleapis/js-genai/commit/bb6610199a76f7a99e28ed77974e6a3af21a52b1">bb66101</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/googleapis/js-genai/commit/a76a3eab126e5b7c6a46f6c43795ec3cc65b5488"><code>a76a3ea</code></a>
chore(main): release 2.15.0 (<a
href="https://redirect.github.com/googleapis/js-genai/issues/1815">#1815</a>)</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/124b606bc5be0d5e70673dc28e16e739c9a25d7c"><code>124b606</code></a>
feat: Support per-request retryOptions in the JS GenAI SDK API
Client</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/52655c192848942d2d866c3b256de27c94583f78"><code>52655c1</code></a>
feat: Support GoogleMaps Tool grounding_types places and routing</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/70d79389536821f1323ae5016f63ee95afa6b48a"><code>70d7938</code></a>
feat: Wire environment service into genai sdk</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/2c911befbf839fc250a296783cbedbd3b668a9f7"><code>2c911be</code></a>
feat: add environment resource</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/1895d5793954cb62e3ab4d90aab2f636b4285497"><code>1895d57</code></a>
docs: Communicate on upcoming updates in the next major version</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/ebeba1cda039d43e821d519afb8ce1d0dc9d0f74"><code>ebeba1c</code></a>
chore(main): release 2.14.0 (<a
href="https://redirect.github.com/googleapis/js-genai/issues/1799">#1799</a>)</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/cc808ebcbe76beb8e54fd5ca24ac358643104853"><code>cc808eb</code></a>
feat: Add flat <code>language_codes</code> field to
<code>AudioTranscriptionConfig</code>.</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/9c0540a26694e6a2896a433e43d1bac963af10e5"><code>9c0540a</code></a>
feat: Allow api key + proj/location for enterprise mode</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/d221cf34c94ad558ab22d59e3163b60122d72948"><code>d221cf3</code></a>
chore: internal update</li>
<li>Additional commits viewable in <a
href="https://github.com/googleapis/js-genai/compare/v2.13.0...v2.15.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `@langchain/core` from 1.2.3 to 1.2.4
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchainjs/releases">@​langchain/core's
releases</a>.</em></p>
<blockquote>
<h2><code>@​langchain/core</code><a
href="https://github.com/1"><code>@​1</code></a>.2.4</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11190">#11190</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/9654bde694af4e78080a76a0b39d7edd35683449"><code>9654bde</code></a>
Thanks <a
href="https://github.com/pawel-twardziak"><code>@​pawel-twardziak</code></a>!
- Coalesce nested LangChain tracer callbacks that share run
bookkeeping.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11153">#11153</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/84ce6d65ef0ab2c556d5a5a3b5651b5cf3d73303"><code>84ce6d6</code></a>
Thanks <a
href="https://github.com/parveshsaini"><code>@​parveshsaini</code></a>!
- fix(core): bind splitText when trimMessages receives a TextSplitter
instance</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/f6dbb882d1d4a591d69020145b6a871fe7801b35"><code>f6dbb88</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11268">#11268</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/9654bde694af4e78080a76a0b39d7edd35683449"><code>9654bde</code></a>
fix(core): coalesce duplicate tracer copies sharing run state (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11190">#11190</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/84ce6d65ef0ab2c556d5a5a3b5651b5cf3d73303"><code>84ce6d6</code></a>
fix(core): bind splitText when trimMessages receives a TextSplitter
instance ...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/710d74f3fc0ff98d5088c8e0c86752829cfaaa2c"><code>710d74f</code></a>
fix: resolve open Dependabot alerts (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11259">#11259</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/5226cddb0d0b31d33bb78fc51230e4283cd6cc64"><code>5226cdd</code></a>
chore(deps-dev): bump <code>@​hono/node-server</code> from 2.0.4 to
2.0.10 in /libs/langcha...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/d829cb490112454b3cf8718a526f28450ff37062"><code>d829cb4</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11204">#11204</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/c8bd4c4a6dbde07fb24deb5870c02dc29c51ab53"><code>c8bd4c4</code></a>
feat(anthropic): add Claude Opus 5 support (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11255">#11255</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/741f380ae54afd2e920495b3042ea6346865836a"><code>741f380</code></a>
chore(deps): bump <code>@​hono/node-server</code> from 2.0.4 to 2.0.10
(<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11244">#11244</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/5103cee12ae0e3e56038f0c20edda5159b252daa"><code>5103cee</code></a>
chore(deps): bump js-yaml from 5.1.0 to 5.2.2 (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11256">#11256</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/db29a6a8060d9d8998f5fb566368e3bad5b32a5b"><code>db29a6a</code></a>
chore(deps): bump axios from 1.16.1 to 1.18.0 (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11228">#11228</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchainjs/compare/@langchain/core@1.2.3...@langchain/core@1.2.4">compare
view</a></li>
</ul>
</details>
<br />

Updates `@langchain/langgraph` from 1.4.8 to 1.4.9
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langgraphjs/releases">@​langchain/langgraph's
releases</a>.</em></p>
<blockquote>
<h2><code>@​langchain/langgraph</code><a
href="https://github.com/1"><code>@​1</code></a>.4.9</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2653">#2653</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/7880055ac7303483e424380cdd52f54cd094e311"><code>7880055</code></a>
Thanks <a
href="https://github.com/christian-bromann"><code>@​christian-bromann</code></a>!
- fix(langgraph): checkpoint Topic as a flat values list</p>
<p>Match Python Topic checkpoints so Host JS graphs no longer put
<code>__pregel_tasks: [[], []]</code> through the Python checkpointer.
Keep reading legacy <code>[seen, values]</code> checkpoints for restore
compatibility.</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langgraphjs/blob/main/libs/langgraph-core/CHANGELOG.md">@​langchain/langgraph's
changelog</a>.</em></p>
<blockquote>
<h2>1.4.9</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2653">#2653</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/7880055ac7303483e424380cdd52f54cd094e311"><code>7880055</code></a>
Thanks <a
href="https://github.com/christian-bromann"><code>@​christian-bromann</code></a>!
- fix(langgraph): checkpoint Topic as a flat values list</p>
<p>Match Python Topic checkpoints so Host JS graphs no longer put
<code>__pregel_tasks: [[], []]</code> through the Python checkpointer.
Keep reading legacy <code>[seen, values]</code> checkpoints for restore
compatibility.</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/5f9915234a5dca861ef01180fde28e52f42c6e15"><code>5f99152</code></a>
chore: version packages (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2655">#2655</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/7880055ac7303483e424380cdd52f54cd094e311"><code>7880055</code></a>
fix(langgraph): checkpoint Topic as a flat values list (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2653">#2653</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/cac6d3106599b5c9ecff8c00d99a7e78571c5202"><code>cac6d31</code></a>
chore(deps): bump the vite-vitest group across 1 directory with 6
updates (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2">#2</a>...</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/fa9892117d56398ce0f02f1a73bafb807a61ce2e"><code>fa98921</code></a>
chore(deps-dev): bump <code>@​vitest/browser</code> from 4.1.9 to 4.1.10
(<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2624">#2624</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/cdffd18d192eaa87375bc2d45b343418af8bd024"><code>cdffd18</code></a>
chore(deps): bump the langchain group across 1 directory with 6 updates
(<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2616">#2616</a>)</li>
<li>See full diff in <a
href="https://github.com/langchain-ai/langgraphjs/commits/@langchain/langgraph@1.4.9/libs/langgraph-core">compare
view</a></li>
</ul>
</details>
<br />

Updates `typebox` from 1.3.9 to 1.3.10
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/sinclairzx81/typebox/commit/221a1de804f08471600ebd4dc8a4460340797d56"><code>221a1de</code></a>
Version 1.3.10 (<a
href="https://redirect.github.com/sinclairzx81/typebox/issues/1662">#1662</a>)</li>
<li><a
href="https://github.com/sinclairzx81/typebox/commit/4992c53f930a675d78acdf5d61a1a12e64e8037a"><code>4992c53</code></a>
Specification</li>
<li>See full diff in <a
href="https://github.com/sinclairzx81/typebox/compare/1.3.9...1.3.10">compare
view</a></li>
</ul>
</details>
<br />

Updates `@ai-sdk/mcp` from 2.0.22 to 2.0.24
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/ai/blob/main/packages/mcp/CHANGELOG.md">@​ai-sdk/mcp's
changelog</a>.</em></p>
<blockquote>
<h2>2.0.24</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [160ccdb]
<ul>
<li><code>@​ai-sdk/provider-utils</code><a
href="https://github.com/5"><code>@​5</code></a>.0.20</li>
</ul>
</li>
</ul>
<h2>2.0.23</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [79e133c]
<ul>
<li><code>@​ai-sdk/provider</code><a
href="https://github.com/4"><code>@​4</code></a>.0.5</li>
<li><code>@​ai-sdk/provider-utils</code><a
href="https://github.com/5"><code>@​5</code></a>.0.19</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/ai/commit/22095f409fdf70dc858546fe26b1cf92f12f87f1"><code>22095f4</code></a>
Version Packages (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/mcp/issues/18381">#18381</a>)</li>
<li><a
href="https://github.com/vercel/ai/commit/9df82a8bc70f569ae0fbb701a81fd6209ec2a2b7"><code>9df82a8</code></a>
Version Packages (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/mcp/issues/18368">#18368</a>)</li>
<li>See full diff in <a
href="https://github.com/vercel/ai/commits/@ai-sdk/mcp@2.0.24/packages/mcp">compare
view</a></li>
</ul>
</details>
<br />

Updates `@ai-sdk/openai` from 4.0.27 to 4.0.29
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/ai/blob/main/packages/openai/CHANGELOG.md">@​ai-sdk/openai's
changelog</a>.</em></p>
<blockquote>
<h2>4.0.29</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [160ccdb]
<ul>
<li><code>@​ai-sdk/provider-utils</code><a
href="https://github.com/5"><code>@​5</code></a>.0.20</li>
</ul>
</li>
</ul>
<h2>4.0.28</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [79e133c]
<ul>
<li><code>@​ai-sdk/provider</code><a
href="https://github.com/4"><code>@​4</code></a>.0.5</li>
<li><code>@​ai-sdk/provider-utils</code><a
href="https://github.com/5"><code>@​5</code></a>.0.19</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/ai/commit/22095f409fdf70dc858546fe26b1cf92f12f87f1"><code>22095f4</code></a>
Version Packages (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/openai/issues/18381">#18381</a>)</li>
<li><a
href="https://github.com/vercel/ai/commit/9df82a8bc70f569ae0fbb701a81fd6209ec2a2b7"><code>9df82a8</code></a>
Version Packages (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/openai/issues/18368">#18368</a>)</li>
<li>See full diff in <a
href="https://github.com/vercel/ai/commits/@ai-sdk/openai@4.0.29/packages/openai">compare
view</a></li>
</ul>
</details>
<br />

Updates `@cloudflare/vitest-pool-workers` from 0.18.8 to 0.20.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/cloudflare/workers-sdk/releases">@​cloudflare/vitest-pool-workers's
releases</a>.</em></p>
<blockquote>
<h2><code>@​cloudflare/vitest-pool-workers</code><a
href="https://github.com/0"><code>@​0</code></a>.20.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/cloudflare/workers-sdk/commit/cc63aae658c39ae33169c6dc89f2e6ec1071fc53"><code>cc63aae</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/f92d1fc1316ba4e5f7e308c79943cb9e34b308c2"><code>f92d1fc</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/a249591473321cc2fb88a7b62a8c2b8663ebd4ef"><code>a249591</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/f92d1fc1316ba4e5f7e308c79943cb9e34b308c2"><code>f92d1fc</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/f92d1fc1316ba4e5f7e308c79943cb9e34b308c2"><code>f92d1fc</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/cec9d8875d3f103acc813724ded980867bd25ed7"><code>cec9d88</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/e0bbf55fdce5239a88c78a4350d3287f52d77964"><code>e0bbf55</code></a>]:
<ul>
<li>wrangler@4.118.0</li>
</ul>
</li>
</ul>
<h2><code>@​cloudflare/vitest-pool-workers</code><a
href="https://github.com/0"><code>@​0</code></a>.20.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/cloudflare/workers-sdk/pull/14586">#14586</a>
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>
Thanks <a
href="https://github.com/emily-shen"><code>@​emily-shen</code></a>! -
Breaking change: Remove several options from the <code>miniflare</code>
override options</p>
<p>The following options have been removed from the
<code>miniflare</code> override options, as they were not intended to be
exposed, were not functional, or have been superseded by other
options:</p>
<ul>
<li><code>wrappedBindings</code></li>
<li><code>cacheWarnUsage</code></li>
<li><code>fetchMock</code>: you should use <code>outboundService</code>
instead</li>
<li><code>containerEngine</code>: containers were not supported in
vitest-pool-workers. Consider using <a
href="https://developers.cloudflare.com/workers/testing/test-harness/"><code>createTestHarness()</code></a>
instead if you want to test against actual containers.</li>
</ul>
<p>Additionally, <code>cache</code> has been deprecated and renamed to
<code>cacheAPI</code>, but <code>cache</code> remains functional.</p>
</li>
</ul>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/cloudflare/workers-sdk/pull/14586">#14586</a>
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>
Thanks <a
href="https://github.com/emily-shen"><code>@​emily-shen</code></a>! -
Preserve the deprecated Miniflare <code>cache</code> option</p>
<p>Vitest configurations using <code>cache</code> continue to work after
the internal Miniflare v5 upgrade. The option is translated to
<code>cacheAPI</code>; new configurations should use
<code>cacheAPI</code> directly.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/cloudflare/workers-sdk/pull/14586">#14586</a>
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>
Thanks <a
href="https://github.com/emily-shen"><code>@​emily-shen</code></a>! -
Stop enabling Miniflare's removed <code>unsafeStickyBlobs</code>
option</p>
<p>The pool no longer sets the <code>unsafeStickyBlobs</code> Miniflare
option, which has been removed. This option was only needed for the
Durable Object isolated storage feature that was dropped in 0.13.0, so
there is no change in behaviour.</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>]:</p>
<ul>
<li><a
href="mailto:miniflare@5.20260730.0-alpha">miniflare@5.20260730.0-alpha</a></li>
<li>wrangler@4.117.0</li>
</ul>
</li>
</ul>
<h2><code>@​cloudflare/vitest-pool-workers</code><a
href="https://github.com/0"><code>@​0</code></a>.19.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/cloudflare/workers-sdk/commit/01d7020806dd523158cf9f26a4575365117f5381"><code>01d7020</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/beec0fbc9d3adec24bc42e31a21fe7f82badb543"><code>beec0fb</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/48f0c6cbbc50dfac02e2d76554c181ced233a792"><code>48f0c6c</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/8049ca451c9561e8b72f3eeeb7916a8712f06133"><code>8049ca4</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/d7f38c311e8cd0f29f56a25250da45f62b20f8ca"><code>d7f38c3</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/1394867d1dc357d9bddabf8c16aede47d052fb18"><code>1394867</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/cc5447865022ebc602258cfbeb79953181a62ae0"><code>cc54478</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5c25cfe4e03e0d3d42ddab57adc3274d6f6a1a30"><code>5c25cfe</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/b21eac24878f060296915f198fae910268c465ef"><code>b21eac2</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/bb09f1bd77a194520db3e61d733996f4bbe4bad8"><code>bb09f1b</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/1f61001e5f7a807db7856f5d89e0b26e12a0d0a0"><code>1f61001</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/01d7020806dd523158cf9f26a4575365117f5381"><code>01d7020</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/e31ab0f40c5310babd8b493490c0e1ca677e9a8c"><code>e31ab0f</code></a>]:
<ul>
<li>miniflare@4.20260730.0</li>
<li>wrangler@4.116.0</li>
</ul>
</li>
</ul>
<h2><code>@​cloudflare/vitest-pool-workers</code><a
href="https://github.com/0"><code>@​0</code></a>.19.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/cloudflare/workers-sdk/pull/14879">#14879</a>
<a
href="https://github.com/cloudflare/workers-sdk/commit/e6480e3c26e849034e9e511a2fd1216257975656"><code>e6480e3</code></a>
Thanks <a
href="https://github.com/dmmulroy"><code>@​dmmulroy</code></a>! - Add a
<code>verbose</code> option to <code>cloudflareTest()</code> and
<code>cloudflarePool()</code> configuration</p>
<p>Set <code>verbose: false</code> to suppress verbose workerd runtime
logs, such as caught Durable Object RPC errors. The option defaults to
<code>true</code> to preserve existing output.</p>
</li>
</ul>
<h3>Patch Changes</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/cloudflare/workers-sdk/blob/main/packages/vitest-pool-workers/CHANGELOG.md">@​cloudflare/vitest-pool-workers's
changelog</a>.</em></p>
<blockquote>
<h2>0.20.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/cloudflare/workers-sdk/commit/cc63aae658c39ae33169c6dc89f2e6ec1071fc53"><code>cc63aae</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/f92d1fc1316ba4e5f7e308c79943cb9e34b308c2"><code>f92d1fc</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/a249591473321cc2fb88a7b62a8c2b8663ebd4ef"><code>a249591</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/f92d1fc1316ba4e5f7e308c79943cb9e34b308c2"><code>f92d1fc</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/f92d1fc1316ba4e5f7e308c79943cb9e34b308c2"><code>f92d1fc</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/cec9d8875d3f103acc813724ded980867bd25ed7"><code>cec9d88</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/e0bbf55fdce5239a88c78a4350d3287f52d77964"><code>e0bbf55</code></a>]:
<ul>
<li>wrangler@4.118.0</li>
</ul>
</li>
</ul>
<h2>0.20.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/cloudflare/workers-sdk/pull/14586">#14586</a>
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>
Thanks <a
href="https://github.com/emily-shen"><code>@​emily-shen</code></a>! -
Breaking change: Remove several options from the <code>miniflare</code>
override options</p>
<p>The following options have been removed from the
<code>miniflare</code> override options, as they were not intended to be
exposed, were not functional, or have been superseded by other
options:</p>
<ul>
<li><code>wrappedBindings</code></li>
<li><code>cacheWarnUsage</code></li>
<li><code>fetchMock</code>: you should use <code>outboundService</code>
instead</li>
<li><code>containerEngine</code>: containers were not supported in
vitest-pool-workers. Consider using <a
href="https://developers.cloudflare.com/workers/testing/test-harness/"><code>createTestHarness()</code></a>
instead if you want to test against actual containers.</li>
</ul>
<p>Additionally, <code>cache</code> has been deprecated and renamed to
<code>cacheAPI</code>, but <code>cache</code> remains functional.</p>
</li>
</ul>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/cloudflare/workers-sdk/pull/14586">#14586</a>
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>
Thanks <a
href="https://github.com/emily-shen"><code>@​emily-shen</code></a>! -
Preserve the deprecated Miniflare <code>cache</code> option</p>
<p>Vitest configurations using <code>cache</code> continue to work after
the internal Miniflare v5 upgrade. The option is translated to
<code>cacheAPI</code>; new configurations should use
<code>cacheAPI</code> directly.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/cloudflare/workers-sdk/pull/14586">#14586</a>
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>
Thanks <a
href="https://github.com/emily-shen"><code>@​emily-shen</code></a>! -
Stop enabling Miniflare's removed <code>unsafeStickyBlobs</code>
option</p>
<p>The pool no longer sets the <code>unsafeStickyBlobs</code> Miniflare
option, which has been removed. This option was only needed for the
Durable Object isolated storage feature that was dropped in 0.13.0, so
there is no change in behaviour.</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>]:</p>
<ul>
<li><a
href="mailto:miniflare@5.20260730.0-alpha">miniflare@5.20260730.0-alpha</a></li>
<li>wrangler@4.117.0</li>
</ul>
</li>
</ul>
<h2>0.19.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/cloudflare/workers-sdk/commit/01d7020806dd523158cf9f26a4575365117f5381"><code>01d7020</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/beec0fbc9d3adec24bc42e31a21fe7f82badb543"><code>beec0fb</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/48f0c6cbbc50dfac02e2d76554c181ced233a792"><code>48f0c6c</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/8049ca451c9561e8b72f3eeeb7916a8712f06133"><code>8049ca4</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/d7f38c311e8cd0f29f56a25250da45f62b20f8ca"><code>d7f38c3</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/1394867d1dc357d9bddabf8c16aede47d052fb18"><code>1394867</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/cc5447865022ebc602258cfbeb79953181a62ae0"><code>cc54478</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5c25cfe4e03e0d3d42ddab57adc3274d6f6a1a30"><code>5c25cfe</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/b21eac24878f060296915f198fae910268c465ef"><code>b21eac2</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/bb09f1bd77a194520db3e61d733996f4bbe4bad8"><code>bb09f1b</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/1f61001e5f7a807db7856f5d89e0b26e12a0d0a0"><code>1f61001</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/01d7020806dd523158cf9f26a4575365117f5381"><code>01d7020</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/e31ab0f40c5310babd8b493490c0e1ca677e9a8c"><code>e31ab0f</code></a>]:
<ul>
<li>miniflare@4.20260730.0</li>
<li>wrangler@4.116.0</li>
</ul>
</li>
</ul>
<h2>0.19.0</h2>
<h3>Minor Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/cloudflare/workers-sdk/pull/14879">#14879</a>
<a
href="https://github.com/cloudflare/workers-sdk/commit/e6480e3c26e849034e9e511a2fd1216257975656"><code>e6480e3</code></a>
Thanks <a
href="https://github.com/dmmulroy"><code>@​dmmulroy</code></a>! - Add a
<code>verbose</code> option to <code>cloudflareTest()</code> and
<code>cloudflarePool()</code> configuration</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/cloudflare/workers-sdk/commit/95d9b12f2c707f254b66b446e0bd9fd6b8b7d96d"><code>95d9b12</code></a>
Version Packages (<a
href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers/issues/14946">#14946</a>)</li>
<li><a
href="https://github.com/cloudflare/workers-sdk/commit/83a37e3ef05d6930f29df904978e7f6eacde2203"><code>83a37e3</code></a>
docs: point vitest-pool-workers BUILD section at the tsdown config (<a
href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers/issues/14940">#14940</a>)</li>
<li><a
href="https://github.com/cloudflare/workers-sdk/commit/fcb5402346b2424008c7a0d0612ee8ba2f65bf3e"><code>fcb5402</code></a>
Version Packages (<a
href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers/issues/14939">#14939</a>)</li>
<li><a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>
Miniflare v5 alpha (<a
href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers/issues/14586">#14586</a>)</li>
<li><a
href="https://github.com/cloudflare/workers-sdk/commit/96fd16f0e06e82eb99001c70e4935e992e69cb87"><code>96fd16f</code></a>
Version Packages (<a
href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers/issues/14898">#14898</a>)</li>
<li><a
href="https://github.com/cloudflare/workers-sdk/commit/760a85b6fac60b0a73298c99df54ae0058653c76"><code>760a85b</code></a>
Version Packages (<a
href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers/issues/14824">#14824</a>)</li>
<li><a
href="https://github.com/cloudflare/workers-sdk/commit/e6480e3c26e849034e9e511a2fd1216257975656"><code>e6480e3</code></a>
[vitest-pool-workers] Make workerd verbose logging configurable (<a
href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers/issues/14879">#14879</a>)</li>
<li><a
href="https://github.com/cloudflare/workers-sdk/commit/edc203e42a10a52f8d2af305fecd2fed4807274e"><code>edc203e</code></a>
[vitest-pool-workers] Ignore workerd's ungraceful TLS disconnect
exception lo...</li>
<li>See full diff in <a
href="https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vitest-pool-workers@0.20.1/packages/vitest-pool-workers">compare
view</a></li>
</ul>
</details>
<br />

Updates `@cloudflare/workers-types` from 5.20260801.1 to 5.20260804.1
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/cloudflare/workerd/commits">compare
view</a></li>
</ul>
</details>
<br />

Updates `@mastra/core` from 1.52.1 to 1.55.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/mastra-ai/mastra/releases">@​mastra/core's
releases</a>.</em></p>
<blockquote>
<h2>July 30, 2026</h2>
<h2>Highlights</h2>
<h3>In-process Code Mode execution (no workspace sandbox required)</h3>
<p>Code Mode transports can now declare <code>requiresSandbox:
false</code>, letting <code>createCodeMode()</code> run without a
workspace sandbox for in-process execution boundaries. This enables
secure in-process runtimes like V8 isolates and exports
<code>sanitizeToolId</code> so transports can share consistent
<code>external_*</code> naming.</p>
<h3>New <code>@mastra/isolated-vm</code> package for V8-isolated Code
Mode</h3>
<p>Introduces <code>@mastra/isolated-vm</code> with
<code>IsolatedVmCodeModeTransport</code>, running model-authored
programs inside an in-process V8 isolate with no
filesystem/network/process access (only bridged <code>external_*</code>
tools). Note: requires <code>isolated-vm</code> native addon and Node
20+ hosts must start with <code>--no-node-snapshot</code>.</p>
<h3>Built-in provider-native Web Search tool</h3>
<p><code>@mastra/core</code> adds <code>webSearchTool</code>, a
first-party web search tool that resolves to provider-native search when
supported by the configured model/provider, simplifying “current info”
agent setups.</p>
<h3>Stored agent drafts via <code>autoPublish</code> (Server + JS
SDK)</h3>
<p>Both <code>@mastra/server</code> and <code>@mastra/client-js</code>
add <code>autoPublish</code> to stored agent creation so you can create
an initial unpublished draft for review before publishing (existing
calls still publish immediately by default).</p>
<h3>New Factory channel identity domain + channels integration slot</h3>
<p><code>@mastra/factory</code> adds a <code>channel-identity</code>
storage domain to link chat-platform senders to Factory users, plus a
<code>channels()</code> integration slot to attach an
<code>AgentControllerChannels</code> during <code>prepare()</code> so
inbound platform messages can drive the same agents as the web UI.</p>
<h3>Breaking Changes</h3>
<ul>
<li><code>ChannelHandler</code> context parameter is now required: the
4th parameter is <code>ctx: ChannelHandlerContext</code> (non-optional).
Code that <em>calls</em> a <code>ChannelHandler</code>-typed function
with only three args must be updated to pass <code>ctx</code>.</li>
</ul>
<h2>Changelog</h2>
<h3><a
href="https://github.com/mastra-ai/mastra/blob/@mastra/core@1.55.0/packages/core/CHANGELOG.md">@​mastra/core@1.55.0</a></h3>
<h4>Minor Changes</h4>
<ul>
<li>
<p>Added support for Code Mode transports that provide their own
execution boundary. A transport can now declare <code>requiresSandbox:
false</code> and <code>createCodeMode()</code> will run it without a
workspace sandbox, which enables in-process transports such as
<code>IsolatedVmCodeModeTransport</code> from
<code>@mastra/isolated-vm</code>: (<a
href="https://redirect.github.com/mastra-ai/mastra/pull/20359">#20359</a>)</p>
<pre lang="typescript"><code>import { createCodeMode } from
'@mastra/core/tools';
import { IsolatedVmCodeModeTransport } from '@mastra/isolated-vm';
<p>// No sandbox needed — the V8 isolate is the execution boundary
const { tool, instructions } = createCodeMode({ tools }, new
IsolatedVmCodeModeTransport());
</code></pre></p>
<p>Also fixed the generated Code Mode instructions to describe isolation
accurately instead of always claiming the program runs fully sandboxed,
since the actual boundary depends on the configured sandbox and
transport. The <code>sanitizeToolId</code> helper used for
<code>external_*</code> naming is now exported from
<code>@mastra/core/tools</code> so transports can reuse it instead of
duplicating it.</p>
</li>
<li>
<p>Added retry callbacks for stream error policies and ensured explicit
matcher policies override provider retry metadata. (<a
href="https://redirect.github.com/mastra-ai/mastra/pull/19724">#19724</a>)</p>
</li>
<li>
<p>Channel handlers can now contribute to the request context of the run
they start. (<a
href="https://redirect.github.com/mastra-ai/mastra/pull/20060">#20060</a>)</p>
<p><code>ChannelHandlerContext</code> gains a
<code>requestContext</code> field holding the
<code>RequestContext</code> for the run the inbound message is about to
start. It is constructed fresh for every message, and a handler may
write to it before calling <code>defaultHandler</code>. Core then adds
its own channel and render-context entries and dispatches with the same
instance, so anything the handler wrote reaches the run.</p>
<pre lang="ts"><code>import { AgentControllerChannels } from
'@mastra/core/channels';
<p>const channels = new AgentControllerChannels({
adapters,
handlers: {
</code></pre></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/mastra-ai/mastra/commit/bccb45d579ae7a914b9c03733f919127952c2300"><code>bccb45d</code></a>
chore: version - exit prerelease mode</li>
<li><a
href="https://github.com/mastra-ai/mastra/commit/469696312ac4c618bc8475b0c5ed7949b8a3455e"><code>4696963</code></a>
fix(core): persist delegation prompt exactly once in sub-agent threads
(<a
href="https://github.com/mastra-ai/mastra/tree/HEAD/packages/core/issues/20174">#20174</a>)</li>
<li><a
href="https://github.com/mastra-ai/mastra/commit/6b861234d6728e50c7b424d504024b468d6db2b8"><code>6b86123</code></a>
chore: version packages (alpha) (<a
href="https://github.com/mastra-ai/mastra/tree/HEAD/packages/core/issues/20419">#20419</a>)</li>
<li><a
href="https://github.com/mastra-ai/mastra/commit/723aa5437106bdb708ae03c0ef6b77aa11291e73"><code>723aa54</code></a>
feat(factory): stricter review agent — weigh existing comments,
calibrated ve...</li>
<li><a
href="https://github.com/mastra-ai/mastra/commit/ef8a7ceb6d663723e5e09aa6ebabc716665325af"><code>ef8a7ce</code></a>
chore: version packages (alpha) (<a
href="https://github.com/mastra-ai/mastra/tree/HEAD/packages/core/issues/20358">#20358</a>)</li>
<li><a
href="https://github.com/mastra-ai/mastra/commit/07f5b4ba9d608d88865030732e580298296adf99"><code>07f5b4b</code></a>
fix(core): avoid serializing result comparisons (<a
href="https://github.com/mastra-ai/mastra/tree/HEAD/packages/core/issues/20340">#20340</a>)</li>
<li><a
href="https://github.com/mastra-ai/mastra/commit/9c16d7b20f02b5bfd1152861a69fd6694c26f4b3"><code>9c16d7b</code></a>
chore: regenerate providers and docs [skip ci]</li>
<li><a
href="https://github.com/mastra-ai/mastra/commit/55c9e248c27c1d72b5bb7e94ea6b8a3999eee49f"><code>55c9e24</code></a>
Run Slack messages as the sender's Mastra tenant (<a
href="https://github.com/mastra-ai/mastra/tree/HEAD/packages/core/issues/20060">#20060</a>)</li>
<li><a
href="https://github.com/mastra-ai/mastra/commit/cfb2899d510252f39ddf46fb75c35c11fb4a36f4"><code>cfb2899</code></a>
chore: version packages</li>
<li><a
href="https://github.com/mastra-ai/mastra/commit/ba369f2a0aaf998da0d6aa033d26f64f96bef8ac"><code>ba369f2</code></a>
feat(isolated-vm): add IsolatedVmCodeModeTransport for in-process Code
Mode i...</li>
<li>Additional commits viewable in <a
href="https://github.com/mastra-ai/mastra/commits/@mastra/core@1.55.0/packages/core">compare
view</a></li>
</ul>
</details>
<br />

Updates `@modelcontextprotocol/sdk` from 1.26.0 to 1.30.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/modelcontextprotocol/typescript-sdk/releases">@​modelcontextprotocol/sdk's
releases</a>.</em></p>
<blockquote>
<h2>1.30.0</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(server): prioritize zod issues and format them by <a
href="https://github.com/mozmo15"><code>@​mozmo15</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1503">modelcontextprotocol/typescript-sdk#1503</a></li>
<li>chore(ci): switch publish to OIDC trusted publishing by <a
href="https://github.com/felixweinberger"><code>@​felixweinberger</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1839">modelcontextprotocol/typescript-sdk#1839</a></li>
<li>Add end-to-end test suite by <a
href="https://github.com/felixweinberger"><code>@​felixweinberger</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2167">modelcontextprotocol/typescript-sdk#2167</a></li>
<li>v1 stdio buffer limit by <a
href="https://github.com/KKonstantinov"><code>@​KKonstantinov</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2239">modelcontextprotocol/typescript-sdk#2239</a></li>
<li>fix: support Zod 3.25 method literals by <a
href="https://github.com/mattzcarey"><code>@​mattzcarey</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2368">modelcontextprotocol/typescript-sdk#2368</a></li>
<li>Validate Content-Type by parsed media type instead of substring
match (v1.x) by <a
href="https://github.com/felixweinberger"><code>@​felixweinberger</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2444">modelcontextprotocol/typescript-sdk#2444</a></li>
<li>fix: send SSE keep-alive comment frames from Streamable HTTP server
transport (v1.x) by <a
href="https://github.com/mattzcarey"><code>@​mattzcarey</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2538">modelcontextprotocol/typescript-sdk#2538</a></li>
<li>fix(deps): widen <code>@​hono/node-server</code> past
GHSA-frvp-7c67-39w9 by <a
href="https://github.com/arimu1"><code>@​arimu1</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2549">modelcontextprotocol/typescript-sdk#2549</a></li>
<li>Fix SSE keep-alive timer lifecycle in Streamable HTTP server
transport (v1.x) by <a
href="https://github.com/felixweinberger"><code>@​felixweinberger</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2547">modelcontextprotocol/typescript-sdk#2547</a></li>
<li>chore: bump version to 1.30.0 by <a
href="https://github.com/felixweinberger"><code>@​felixweinberger</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2563">modelcontextprotocol/typescript-sdk#2563</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/mozmo15"><code>@​mozmo15</code></a> made
their first contribution in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1503">modelcontextprotocol/typescript-sdk#1503</a></li>
<li><a href="https://github.com/arimu1"><code>@​arimu1</code></a> made
their first contribution in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2549">modelcontextprotocol/typescript-sdk#2549</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/modelcontextprotocol/typescript-sdk/compare/v1.29.0...1.30.0">https://github.com/modelcontextprotocol/typescript-sdk/compare/v1.29.0...1.30.0</a></p>
<h2>v1.29.0</h2>
<h2>What's Changed</h2>
<ul>
<li>fix: treat v1.x as primary branch for npm latest tag (backport <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/1577">#1577</a>)
by <a
href="https://github.com/felixweinberger"><code>@​felixweinberger</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1749">modelcontextprotocol/typescript-sdk#1749</a></li>
<li>[v1.x] fix: disallow null (infinite) requested TTL by <a
href="https://github.com/LucaButBoring"><code>@​LucaButBoring</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1339">modelcontextprotocol/typescript-sdk#1339</a></li>
<li>[v1.x] fix: add missing size field to ResourceSchema by <a
href="https://github.com/olaservo"><code>@​olaservo</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1575">modelcontextprotocol/typescript-sdk#1575</a></li>
<li>Add typings exports by <a
href="https://github.com/tdraier"><code>@​tdraier</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1623">modelcontextprotocol/typescript-sdk#1623</a></li>
<li>v1.x npm audit fix by <a
href="https://github.com/KKonstantinov"><code>@​KKonstantinov</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1780">modelcontextprotocol/typescript-sdk#1780</a></li>
<li>v1.x <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/1623">#1623</a>
follow up -add missing types to package.json by <a
href="https://github.com/KKonstantinov"><code>@​KKonstantinov</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1773">modelcontextprotocol/typescript-sdk#1773</a></li>
<li>[v1.x backport] Allow servers / clients to advertise extensions in
the capability object by <a
href="https://github.com/localden"><code>@​localden</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1811">modelcontextprotocol/typescript-sdk#1811</a></li>
<li>fix(stdio): always set windowsHide on Windows, not just in Electron
by <a href="https://github.com/jnMetaCode"><code>@​jnMetaCode</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1640">modelcontextprotocol/typescript-sdk#1640</a></li>
<li>chore: bump version to 1.29.0 by <a
href="https://github.com/felixweinberger"><code>@​felixweinberger</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1820">modelcontextprotocol/typescript-sdk#1820</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/tdraier"><code>@​tdraier</code></a> made
their first contribution in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1623">modelcontextprotocol/typescript-sdk#1623</a></li>
<li><a
href="https://github.com/jnMetaCode"><code>@​jnMetaCode</code></a> made
their first contribution in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1640">modelcontextprotocol/typescript-sdk#1640</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/modelcontextprotocol/typescript-sdk/compare/v1.28.0...v1.29.0">https://github.com/modelcontextprotocol/typescript-sdk/compare/v1.28.0...v1.29.0</a></p>
<h2>v1.28.0</h2>
<h2>What's Changed</h2>
<ul>
<li>feat: use scopes_supported from resource metadata by default (fixes
<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/580">#580</a>)
by <a href="https://github.com/antogyn"><code>@​antogyn</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/757">modelcontextprotocol/typescript-sdk#757</a></li>
<li>[v1.x backport] Default to client_secret_basic when server omits
token_endpoint_auth_methods_supported by <a
href="https://github.com/pcarleton"><code>@​pcarleton</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1611">modelcontextprotocol/typescript-sdk#1611</a></li>
<li>fix: reject plain JSON Schema objects passed as inputSchema by <a
href="https://github.com/tiluckdave"><code>@​tiluckdave</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1596">modelcontextprotocol/typescript-sdk#1596</a></li>
<li>fix: clear _timeoutInfo in _onclose() and scope .finally() abort
controller cleanup by <a
href="https://github.com/pcarleton"><code>@​pcarleton</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1462">modelcontextprotocol/typescript-sdk#1462</a></li>
<li>fix(server/auth): RFC 8252 loopback port relaxation by <a
href="https://github.com/poteat"><code>@​poteat</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1738">modelcontextprotocol/typescript-sdk#1738</a></li>
<li>chore: bump version to 1.28.0 by <a
href="https://github.com/felixweinberger"><code>@​felixweinberger</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1746">modelcontextprotocol/typescript-sdk#1746</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/antogyn"><code>@​antogyn</code></a> made
their first contribution in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/757">modelcontextprotocol/typescript-sdk#757</a></li>
<li><a
href="https://github.com/tiluckdave"><code>@​tiluckdave</code></a> made
their first contribution in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1596">modelcontextprotocol/typescript-sdk#1596</a></li>
<li><a href="https://github.com/poteat"><code>@​poteat</code></a> made
their first contribution in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1738">modelcontextprotocol/typescript-sdk#1738</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/2d889f2b329e46680ec9bdd565de4616c497825a"><code>2d889f2</code></a>
chore: bump version to 1.30.0 (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2563">#2563</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/e3f3daa12cc2603919939b72136ce9d9e800b868"><code>e3f3daa</code></a>
Fix SSE keep-alive timer lifecycle in Streamable HTTP server transport
(v1.x)...</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/bb5a718cbf90796bacbf62218b359196d210426b"><code>bb5a718</code></a>
fix(deps): widen <code>@​hono/node-server</code> past
GHSA-frvp-7c67-39w9 (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2549">#2549</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/1dad2634ce5799fb386283d14291d1b4935a9a52"><code>1dad263</code></a>
fix: send SSE keep-alive comment frames from Streamable HTTP server
transport...</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/69749aa5081ddfe675d36da8d96c7e27d83742b8"><code>69749aa</code></a>
Validate Content-Type by parsed media type instead of substring match
(v1.x) ...</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/369513df7b0e9d8a979c86f68ba1930e0d5f27f0"><code>369513d</code></a>
fix: support Zod 3.25 method literals (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2368">#2368</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/e7ee57c2f33b8290a78a3cefa27ab635fe67fbff"><code>e7ee57c</code></a>
v1 stdio buffer limit (<a
href="https://redirect.github.com/modelcontextprotocol...

_Description has been truncated_

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: jkomyno <12381818+jkomyno@users.noreply.github.com>
 2026-08-07 18:41:15 +05:30
dependabot[bot] dda31cf3cb chore(deps): bump the github-actions group with 2 updates (#4089) 
Bumps the github-actions group with 2 updates:
[anthropics/claude-code-action](https://github.com/anthropics/claude-code-action)
and
[anthropics/claude-code-action/base-action](https://github.com/anthropics/claude-code-action).

Updates `anthropics/claude-code-action` from 1.0.183 to 1.0.185
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-code-action/releases">anthropics/claude-code-action's
releases</a>.</em></p>
<blockquote>
<h2>v1.0.185</h2>
<h2>What's Changed</h2>
<ul>
<li>Derive trigger timestamps for issues and pull_request events by <a
href="https://github.com/ashwin-ant"><code>@​ashwin-ant</code></a> in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1592">anthropics/claude-code-action#1592</a></li>
<li>Pin bun config for MCP server processes by <a
href="https://github.com/ashwin-ant"><code>@​ashwin-ant</code></a> in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1589">anthropics/claude-code-action#1589</a></li>
<li>Match downloaded images to their source URLs by asset identifier by
<a href="https://github.com/ashwin-ant"><code>@​ashwin-ant</code></a> in
<a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1588">anthropics/claude-code-action#1588</a></li>
<li>Check collaborator permissions for workflow_run events by <a
href="https://github.com/ashwin-ant"><code>@​ashwin-ant</code></a> in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1590">anthropics/claude-code-action#1590</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.185">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.185</a></p>
<h2>v1.0.184</h2>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.184">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.184</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/anthropics/claude-code-action/commit/9db594c7a0e82298c121c18b7f08aa1579ce7341"><code>9db594c</code></a>
chore: bump Claude Code to 2.1.222 and Agent SDK to 0.3.222</li>
<li><a
href="https://github.com/anthropics/claude-code-action/commit/acb0385805f08d88fa4906025a41975ee6122e32"><code>acb0385</code></a>
Check collaborator permissions for workflow_run events (<a
href="https://redirect.github.com/anthropics/claude-code-action/issues/1590">#1590</a>)</li>
<li><a
href="https://github.com/anthropics/claude-code-action/commit/b80a0f042f2ff42ebd031d911263a059bdd9bd85"><code>b80a0f0</code></a>
Match downloaded images to their source URLs by asset identifier (<a
href="https://redirect.github.com/anthropics/claude-code-action/issues/1588">#1588</a>)</li>
<li><a
href="https://github.com/anthropics/claude-code-action/commit/6fb6bb685891c44ad1313dedad3640bcd1f485c9"><code>6fb6bb6</code></a>
Pin bun config for MCP server processes (<a
href="https://redirect.github.com/anthropics/claude-code-action/issues/1589">#1589</a>)</li>
<li><a
href="https://github.com/anthropics/claude-code-action/commit/b2963b9127309fd8ef897bb24a5d79761d566111"><code>b2963b9</code></a>
Derive trigger timestamps for issues and pull_request events (<a
href="https://redirect.github.com/anthropics/claude-code-action/issues/1592">#1592</a>)</li>
<li><a
href="https://github.com/anthropics/claude-code-action/commit/86180fa9e4d311eed10c9cc49854c53dab5d517a"><code>86180fa</code></a>
chore: bump Claude Code to 2.1.221 and Agent SDK to 0.3.221</li>
<li>See full diff in <a
href="https://github.com/anthropics/claude-code-action/compare/be7b93b1907a4abad570368f3c74b6fe3807510b...9db594c7a0e82298c121c18b7f08aa1579ce7341">compare
view</a></li>
</ul>
</details>
<br />

Updates `anthropics/claude-code-action/base-action` from 1.0.183 to
1.0.185
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-code-action/releases">anthropics/claude-code-action/base-action's
releases</a>.</em></p>
<blockquote>
<h2>v1.0.185</h2>
<h2>What's Changed</h2>
<ul>
<li>Derive trigger timestamps for issues and pull_request events by <a
href="https://github.com/ashwin-ant"><code>@​ashwin-ant</code></a> in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1592">anthropics/claude-code-action#1592</a></li>
<li>Pin bun config for MCP server processes by <a
href="https://github.com/ashwin-ant"><code>@​ashwin-ant</code></a> in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1589">anthropics/claude-code-action#1589</a></li>
<li>Match downloaded images to their source URLs by asset identifier by
<a href="https://github.com/ashwin-ant"><code>@​ashwin-ant</code></a> in
<a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1588">anthropics/claude-code-action#1588</a></li>
<li>Check collaborator permissions for workflow_run events by <a
href="https://github.com/ashwin-ant"><code>@​ashwin-ant</code></a> in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1590">anthropics/claude-code-action#1590</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.185">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.185</a></p>
<h2>v1.0.184</h2>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.184">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.184</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/anthropics/claude-code-action/commit/9db594c7a0e82298c121c18b7f08aa1579ce7341"><code>9db594c</code></a>
chore: bump Claude Code to 2.1.222 and Agent SDK to 0.3.222</li>
<li><a
href="https://github.com/anthropics/claude-code-action/commit/acb0385805f08d88fa4906025a41975ee6122e32"><code>acb0385</code></a>
Check collaborator permissions for workflow_run events (<a
href="https://redirect.github.com/anthropics/claude-code-action/issues/1590">#1590</a>)</li>
<li><a
href="https://github.com/anthropics/claude-code-action/commit/b80a0f042f2ff42ebd031d911263a059bdd9bd85"><code>b80a0f0</code></a>
Match downloaded images to their source URLs by asset identifier (<a
href="https://redirect.github.com/anthropics/claude-code-action/issues/1588">#1588</a>)</li>
<li><a
href="https://github.com/anthropics/claude-code-action/commit/6fb6bb685891c44ad1313dedad3640bcd1f485c9"><code>6fb6bb6</code></a>
Pin bun config for MCP server processes (<a
href="https://redirect.github.com/anthropics/claude-code-action/issues/1589">#1589</a>)</li>
<li><a
href="https://github.com/anthropics/claude-code-action/commit/b2963b9127309fd8ef897bb24a5d79761d566111"><code>b2963b9</code></a>
Derive trigger timestamps for issues and pull_request events (<a
href="https://redirect.github.com/anthropics/claude-code-action/issues/1592">#1592</a>)</li>
<li><a
href="https://github.com/anthropics/claude-code-action/commit/86180fa9e4d311eed10c9cc49854c53dab5d517a"><code>86180fa</code></a>
chore: bump Claude Code to 2.1.221 and Agent SDK to 0.3.221</li>
<li>See full diff in <a
href="https://github.com/anthropics/claude-code-action/compare/be7b93b1907a4abad570368f3c74b6fe3807510b...9db594c7a0e82298c121c18b7f08aa1579ce7341">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-07 16:54:15 +05:30
dependabot[bot] 2cab683f0e chore(deps-dev): bump the npm-development group with 6 updates (#4091) 
Bumps the npm-development group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [lint-staged](https://github.com/lint-staged/lint-staged) | `17.2.0` |
`17.3.0` |
| [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) |
`1.76.0` | `1.77.0` |
|
[oxlint-plugin-eslint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint)
| `1.76.0` | `1.77.0` |
|
[@types/semver](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/semver)
| `7.7.1` | `7.8.0` |
|
[@earendil-works/pi-coding-agent](https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent)
| `0.82.1` | `0.83.0` |
| [eve](https://github.com/vercel/eve/tree/HEAD/packages/eve) |
`0.27.13` | `0.29.5` |

Updates `lint-staged` from 17.2.0 to 17.3.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/lint-staged/lint-staged/releases">lint-staged's
releases</a>.</em></p>
<blockquote>
<h2>v17.3.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/lint-staged/lint-staged/pull/1825">#1825</a>
<a
href="https://github.com/lint-staged/lint-staged/commit/16b3f74850e5d2811b5fbaea6c136733a71ad3e4"><code>16b3f74</code></a>
- It is now possible to run multiple tasks in parallel for a single glob
by configuring it with an array of tasks (which run sequentially), and
then placing another array inside it (where the tasks will run in
parallel). The following demonstrates the order tasks will start in:</p>
<pre lang="json"><code>{
&quot;*.ts&quot;: [&quot;first&quot;, &quot;second&quot;,
[&quot;third&quot;, &quot;third&quot;], &quot;fourth&quot;]
}
</code></pre>
<p>As a concrete example, <em>lint-staged</em>'s own configuration
is:</p>
<pre lang="js"><code>/** @type {import('./lib/index.js').Configuration}
*/
export default {
  &quot;*&quot;: [
    [
      &quot;oxfmt --check --no-error-on-unmatched-pattern&quot;,
      &quot;oxlint --no-error-on-unmatched-pattern&quot;,
    ],
  ],
  &quot;*.ts&quot;: () =&gt; &quot;tsc&quot;,
};
</code></pre>
<p>which means:</p>
<ol>
<li>for all staged files, run the two commands in parallel with staged
filenames appended, for example:
<ul>
<li><code>oxfmt --check --no-error-on-unmatched-pattern
lib/index.js</code></li>
<li><code>oxlint --no-error-on-unmatched-pattern
lib/index.js</code></li>
</ul>
</li>
<li>additionally, if any <code>*.ts</code> files are staged, run
<code>tsc</code> without appending any arguments</li>
<li>The two sets of commands also run in parallel</li>
</ol>
</li>
</ul>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/lint-staged/lint-staged/pull/1829">#1829</a>
<a
href="https://github.com/lint-staged/lint-staged/commit/15f7e5314b4afe4702808d978758b22d42437f43"><code>15f7e53</code></a>
- During an in-progress merge, files that are unchanged from the branch
being merged are now skipped. Technically, files are only included if
there are staged changes against both <code>HEAD</code> and
<code>MERGE_HEAD</code>.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md">lint-staged's
changelog</a>.</em></p>
<blockquote>
<h2>17.3.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/lint-staged/lint-staged/pull/1825">#1825</a>
<a
href="https://github.com/lint-staged/lint-staged/commit/16b3f74850e5d2811b5fbaea6c136733a71ad3e4"><code>16b3f74</code></a>
- It is now possible to run multiple tasks in parallel for a single glob
by configuring it with an array of tasks (which run sequentially), and
then placing another array inside it (where the tasks will run in
parallel). The following demonstrates the order tasks will start in:</p>
<pre lang="json"><code>{
&quot;*.ts&quot;: [&quot;first&quot;, &quot;second&quot;,
[&quot;third&quot;, &quot;third&quot;], &quot;fourth&quot;]
}
</code></pre>
<p>As a concrete example, <em>lint-staged</em>'s own configuration
is:</p>
<pre lang="js"><code>/** @type {import('./lib/index.js').Configuration}
*/
export default {
  &quot;*&quot;: [
    [
      &quot;oxfmt --check --no-error-on-unmatched-pattern&quot;,
      &quot;oxlint --no-error-on-unmatched-pattern&quot;,
    ],
  ],
  &quot;*.ts&quot;: () =&gt; &quot;tsc&quot;,
};
</code></pre>
<p>which means:</p>
<ol>
<li>for all staged files, run the two commands in parallel with staged
filenames appended, for example:
<ul>
<li><code>oxfmt --check --no-error-on-unmatched-pattern
lib/index.js</code></li>
<li><code>oxlint --no-error-on-unmatched-pattern
lib/index.js</code></li>
</ul>
</li>
<li>additionally, if any <code>*.ts</code> files are staged, run
<code>tsc</code> without appending any arguments</li>
<li>The two sets of commands also run in parallel</li>
</ol>
</li>
</ul>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/lint-staged/lint-staged/pull/1829">#1829</a>
<a
href="https://github.com/lint-staged/lint-staged/commit/15f7e5314b4afe4702808d978758b22d42437f43"><code>15f7e53</code></a>
- During an in-progress merge, files that are unchanged from the branch
being merged are now skipped. Technically, files are only included if
there are staged changes against both <code>HEAD</code> and
<code>MERGE_HEAD</code>.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/d15344350d914f5ce24df2c85f3ffebb9b387f3b"><code>d153443</code></a>
Merge pull request <a
href="https://redirect.github.com/lint-staged/lint-staged/issues/1828">#1828</a>
from lint-staged/changeset-release/main</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/5162c149bbfa09b8a5ad4d37c647d63946568ca8"><code>5162c14</code></a>
chore(changeset): release</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/a4db9a4c32f108d1397436752be7e9dda956baa2"><code>a4db9a4</code></a>
Merge pull request <a
href="https://redirect.github.com/lint-staged/lint-staged/issues/1831">#1831</a>
from lint-staged/linter-updates</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/ea96cab0109ab44a5b2562927b890648ee32b4cc"><code>ea96cab</code></a>
style: enable oxlint &quot;suspicious&quot; category</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/2fae00778cea0c99da9bcb8bad4718dce08ea04e"><code>2fae007</code></a>
style: add <code>@e18e/eslint-plugin</code></li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/2280c38a09ff4ca4db60320b5879e0029527afaa"><code>2280c38</code></a>
Merge pull request <a
href="https://redirect.github.com/lint-staged/lint-staged/issues/1829">#1829</a>
from lint-staged/fix-merge-conflict-files</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/1453ae6ae0e05275d714ad0cad7cd090885f504d"><code>1453ae6</code></a>
test: relax assertion so that it passes in worktree</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/15f7e5314b4afe4702808d978758b22d42437f43"><code>15f7e53</code></a>
fix: lint only files changed against HEAD and MERGE_HEAD, during a
merge</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/dedfc31007aed50e1c9c5591a11085cb485ba41c"><code>dedfc31</code></a>
Merge pull request <a
href="https://redirect.github.com/lint-staged/lint-staged/issues/1825">#1825</a>
from lint-staged/parallel-tasks-inside-sequence</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/286e25cef9fde2fb6e77d2312fd91ac99020d69d"><code>286e25c</code></a>
feat: allow running parallel tasks by nesting arrays</li>
<li>Additional commits viewable in <a
href="https://github.com/lint-staged/lint-staged/compare/v17.2.0...v17.3.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `oxlint` from 1.76.0 to 1.77.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/oxc-project/oxc/releases">oxlint's
releases</a>.</em></p>
<blockquote>
<h2>oxlint v1.27.0 &amp;&amp; oxfmt v0.12.0</h2>
<h1>Oxlint v1.27.0</h1>
<h3>🚀 Features</h3>
<ul>
<li>222a8f0 linter/plugins: Implement
<code>SourceCode#isSpaceBetween</code> (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15498">#15498</a>)
(overlookmotel)</li>
<li>2f9735d linter/plugins: Implement
<code>context.languageOptions</code> (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15486">#15486</a>)
(overlookmotel)</li>
<li>bc731ff linter/plugins: Stub out all <code>Context</code> APIs (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15479">#15479</a>)
(overlookmotel)</li>
<li>5822cb4 linter/plugins: Add <code>extend</code> method to
<code>FILE_CONTEXT</code> (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15477">#15477</a>)
(overlookmotel)</li>
<li>7b1e6f3 apps: Add pure rust binaries and release to github (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15469">#15469</a>)
(Boshen)</li>
<li>2a89b43 linter: Introduce debug assertions after fixes to assert
validity (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15389">#15389</a>)
(camc314)</li>
<li>ad3c45a editor: Add <code>oxc.path.node</code> option (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15040">#15040</a>)
(Sysix)</li>
</ul>
<h3>🐛 Bug Fixes</h3>
<ul>
<li>6f3cd77 linter/no-var: Incorrect warning for blocks (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15504">#15504</a>)
(Hamir Mahal)</li>
<li>6957fb9 linter/plugins: Do not allow access to
<code>Context#id</code> in <code>createOnce</code> (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15489">#15489</a>)
(overlookmotel)</li>
<li>7409630 linter/plugins: Allow access to <code>cwd</code> in
<code>createOnce</code> in ESLint interop mode (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15488">#15488</a>)
(overlookmotel)</li>
<li>732205e parser: Reject <code>using</code> / <code>await using</code>
in a switch <code>case</code> / <code>default</code> clause (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15225">#15225</a>)
(sapphi-red)</li>
<li>a17ca32 linter/plugins: Replace <code>Context</code> class (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15448">#15448</a>)
(overlookmotel)</li>
<li>ecf2f7b language_server: Fail gracefully when tsgolint executable
not found (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15436">#15436</a>)
(camc314)</li>
<li>3c8d3a7 lang-server: Improve logging in failure case for tsgolint
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15299">#15299</a>)
(camc314)</li>
<li>ef71410 linter: Use jsx if source type is JS in fix debug assertion
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15434">#15434</a>)
(camc314)</li>
<li>e32bbf6 linter/no-var: Handle TypeScript declare keyword in fixer
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15426">#15426</a>)
(camc314)</li>
<li>6565dbe linter/switch-case-braces: Skip comments when searching for
<code>:</code> token (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15425">#15425</a>)
(camc314)</li>
<li>85bd19a linter/prefer-class-fields: Insert value after type
annotation in fixer (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15423">#15423</a>)
(camc314)</li>
<li>fde753e linter/plugins: Block access to
<code>context.settings</code> in <code>createOnce</code> (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15394">#15394</a>)
(overlookmotel)</li>
<li>ddd9f9f linter/forward-ref-uses-ref: Dont suggest removing wrapper
in invalid positions (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15388">#15388</a>)
(camc314)</li>
<li>dac2a9c linter/no-template-curly-in-string: Remove fixer (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15387">#15387</a>)
(camc314)</li>
<li>989b8e3 linter/no-var: Only fix to <code>const</code> if the var has
an initializer (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15385">#15385</a>)
(camc314)</li>
<li>cc403f5 linter/plugins: Return empty object for unimplemented
parserServices (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15364">#15364</a>)
(magic-akari)</li>
</ul>
<h3>⚡ Performance</h3>
<ul>
<li>25d577e language_server: Start tools in parallel (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15500">#15500</a>)
(Sysix)</li>
<li>3c57291 linter/plugins: Optimize loops (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15449">#15449</a>)
(overlookmotel)</li>
<li>3166233 linter/plugins: Remove <code>Arc</code>s (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15431">#15431</a>)
(overlookmotel)</li>
<li>9de1322 linter/plugins: Lazily deserialize settings JSON (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15395">#15395</a>)
(overlookmotel)</li>
<li>3049ec2 linter/plugins: Optimize <code>deepFreezeSettings</code> (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15392">#15392</a>)
(overlookmotel)</li>
<li>444ebfd linter/plugins: Use single object for
<code>parserServices</code> (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15378">#15378</a>)
(overlookmotel)</li>
</ul>
<h3>📚 Documentation</h3>
<ul>
<li>97d2104 linter: Update comment in lint.rs about default value for
tsconfig path (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15530">#15530</a>)
(Connor Shea)</li>
<li>2c6bd9e linter: Always refer as &quot;ES2015&quot; instead of
&quot;ES6&quot; (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15411">#15411</a>)
(sapphi-red)</li>
<li>a0c5203 linter/import/named: Update &quot;ES7&quot; comment in
examples (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15410">#15410</a>)
(sapphi-red)</li>
<li>3dc24b5 linter,minifier: Always refer as &quot;ES Modules&quot;
instead of &quot;ES6 Modules&quot; (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15409">#15409</a>)
(sapphi-red)</li>
<li>2ad77fb linter/no-this-before-super: Correct &quot;Why is this
bad?&quot; section (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15408">#15408</a>)
(sapphi-red)</li>
<li>57f0ce1 linter: Add backquotes where appropriate (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15407">#15407</a>)
(sapphi-red)</li>
</ul>
<h1>Oxfmt v0.12.0</h1>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md">oxlint's
changelog</a>.</em></p>
<blockquote>
<h2>[1.77.0] - 2026-08-03</h2>
<h3>🐛 Bug Fixes</h3>
<ul>
<li>5c0fa61 linter/eslint/no-warning-comments: Unify config structs and
remove manual options docs (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25151">#25151</a>)
(Mikhail Baev)</li>
</ul>
<h3>📚 Documentation</h3>
<ul>
<li>9dc7756 linter/typescript/no-unnecessary-condition: Clarify options
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25110">#25110</a>)
(camc314)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/oxc-project/oxc/commit/9a423f2f485b79c2353c49442c0c7f60f900261d"><code>9a423f2</code></a>
release(apps): oxlint v1.77.0 &amp;&amp; oxfmt v0.62.0 (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25251">#25251</a>)</li>
<li><a
href="https://github.com/oxc-project/oxc/commit/5c0fa61ddbd098fea5101dff356dc9b67adbee95"><code>5c0fa61</code></a>
fix(linter/eslint/no-warning-comments): unify config structs and remove
manua...</li>
<li><a
href="https://github.com/oxc-project/oxc/commit/9dc77567291db6ebd0641284f80bf50163c6a257"><code>9dc7756</code></a>
docs(linter/typescript/no-unnecessary-condition): clarify options (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25110">#25110</a>)</li>
<li>See full diff in <a
href="https://github.com/oxc-project/oxc/commits/oxlint_v1.77.0/npm/oxlint">compare
view</a></li>
</ul>
</details>
<br />

Updates `oxlint-plugin-eslint` from 1.76.0 to 1.77.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/oxc-project/oxc/commit/9a423f2f485b79c2353c49442c0c7f60f900261d"><code>9a423f2</code></a>
release(apps): oxlint v1.77.0 &amp;&amp; oxfmt v0.62.0 (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25251">#25251</a>)</li>
<li>See full diff in <a
href="https://github.com/oxc-project/oxc/commits/apps_v1.77.0/npm/oxlint-plugin-eslint">compare
view</a></li>
</ul>
</details>
<br />

Updates `@types/semver` from 7.7.1 to 7.8.0
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/semver">compare
view</a></li>
</ul>
</details>
<br />

Updates `@earendil-works/pi-coding-agent` from 0.82.1 to 0.83.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/earendil-works/pi/releases">@​earendil-works/pi-coding-agent's
releases</a>.</em></p>
<blockquote>
<h2>v0.83.0</h2>
<h3>New Features</h3>
<ul>
<li><strong>Credential export for external clients</strong> — <code>pi
auth print-api-key</code> and <code>pi auth print-bearer-token</code>
export configured credentials with automatic OAuth refresh and
minimum-validity enforcement.</li>
<li><strong>Headless OpenRouter sign-in</strong> — Complete
<code>/login</code> over SSH by pasting the redirect URL or
authorization code when the loopback callback is unavailable. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/providers.md#openrouter">OpenRouter</a>.</li>
<li><strong>Claude Opus 5 on GitHub Copilot</strong> — Use Claude Opus 5
through GitHub Copilot with adaptive thinking and a 1M context window.
See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/providers.md#github-copilot">GitHub
Copilot</a>.</li>
</ul>
<h3>Breaking Changes</h3>
<ul>
<li>Upgraded bundled TypeBox aliases to 1.3.7, removing deprecated APIs
including <code>Type.Base</code>, <code>Type.Awaited</code>,
<code>Type.Promise</code>, <code>Type.AsyncIterator</code>,
<code>Type.Iterator</code>, <code>Type.Options</code>, and
<code>Value.Mutate</code>, while fixing compiled validation of nullable
array tool arguments. Extensions using removed APIs must migrate to
supported TypeBox APIs. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/packages.md#dependencies">Package
Dependencies</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7243">#7243</a>
by <a
href="https://github.com/petrroll"><code>@​petrroll</code></a>).</li>
</ul>
<h3>Added</h3>
<ul>
<li>Added <code>pi auth print-api-key</code> and <code>pi auth
print-bearer-token</code> commands for exporting configured credentials
to external clients, including automatic OAuth refresh and configurable
minimum token validity (<a
href="https://redirect.github.com/earendil-works/pi/pull/7168">#7168</a>).</li>
<li>Exposed the session's resolved model scope as
<code>ctx.scopedModels</code> to extensions. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/extensions.md#ctxmodelregistry--ctxmodel--ctxthinkinglevel--ctxscopedmodels">Extension
Context</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7191">#7191</a>
by <a href="https://github.com/pungggi"><code>@​pungggi</code></a>, <a
href="https://redirect.github.com/earendil-works/pi/pull/7215">#7215</a>).</li>
<li>Added inherited per-request <code>fetch</code> injection for
supported text and image provider transports.</li>
<li>Added the inherited <code>&quot;pending&quot;</code> stop reason for
partial streaming messages. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/custom-provider.md#stream-pattern">Custom
Provider Stream Pattern</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7151">#7151</a>
by <a
href="https://github.com/lucasmeijer"><code>@​lucasmeijer</code></a>).</li>
<li>Added inherited raw provider stop reasons across Google, Anthropic,
Amazon Bedrock, Mistral, and OpenAI streams; unmapped terminal reasons
now surface as provider errors instead of successful stops (<a
href="https://redirect.github.com/earendil-works/pi/pull/7272">#7272</a>).</li>
<li>Added manual redirect URL and authorization-code entry to OpenRouter
login for remote and headless environments. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/providers.md#openrouter">OpenRouter</a>
(<a
href="https://redirect.github.com/earendil-works/pi/pull/7114">#7114</a>
by <a
href="https://github.com/rgarcia"><code>@​rgarcia</code></a>).</li>
<li>Added inherited Claude Opus 5 support for GitHub Copilot with
adaptive thinking and a 1M context window. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/providers.md#github-copilot">GitHub
Copilot</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7158">#7158</a>
by <a
href="https://github.com/jay-aye-see-kay"><code>@​jay-aye-see-kay</code></a>).</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Changed inherited OAuth credential resolution to refresh tokens with
less than five minutes of validity remaining instead of waiting until
expiration (<a
href="https://redirect.github.com/earendil-works/pi/pull/7168">#7168</a>).</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Added a status line when the tool output expansion is toggled (<a
href="https://redirect.github.com/earendil-works/pi/issues/7180">#7180</a>).</li>
<li>Fixed file-backed <code>SYSTEM.md</code> and
<code>APPEND_SYSTEM.md</code> prompts being omitted from the interactive
startup context listing. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/usage.md#system-prompt-files">System
Prompt Files</a> (<a
href="https://redirect.github.com/earendil-works/pi/issues/7096">#7096</a>).</li>
<li>Fixed context files loading twice when a linked Git worktree is
nested under its main repository. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/usage.md#context-files">Context
Files</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7221">#7221</a>
by <a
href="https://github.com/arajkumar"><code>@​arajkumar</code></a>).</li>
<li>Fixed llama.cpp streamed responses reporting zero token usage and
leaving session context accounting empty. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/llama-cpp.md">llama.cpp</a>
(<a
href="https://redirect.github.com/earendil-works/pi/pull/7258">#7258</a>
by <a
href="https://github.com/SteveImmanuel"><code>@​SteveImmanuel</code></a>).</li>
<li>Fixed session replacement and committed tree navigation during an
active response to abort and persist the outgoing turn instead of
leaving dangling tool calls. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/usage.md#sessions">Sessions</a>
(<a
href="https://redirect.github.com/earendil-works/pi/pull/7022">#7022</a>
by <a
href="https://github.com/tmustier"><code>@​tmustier</code></a>).</li>
<li>Fixed failed Git package installs leaving partial directories that
blocked clean retries. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/packages.md#install-and-manage">Install
and Manage</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7210">#7210</a>
by <a
href="https://github.com/haoqixu"><code>@​haoqixu</code></a>).</li>
<li>Fixed the <code>/model</code> selector retaining a stale selection
while filtering instead of highlighting the top match (<a
href="https://redirect.github.com/earendil-works/pi/pull/7211">#7211</a>
by <a
href="https://github.com/christianbasch"><code>@​christianbasch</code></a>).</li>
<li>Fixed direct RPC bash commands bypassing extension
<code>user_bash</code> handlers. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/extensions.md#user-bash-events">User
Bash Events</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7214">#7214</a>).</li>
<li>Fixed skills, prompts, and themes losing package source metadata
after extensions reload resources. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/extensions.md#resource-events">Resource
Events</a> (<a
href="https://redirect.github.com/earendil-works/pi/issues/6968">#6968</a>).</li>
<li>Fixed cancellation of concurrently running user bash commands so
every active command is aborted (<a
href="https://redirect.github.com/earendil-works/pi/pull/7103">#7103</a>
by <a
href="https://github.com/yzhg1983"><code>@​yzhg1983</code></a>).</li>
<li>Fixed duplicate messages appearing when extensions switch sessions
during interactive startup (<a
href="https://redirect.github.com/earendil-works/pi/pull/7110">#7110</a>
by <a
href="https://github.com/yzhg1983"><code>@​yzhg1983</code></a>).</li>
<li>Fixed inherited Qwen Token Plan reasoning models to send their
service-specific thinking controls and supported reasoning-effort levels
(<a
href="https://redirect.github.com/earendil-works/pi/issues/6951">#6951</a>,
<a
href="https://redirect.github.com/earendil-works/pi/issues/6998">#6998</a>).</li>
<li>Fixed inherited Z.AI output limits being sent through an unsupported
parameter. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/providers.md">Providers</a>
(<a
href="https://redirect.github.com/earendil-works/pi/pull/7174">#7174</a>
by <a
href="https://github.com/HyeokjaeLee"><code>@​HyeokjaeLee</code></a>).</li>
<li>Fixed explicitly configured Amazon Bedrock profiles being overridden
by ambient AWS access keys. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/providers.md#amazon-bedrock">Amazon
Bedrock</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7176">#7176</a>
by <a
href="https://github.com/christianbasch"><code>@​christianbasch</code></a>).</li>
<li>Fixed inherited image fallback paths overflowing narrow terminals,
shortened home-directory paths, and made absolute paths clickable when
terminal hyperlinks are available (<a
href="https://redirect.github.com/earendil-works/pi/pull/7262">#7262</a>).</li>
<li>Fixed inherited OpenAI-compatible tool calls losing their function
arguments when malformed deltas also contain an empty
<code>custom</code> object (<a
href="https://redirect.github.com/earendil-works/pi/pull/7288">#7288</a>
by <a
href="https://github.com/sunnyyoung"><code>@​sunnyyoung</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/CHANGELOG.md">@​earendil-works/pi-coding-agent's
changelog</a>.</em></p>
<blockquote>
<h2>[0.83.0] - 2026-07-29</h2>
<h3>New Features</h3>
<ul>
<li><strong>Credential export for external clients</strong> — <code>pi
auth print-api-key</code> and <code>pi auth print-bearer-token</code>
export configured credentials with automatic OAuth refresh and
minimum-validity enforcement.</li>
<li><strong>Headless OpenRouter sign-in</strong> — Complete
<code>/login</code> over SSH by pasting the redirect URL or
authorization code when the loopback callback is unavailable. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#openrouter">OpenRouter</a>.</li>
<li><strong>Claude Opus 5 on GitHub Copilot</strong> — Use Claude Opus 5
through GitHub Copilot with adaptive thinking and a 1M context window.
See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#github-copilot">GitHub
Copilot</a>.</li>
</ul>
<h3>Breaking Changes</h3>
<ul>
<li>Upgraded bundled TypeBox aliases to 1.3.7, removing deprecated APIs
including <code>Type.Base</code>, <code>Type.Awaited</code>,
<code>Type.Promise</code>, <code>Type.AsyncIterator</code>,
<code>Type.Iterator</code>, <code>Type.Options</code>, and
<code>Value.Mutate</code>, while fixing compiled validation of nullable
array tool arguments. Extensions using removed APIs must migrate to
supported TypeBox APIs. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/packages.md#dependencies">Package
Dependencies</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7243">#7243</a>
by <a
href="https://github.com/petrroll"><code>@​petrroll</code></a>).</li>
</ul>
<h3>Added</h3>
<ul>
<li>Added <code>pi auth print-api-key</code> and <code>pi auth
print-bearer-token</code> commands for exporting configured credentials
to external clients, including automatic OAuth refresh and configurable
minimum token validity (<a
href="https://redirect.github.com/earendil-works/pi/pull/7168">#7168</a>).</li>
<li>Exposed the session's resolved model scope as
<code>ctx.scopedModels</code> to extensions. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/extensions.md#ctxmodelregistry--ctxmodel--ctxthinkinglevel--ctxscopedmodels">Extension
Context</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7191">#7191</a>
by <a href="https://github.com/pungggi"><code>@​pungggi</code></a>, <a
href="https://redirect.github.com/earendil-works/pi/pull/7215">#7215</a>).</li>
<li>Added inherited per-request <code>fetch</code> injection for
supported text and image provider transports.</li>
<li>Added the inherited <code>&quot;pending&quot;</code> stop reason for
partial streaming messages. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/custom-provider.md#stream-pattern">Custom
Provider Stream Pattern</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7151">#7151</a>
by <a
href="https://github.com/lucasmeijer"><code>@​lucasmeijer</code></a>).</li>
<li>Added inherited raw provider stop reasons across Google, Anthropic,
Amazon Bedrock, Mistral, and OpenAI streams; unmapped terminal reasons
now surface as provider errors instead of successful stops (<a
href="https://redirect.github.com/earendil-works/pi/pull/7272">#7272</a>).</li>
<li>Added manual redirect URL and authorization-code entry to OpenRouter
login for remote and headless environments. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#openrouter">OpenRouter</a>
(<a
href="https://redirect.github.com/earendil-works/pi/pull/7114">#7114</a>
by <a
href="https://github.com/rgarcia"><code>@​rgarcia</code></a>).</li>
<li>Added inherited Claude Opus 5 support for GitHub Copilot with
adaptive thinking and a 1M context window. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#github-copilot">GitHub
Copilot</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7158">#7158</a>
by <a
href="https://github.com/jay-aye-see-kay"><code>@​jay-aye-see-kay</code></a>).</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Changed inherited OAuth credential resolution to refresh tokens with
less than five minutes of validity remaining instead of waiting until
expiration (<a
href="https://redirect.github.com/earendil-works/pi/pull/7168">#7168</a>).</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Added a status line when the tool output expansion is toggled (<a
href="https://redirect.github.com/earendil-works/pi/issues/7180">#7180</a>).</li>
<li>Fixed file-backed <code>SYSTEM.md</code> and
<code>APPEND_SYSTEM.md</code> prompts being omitted from the interactive
startup context listing. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/usage.md#system-prompt-files">System
Prompt Files</a> (<a
href="https://redirect.github.com/earendil-works/pi/issues/7096">#7096</a>).</li>
<li>Fixed context files loading twice when a linked Git worktree is
nested under its main repository. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/usage.md#context-files">Context
Files</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7221">#7221</a>
by <a
href="https://github.com/arajkumar"><code>@​arajkumar</code></a>).</li>
<li>Fixed llama.cpp streamed responses reporting zero token usage and
leaving session context accounting empty. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/llama-cpp.md">llama.cpp</a>
(<a
href="https://redirect.github.com/earendil-works/pi/pull/7258">#7258</a>
by <a
href="https://github.com/SteveImmanuel"><code>@​SteveImmanuel</code></a>).</li>
<li>Fixed session replacement and committed tree navigation during an
active response to abort and persist the outgoing turn instead of
leaving dangling tool calls. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/usage.md#sessions">Sessions</a>
(<a
href="https://redirect.github.com/earendil-works/pi/pull/7022">#7022</a>
by <a
href="https://github.com/tmustier"><code>@​tmustier</code></a>).</li>
<li>Fixed failed Git package installs leaving partial directories that
blocked clean retries. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/packages.md#install-and-manage">Install
and Manage</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7210">#7210</a>
by <a
href="https://github.com/haoqixu"><code>@​haoqixu</code></a>).</li>
<li>Fixed the <code>/model</code> selector retaining a stale selection
while filtering instead of highlighting the top match (<a
href="https://redirect.github.com/earendil-works/pi/pull/7211">#7211</a>
by <a
href="https://github.com/christianbasch"><code>@​christianbasch</code></a>).</li>
<li>Fixed direct RPC bash commands bypassing extension
<code>user_bash</code> handlers. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/extensions.md#user-bash-events">User
Bash Events</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7214">#7214</a>).</li>
<li>Fixed skills, prompts, and themes losing package source metadata
after extensions reload resources. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/extensions.md#resource-events">Resource
Events</a> (<a
href="https://redirect.github.com/earendil-works/pi/issues/6968">#6968</a>).</li>
<li>Fixed cancellation of concurrently running user bash commands so
every active command is aborted (<a
href="https://redirect.github.com/earendil-works/pi/pull/7103">#7103</a>
by <a
href="https://github.com/yzhg1983"><code>@​yzhg1983</code></a>).</li>
<li>Fixed duplicate messages appearing when extensions switch sessions
during interactive startup (<a
href="https://redirect.github.com/earendil-works/pi/pull/7110">#7110</a>
by <a
href="https://github.com/yzhg1983"><code>@​yzhg1983</code></a>).</li>
<li>Fixed inherited Qwen Token Plan reasoning models to send their
service-specific thinking controls and supported reasoning-effort levels
(<a
href="https://redirect.github.com/earendil-works/pi/issues/6951">#6951</a>,
<a
href="https://redirect.github.com/earendil-works/pi/issues/6998">#6998</a>).</li>
<li>Fixed inherited Z.AI output limits being sent through an unsupported
parameter. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md">Providers</a>
(<a
href="https://redirect.github.com/earendil-works/pi/pull/7174">#7174</a>
by <a
href="https://github.com/HyeokjaeLee"><code>@​HyeokjaeLee</code></a>).</li>
<li>Fixed explicitly configured Amazon Bedrock profiles being overridden
by ambient AWS access keys. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#amazon-bedrock">Amazon
Bedrock</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7176">#7176</a>
by <a
href="https://github.com/christianbasch"><code>@​christianbasch</code></a>).</li>
<li>Fixed inherited image fallback paths overflowing narrow terminals,
shortened home-directory paths, and made absolute paths clickable when
terminal hyperlinks are available (<a
href="https://redirect.github.com/earendil-works/pi/pull/7262">#7262</a>).</li>
<li>Fixed inherited OpenAI-compatible tool calls losing their function
arguments when malformed deltas also contain an empty
<code>custom</code> object (<a
href="https://redirect.github.com/earendil-works/pi/pull/7288">#7288</a>
by <a
href="https://github.com/sunnyyoung"><code>@​sunnyyoung</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/earendil-works/pi/commit/845d6ff1f6643aba440341cce877ce1c43ebbc39"><code>845d6ff</code></a>
Release v0.83.0</li>
<li><a
href="https://github.com/earendil-works/pi/commit/f0499a63ff5563ff041c689f680ecbf01436a5e2"><code>f0499a6</code></a>
docs: audit changelogs since v0.82.1</li>
<li><a
href="https://github.com/earendil-works/pi/commit/bff5ab71743b442efa234dbed369e0a96da791f3"><code>bff5ab7</code></a>
fix(coding-agent): show system prompt files in startup context (<a
href="https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent/issues/7266">#7266</a>)</li>
<li><a
href="https://github.com/earendil-works/pi/commit/cced6a21da273b26ee4a23a803680614bbe8dd1e"><code>cced6a2</code></a>
fix(coding-agent): stop loading AGENTS.md twice in nested git worktrees
(<a
href="https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent/issues/7221">#7221</a>)</li>
<li><a
href="https://github.com/earendil-works/pi/commit/f9476a61e557bfdce2fbf3ffeaad0988fe47c184"><code>f9476a6</code></a>
fix(ai): update TypeBox nullable array validation (<a
href="https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent/issues/7243">#7243</a>)</li>
<li><a
href="https://github.com/earendil-works/pi/commit/0c32e83a352a4284133b2544f730a23814948ac3"><code>0c32e83</code></a>
fix(coding-agent): enable streaming usage for llama.cpp provider (<a
href="https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent/issues/7258">#7258</a>)</li>
<li><a
href="https://github.com/earendil-works/pi/commit/47ca25fcd8535b80710fad5be758f1f2cf81443c"><code>47ca25f</code></a>
Revert &quot;fix(coding-agent): build-check-test (<a
href="https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent/issues/7206">#7206</a>)&quot;</li>
<li><a
href="https://github.com/earendil-works/pi/commit/0d008b746892ad33d3fe15c0c4bc86a14369e0e8"><code>0d008b7</code></a>
fix(coding-agent): show tool expansion status</li>
<li><a
href="https://github.com/earendil-works/pi/commit/f14519551682cd0fddac2e4b4e8b1f333667e94c"><code>f145195</code></a>
fix(coding-agent): build-check-test (<a
href="https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent/issues/7206">#7206</a>)</li>
<li><a
href="https://github.com/earendil-works/pi/commit/cefa40ed8f8dbcd6ffd67b5e7a0eaa75a5050d1a"><code>cefa40e</code></a>
***WIP it's a PoC *** fix(coding-agent): guard tree navigation during
respons...</li>
<li>Additional commits viewable in <a
href="https://github.com/earendil-works/pi/commits/v0.83.0/packages/coding-agent">compare
view</a></li>
</ul>
</details>
<br />

Updates `eve` from 0.27.13 to 0.29.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/eve/releases">eve's
releases</a>.</em></p>
<blockquote>
<h2>eve@0.29.5</h2>
<h3>Patch Changes</h3>
<ul>
<li>c0dc572: Rename the TUI <code>/new</code> command to
<code>/reset</code> so session reset uses the same name across the
client, HTTP, channel, and TUI APIs.</li>
<li>3dce30a: Add manual session compaction through custom-channel
helpers, the eve HTTP client, and the <code>eve dev</code> TUI's
<code>/compact</code> command. Compaction preserves the session, queues
behind an active turn, and does not send synthetic model input.</li>
<li>910805e: Make a single <code>Esc</code> cancel the running turn in
the eve dev TUI when no message is queued. Queued messages still use
<code>Esc</code> to steer the oldest message into the next turn.</li>
<li>9c51755: Connection search and discovered connection tools now use
the same <code>defineDynamic</code> and <code>defineTool</code> pipeline
as authored tools. Dynamic tool maps now reject entries that omit
<code>defineTool</code> instead of accepting unsupported raw
objects.</li>
<li>84aa671: Clarify the dev TUI’s <code>/add</code> flow with
consistent integration categories and category-specific browsing labels.
MCP connections are now named explicitly, and the flow more clearly
explains channels, extensions, and observability integrations.</li>
<li>0c28eb7: Allow declared subagents to export
<code>defineDynamic</code> from <code>agent.ts</code>. Session and turn
resolvers can now return an agent configuration to expose it or nil to
omit it from direct and Workflow delegation.</li>
<li>f3bb60d: Add manual session-context clearing through custom-channel
helpers, the eve HTTP client, and the <code>eve dev</code> TUI's
<code>/clear</code> command. Clearing removes model-message history
while preserving the session, agent configuration, durable state,
limits, and sandbox.</li>
<li>ac7d3c6: Add <code>/cancel</code> to the eve dev TUI. The command
cooperatively cancels a running turn from either the live streaming
input or the idle prompt while preserving the session and settled
context.</li>
</ul>
<h2>eve@0.29.4</h2>
<h3>Patch Changes</h3>
<ul>
<li>e90a8c2: Launch local or deployed eve applications as stable ACP v1
agents with <code>eve acp [url]</code>, including streamed messages,
tool activity, human input, cancellation, concurrent sessions, and
verified Vercel authentication.</li>
<li>cec672d: Add guided Discord setup through <code>eve add
channel/discord</code>, including Vercel Connect provisioning, trigger
attachment, interactions endpoint configuration, slash-command
registration, and channel scaffolding.</li>
<li>ed328e7: Render registry item titles with their exact
registry-provided casing by loading manifests for each page of catalog
results.</li>
<li>c875a67: Update the generated <code>AGENTS.md</code> to direct
coding agents to the eve registry for discovering and installing
integrations.</li>
<li>5153b13: Add JSON output to <code>eve registry list</code> and
<code>eve registry search</code> for scripts that inspect registry
catalogs.</li>
<li>155d46a: Connection registry items now configure their Vercel
Connect connector during <code>eve add</code>, and registry setup
commands close their IPC channel after reporting an outcome so
<code>/add</code> returns instead of remaining stuck.</li>
<li>6f3daca: Add <code>ClientSession.snapshot()</code> for reading a
finite, cursor-consistent session event prefix that can hydrate
server-rendered applications.</li>
<li>67bfc76: Resolve sandbox skill roots and seed-file paths through the
same <code>$HOME</code> resolver the file tools use, so the skills
location is spelled once instead of twice.</li>
<li>a5acde8: Ensure exiting the dev TUI shuts down its owned server and
any surviving workflow processes before the CLI exits. Persisted
workflow messages now reach the ready worker during restart instead of
being rejected while the file watcher starts.</li>
<li>731464f: Give the local trace spool's on-disk layout a single owner:
the shared trace reader now exposes the listing and segment-read
primitives that <code>eve traces</code> and the <code>/traces</code>
viewer both use, and payload formatting is shared between the detail
panel and the conversation view.</li>
<li>f7ba3b3: Derive the <code>/traces</code> conversation viewer's line
geometry from one prefix-sum helper so scroll, click, and wheel math
cannot disagree, and reset the view through a single factory when the
viewed trace changes.</li>
<li>3f4bb9c: The <code>/traces</code> viewer now follows your terminal's
colors instead of forcing a hardcoded black/grey truecolor palette. It
probes the terminal's default background (OSC 11) and derives its card
surfaces from your own theme — subtly elevated bands on dark and light
backgrounds alike, with red bands for failures, and card titles that
invert to black on light backgrounds so they stay legible. Terminals
that don't answer the probe get a clean gutter-rail rendering drawn
entirely with the shared TUI theme.</li>
<li>f5d0533: Derive the dev TUI's slash-command suggestion window from
the command registry instead of a hand-maintained constant, and collapse
the duplicated cursor step in the terminal line-wrap loop.</li>
</ul>
<h2>eve@0.29.3</h2>
<h3>Patch Changes</h3>
<ul>
<li>22bfa02: Add guided Photon setup through <code>eve add
channel/photon-imessage</code>, including project creation, phone
registration, Vercel Connect or portable credentials, and channel
scaffolding.</li>
<li>0c0de19: Add an opt-in experimental steering policy to Chat SDK
sends that cancels an active turn before delivering its replacement
message.</li>
<li>b00a79d: Add <code>photonIMessageChannel</code>, a first-class
Photon iMessage channel with lazy credentials, Vercel OIDC webhook
verification, and automatic eve session routing.</li>
<li>495e93b: Resolve leading <code>$HOME</code> paths in the built-in
<code>read_file</code>, <code>write_file</code>, <code>glob</code>, and
<code>grep</code> tools so agents can directly access packaged skill
references advertised in their prompt.</li>
<li>bf01952: Local trace spans now capture model and tool payloads: the
system prompt, prompt messages, and response text/reasoning/tool calls
on model spans, and call arguments/results on tool spans, each capped at
32 KB with provider transport metadata stripped. Set
<code>EVE_TRACES_CONTENT=off</code> to keep payloads out of the
spool.</li>
<li>680db59: Provider-executed tool calls (like a gateway's
<code>web_search</code>) now show up in local traces: their calls and
results are captured on the model span and the <code>/traces</code>
viewer renders them as tool cards, with oversized outputs truncated to
stay valid JSON.</li>
<li>7ab6d8a: Terminal text wrapping in the dev TUI is now linear-time,
so views rendering large single-line payloads (long tool results, big
JSON) no longer stall on every repaint.</li>
<li>52cee9c: Consolidate the three Vercel CLI subprocess runners onto
one shared lifecycle. A <code>vercel</code> lookup killed by a signal
(for example Ctrl-C during setup) now reports a cancellation failure
instead of resolving as a success with truncated output.</li>
<li>7703448: The local trace spool reader behind <code>eve traces</code>
moved into a shared internal module; command behavior is unchanged.</li>
<li>2d87acb: Subagent turn spans now record the dispatch that created
them —
<code>agent.parent.session.id</code>, <code>agent.parent.turn.id</code>,
<code>agent.parent.call_id</code>, and
<code>agent.subagent.name</code> — so a parent turn that fans out to
several children can
be attributed to the exact tool call behind each one.</li>
<li>3c846bc: The <code>/traces</code> viewer supports drag-to-select:
dragging with the mouse highlights text and releasing copies it to the
clipboard (OSC 52 with tmux passthrough, plus the platform clipboard
command) with a confirmation toast. Clicks now act on release so drags
never toggle cards, and Esc cancels an in-flight selection.</li>
<li>3645c6e: The <code>/traces</code> viewer frame breathes: padding
rows around the title and above the footer hints, the copy toast floats
top-right as a small surface with a left edge bar, and the scroll wheel
scrolls the attributes drawer when the pointer is over it.</li>
<li>8858403: The local tracing subsystem (spool writer/reader,
retention, the zero-config local OTel runtime, and agent span capture)
moved from <code>src/harness</code> into its own
<code>src/tracing</code> module; no behavior change.</li>
<li>9adb455: Adds a <code>/traces</code> command to the dev TUI: a
full-screen live viewer over the local trace spool that re-tells each
trace as a chat-style conversation — system prompt, user and assistant
messages, and tool calls render as expandable cards (arrow keys or mouse
click to expand/collapse), with a right-side metadata drawer. Subagent
turns are badged with their dispatch lineage
(<code>subagent:&lt;name&gt;</code>), and the viewer opens on the trace
containing the current session — including windowed sessions and
subagent children recorded into a parent's trace. Expanded cards scroll
line-by-line so content taller than the viewport is fully readable.
Model spans with errors, token usage, or tool calls (but no text) now
appear as cards instead of disappearing. Terminal escape sequences in
trace payloads are stripped at render time. Tool-call arguments and
results are captured without stripping domain-level
<code>providerOptions</code>/<code>providerMetadata</code> keys. A
single prompt message over 32 KiB is truncated at the text level so the
serialized JSON stays parseable. Local spans capture system prompt,
prompt messages, responses, reasoning, and tool arguments/results
(<code>EVE_TRACES_CONTENT=off</code> to disable); long conversations
truncate oldest messages first with an omission marker.</li>
<li>275271d: Subagent runs now record into the trace of the session that
dispatched them instead of a disconnected trace of their own, and
<code>eve traces</code> resolves either session id to it. Local traces
also open a real <code>agent.session</code> root span rather than a
synthesized parent, so an authored OTel sampler's root rule decides
whether a session is sampled, and a session long enough to outgrow one
trace rolls into numbered windows that <code>eve traces
&lt;session-id&gt;</code> lists oldest first. Rows whose lifetime
outlives the worker that opened them — <code>agent.session</code> and
<code>agent.turn</code> — now show the extent of their descendants
instead of <code>0ms</code>.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/eve/blob/main/packages/eve/CHANGELOG.md">eve's
changelog</a>.</em></p>
<blockquote>
<h2>0.29.5</h2>
<h3>Patch Changes</h3>
<ul>
<li>c0dc572: Rename the TUI <code>/new</code> command to
<code>/reset</code> so session reset uses the same name across the
client, HTTP, channel, and TUI APIs.</li>
<li>3dce30a: Add manual session compaction through custom-channel
helpers, the eve HTTP client, and the <code>eve dev</code> TUI's
<code>/compact</code> command. Compaction preserves the session, queues
behind an active turn, and does not send synthetic model input.</li>
<li>910805e: Make a single <code>Esc</code> cancel the running turn in
the eve dev TUI when no message is queued. Queued messages still use
<code>Esc</code> to steer the oldest message into the next turn.</li>
<li>9c51755: Connection search and discovered connection tools now use
the same <code>defineDynamic</code> and <code>defineTool</code> pipeline
as authored tools. Dynamic tool maps now reject entries that omit
<code>defineTool</code> instead of accepting unsupported raw
objects.</li>
<li>84aa671: Clarify the dev TUI’s <code>/add</code> flow with
consistent integration categories and category-specific browsing labels.
MCP connections are now named explicitly, and the flow more clearly
explains channels, extensions, and observability integrations.</li>
<li>0c28eb7: Allow declared subagents to export
<code>defineDynamic</code> from <code>agent.ts</code>. Session and turn
resolvers can now return an agent configuration to expose it or nil to
omit it from direct and Workflow delegation.</li>
<li>f3bb60d: Add manual session-context clearing through custom-channel
helpers, the eve HTTP client, and the <code>eve dev</code> TUI's
<code>/clear</code> command. Clearing removes model-message history
while preserving the session, agent configuration, durable state,
limits, and sandbox.</li>
<li>ac7d3c6: Add <code>/cancel</code> to the eve dev TUI. The command
cooperatively cancels a running turn from either the live streaming
input or the idle prompt while preserving the session and settled
context.</li>
</ul>
<h2>0.29.4</h2>
<h3>Patch Changes</h3>
<ul>
<li>e90a8c2: Launch local or deployed eve applications as stable ACP v1
agents with <code>eve acp [url]</code>, including streamed messages,
tool activity, human input, cancellation, concurrent sessions, and
verified Vercel authentication.</li>
<li>cec672d: Add guided Discord setup through <code>eve add
channel/discord</code>, including Vercel Connect provisioning, trigger
attachment, interactions endpoint configuration, slash-command
registration, and channel scaffolding.</li>
<li>ed328e7: Render registry item titles with their exact
registry-provided casing by loading manifests for each page of catalog
results.</li>
<li>c875a67: Update the generated <code>AGENTS.md</code> to direct
coding agents to the eve registry for discovering and installing
integrations.</li>
<li>5153b13: Add JSON output to <code>eve registry list</code> and
<code>eve registry search</code> for scripts that inspect registry
catalogs.</li>
<li>155d46a: Connection registry items now configure their Vercel
Connect connector during <code>eve add</code>, and registry setup
commands close their IPC channel after reporting an outcome so
<code>/add</code> returns instead of remaining stuck.</li>
<li>6f3daca: Add <code>ClientSession.snapshot()</code> for reading a
finite, cursor-consistent session event prefix that can hydrate
server-rendered applications.</li>
<li>67bfc76: Resolve sandbox skill roots and seed-file paths through the
same <code>$HOME</code> resolver the file tools use, so the skills
location is spelled once instead of twice.</li>
<li>a5acde8: Ensure exiting the dev TUI shuts down its owned server and
any surviving workflow processes before the CLI exits. Persisted
workflow messages now reach the ready worker during restart instead of
being rejected while the file watcher starts.</li>
<li>731464f: Give the local trace spool's on-disk layout a single owner:
the shared trace reader now exposes the listing and segment-read
primitives that <code>eve traces</code> and the <code>/traces</code>
viewer both use, and payload formatting is shared between the detail
panel and the conversation view.</li>
<li>f7ba3b3: Derive the <code>/traces</code> conversation viewer's line
geometry from one prefix-sum helper so scroll, click, and wheel math
cannot disagree, and reset the view through a single factory when the
viewed trace changes.</li>
<li>3f4bb9c: The <code>/traces</code> viewer now follows your terminal's
colors instead of forcing a hardcoded black/grey truecolor palette. It
probes the terminal's default background (OSC 11) and derives its card
surfaces from your own theme — subtly elevated bands on dark and light
backgrounds alike, with red bands for failures, and card titles that
invert to black on light backgrounds so they stay legible. Terminals
that don't answer the probe get a clean gutter-rail rendering drawn
entirely with the shared TUI theme.</li>
<li>f5d0533: Derive the dev TUI's slash-command suggestion window from
the command registry instead of a hand-maintained constant, and collapse
the duplicated cursor step in the terminal line-wrap loop.</li>
</ul>
<h2>0.29.3</h2>
<h3>Patch Changes</h3>
<ul>
<li>22bfa02: Add guided Photon setup through <code>eve add
channel/photon-imessage</code>, including project creation, phone
registration, Vercel Connect or portable credentials, and channel
scaffolding.</li>
<li>0c0de19: Add an opt-in experimental steering policy to Chat SDK
sends that cancels an active turn before delivering its replacement
message.</li>
<li>b00a79d: Add <code>photonIMessageChannel</code>, a first-class
Photon iMessage channel with lazy credentials, Vercel OIDC webhook
verification, and automatic eve session routing.</li>
<li>495e93b: Resolve leading <code>$HOME</code> paths in the built-in
<code>read_file</code>, <code>write_file</code>, <code>glob</code>, and
<code>grep</code> tools so agents can directly access packaged skill
references advertised in their prompt.</li>
<li>bf01952: Local trace spans now capture model and tool payloads: the
system prompt, prompt messages, and response text/reasoning/tool calls
on model spans, and call arguments/results on tool spans, each capped at
32 KB with provider transport metadata stripped. Set
<code>EVE_TRACES_CONTENT=off</code> to keep payloads out of the
spool.</li>
<li>680db59: Provider-executed tool calls (like a gateway's
<code>web_search</code>) now show up in local traces: their calls and
results are captured on the model span and the <code>/traces</code>
viewer renders them as tool cards, with oversized outputs truncated to
stay valid JSON.</li>
<li>7ab6d8a: Terminal text wrapping in the dev TUI is now linear-time,
so views rendering large single-line payloads (long tool results, big
JSON) no longer stall on every repaint.</li>
<li>52cee9c: Consolidate the three Vercel CLI subprocess runners onto
one shared lifecycle. A <code>vercel</code> lookup killed by a signal
(for example Ctrl-C during setup) now reports a cancellation failure
instead of resolving as a success with truncated output.</li>
<li>7703448: The local trace spool reader behind <code>eve traces</code>
moved into a shared internal module; command behavior is unchanged.</li>
<li>2d87acb: Subagent turn spans now record the dispatch that created
them —
<code>agent.parent.session.id</code>, <code>agent.parent.turn.id</code>,
<code>agent.parent.call_id</code>, and
<code>agent.subagent.name</code> — so a parent turn that fans out to
several children can
be attributed to the exact tool call behind each one.</li>
<li>3c846bc: The <code>/traces</code> viewer supports drag-to-select:
dragging with the mouse highlights text and releasing copies it to the
clipboard (OSC 52 with tmux passthrough, plus the platform clipboard
command) with a confirmation toast. Clicks now act on release so drags
never toggle cards, and Esc cancels an in-flight selection.</li>
<li>3645c6e: The <code>/traces</code> viewer frame breathes: padding
rows around the title and above the footer hints, the copy toast floats
top-right as a small surface with a left edge bar, and the scroll wheel
scrolls the attributes drawer when the pointer is over it.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/eve/commit/8988139097d1e1a1f1aca9b2828e63408848fccf"><code>8988139</code></a>
Version Packages (<a
href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1497">#1497</a>)</li>
<li><a
href="https://github.com/vercel/eve/commit/c0dc57240ec850b0f73075f0e3cc900c6e07640a"><code>c0dc572</code></a>
feat(tui): rename /new command to /reset (<a
href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1513">#1513</a>)</li>
<li><a
href="https://github.com/vercel/eve/commit/910805e8a825a34ba90c0a22a59dc1d787967976"><code>910805e</code></a>
feat(tui): cancel with one Esc press (<a
href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1514">#1514</a>)</li>
<li><a
href="https://github.com/vercel/eve/commit/ac7d3c66f8c43ce1008d88cedd5254bfec1301e1"><code>ac7d3c6</code></a>
feat(tui): add /cancel command (<a
href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1512">#1512</a>)</li>
<li><a
href="https://github.com/vercel/eve/commit/f3bb60dd53fa56e955c6ea71cbf72533cfe618e1"><code>f3bb60d</code></a>
feat: add manual session context clearing (<a
href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1511">#1511</a>)</li>
<li><a
href="https://github.com/vercel/eve/commit/3dce30a18d24644d85b6120d79eaf4d304beaf4b"><code>3dce30a</code></a>
feat: add manual session compaction (<a
href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1508">#1508</a>)</li>
<li><a
href="https://github.com/vercel/eve/commit/9c517555e870231af00df799523bffd9fc00df71"><code>9c51755</code></a>
refactor(eve): use public dynamic definitions for connection tools (<a
href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1505">#1505</a>)</li>
<li><a
href="https://github.com/vercel/eve/commit/0c28eb7e886c1a69ee20a5229682509d5413e140"><code>0c28eb7</code></a>
feat(eve): support dynamic subagents (<a
href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1485">#1485</a>)</li>
<li><a
href="https://github.com/vercel/eve/commit/84aa6715dbf6b6d696b7f567744711f4526b183f"><code>84aa671</code></a>
fix(eve): clarify add flow categories (<a
href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1494">#1494</a>)</li>
<li><a
href="https://github.com/vercel/eve/commit/ab86523b3e07f05f415c9c784232b3875b17b16f"><code>ab86523</code></a>
feat(eve): agent-handle lifecycle contracts (three-phase handles, turn
outcom...</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/eve/commits/eve@0.29.5/packages/eve">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@composio/cli@0.3.3-beta.341 		2026-08-07 16:53:51 +05:30
Soumya Medapati b581670d40 docs: rewrite the "CRITICAL INSTRUCTIONS FOR AI MODELS" block as descriptive notes (#4083) 
## What

In three independent eval runs across two rounds
(ctx.composio.io/soumya/docs-agent-eval/), capable agents classified
this block as prompt injection and deliberately ignored it (round 1,
agent-007: "a prompt injection I had to identify and ignore"; round 3,
two more agents unprompted). The ALWAYS/NEVER imperative framing also
contradicted the sessions-vs-direct-execution page — the block forbade
the API that page documents.

## Change

Rewritten in `docs/lib/llm-guardrails/session.ts` — same facts, no
commands:

- Sessions documented as the recommended default (samples unchanged)
- The provider-import gotcha kept — it's the most common real mistake in
generated code
- The managed-auth default kept
- Direct execution acknowledged as a supported lower-level interface,
with a link to the sessions-vs-direct tradeoffs page (this replaces the
"DISCOURAGED — do not generate tools.execute()" section, which
contradicted the docs one click away)

An AI-steering block only works if AI readers trust it.

## Verification

- `bun test tests/static/` passes (the execute-version policy test also
validates the guardrail blocks)
- Every factual claim from the old block is preserved; only the framing
and the tools.execute() discouragement changed

Split out of #4059 (which now carries only the legacy-flag and
REST/SDK-naming changes) so this piece can be decided on its own.

🤖 Generated with [Claude Code](https://claude.com/claude-code)
 2026-08-06 13:11:39 -07:00
Soumya Medapati 8b9a5a7381 docs: rewrite the AI guardrails block as descriptive notes 
Three independent eval runs across two rounds show capable agents
classify the CRITICAL INSTRUCTIONS block as prompt injection and ignore
it; its ALWAYS/NEVER framing also contradicted the
sessions-vs-direct-execution page. Same facts, no commands: sessions
stay the recommended default, the provider-import gotcha and
managed-auth default are kept, and direct execution is acknowledged as a
supported lower-level interface with a link to the tradeoffs page.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-08-06 13:04:52 -07:00
jkomyno 3639ad29a6 docs(changelog): align free-form object release notes 2026-08-07 00:07:04 +05:30
jkomyno 4a89ff112c fix(json-schema): enforce dynamic object contracts 2026-08-07 00:06:55 +05:30
jkomyno 063f03a72f docs(changesets): explain each behavior change with a before and after 2026-08-06 22:50:46 +05:30
jkomyno ac6bbabd31 fix(claude-agent-sdk): register complete tool schemas 
The provider registered tools through jsonSchemaToZodShape, which returns only
the per-property map. Root-level constraints -- `additionalProperties`, boolean
or schema-valued, and `patternProperties` -- are structurally unrepresentable in
a raw shape, so they were dropped before the Claude Agent SDK ever saw them:
free-form object arguments lost their content, and an unknown key was silently
stripped from tool input rather than rejected.

Registering the complete object schema fixes both. A tool with no input
parameters keeps its closed root explicitly, since a bare `properties: {}` is
now an open object.

Proven at the real SDK boundary rather than against a mocked `tool()`: the new
suite drives createSdkMcpServer over an in-memory MCP transport and asserts on
the advertised inputSchema and on real tools/call results.
 2026-08-06 21:59:12 +05:30
jkomyno 46ee10eb78 chore(deps): catalog @types/node on the Node 24 line 
Every workspace package now takes @types/node from the catalog instead of
pinning its own major, and an override pulls the transitive copies onto the
same line -- @types/ws and @types/yauzl depend on `@types/node: *`, so
vite/vitest peer-resolved 26 for packages that declare nothing themselves.

Node 26 is not a safe target yet. This also removes the one-off ^24.13.3
devDependency the schema-conversion corpus loaders had added to
@composio/json-schema-to-effect-schema, which was the only package in the
repository typing against a different major.
 2026-08-06 21:44:41 +05:30
jkomyno b7592585dd refactor(json-schema-to-effect-schema): validate through a filter instead of a declaration 
`Schema.declare`, `ParseResult`, and `Either` are all removed or reshaped in
Effect 4, so the converter compiled against three APIs that do not survive the
next major.

Express validation as a filter over `Schema.Unknown` instead: the filter returns
the formatted messages and Effect builds the issue tree, which drops the
hand-constructed `ParseResult.Composite`/`Type` values and the identity encode
half that declarations no longer carry. `Either.try` has no `Result` counterpart
in Effect 4 and both uses were local try/catch in disguise, so they become that.

Reported messages are unchanged: the location stays inside the message, because
`formatIssues` may fan one issue out into several. Tests move to
`decodeUnknownOption`, which keeps its name across both majors.

The CLI keeps `ParseResult.ArrayFormatter` while the repo is on Effect 3.x.
 2026-08-06 21:25:48 +05:30
jkomyno cb6fe9bf64 chore(changesets): release the schema conversion fixes as minor bumps 
Python's unknown-key rejection changes behavior for the langchain, langgraph,
and crewai providers rather than only fixing a defect, so the release carries a
minor bump across both SDKs instead of a patch.
 2026-08-06 21:00:15 +05:30
jkomyno e8ffecece3 docs(changelog): document free-form object argument preservation 
Records the cross-SDK fix and, in particular, the Python behavior change the
release would otherwise ship undocumented: object schemas that name properties
and omit `additionalProperties` now reject unknown keys instead of dropping
them, affecting the langchain, langgraph, and crewai providers.
 2026-08-06 20:50:43 +05:30