mirror of
https://github.com/ComposioHQ/composio.git
synced 2026-09-22 11:46:35 +08:00
@composio/cli@0.3.3-beta.346
4754 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Alberto Schiabel
|
0e6b59ba14 |
perf(cli): resolve toolkits from local knowledge, not the catalog (#4056)
This PR: - builds on top of https://github.com/ComposioHQ/composio/pull/4055 - resolves a tool's toolkit against what the CLI already knows — the slugs baked in at build time (https://github.com/ComposioHQ/composio/pull/4055) plus the ones this machine has learned since — so the common case costs one small local file read and no network. Every tool execution needed the toolkit, and the catalog was ~800 KB and ~2 s of the wall time of a command that then does one small API call - resolves that local knowledge once per run: `Effect.cached` on the catalog service means one file read, one parse, and one lookup set per process, where a single `composio execute` resolves a toolkit four times over (bootstrap telemetry, the execute context, the connection check, the execution itself) and `--parallel` multiplies that by the number of tools - falls through to the catalog only for a slug that matches nothing known, which is what a toolkit released after the binary looks like, and records what it finds in `known-toolkit-slugs.json` — so it costs a fetch once rather than every run. The recording forks at most once per run: every miss in a run merges the same memoized fetch, so later forks could only rewrite an identical file - refreshes learned slugs in the background once they are older than a week, which bounds how long a brand-new toolkit can be mistaken for a shorter one sharing its prefix - gives that background refresh ten seconds, then abandons it. A successful command ends when the event loop drains, not on an explicit `process.exit`, so an unbounded background fetch would hold the exiting `composio` process open until the network answered — visible to `&&` chains, `$(...)`, and CI step timing. An abandoned refresh costs a fetch on a later run, nothing more - keeps `FORCE_USE_CACHE` semantics intact: the learned file is derived data, not saved API responses, so it is read unconditionally. That distinction is documented in the module and in the README - cannot fail a command — a missing, unreadable, or corrupt file means "nothing learned yet", and an unreachable catalog still degrades to the first-underscore guess - writes cache files through a temp file and a rename, so an interrupted run leaves the previous cache intact instead of a truncated `toolkits.json` the next run reads back as a parse failure - drops the `toolkit` field from the cached tool model, which nothing reads once resolution goes through the catalog service - measured on a logged-in binary: `composio execute GOOGLE_ANALYTICS_RUN_REPORT --dry-run` goes from ~8.0-8.6 s before the stack, to ~3.4-4.3 s after https://github.com/ComposioHQ/composio/pull/4054, to ~1.7-2.0 s here — startup and the tool-schema fetch only - no visible command surface changed, so no VHS recording ## Summary Resolution now reads like this, with the catalog reached only on a genuine miss: ```mermaid graph TD A[tool slug] --> B{session meta tool?} B -->|yes| C[no toolkit] B -->|no| D[baked slugs + learned slugs] D --> E{longest prefix match?} E -->|yes| F[toolkit slug] E -->|no| G[fetch catalog] G -->|match| H[toolkit slug, slug remembered] G -->|unreachable| I[first-underscore guess] ``` Twelve tests cover the branches: baked hit and learned hit with zero fetches, first run seeding the file, a miss that fetches and persists, an unreachable catalog degrading to the guess, a corrupt file tolerated, a stale file refreshing in the background, a fresh file not refreshing, meta tools resolving to nothing without a fetch, the same run answering from its memo instead of re-reading the file, and a second recording in one run never reaching the file.@composio/cli@0.3.3-beta.346 |
||
|
Alberto Schiabel
|
ba52db09bb |
chore(cli): bake the toolkit slug catalog into the CLI (#4055)
This PR: - builds on top of https://github.com/ComposioHQ/composio/pull/4054 - checks in `src/generated/toolkit-slugs.ts` — the 1070 toolkit slugs the CLI knows without asking the API. Resolving a tool slug to its toolkit needs the catalog, but the catalog is ~800 KB of metadata to learn ~11 KB of slugs - adds `scripts/generate-toolkit-slugs.ts` (`pnpm --filter @composio/cli generate:toolkit-slugs`), which paginates the production catalog, keeps `native` toolkits, sorts and dedupes. It authenticates with `COMPOSIO_API_KEY` (CI) or `COMPOSIO_USER_API_KEY` + `COMPOSIO_ORG_ID` (a logged-in developer); both paths verified against production - gates the write: fewer than 1000 slugs, a malformed slug, or a missing staple (`github`, `gmail`, `google_analytics`) aborts before touching the file, so a bad or wrong-scoped credential fails loudly instead of overwriting a good list with a partial catalog - adds `.github/workflows/cli.update-toolkit-slugs.yml`, a weekly cron that opens a refresh PR when the catalog moves. `workflow_dispatch` only works once this lands on the default branch - warns during binary builds when the baked list is older than two weeks, and never fails on it — a stale list is slow, never wrong, because the backend does not remove toolkits - adds a guard test: sorted, unique, lowercase-slug-shaped, staples present, no network - nothing reads the list yet; https://github.com/ComposioHQ/composio/pull/4055 wires it into resolution - internal only — no changelog entry, no visible command surface, no VHS recording ## Context On the cron secret: `docs-update-data.yml` documents `secrets.COMPOSIO_API_KEY` as staging-scoped and uses its own `secrets.COMPOSIO_DOCS_API_KEY` for production reads. This workflow uses the shared secret as decided, and the sanity gate is what makes that safe to try — a wrong-scoped key 401s, writes nothing, and opens no PR. The alternative is named in a comment next to the `env:` block, one line to swap if the first run fails. ## Follow-up folded in The toolkit-slug shape now has one definition: `TOOLKIT_SLUG_PATTERN` lives in `src/models/toolkits.ts` and is shared by the schema, the generation script's sanity gate, and the generated-output guard test.@composio/cli@0.3.3-beta.345 |
||
|
Alberto Schiabel
|
0245945a43 |
perf(cli): fetch the toolkit catalog once per process (#4054)
This PR: - builds on top of https://github.com/ComposioHQ/composio/pull/4053 - memoizes the toolkit catalog for the lifetime of the cached repository layer with `Effect.cached`. A single command asks for the full list several times — toolkit resolution, validation, telemetry — and the file cache only answers when `FORCE_USE_CACHE` is set, so the default path paid for the same ~800 KB two-page download up to four times - fixes a doubling underneath it: `createCachedEffect` wrapped its whole body — cache lookup and the underlying request alike — in one `catchAll` that fell back to re-running the request, so a request that failed on its own was immediately sent again and failed the same way. Cache concerns now degrade to a cache miss on their own, and the request runs exactly once with its failure passed straight through - `Effect.cached` memoizes the outcome rather than only the success, so a failed fetch stays failed for the process. That is the right trade for a one-shot CLI, where retrying a broken network per call only multiplies the wait before the same error surfaces - adds a counting-repository test stub and four tests: one fetch for N sequential callers, one for N concurrent callers, one attempt for a failing fetch, and a `FORCE_USE_CACHE` hit served with zero fetches (that last one passes against the old implementation too, so it pins existing behavior rather than blessing the rewrite) - measured on a logged-in binary: `composio execute GOOGLE_ANALYTICS_RUN_REPORT --dry-run` goes from ~8.0-8.6 s to ~3.4-4.3 s - no visible command surface changed, so no VHS recording@composio/cli@0.3.3-beta.344 |
||
|
Alberto Schiabel
|
5eefadf57b |
fix(cli): resolve multi-word toolkits from tool slugs (#4053)
This PR: - closes https://github.com/ComposioHQ/composio/issues/4049 - resolves a tool's toolkit by matching the tool slug against the known toolkit list, longest underscore-bounded prefix first, instead of splitting on the first underscore — `GOOGLE_ANALYTICS_RUN_REPORT` belongs to `google_analytics`, not `google`, and the old split picked the wrong connected account - routes every call site (execute, listen, tools-executor, file uploads, error overrides, telemetry) through one Effect resolver, `toolkitFromToolSlug`, so they cannot disagree - keeps the first-underscore split as `guessToolkitFromToolSlug`, used only when the toolkit list cannot be loaded - fixes a second miss that the old split hid: `COMPOSIO_SEARCH_TOOLS` is a session meta tool, but `composio_search` is a real linkable toolkit, so matching against the real catalog made a failed meta call tell users to link an app that had nothing to do with it. The meta tool slugs move out of `tools-executor.ts` into `src/utils/meta-tool-slugs.ts`, and resolution answers "no toolkit" for them before any prefix matching - no visible command surface changed, so no VHS recording ## Context This is correct but not yet fast: resolution still reads the toolkit catalog, which is ~800 KB over two pages. Three stacked PRs follow that make the common case cost no network at all.@composio/cli@0.3.3-beta.343 |
||
|
jkomyno
|
5350b00d90 |
perf(cli): resolve toolkits from local knowledge, not the catalog
Every tool execution had to know which toolkit the tool belongs to, and the only reliable source was the toolkit catalog — ~800 KB and ~2 s of the wall time of a command that then does one small API call. Match against what the CLI already knows instead: the slugs baked in at build time, plus the ones this machine has learned since, kept in `known-toolkit-slugs.json`. A slug that matches nothing known still falls through to the catalog — that is what a toolkit released after the binary looks like — and what it finds is remembered, so it costs a fetch once rather than every run. Learned slugs older than a week trigger a background refresh; that bounds how long a brand-new toolkit can be mistaken for a shorter one sharing its prefix. The file is derived data rather than saved API responses, so it is read regardless of FORCE_USE_CACHE, which keeps its meaning. Nothing here can fail a command: a missing, unreadable, or corrupt file means "nothing learned yet", and an unreachable catalog still degrades to the first-underscore guess. Cache writes also move to a temp file and a rename, so an interrupted run leaves the previous cache intact instead of a truncated file that the next run reads back as a parse failure. |
||
|
jkomyno
|
bf3efaa270 |
chore(cli): bake the toolkit slug catalog into the CLI
Resolving a tool slug to its toolkit needs the catalog, but the catalog is ~800 KB of metadata to learn ~11 KB of slugs. Check the slugs in as generated source so the CLI starts out knowing them. Adds the generator (paginates the production catalog, keeps native toolkits, sorts and dedupes), the checked-in list, a guard test, and a weekly workflow that opens a refresh PR when the catalog moves. The generator refuses to write a list that is short, malformed, or missing staple toolkits, so a bad or wrong-scoped credential aborts before overwriting a good list. The binary build warns when the list is older than two weeks, and never fails on it. Nothing reads the list yet. |
||
|
jkomyno
|
4a764c100a |
perf(cli): fetch the toolkit catalog once per process
A single command can ask for the full toolkit list several times — toolkit resolution, validation, telemetry — and the file cache only answers when FORCE_USE_CACHE is set, so the default path paid for the same ~800 KB two-page download up to four times. Memoize the lookup for the lifetime of the cached repository layer. The first caller pays and the rest await the same result. Effect.cached memoizes the outcome rather than only the success, so a failed fetch stays failed for the process: the right trade for a one-shot CLI, where retrying a broken network per call only multiplies the wait before the same error surfaces. That surfaced a second doubling underneath. The caching helper wrapped its whole body — cache lookup and the underlying request alike — in one catchAll that fell back to re-running the request, so a request that failed on its own was immediately sent again and failed the same way. Cache concerns now degrade to a miss on their own, and the request runs exactly once with its failure passed straight through. |
||
|
jkomyno
|
5a74b4aade |
fix(cli): resolve multi-word toolkits from tool slugs
Tool slugs carry no delimiter between the toolkit and the action, so splitting on the first underscore resolved GOOGLE_ANALYTICS_RUN_REPORT to `google` instead of `google_analytics` and picked the wrong connected account. Match the tool slug against the known toolkit list instead, longest underscore-bounded prefix first, and keep the old split as the fallback for when that list is unavailable. Routed through a new Effect resolver so every call site (execute, listen, tools-executor, file uploads, error overrides, telemetry) shares one answer. Matching against the real catalog exposes a second miss the old split hid: `COMPOSIO_SEARCH_TOOLS` is a session meta tool, but `composio_search` is a real linkable toolkit, so a failed meta call told users to link an app that had nothing to do with it. The meta tool slugs move out of tools-executor into src/utils/meta-tool-slugs.ts, and resolution answers 'no toolkit' for them before any prefix matching. Fixes https://github.com/ComposioHQ/composio/issues/4049 |
||
|
Alberto Schiabel
|
c625edc0f7 |
fix(core): reuse fetched schemas for provider execution (#4103)
Reuse fetched raw tool schemas for provider-wrapped execution while preserving modifier isolation, runtime validation, and unknown-slug fallback behavior. Refresh the Python 3.12.13 mise lock entries required by the Audit freshness gate. Co-authored-by: breezeFur <voidexl@outlook.com>@composio/cli@0.3.3-beta.342 |
||
|
sdkrelease[bot]
|
13cba53b1d |
Release: update version (#4038)
This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to next, this PR will be updated. # Releases ## @composio/core@0.15.0 ### Minor Changes -@composio/json-schema-to-zod@0.2.2 @composio/experimental@0.2.2 @composio/core@0.15.0 @composio/openai@0.11.0 @composio/slim@0.15.0 py@0.18.2 |
||
|
Alberto Schiabel
|
b9a715e055 |
fix(e2e): pack core's workspace dependency in the openai-zod4 fixture (#4097)
The `openai-zod4-compat` E2E fixture fails on every release branch that bumps an internal workspace package. It is currently blocking the Python 0.18.2 / TypeScript 0.15.0 train (https://github.com/ComposioHQ/composio/pull/4038). ## Root cause The fixture packs `@composio/core` and `@composio/openai` and installs the tarballs. `pnpm pack` rewrites `@composio/core`'s `workspace:*` dependency on `@composio/json-schema-to-zod` to the exact workspace version, so the tarball carries a hard pin: ```json "@composio/json-schema-to-zod": "0.2.2" ``` On `next` that pin points at an already-published version, so the install resolves from the registry and the fixture passes. On a release branch it points at the version about to be published, which does not exist yet: ``` npm error code ETARGET npm error notarget No matching version found for @composio/json-schema-to-zod@0.2.2. ``` The setup step then exits non-zero and all 7 assertions fail with empty output. That is exactly what https://github.com/ComposioHQ/composio/pull/4038 shows: `@composio/json-schema-to-zod` is bumped to `0.2.2` there, which is the first release train to bump an internal dependency of `@composio/core` since this fixture was added. ## Fix Pack `@composio/json-schema-to-zod` alongside the other two and install all three tarballs. npm satisfies core's pin from the top-level tarball, so the fixture resolves entirely from local builds and no longer depends on publication order. Behavior on `next` is unchanged — it just prefers the local build over the identical published one. ## Verification Reproduced and fixed against the release branch (`changeset-release/next` @ `8068225d7`, core `0.15.0` / json-schema-to-zod `0.2.2`) in a local worktree, since Docker was not available to run the containerized suite here: - packing core alone and running the fixture's install command reproduces the ETARGET failure verbatim - packing all three and installing them succeeds; `node_modules/@composio/json-schema-to-zod` resolves to `0.2.2` and `@composio/core`'s pin is satisfied locally - `node ts/scripts/validate-changesets.mjs` passes; no changeset needed, the fixture is a private package CI runs the real containerized suite on this PR. |
||
|
Alberto Schiabel
|
c337e5696e |
chore(sdk): prepare Python 0.18.2 and TypeScript 0.15.0 releases (#4095)
Prepares the next SDK train: Python `composio` `0.18.2` and the TypeScript packages that the pending Changesets will publish (`@composio/core` and `@composio/slim` `0.15.0`, `@composio/openai` `0.11.0`, `@composio/experimental` and `@composio/json-schema-to-zod` `0.2.2`). No CLI release is part of this train. ## What this PR does - bumps Python core and all 13 provider packages to `0.18.2`, including `python/composio/__version__.py` and the root plus per-provider `uv.lock` files - adds `docs/content/changelog/08-07-26-sdk-releases.mdx`, the combined customer-facing changelog for both SDKs - documents `@composio/core` `0.15.0` in that entry so the generated release PR passes the release-workflow guard - leaves the pending Changesets untouched; the generated release PR remains responsible for npm versioning and publication ## Release sequence 1. Merge this PR. 2. Let Changesets regenerate the "Release: update version" PR, wait for it to go green, then merge it. Merging publishes the TypeScript packages. 3. Tag the resulting `next` commit `py@0.18.2` to publish the Python packages to PyPI. ## Notes - The root `uv.lock` diff carries ~28 lines of marker-annotation churn beyond the version bumps. That is the repo-pinned `uv` `0.8.19` normalising markers the committed lockfile had recorded differently; no dependency versions change. - `@composio/mastra` and the TypeScript providers are unchanged: their declared peer ranges still accept `@composio/core` `0.15.0`, so Changesets does not bump them. ## Verification - `pnpm test:release-workflow` — passes (Python package, runtime, and provider versions agree; both SDK versions documented in the changelog) - `uv run pytest tests/` in `python/` — 925 passed, 35 skipped - `uv run --package composio python -c "import composio"` — reports `0.18.2` - `bun test tests/static/` in `docs/` — 195 pass, 1 pre-existing failure (`getLLMText — version pointer`, also fails on a clean tree) - `bun run types:check` in `docs/` — MDX generation and route typegen succeed; the final `tsc` step could not run locally because `typescript-7` is absent from `docs/node_modules` |
||
|
LHMQ878
|
051c8c5357 |
fix(telemetry): redact secrets inside JSON payloads (#4043)
## Summary
Telemetry error text is redacted before it leaves the process, but the
key/value rule only matches when the separator follows the key name
directly:
```
\b(authorization|api[-_]?key|...|pwd)\b(\s*[:=]+\s*)(["']?)([^\s"',}&]+)\3
```
In JSON — and in a Python `dict` repr — the key's own closing quote sits
between the name and the colon, so `{"api_key": "..."}` never matches
and the value is sent verbatim. That is the shape error messages usually
carry: an API error envelope, a rejected request body echoed back, or an
f-string interpolating a config dict. Both SDKs share the pattern and
both are affected.
The fix moves the optional quote into the separator group
(`(["']?\s*[:=]+\s*)`). The key name, separator, and quoting are all
preserved in the output; only the value is replaced.
Measured with `redact_sensitive_text` / `redactSensitiveText` directly,
before and after:
| input | before | after |
|---|---|---|
| `api_key=sk-1` | redacted | redacted |
| `api_key: "sk-1"` | redacted | redacted |
| `x-api-key: sk-live-hdr` | redacted | redacted |
| `{"api_key": "sk-live-abc"}` | **leaks** | `{"api_key": "[REDACTED]"}`
|
| `{"api_key":"sk-live-abc"}` | **leaks** | redacted |
| `{"api_key" : "sk-live-abc"}` | **leaks** | redacted |
| `{"refresh_token":"rt-abc.def-123"}` | **leaks** | redacted |
| `{"x-api-key":"sk-hdr","user":"bob"}` | **leaks** | redacted,
`"user":"bob"` kept |
| `{'client_secret': 'cs-live-abc'}` | **leaks** | redacted |
| `the password field is required` | untouched | untouched |
| `no separator here "api_key" and nothing else` | untouched | untouched
|
The end-to-end path in Python is `composio/core/models/base.py:60-61`,
which passes `str(e)` and `traceback.format_exc()` through the redactor
into the telemetry `error` field. A tool failure whose message
interpolates the rejected request body — `Error executing tool: request
body was rejected: {"toolkit": "GMAIL", "arguments": {"api_key": "...",
...}}` — leaked the customer's key today.
## Changes
- `python/composio/utils/redaction.py`,
`ts/packages/core/src/telemetry/redact.ts`: allow a quote between the
key name and the separator.
- Tests on both sides for JSON, minified JSON, spaced-colon JSON, dict
repr, the realistic serialized-payload shape, key/quote preservation,
and no-false-positive cases.
- Changeset for `@composio/core`.
## Type of change
- [x] Bug fix
## How Has This Been Tested?
Node 24.13.0 / pnpm 11.8.0 / Python 3.10.20 (uv), Windows.
- `uv run pytest tests/test_redaction.py` — 13 passed. With
`redaction.py` reverted and the new tests kept, 9 of them fail; the 4
that still pass are the pre-existing test plus the three
no-false-positive controls.
- `npx vitest run test/telemetry/redact.test.ts` in `ts/packages/core` —
10 passed. With `redact.ts` reverted, the 3 new cases fail.
- Full Python suite: 913 passed, same 4 failures as on `next` unchanged
(3 are `ModuleNotFoundError: composio_langchain` from providers not
installed in my env; 1 is `test_empty_name_safe_fails_at_write_time`,
which expects `IsADirectoryError` but Windows raises `PermissionError`
when opening a directory). Collection 944 → 956, exactly the 12 tests
added.
- Full `@composio/core` vitest: 798 passed / 2 failed, byte-identical to
the unchanged baseline (794 passed / same 2 failed — both Windows
path-and-symlink cases). 11 test files fail to load in both runs because
I installed with `--ignore-scripts`; the repo's `preinstall` hook
doesn't run in my shell.
- `ruff format --check` and `ruff check` clean on the two Python files;
`prettier --write` applied to the two TypeScript files.
## Checklist
- [x] I have read the Code of Conduct and this PR adheres to it
- [x] I ran linters/tests locally and they passed
- [ ] I updated documentation as needed — no user-facing behavior change
to document
- [x] I added tests or explain why not applicable
- [x] I added a changeset if this change affects published packages
## Additional context
This is defence-in-depth, so it stays deliberately narrow: same denylist
of key names, same value character class, no new rules. Bare-prefix
secrets (`sk-...`, `ghp_...`) and PEM blocks are still not matched by
either SDK — worth a separate look, but widening the pattern is a
different risk trade-off than closing a shape the rule already intends
to cover.
|
||
|
Alberto Schiabel
|
6e0a9db3c7 |
feat(docs): make coding agents reach for REST API v3.1 (#4079)
This PR: - fixes [UXE-233](https://linear.app/composio/issue/UXE-233/docs-should-explicitly-direct-agents-to-use-v31-apis) - makes the agent-facing Markdown channels publish concrete REST v3.1 base URLs and endpoint tables while preserving the supported v3.0 reference tree - centralizes `REST_VERSION_GUIDANCE`, `TOOL_VERSION_GUIDANCE`, and raw-spec path matching in `lib/api-version-guidance.ts` - renders `ApiBaseUrl` and `ApiEndpointsTable` in authored MDX and adds an explicit version pointer to generated OpenAPI operation Markdown - separates current and legacy REST references in `llms.txt`, excludes v3.0 page bodies from `llms-full.txt`, and adds v3.1 selection guidance to Context7 - validates serialized `ApiEndpointsTable` payloads with Zod before generation while preserving forward-compatible fields - addresses review feedback for the renamed authentication page, SDK-reference pointer scope, generator validation behavior, and stale OpenAPI tool-version descriptions ## Context REST v3.0 is superseded but remains supported for existing integrations. This PR changes what new agent-generated code discovers first; it does not require existing v3.0 callers to migrate. Authenticated read-only probes against the deployed API confirmed that the affected v3 endpoints default to `00000000_00`, while their v3.1 counterparts default to `latest`. `POST /tools/scopes/required` is available only on v3.1 and defaults to `latest`. This PR does not move public URLs. A future `/reference/v3/` to `/reference/v3.0/` migration remains separate because it has independent compatibility and search-indexing risk. ## Verification - `bun test tests/static/` - `bun run build` - `bun run test:integration` - `bun run types:check` - `bun run lint` ## Review follow-up The version-default guidance is intentionally limited to the five verified tool endpoints. v3.1 is a structural superset of v3, so this PR does not claim route parity. Static coverage rejects broad non-tool parity wording in both the shared guidance and Context7 rules. |
||
|
dependabot[bot]
|
0c4c5a360a |
chore(deps): bump the npm-production group across 1 directory with 17 updates (#4090)
Bumps the npm-production group with 17 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@anthropic-ai/claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-typescript) | `0.3.220` | `0.3.221` | | [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai) | `6.0.235` | `6.0.241` | | [@google/genai](https://github.com/googleapis/js-genai) | `2.13.0` | `2.15.0` | | [@langchain/core](https://github.com/langchain-ai/langchainjs) | `1.2.3` | `1.2.4` | | [@langchain/langgraph](https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core) | `1.4.8` | `1.4.9` | | [typebox](https://github.com/sinclairzx81/typebox) | `1.3.9` | `1.3.10` | | [@ai-sdk/mcp](https://github.com/vercel/ai/tree/HEAD/packages/mcp) | `2.0.22` | `2.0.24` | | [@ai-sdk/openai](https://github.com/vercel/ai/tree/HEAD/packages/openai) | `4.0.27` | `4.0.29` | | [@cloudflare/vitest-pool-workers](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers) | `0.18.8` | `0.20.1` | | [@cloudflare/workers-types](https://github.com/cloudflare/workerd) | `5.20260801.1` | `5.20260804.1` | | [@mastra/core](https://github.com/mastra-ai/mastra/tree/HEAD/packages/core) | `1.52.1` | `1.55.0` | | [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.26.0` | `1.30.0` | | [hono](https://github.com/honojs/hono) | `4.12.31` | `4.13.0` | | [pnpm](https://github.com/pnpm/pnpm/tree/HEAD/pnpm11/pnpm) | `11.17.0` | `11.20.0` | | [publint](https://github.com/publint/publint/tree/HEAD/packages/publint) | `0.3.22` | `0.3.23` | | [tsx](https://github.com/privatenumber/tsx) | `4.23.1` | `4.23.5` | | [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.114.0` | `4.118.0` | Updates `@anthropic-ai/claude-agent-sdk` from 0.3.220 to 0.3.221 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/anthropics/claude-agent-sdk-typescript/releases">@anthropic-ai/claude-agent-sdk's releases</a>.</em></p> <blockquote> <h2>v0.3.221</h2> <h2>What's changed</h2> <ul> <li>Improved <code>skills</code> option validation: malformed names (delimiters or control characters) and wildcard-form names are rejected with a clear error; use <code>skills: 'all'</code> to enable every skill</li> <li>Fixed external MCP servers passed via the <code>mcpServers</code> option not being connected before the first turn, which caused the model to emit tool calls as literal text</li> </ul> <h2>Update</h2> <pre lang="sh"><code>npm install @anthropic-ai/claude-agent-sdk@0.3.221 # or yarn add @anthropic-ai/claude-agent-sdk@0.3.221 # or pnpm add @anthropic-ai/claude-agent-sdk@0.3.221 # or bun add @anthropic-ai/claude-agent-sdk@0.3.221 </code></pre> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/anthropics/claude-agent-sdk-typescript/blob/main/CHANGELOG.md">@anthropic-ai/claude-agent-sdk's changelog</a>.</em></p> <blockquote> <h2>0.3.221</h2> <ul> <li>Improved <code>skills</code> option validation: malformed names (delimiters or control characters) and wildcard-form names are rejected with a clear error; use <code>skills: 'all'</code> to enable every skill</li> <li>Fixed external MCP servers passed via the <code>mcpServers</code> option not being connected before the first turn, which caused the model to emit tool calls as literal text</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/31fbbfd403b3289933abc297e66cec775301e15e"><code>31fbbfd</code></a> chore: Update CHANGELOG.md</li> <li>See full diff in <a href="https://github.com/anthropics/claude-agent-sdk-typescript/compare/v0.3.220...v0.3.221">compare view</a></li> </ul> </details> <br /> Updates `ai` from 6.0.235 to 6.0.241 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vercel/ai/blob/ai@6.0.241/packages/ai/CHANGELOG.md">ai's changelog</a>.</em></p> <blockquote> <h2>6.0.241</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [7e50c52] <ul> <li><code>@ai-sdk/gateway</code><a href="https://github.com/3"><code>@3</code></a>.0.163</li> </ul> </li> </ul> <h2>6.0.240</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [b28367e] <ul> <li><code>@ai-sdk/gateway</code><a href="https://github.com/3"><code>@3</code></a>.0.162</li> </ul> </li> </ul> <h2>6.0.239</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [d3d9e0b] <ul> <li><code>@ai-sdk/gateway</code><a href="https://github.com/3"><code>@3</code></a>.0.161</li> </ul> </li> </ul> <h2>6.0.238</h2> <h3>Patch Changes</h3> <ul> <li>9ecdefe: Prevent validated downloads on Node.js from reaching private or internal services through DNS aliases or DNS rebinding by validating and pinning every resolved address at connection time.</li> <li>26d10c0: support overriding model call settings for individual <code>prepareStep</code> invocations</li> <li>7767170: Preserve provider metadata from empty text deltas in <code>streamText</code>.</li> <li>Updated dependencies [9ecdefe]</li> <li>Updated dependencies [87fb433] <ul> <li><code>@ai-sdk/provider-utils</code><a href="https://github.com/4"><code>@4</code></a>.0.41</li> <li><code>@ai-sdk/gateway</code><a href="https://github.com/3"><code>@3</code></a>.0.160</li> </ul> </li> </ul> <h2>6.0.237</h2> <h3>Patch Changes</h3> <ul> <li>f6020d7: Avoid synthesizing client tool errors for invalid provider-executed tool calls.</li> <li>Updated dependencies [de438f5] <ul> <li><code>@ai-sdk/gateway</code><a href="https://github.com/3"><code>@3</code></a>.0.159</li> </ul> </li> </ul> <h2>6.0.236</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [8418710] <ul> <li><code>@ai-sdk/gateway</code><a href="https://github.com/3"><code>@3</code></a>.0.158</li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/ai/commit/5b4cf0ef925c6dfac12167e9e986e2e2e796e68e"><code>5b4cf0e</code></a> Version Packages (<a href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18345">#18345</a>)</li> <li><a href="https://github.com/vercel/ai/commit/b878ce998fbe53bb27d8124b59c94cb9c109899b"><code>b878ce9</code></a> Version Packages (<a href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18314">#18314</a>)</li> <li><a href="https://github.com/vercel/ai/commit/fbb507af0398516dc4db212a6dcdfff48744a4fd"><code>fbb507a</code></a> Version Packages (<a href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18280">#18280</a>)</li> <li><a href="https://github.com/vercel/ai/commit/6e37b23980716390f878881f0e39a878295d1dd4"><code>6e37b23</code></a> v6.0: docs: document GenerateTextResult.output getter errors (<a href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18252">#18252</a>)</li> <li><a href="https://github.com/vercel/ai/commit/006a2f87a3ca3409973d1a11ed21002b37d38c74"><code>006a2f8</code></a> Version Packages (<a href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18089">#18089</a>)</li> <li><a href="https://github.com/vercel/ai/commit/2deee5b27ec31ba38a2e2b20966fe1a868b5f117"><code>2deee5b</code></a> v6.0: docs: clarify generateText text aggregation and empty-string behavior (...</li> <li><a href="https://github.com/vercel/ai/commit/26d10c0b30ca68d5c7b618b8d54b06ae01930a68"><code>26d10c0</code></a> [v6.0] feat: support per-step model call setting overrides in prepareStep (<a href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/1">#1</a>...</li> <li><a href="https://github.com/vercel/ai/commit/9ecdefe4eb4db14c76bcc7c04813663d2012fb8e"><code>9ecdefe</code></a> [v6] fix(provider-utils): prevent DNS alias SSRF in validated downloads (<a href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18095">#18095</a>)</li> <li><a href="https://github.com/vercel/ai/commit/776717089720a00a29a7b72b86f7bdc54ea8c0bd"><code>7767170</code></a> [v6.0] fix: preserve provider metadata from empty streamText text deltas (<a href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18">#18</a>...</li> <li><a href="https://github.com/vercel/ai/commit/98d8c433aa6a0d3ec05c201e0355f876c6349c47"><code>98d8c43</code></a> Version Packages (<a href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18028">#18028</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vercel/ai/commits/ai@6.0.241/packages/ai">compare view</a></li> </ul> </details> <br /> Updates `@google/genai` from 2.13.0 to 2.15.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/googleapis/js-genai/releases">@google/genai's releases</a>.</em></p> <blockquote> <h2>v2.15.0</h2> <h2><a href="https://github.com/googleapis/js-genai/compare/v2.14.0...v2.15.0">2.15.0</a> (2026-07-30)</h2> <h3>Features</h3> <ul> <li>add environment resource (<a href="https://github.com/googleapis/js-genai/commit/2c911befbf839fc250a296783cbedbd3b668a9f7">2c911be</a>)</li> <li>Support GoogleMaps Tool grounding_types places and routing (<a href="https://github.com/googleapis/js-genai/commit/52655c192848942d2d866c3b256de27c94583f78">52655c1</a>)</li> <li>Support per-request retryOptions in the JS GenAI SDK API Client (<a href="https://github.com/googleapis/js-genai/commit/124b606bc5be0d5e70673dc28e16e739c9a25d7c">124b606</a>)</li> <li>Wire environment service into genai sdk (<a href="https://github.com/googleapis/js-genai/commit/70d79389536821f1323ae5016f63ee95afa6b48a">70d7938</a>)</li> </ul> <h2>v2.14.0</h2> <h2><a href="https://github.com/googleapis/js-genai/compare/v2.13.0...v2.14.0">2.14.0</a> (2026-07-28)</h2> <h3>Features</h3> <ul> <li>[GenerateContentConfig] Add GenerationConfig.audio_transcription_config and Part.audio_transcription. (<a href="https://github.com/googleapis/js-genai/commit/4b2e67aebbb713321c095ccad34618f2a98fdd7d">4b2e67a</a>)</li> <li>Add flat <code>language_codes</code> field to <code>AudioTranscriptionConfig</code>. (<a href="https://github.com/googleapis/js-genai/commit/cc808ebcbe76beb8e54fd5ca24ac358643104853">cc808eb</a>)</li> <li>Allow api key + proj/location for enterprise mode (<a href="https://github.com/googleapis/js-genai/commit/9c0540a26694e6a2896a433e43d1bac963af10e5">9c0540a</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>add deprecation warnings to Imagen generate_images, edit_images, generate_videos (if using prompt/text/image args), LiveConnectConfig.GenerationConfig which will be removed in the next major version (<a href="https://github.com/googleapis/js-genai/commit/bb6610199a76f7a99e28ed77974e6a3af21a52b1">bb66101</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/googleapis/js-genai/blob/main/CHANGELOG.md">@google/genai's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/googleapis/js-genai/compare/v2.14.0...v2.15.0">2.15.0</a> (2026-07-30)</h2> <h3>Features</h3> <ul> <li>add environment resource (<a href="https://github.com/googleapis/js-genai/commit/2c911befbf839fc250a296783cbedbd3b668a9f7">2c911be</a>)</li> <li>Support GoogleMaps Tool grounding_types places and routing (<a href="https://github.com/googleapis/js-genai/commit/52655c192848942d2d866c3b256de27c94583f78">52655c1</a>)</li> <li>Support per-request retryOptions in the JS GenAI SDK API Client (<a href="https://github.com/googleapis/js-genai/commit/124b606bc5be0d5e70673dc28e16e739c9a25d7c">124b606</a>)</li> <li>Wire environment service into genai sdk (<a href="https://github.com/googleapis/js-genai/commit/70d79389536821f1323ae5016f63ee95afa6b48a">70d7938</a>)</li> </ul> <h2><a href="https://github.com/googleapis/js-genai/compare/v2.13.0...v2.14.0">2.14.0</a> (2026-07-28)</h2> <h3>Features</h3> <ul> <li>[GenerateContentConfig] Add GenerationConfig.audio_transcription_config and Part.audio_transcription. (<a href="https://github.com/googleapis/js-genai/commit/4b2e67aebbb713321c095ccad34618f2a98fdd7d">4b2e67a</a>)</li> <li>Add flat <code>language_codes</code> field to <code>AudioTranscriptionConfig</code>. (<a href="https://github.com/googleapis/js-genai/commit/cc808ebcbe76beb8e54fd5ca24ac358643104853">cc808eb</a>)</li> <li>Allow api key + proj/location for enterprise mode (<a href="https://github.com/googleapis/js-genai/commit/9c0540a26694e6a2896a433e43d1bac963af10e5">9c0540a</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>add deprecation warnings to Imagen generate_images, edit_images, generate_videos (if using prompt/text/image args), LiveConnectConfig.GenerationConfig which will be removed in the next major version (<a href="https://github.com/googleapis/js-genai/commit/bb6610199a76f7a99e28ed77974e6a3af21a52b1">bb66101</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/googleapis/js-genai/commit/a76a3eab126e5b7c6a46f6c43795ec3cc65b5488"><code>a76a3ea</code></a> chore(main): release 2.15.0 (<a href="https://redirect.github.com/googleapis/js-genai/issues/1815">#1815</a>)</li> <li><a href="https://github.com/googleapis/js-genai/commit/124b606bc5be0d5e70673dc28e16e739c9a25d7c"><code>124b606</code></a> feat: Support per-request retryOptions in the JS GenAI SDK API Client</li> <li><a href="https://github.com/googleapis/js-genai/commit/52655c192848942d2d866c3b256de27c94583f78"><code>52655c1</code></a> feat: Support GoogleMaps Tool grounding_types places and routing</li> <li><a href="https://github.com/googleapis/js-genai/commit/70d79389536821f1323ae5016f63ee95afa6b48a"><code>70d7938</code></a> feat: Wire environment service into genai sdk</li> <li><a href="https://github.com/googleapis/js-genai/commit/2c911befbf839fc250a296783cbedbd3b668a9f7"><code>2c911be</code></a> feat: add environment resource</li> <li><a href="https://github.com/googleapis/js-genai/commit/1895d5793954cb62e3ab4d90aab2f636b4285497"><code>1895d57</code></a> docs: Communicate on upcoming updates in the next major version</li> <li><a href="https://github.com/googleapis/js-genai/commit/ebeba1cda039d43e821d519afb8ce1d0dc9d0f74"><code>ebeba1c</code></a> chore(main): release 2.14.0 (<a href="https://redirect.github.com/googleapis/js-genai/issues/1799">#1799</a>)</li> <li><a href="https://github.com/googleapis/js-genai/commit/cc808ebcbe76beb8e54fd5ca24ac358643104853"><code>cc808eb</code></a> feat: Add flat <code>language_codes</code> field to <code>AudioTranscriptionConfig</code>.</li> <li><a href="https://github.com/googleapis/js-genai/commit/9c0540a26694e6a2896a433e43d1bac963af10e5"><code>9c0540a</code></a> feat: Allow api key + proj/location for enterprise mode</li> <li><a href="https://github.com/googleapis/js-genai/commit/d221cf34c94ad558ab22d59e3163b60122d72948"><code>d221cf3</code></a> chore: internal update</li> <li>Additional commits viewable in <a href="https://github.com/googleapis/js-genai/compare/v2.13.0...v2.15.0">compare view</a></li> </ul> </details> <br /> Updates `@langchain/core` from 1.2.3 to 1.2.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langchainjs/releases">@langchain/core's releases</a>.</em></p> <blockquote> <h2><code>@langchain/core</code><a href="https://github.com/1"><code>@1</code></a>.2.4</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/11190">#11190</a> <a href="https://github.com/langchain-ai/langchainjs/commit/9654bde694af4e78080a76a0b39d7edd35683449"><code>9654bde</code></a> Thanks <a href="https://github.com/pawel-twardziak"><code>@pawel-twardziak</code></a>! - Coalesce nested LangChain tracer callbacks that share run bookkeeping.</p> </li> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/11153">#11153</a> <a href="https://github.com/langchain-ai/langchainjs/commit/84ce6d65ef0ab2c556d5a5a3b5651b5cf3d73303"><code>84ce6d6</code></a> Thanks <a href="https://github.com/parveshsaini"><code>@parveshsaini</code></a>! - fix(core): bind splitText when trimMessages receives a TextSplitter instance</p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langchainjs/commit/f6dbb882d1d4a591d69020145b6a871fe7801b35"><code>f6dbb88</code></a> chore: version packages (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/11268">#11268</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/9654bde694af4e78080a76a0b39d7edd35683449"><code>9654bde</code></a> fix(core): coalesce duplicate tracer copies sharing run state (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/11190">#11190</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/84ce6d65ef0ab2c556d5a5a3b5651b5cf3d73303"><code>84ce6d6</code></a> fix(core): bind splitText when trimMessages receives a TextSplitter instance ...</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/710d74f3fc0ff98d5088c8e0c86752829cfaaa2c"><code>710d74f</code></a> fix: resolve open Dependabot alerts (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/11259">#11259</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/5226cddb0d0b31d33bb78fc51230e4283cd6cc64"><code>5226cdd</code></a> chore(deps-dev): bump <code>@hono/node-server</code> from 2.0.4 to 2.0.10 in /libs/langcha...</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/d829cb490112454b3cf8718a526f28450ff37062"><code>d829cb4</code></a> chore: version packages (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/11204">#11204</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/c8bd4c4a6dbde07fb24deb5870c02dc29c51ab53"><code>c8bd4c4</code></a> feat(anthropic): add Claude Opus 5 support (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/11255">#11255</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/741f380ae54afd2e920495b3042ea6346865836a"><code>741f380</code></a> chore(deps): bump <code>@hono/node-server</code> from 2.0.4 to 2.0.10 (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/11244">#11244</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/5103cee12ae0e3e56038f0c20edda5159b252daa"><code>5103cee</code></a> chore(deps): bump js-yaml from 5.1.0 to 5.2.2 (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/11256">#11256</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/db29a6a8060d9d8998f5fb566368e3bad5b32a5b"><code>db29a6a</code></a> chore(deps): bump axios from 1.16.1 to 1.18.0 (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/11228">#11228</a>)</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langchainjs/compare/@langchain/core@1.2.3...@langchain/core@1.2.4">compare view</a></li> </ul> </details> <br /> Updates `@langchain/langgraph` from 1.4.8 to 1.4.9 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langgraphjs/releases">@langchain/langgraph's releases</a>.</em></p> <blockquote> <h2><code>@langchain/langgraph</code><a href="https://github.com/1"><code>@1</code></a>.4.9</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2653">#2653</a> <a href="https://github.com/langchain-ai/langgraphjs/commit/7880055ac7303483e424380cdd52f54cd094e311"><code>7880055</code></a> Thanks <a href="https://github.com/christian-bromann"><code>@christian-bromann</code></a>! - fix(langgraph): checkpoint Topic as a flat values list</p> <p>Match Python Topic checkpoints so Host JS graphs no longer put <code>__pregel_tasks: [[], []]</code> through the Python checkpointer. Keep reading legacy <code>[seen, values]</code> checkpoints for restore compatibility.</p> </li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langgraphjs/blob/main/libs/langgraph-core/CHANGELOG.md">@langchain/langgraph's changelog</a>.</em></p> <blockquote> <h2>1.4.9</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2653">#2653</a> <a href="https://github.com/langchain-ai/langgraphjs/commit/7880055ac7303483e424380cdd52f54cd094e311"><code>7880055</code></a> Thanks <a href="https://github.com/christian-bromann"><code>@christian-bromann</code></a>! - fix(langgraph): checkpoint Topic as a flat values list</p> <p>Match Python Topic checkpoints so Host JS graphs no longer put <code>__pregel_tasks: [[], []]</code> through the Python checkpointer. Keep reading legacy <code>[seen, values]</code> checkpoints for restore compatibility.</p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langgraphjs/commit/5f9915234a5dca861ef01180fde28e52f42c6e15"><code>5f99152</code></a> chore: version packages (<a href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2655">#2655</a>)</li> <li><a href="https://github.com/langchain-ai/langgraphjs/commit/7880055ac7303483e424380cdd52f54cd094e311"><code>7880055</code></a> fix(langgraph): checkpoint Topic as a flat values list (<a href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2653">#2653</a>)</li> <li><a href="https://github.com/langchain-ai/langgraphjs/commit/cac6d3106599b5c9ecff8c00d99a7e78571c5202"><code>cac6d31</code></a> chore(deps): bump the vite-vitest group across 1 directory with 6 updates (<a href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2">#2</a>...</li> <li><a href="https://github.com/langchain-ai/langgraphjs/commit/fa9892117d56398ce0f02f1a73bafb807a61ce2e"><code>fa98921</code></a> chore(deps-dev): bump <code>@vitest/browser</code> from 4.1.9 to 4.1.10 (<a href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2624">#2624</a>)</li> <li><a href="https://github.com/langchain-ai/langgraphjs/commit/cdffd18d192eaa87375bc2d45b343418af8bd024"><code>cdffd18</code></a> chore(deps): bump the langchain group across 1 directory with 6 updates (<a href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2616">#2616</a>)</li> <li>See full diff in <a href="https://github.com/langchain-ai/langgraphjs/commits/@langchain/langgraph@1.4.9/libs/langgraph-core">compare view</a></li> </ul> </details> <br /> Updates `typebox` from 1.3.9 to 1.3.10 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sinclairzx81/typebox/commit/221a1de804f08471600ebd4dc8a4460340797d56"><code>221a1de</code></a> Version 1.3.10 (<a href="https://redirect.github.com/sinclairzx81/typebox/issues/1662">#1662</a>)</li> <li><a href="https://github.com/sinclairzx81/typebox/commit/4992c53f930a675d78acdf5d61a1a12e64e8037a"><code>4992c53</code></a> Specification</li> <li>See full diff in <a href="https://github.com/sinclairzx81/typebox/compare/1.3.9...1.3.10">compare view</a></li> </ul> </details> <br /> Updates `@ai-sdk/mcp` from 2.0.22 to 2.0.24 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vercel/ai/blob/main/packages/mcp/CHANGELOG.md">@ai-sdk/mcp's changelog</a>.</em></p> <blockquote> <h2>2.0.24</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [160ccdb] <ul> <li><code>@ai-sdk/provider-utils</code><a href="https://github.com/5"><code>@5</code></a>.0.20</li> </ul> </li> </ul> <h2>2.0.23</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [79e133c] <ul> <li><code>@ai-sdk/provider</code><a href="https://github.com/4"><code>@4</code></a>.0.5</li> <li><code>@ai-sdk/provider-utils</code><a href="https://github.com/5"><code>@5</code></a>.0.19</li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/ai/commit/22095f409fdf70dc858546fe26b1cf92f12f87f1"><code>22095f4</code></a> Version Packages (<a href="https://github.com/vercel/ai/tree/HEAD/packages/mcp/issues/18381">#18381</a>)</li> <li><a href="https://github.com/vercel/ai/commit/9df82a8bc70f569ae0fbb701a81fd6209ec2a2b7"><code>9df82a8</code></a> Version Packages (<a href="https://github.com/vercel/ai/tree/HEAD/packages/mcp/issues/18368">#18368</a>)</li> <li>See full diff in <a href="https://github.com/vercel/ai/commits/@ai-sdk/mcp@2.0.24/packages/mcp">compare view</a></li> </ul> </details> <br /> Updates `@ai-sdk/openai` from 4.0.27 to 4.0.29 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vercel/ai/blob/main/packages/openai/CHANGELOG.md">@ai-sdk/openai's changelog</a>.</em></p> <blockquote> <h2>4.0.29</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [160ccdb] <ul> <li><code>@ai-sdk/provider-utils</code><a href="https://github.com/5"><code>@5</code></a>.0.20</li> </ul> </li> </ul> <h2>4.0.28</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [79e133c] <ul> <li><code>@ai-sdk/provider</code><a href="https://github.com/4"><code>@4</code></a>.0.5</li> <li><code>@ai-sdk/provider-utils</code><a href="https://github.com/5"><code>@5</code></a>.0.19</li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/ai/commit/22095f409fdf70dc858546fe26b1cf92f12f87f1"><code>22095f4</code></a> Version Packages (<a href="https://github.com/vercel/ai/tree/HEAD/packages/openai/issues/18381">#18381</a>)</li> <li><a href="https://github.com/vercel/ai/commit/9df82a8bc70f569ae0fbb701a81fd6209ec2a2b7"><code>9df82a8</code></a> Version Packages (<a href="https://github.com/vercel/ai/tree/HEAD/packages/openai/issues/18368">#18368</a>)</li> <li>See full diff in <a href="https://github.com/vercel/ai/commits/@ai-sdk/openai@4.0.29/packages/openai">compare view</a></li> </ul> </details> <br /> Updates `@cloudflare/vitest-pool-workers` from 0.18.8 to 0.20.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/cloudflare/workers-sdk/releases">@cloudflare/vitest-pool-workers's releases</a>.</em></p> <blockquote> <h2><code>@cloudflare/vitest-pool-workers</code><a href="https://github.com/0"><code>@0</code></a>.20.1</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [<a href="https://github.com/cloudflare/workers-sdk/commit/cc63aae658c39ae33169c6dc89f2e6ec1071fc53"><code>cc63aae</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/f92d1fc1316ba4e5f7e308c79943cb9e34b308c2"><code>f92d1fc</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/a249591473321cc2fb88a7b62a8c2b8663ebd4ef"><code>a249591</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/f92d1fc1316ba4e5f7e308c79943cb9e34b308c2"><code>f92d1fc</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/f92d1fc1316ba4e5f7e308c79943cb9e34b308c2"><code>f92d1fc</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/cec9d8875d3f103acc813724ded980867bd25ed7"><code>cec9d88</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/e0bbf55fdce5239a88c78a4350d3287f52d77964"><code>e0bbf55</code></a>]: <ul> <li>wrangler@4.118.0</li> </ul> </li> </ul> <h2><code>@cloudflare/vitest-pool-workers</code><a href="https://github.com/0"><code>@0</code></a>.20.0</h2> <h3>Minor Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/cloudflare/workers-sdk/pull/14586">#14586</a> <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a> Thanks <a href="https://github.com/emily-shen"><code>@emily-shen</code></a>! - Breaking change: Remove several options from the <code>miniflare</code> override options</p> <p>The following options have been removed from the <code>miniflare</code> override options, as they were not intended to be exposed, were not functional, or have been superseded by other options:</p> <ul> <li><code>wrappedBindings</code></li> <li><code>cacheWarnUsage</code></li> <li><code>fetchMock</code>: you should use <code>outboundService</code> instead</li> <li><code>containerEngine</code>: containers were not supported in vitest-pool-workers. Consider using <a href="https://developers.cloudflare.com/workers/testing/test-harness/"><code>createTestHarness()</code></a> instead if you want to test against actual containers.</li> </ul> <p>Additionally, <code>cache</code> has been deprecated and renamed to <code>cacheAPI</code>, but <code>cache</code> remains functional.</p> </li> </ul> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/cloudflare/workers-sdk/pull/14586">#14586</a> <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a> Thanks <a href="https://github.com/emily-shen"><code>@emily-shen</code></a>! - Preserve the deprecated Miniflare <code>cache</code> option</p> <p>Vitest configurations using <code>cache</code> continue to work after the internal Miniflare v5 upgrade. The option is translated to <code>cacheAPI</code>; new configurations should use <code>cacheAPI</code> directly.</p> </li> <li> <p><a href="https://redirect.github.com/cloudflare/workers-sdk/pull/14586">#14586</a> <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a> Thanks <a href="https://github.com/emily-shen"><code>@emily-shen</code></a>! - Stop enabling Miniflare's removed <code>unsafeStickyBlobs</code> option</p> <p>The pool no longer sets the <code>unsafeStickyBlobs</code> Miniflare option, which has been removed. This option was only needed for the Durable Object isolated storage feature that was dropped in 0.13.0, so there is no change in behaviour.</p> </li> <li> <p>Updated dependencies [<a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>]:</p> <ul> <li><a href="mailto:miniflare@5.20260730.0-alpha">miniflare@5.20260730.0-alpha</a></li> <li>wrangler@4.117.0</li> </ul> </li> </ul> <h2><code>@cloudflare/vitest-pool-workers</code><a href="https://github.com/0"><code>@0</code></a>.19.1</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [<a href="https://github.com/cloudflare/workers-sdk/commit/01d7020806dd523158cf9f26a4575365117f5381"><code>01d7020</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/beec0fbc9d3adec24bc42e31a21fe7f82badb543"><code>beec0fb</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/48f0c6cbbc50dfac02e2d76554c181ced233a792"><code>48f0c6c</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/8049ca451c9561e8b72f3eeeb7916a8712f06133"><code>8049ca4</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/d7f38c311e8cd0f29f56a25250da45f62b20f8ca"><code>d7f38c3</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/1394867d1dc357d9bddabf8c16aede47d052fb18"><code>1394867</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/cc5447865022ebc602258cfbeb79953181a62ae0"><code>cc54478</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5c25cfe4e03e0d3d42ddab57adc3274d6f6a1a30"><code>5c25cfe</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/b21eac24878f060296915f198fae910268c465ef"><code>b21eac2</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/bb09f1bd77a194520db3e61d733996f4bbe4bad8"><code>bb09f1b</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/1f61001e5f7a807db7856f5d89e0b26e12a0d0a0"><code>1f61001</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/01d7020806dd523158cf9f26a4575365117f5381"><code>01d7020</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/e31ab0f40c5310babd8b493490c0e1ca677e9a8c"><code>e31ab0f</code></a>]: <ul> <li>miniflare@4.20260730.0</li> <li>wrangler@4.116.0</li> </ul> </li> </ul> <h2><code>@cloudflare/vitest-pool-workers</code><a href="https://github.com/0"><code>@0</code></a>.19.0</h2> <h3>Minor Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/cloudflare/workers-sdk/pull/14879">#14879</a> <a href="https://github.com/cloudflare/workers-sdk/commit/e6480e3c26e849034e9e511a2fd1216257975656"><code>e6480e3</code></a> Thanks <a href="https://github.com/dmmulroy"><code>@dmmulroy</code></a>! - Add a <code>verbose</code> option to <code>cloudflareTest()</code> and <code>cloudflarePool()</code> configuration</p> <p>Set <code>verbose: false</code> to suppress verbose workerd runtime logs, such as caught Durable Object RPC errors. The option defaults to <code>true</code> to preserve existing output.</p> </li> </ul> <h3>Patch Changes</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/cloudflare/workers-sdk/blob/main/packages/vitest-pool-workers/CHANGELOG.md">@cloudflare/vitest-pool-workers's changelog</a>.</em></p> <blockquote> <h2>0.20.1</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [<a href="https://github.com/cloudflare/workers-sdk/commit/cc63aae658c39ae33169c6dc89f2e6ec1071fc53"><code>cc63aae</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/f92d1fc1316ba4e5f7e308c79943cb9e34b308c2"><code>f92d1fc</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/a249591473321cc2fb88a7b62a8c2b8663ebd4ef"><code>a249591</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/f92d1fc1316ba4e5f7e308c79943cb9e34b308c2"><code>f92d1fc</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/f92d1fc1316ba4e5f7e308c79943cb9e34b308c2"><code>f92d1fc</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/cec9d8875d3f103acc813724ded980867bd25ed7"><code>cec9d88</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/e0bbf55fdce5239a88c78a4350d3287f52d77964"><code>e0bbf55</code></a>]: <ul> <li>wrangler@4.118.0</li> </ul> </li> </ul> <h2>0.20.0</h2> <h3>Minor Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/cloudflare/workers-sdk/pull/14586">#14586</a> <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a> Thanks <a href="https://github.com/emily-shen"><code>@emily-shen</code></a>! - Breaking change: Remove several options from the <code>miniflare</code> override options</p> <p>The following options have been removed from the <code>miniflare</code> override options, as they were not intended to be exposed, were not functional, or have been superseded by other options:</p> <ul> <li><code>wrappedBindings</code></li> <li><code>cacheWarnUsage</code></li> <li><code>fetchMock</code>: you should use <code>outboundService</code> instead</li> <li><code>containerEngine</code>: containers were not supported in vitest-pool-workers. Consider using <a href="https://developers.cloudflare.com/workers/testing/test-harness/"><code>createTestHarness()</code></a> instead if you want to test against actual containers.</li> </ul> <p>Additionally, <code>cache</code> has been deprecated and renamed to <code>cacheAPI</code>, but <code>cache</code> remains functional.</p> </li> </ul> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/cloudflare/workers-sdk/pull/14586">#14586</a> <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a> Thanks <a href="https://github.com/emily-shen"><code>@emily-shen</code></a>! - Preserve the deprecated Miniflare <code>cache</code> option</p> <p>Vitest configurations using <code>cache</code> continue to work after the internal Miniflare v5 upgrade. The option is translated to <code>cacheAPI</code>; new configurations should use <code>cacheAPI</code> directly.</p> </li> <li> <p><a href="https://redirect.github.com/cloudflare/workers-sdk/pull/14586">#14586</a> <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a> Thanks <a href="https://github.com/emily-shen"><code>@emily-shen</code></a>! - Stop enabling Miniflare's removed <code>unsafeStickyBlobs</code> option</p> <p>The pool no longer sets the <code>unsafeStickyBlobs</code> Miniflare option, which has been removed. This option was only needed for the Durable Object isolated storage feature that was dropped in 0.13.0, so there is no change in behaviour.</p> </li> <li> <p>Updated dependencies [<a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>]:</p> <ul> <li><a href="mailto:miniflare@5.20260730.0-alpha">miniflare@5.20260730.0-alpha</a></li> <li>wrangler@4.117.0</li> </ul> </li> </ul> <h2>0.19.1</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [<a href="https://github.com/cloudflare/workers-sdk/commit/01d7020806dd523158cf9f26a4575365117f5381"><code>01d7020</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/beec0fbc9d3adec24bc42e31a21fe7f82badb543"><code>beec0fb</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/48f0c6cbbc50dfac02e2d76554c181ced233a792"><code>48f0c6c</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/8049ca451c9561e8b72f3eeeb7916a8712f06133"><code>8049ca4</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/d7f38c311e8cd0f29f56a25250da45f62b20f8ca"><code>d7f38c3</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/1394867d1dc357d9bddabf8c16aede47d052fb18"><code>1394867</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/cc5447865022ebc602258cfbeb79953181a62ae0"><code>cc54478</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5c25cfe4e03e0d3d42ddab57adc3274d6f6a1a30"><code>5c25cfe</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/b21eac24878f060296915f198fae910268c465ef"><code>b21eac2</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/bb09f1bd77a194520db3e61d733996f4bbe4bad8"><code>bb09f1b</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/1f61001e5f7a807db7856f5d89e0b26e12a0d0a0"><code>1f61001</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/01d7020806dd523158cf9f26a4575365117f5381"><code>01d7020</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/e31ab0f40c5310babd8b493490c0e1ca677e9a8c"><code>e31ab0f</code></a>]: <ul> <li>miniflare@4.20260730.0</li> <li>wrangler@4.116.0</li> </ul> </li> </ul> <h2>0.19.0</h2> <h3>Minor Changes</h3> <ul> <li><a href="https://redirect.github.com/cloudflare/workers-sdk/pull/14879">#14879</a> <a href="https://github.com/cloudflare/workers-sdk/commit/e6480e3c26e849034e9e511a2fd1216257975656"><code>e6480e3</code></a> Thanks <a href="https://github.com/dmmulroy"><code>@dmmulroy</code></a>! - Add a <code>verbose</code> option to <code>cloudflareTest()</code> and <code>cloudflarePool()</code> configuration</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/cloudflare/workers-sdk/commit/95d9b12f2c707f254b66b446e0bd9fd6b8b7d96d"><code>95d9b12</code></a> Version Packages (<a href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers/issues/14946">#14946</a>)</li> <li><a href="https://github.com/cloudflare/workers-sdk/commit/83a37e3ef05d6930f29df904978e7f6eacde2203"><code>83a37e3</code></a> docs: point vitest-pool-workers BUILD section at the tsdown config (<a href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers/issues/14940">#14940</a>)</li> <li><a href="https://github.com/cloudflare/workers-sdk/commit/fcb5402346b2424008c7a0d0612ee8ba2f65bf3e"><code>fcb5402</code></a> Version Packages (<a href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers/issues/14939">#14939</a>)</li> <li><a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a> Miniflare v5 alpha (<a href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers/issues/14586">#14586</a>)</li> <li><a href="https://github.com/cloudflare/workers-sdk/commit/96fd16f0e06e82eb99001c70e4935e992e69cb87"><code>96fd16f</code></a> Version Packages (<a href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers/issues/14898">#14898</a>)</li> <li><a href="https://github.com/cloudflare/workers-sdk/commit/760a85b6fac60b0a73298c99df54ae0058653c76"><code>760a85b</code></a> Version Packages (<a href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers/issues/14824">#14824</a>)</li> <li><a href="https://github.com/cloudflare/workers-sdk/commit/e6480e3c26e849034e9e511a2fd1216257975656"><code>e6480e3</code></a> [vitest-pool-workers] Make workerd verbose logging configurable (<a href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers/issues/14879">#14879</a>)</li> <li><a href="https://github.com/cloudflare/workers-sdk/commit/edc203e42a10a52f8d2af305fecd2fed4807274e"><code>edc203e</code></a> [vitest-pool-workers] Ignore workerd's ungraceful TLS disconnect exception lo...</li> <li>See full diff in <a href="https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vitest-pool-workers@0.20.1/packages/vitest-pool-workers">compare view</a></li> </ul> </details> <br /> Updates `@cloudflare/workers-types` from 5.20260801.1 to 5.20260804.1 <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/cloudflare/workerd/commits">compare view</a></li> </ul> </details> <br /> Updates `@mastra/core` from 1.52.1 to 1.55.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/mastra-ai/mastra/releases">@mastra/core's releases</a>.</em></p> <blockquote> <h2>July 30, 2026</h2> <h2>Highlights</h2> <h3>In-process Code Mode execution (no workspace sandbox required)</h3> <p>Code Mode transports can now declare <code>requiresSandbox: false</code>, letting <code>createCodeMode()</code> run without a workspace sandbox for in-process execution boundaries. This enables secure in-process runtimes like V8 isolates and exports <code>sanitizeToolId</code> so transports can share consistent <code>external_*</code> naming.</p> <h3>New <code>@mastra/isolated-vm</code> package for V8-isolated Code Mode</h3> <p>Introduces <code>@mastra/isolated-vm</code> with <code>IsolatedVmCodeModeTransport</code>, running model-authored programs inside an in-process V8 isolate with no filesystem/network/process access (only bridged <code>external_*</code> tools). Note: requires <code>isolated-vm</code> native addon and Node 20+ hosts must start with <code>--no-node-snapshot</code>.</p> <h3>Built-in provider-native Web Search tool</h3> <p><code>@mastra/core</code> adds <code>webSearchTool</code>, a first-party web search tool that resolves to provider-native search when supported by the configured model/provider, simplifying “current info” agent setups.</p> <h3>Stored agent drafts via <code>autoPublish</code> (Server + JS SDK)</h3> <p>Both <code>@mastra/server</code> and <code>@mastra/client-js</code> add <code>autoPublish</code> to stored agent creation so you can create an initial unpublished draft for review before publishing (existing calls still publish immediately by default).</p> <h3>New Factory channel identity domain + channels integration slot</h3> <p><code>@mastra/factory</code> adds a <code>channel-identity</code> storage domain to link chat-platform senders to Factory users, plus a <code>channels()</code> integration slot to attach an <code>AgentControllerChannels</code> during <code>prepare()</code> so inbound platform messages can drive the same agents as the web UI.</p> <h3>Breaking Changes</h3> <ul> <li><code>ChannelHandler</code> context parameter is now required: the 4th parameter is <code>ctx: ChannelHandlerContext</code> (non-optional). Code that <em>calls</em> a <code>ChannelHandler</code>-typed function with only three args must be updated to pass <code>ctx</code>.</li> </ul> <h2>Changelog</h2> <h3><a href="https://github.com/mastra-ai/mastra/blob/@mastra/core@1.55.0/packages/core/CHANGELOG.md">@mastra/core@1.55.0</a></h3> <h4>Minor Changes</h4> <ul> <li> <p>Added support for Code Mode transports that provide their own execution boundary. A transport can now declare <code>requiresSandbox: false</code> and <code>createCodeMode()</code> will run it without a workspace sandbox, which enables in-process transports such as <code>IsolatedVmCodeModeTransport</code> from <code>@mastra/isolated-vm</code>: (<a href="https://redirect.github.com/mastra-ai/mastra/pull/20359">#20359</a>)</p> <pre lang="typescript"><code>import { createCodeMode } from '@mastra/core/tools'; import { IsolatedVmCodeModeTransport } from '@mastra/isolated-vm'; <p>// No sandbox needed — the V8 isolate is the execution boundary const { tool, instructions } = createCodeMode({ tools }, new IsolatedVmCodeModeTransport()); </code></pre></p> <p>Also fixed the generated Code Mode instructions to describe isolation accurately instead of always claiming the program runs fully sandboxed, since the actual boundary depends on the configured sandbox and transport. The <code>sanitizeToolId</code> helper used for <code>external_*</code> naming is now exported from <code>@mastra/core/tools</code> so transports can reuse it instead of duplicating it.</p> </li> <li> <p>Added retry callbacks for stream error policies and ensured explicit matcher policies override provider retry metadata. (<a href="https://redirect.github.com/mastra-ai/mastra/pull/19724">#19724</a>)</p> </li> <li> <p>Channel handlers can now contribute to the request context of the run they start. (<a href="https://redirect.github.com/mastra-ai/mastra/pull/20060">#20060</a>)</p> <p><code>ChannelHandlerContext</code> gains a <code>requestContext</code> field holding the <code>RequestContext</code> for the run the inbound message is about to start. It is constructed fresh for every message, and a handler may write to it before calling <code>defaultHandler</code>. Core then adds its own channel and render-context entries and dispatches with the same instance, so anything the handler wrote reaches the run.</p> <pre lang="ts"><code>import { AgentControllerChannels } from '@mastra/core/channels'; <p>const channels = new AgentControllerChannels({ adapters, handlers: { </code></pre></p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/mastra-ai/mastra/commit/bccb45d579ae7a914b9c03733f919127952c2300"><code>bccb45d</code></a> chore: version - exit prerelease mode</li> <li><a href="https://github.com/mastra-ai/mastra/commit/469696312ac4c618bc8475b0c5ed7949b8a3455e"><code>4696963</code></a> fix(core): persist delegation prompt exactly once in sub-agent threads (<a href="https://github.com/mastra-ai/mastra/tree/HEAD/packages/core/issues/20174">#20174</a>)</li> <li><a href="https://github.com/mastra-ai/mastra/commit/6b861234d6728e50c7b424d504024b468d6db2b8"><code>6b86123</code></a> chore: version packages (alpha) (<a href="https://github.com/mastra-ai/mastra/tree/HEAD/packages/core/issues/20419">#20419</a>)</li> <li><a href="https://github.com/mastra-ai/mastra/commit/723aa5437106bdb708ae03c0ef6b77aa11291e73"><code>723aa54</code></a> feat(factory): stricter review agent — weigh existing comments, calibrated ve...</li> <li><a href="https://github.com/mastra-ai/mastra/commit/ef8a7ceb6d663723e5e09aa6ebabc716665325af"><code>ef8a7ce</code></a> chore: version packages (alpha) (<a href="https://github.com/mastra-ai/mastra/tree/HEAD/packages/core/issues/20358">#20358</a>)</li> <li><a href="https://github.com/mastra-ai/mastra/commit/07f5b4ba9d608d88865030732e580298296adf99"><code>07f5b4b</code></a> fix(core): avoid serializing result comparisons (<a href="https://github.com/mastra-ai/mastra/tree/HEAD/packages/core/issues/20340">#20340</a>)</li> <li><a href="https://github.com/mastra-ai/mastra/commit/9c16d7b20f02b5bfd1152861a69fd6694c26f4b3"><code>9c16d7b</code></a> chore: regenerate providers and docs [skip ci]</li> <li><a href="https://github.com/mastra-ai/mastra/commit/55c9e248c27c1d72b5bb7e94ea6b8a3999eee49f"><code>55c9e24</code></a> Run Slack messages as the sender's Mastra tenant (<a href="https://github.com/mastra-ai/mastra/tree/HEAD/packages/core/issues/20060">#20060</a>)</li> <li><a href="https://github.com/mastra-ai/mastra/commit/cfb2899d510252f39ddf46fb75c35c11fb4a36f4"><code>cfb2899</code></a> chore: version packages</li> <li><a href="https://github.com/mastra-ai/mastra/commit/ba369f2a0aaf998da0d6aa033d26f64f96bef8ac"><code>ba369f2</code></a> feat(isolated-vm): add IsolatedVmCodeModeTransport for in-process Code Mode i...</li> <li>Additional commits viewable in <a href="https://github.com/mastra-ai/mastra/commits/@mastra/core@1.55.0/packages/core">compare view</a></li> </ul> </details> <br /> Updates `@modelcontextprotocol/sdk` from 1.26.0 to 1.30.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/modelcontextprotocol/typescript-sdk/releases">@modelcontextprotocol/sdk's releases</a>.</em></p> <blockquote> <h2>1.30.0</h2> <h2>What's Changed</h2> <ul> <li>fix(server): prioritize zod issues and format them by <a href="https://github.com/mozmo15"><code>@mozmo15</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1503">modelcontextprotocol/typescript-sdk#1503</a></li> <li>chore(ci): switch publish to OIDC trusted publishing by <a href="https://github.com/felixweinberger"><code>@felixweinberger</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1839">modelcontextprotocol/typescript-sdk#1839</a></li> <li>Add end-to-end test suite by <a href="https://github.com/felixweinberger"><code>@felixweinberger</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2167">modelcontextprotocol/typescript-sdk#2167</a></li> <li>v1 stdio buffer limit by <a href="https://github.com/KKonstantinov"><code>@KKonstantinov</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2239">modelcontextprotocol/typescript-sdk#2239</a></li> <li>fix: support Zod 3.25 method literals by <a href="https://github.com/mattzcarey"><code>@mattzcarey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2368">modelcontextprotocol/typescript-sdk#2368</a></li> <li>Validate Content-Type by parsed media type instead of substring match (v1.x) by <a href="https://github.com/felixweinberger"><code>@felixweinberger</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2444">modelcontextprotocol/typescript-sdk#2444</a></li> <li>fix: send SSE keep-alive comment frames from Streamable HTTP server transport (v1.x) by <a href="https://github.com/mattzcarey"><code>@mattzcarey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2538">modelcontextprotocol/typescript-sdk#2538</a></li> <li>fix(deps): widen <code>@hono/node-server</code> past GHSA-frvp-7c67-39w9 by <a href="https://github.com/arimu1"><code>@arimu1</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2549">modelcontextprotocol/typescript-sdk#2549</a></li> <li>Fix SSE keep-alive timer lifecycle in Streamable HTTP server transport (v1.x) by <a href="https://github.com/felixweinberger"><code>@felixweinberger</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2547">modelcontextprotocol/typescript-sdk#2547</a></li> <li>chore: bump version to 1.30.0 by <a href="https://github.com/felixweinberger"><code>@felixweinberger</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2563">modelcontextprotocol/typescript-sdk#2563</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/mozmo15"><code>@mozmo15</code></a> made their first contribution in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1503">modelcontextprotocol/typescript-sdk#1503</a></li> <li><a href="https://github.com/arimu1"><code>@arimu1</code></a> made their first contribution in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2549">modelcontextprotocol/typescript-sdk#2549</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/modelcontextprotocol/typescript-sdk/compare/v1.29.0...1.30.0">https://github.com/modelcontextprotocol/typescript-sdk/compare/v1.29.0...1.30.0</a></p> <h2>v1.29.0</h2> <h2>What's Changed</h2> <ul> <li>fix: treat v1.x as primary branch for npm latest tag (backport <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/1577">#1577</a>) by <a href="https://github.com/felixweinberger"><code>@felixweinberger</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1749">modelcontextprotocol/typescript-sdk#1749</a></li> <li>[v1.x] fix: disallow null (infinite) requested TTL by <a href="https://github.com/LucaButBoring"><code>@LucaButBoring</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1339">modelcontextprotocol/typescript-sdk#1339</a></li> <li>[v1.x] fix: add missing size field to ResourceSchema by <a href="https://github.com/olaservo"><code>@olaservo</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1575">modelcontextprotocol/typescript-sdk#1575</a></li> <li>Add typings exports by <a href="https://github.com/tdraier"><code>@tdraier</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1623">modelcontextprotocol/typescript-sdk#1623</a></li> <li>v1.x npm audit fix by <a href="https://github.com/KKonstantinov"><code>@KKonstantinov</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1780">modelcontextprotocol/typescript-sdk#1780</a></li> <li>v1.x <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/1623">#1623</a> follow up -add missing types to package.json by <a href="https://github.com/KKonstantinov"><code>@KKonstantinov</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1773">modelcontextprotocol/typescript-sdk#1773</a></li> <li>[v1.x backport] Allow servers / clients to advertise extensions in the capability object by <a href="https://github.com/localden"><code>@localden</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1811">modelcontextprotocol/typescript-sdk#1811</a></li> <li>fix(stdio): always set windowsHide on Windows, not just in Electron by <a href="https://github.com/jnMetaCode"><code>@jnMetaCode</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1640">modelcontextprotocol/typescript-sdk#1640</a></li> <li>chore: bump version to 1.29.0 by <a href="https://github.com/felixweinberger"><code>@felixweinberger</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1820">modelcontextprotocol/typescript-sdk#1820</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/tdraier"><code>@tdraier</code></a> made their first contribution in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1623">modelcontextprotocol/typescript-sdk#1623</a></li> <li><a href="https://github.com/jnMetaCode"><code>@jnMetaCode</code></a> made their first contribution in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1640">modelcontextprotocol/typescript-sdk#1640</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/modelcontextprotocol/typescript-sdk/compare/v1.28.0...v1.29.0">https://github.com/modelcontextprotocol/typescript-sdk/compare/v1.28.0...v1.29.0</a></p> <h2>v1.28.0</h2> <h2>What's Changed</h2> <ul> <li>feat: use scopes_supported from resource metadata by default (fixes <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/580">#580</a>) by <a href="https://github.com/antogyn"><code>@antogyn</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/757">modelcontextprotocol/typescript-sdk#757</a></li> <li>[v1.x backport] Default to client_secret_basic when server omits token_endpoint_auth_methods_supported by <a href="https://github.com/pcarleton"><code>@pcarleton</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1611">modelcontextprotocol/typescript-sdk#1611</a></li> <li>fix: reject plain JSON Schema objects passed as inputSchema by <a href="https://github.com/tiluckdave"><code>@tiluckdave</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1596">modelcontextprotocol/typescript-sdk#1596</a></li> <li>fix: clear _timeoutInfo in _onclose() and scope .finally() abort controller cleanup by <a href="https://github.com/pcarleton"><code>@pcarleton</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1462">modelcontextprotocol/typescript-sdk#1462</a></li> <li>fix(server/auth): RFC 8252 loopback port relaxation by <a href="https://github.com/poteat"><code>@poteat</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1738">modelcontextprotocol/typescript-sdk#1738</a></li> <li>chore: bump version to 1.28.0 by <a href="https://github.com/felixweinberger"><code>@felixweinberger</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1746">modelcontextprotocol/typescript-sdk#1746</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/antogyn"><code>@antogyn</code></a> made their first contribution in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/757">modelcontextprotocol/typescript-sdk#757</a></li> <li><a href="https://github.com/tiluckdave"><code>@tiluckdave</code></a> made their first contribution in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1596">modelcontextprotocol/typescript-sdk#1596</a></li> <li><a href="https://github.com/poteat"><code>@poteat</code></a> made their first contribution in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1738">modelcontextprotocol/typescript-sdk#1738</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/2d889f2b329e46680ec9bdd565de4616c497825a"><code>2d889f2</code></a> chore: bump version to 1.30.0 (<a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2563">#2563</a>)</li> <li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/e3f3daa12cc2603919939b72136ce9d9e800b868"><code>e3f3daa</code></a> Fix SSE keep-alive timer lifecycle in Streamable HTTP server transport (v1.x)...</li> <li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/bb5a718cbf90796bacbf62218b359196d210426b"><code>bb5a718</code></a> fix(deps): widen <code>@hono/node-server</code> past GHSA-frvp-7c67-39w9 (<a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2549">#2549</a>)</li> <li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/1dad2634ce5799fb386283d14291d1b4935a9a52"><code>1dad263</code></a> fix: send SSE keep-alive comment frames from Streamable HTTP server transport...</li> <li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/69749aa5081ddfe675d36da8d96c7e27d83742b8"><code>69749aa</code></a> Validate Content-Type by parsed media type instead of substring match (v1.x) ...</li> <li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/369513df7b0e9d8a979c86f68ba1930e0d5f27f0"><code>369513d</code></a> fix: support Zod 3.25 method literals (<a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2368">#2368</a>)</li> <li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/e7ee57c2f33b8290a78a3cefa27ab635fe67fbff"><code>e7ee57c</code></a> v1 stdio buffer limit (<a href="https://redirect.github.com/modelcontextprotocol... _Description has been truncated_ --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: jkomyno <12381818+jkomyno@users.noreply.github.com> |
||
|
dependabot[bot]
|
dda31cf3cb |
chore(deps): bump the github-actions group with 2 updates (#4089)
Bumps the github-actions group with 2 updates: [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) and [anthropics/claude-code-action/base-action](https://github.com/anthropics/claude-code-action). Updates `anthropics/claude-code-action` from 1.0.183 to 1.0.185 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/anthropics/claude-code-action/releases">anthropics/claude-code-action's releases</a>.</em></p> <blockquote> <h2>v1.0.185</h2> <h2>What's Changed</h2> <ul> <li>Derive trigger timestamps for issues and pull_request events by <a href="https://github.com/ashwin-ant"><code>@ashwin-ant</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1592">anthropics/claude-code-action#1592</a></li> <li>Pin bun config for MCP server processes by <a href="https://github.com/ashwin-ant"><code>@ashwin-ant</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1589">anthropics/claude-code-action#1589</a></li> <li>Match downloaded images to their source URLs by asset identifier by <a href="https://github.com/ashwin-ant"><code>@ashwin-ant</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1588">anthropics/claude-code-action#1588</a></li> <li>Check collaborator permissions for workflow_run events by <a href="https://github.com/ashwin-ant"><code>@ashwin-ant</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1590">anthropics/claude-code-action#1590</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.185">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.185</a></p> <h2>v1.0.184</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.184">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.184</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/anthropics/claude-code-action/commit/9db594c7a0e82298c121c18b7f08aa1579ce7341"><code>9db594c</code></a> chore: bump Claude Code to 2.1.222 and Agent SDK to 0.3.222</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/acb0385805f08d88fa4906025a41975ee6122e32"><code>acb0385</code></a> Check collaborator permissions for workflow_run events (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1590">#1590</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/b80a0f042f2ff42ebd031d911263a059bdd9bd85"><code>b80a0f0</code></a> Match downloaded images to their source URLs by asset identifier (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1588">#1588</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/6fb6bb685891c44ad1313dedad3640bcd1f485c9"><code>6fb6bb6</code></a> Pin bun config for MCP server processes (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1589">#1589</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/b2963b9127309fd8ef897bb24a5d79761d566111"><code>b2963b9</code></a> Derive trigger timestamps for issues and pull_request events (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1592">#1592</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/86180fa9e4d311eed10c9cc49854c53dab5d517a"><code>86180fa</code></a> chore: bump Claude Code to 2.1.221 and Agent SDK to 0.3.221</li> <li>See full diff in <a href="https://github.com/anthropics/claude-code-action/compare/be7b93b1907a4abad570368f3c74b6fe3807510b...9db594c7a0e82298c121c18b7f08aa1579ce7341">compare view</a></li> </ul> </details> <br /> Updates `anthropics/claude-code-action/base-action` from 1.0.183 to 1.0.185 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/anthropics/claude-code-action/releases">anthropics/claude-code-action/base-action's releases</a>.</em></p> <blockquote> <h2>v1.0.185</h2> <h2>What's Changed</h2> <ul> <li>Derive trigger timestamps for issues and pull_request events by <a href="https://github.com/ashwin-ant"><code>@ashwin-ant</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1592">anthropics/claude-code-action#1592</a></li> <li>Pin bun config for MCP server processes by <a href="https://github.com/ashwin-ant"><code>@ashwin-ant</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1589">anthropics/claude-code-action#1589</a></li> <li>Match downloaded images to their source URLs by asset identifier by <a href="https://github.com/ashwin-ant"><code>@ashwin-ant</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1588">anthropics/claude-code-action#1588</a></li> <li>Check collaborator permissions for workflow_run events by <a href="https://github.com/ashwin-ant"><code>@ashwin-ant</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1590">anthropics/claude-code-action#1590</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.185">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.185</a></p> <h2>v1.0.184</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.184">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.184</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/anthropics/claude-code-action/commit/9db594c7a0e82298c121c18b7f08aa1579ce7341"><code>9db594c</code></a> chore: bump Claude Code to 2.1.222 and Agent SDK to 0.3.222</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/acb0385805f08d88fa4906025a41975ee6122e32"><code>acb0385</code></a> Check collaborator permissions for workflow_run events (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1590">#1590</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/b80a0f042f2ff42ebd031d911263a059bdd9bd85"><code>b80a0f0</code></a> Match downloaded images to their source URLs by asset identifier (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1588">#1588</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/6fb6bb685891c44ad1313dedad3640bcd1f485c9"><code>6fb6bb6</code></a> Pin bun config for MCP server processes (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1589">#1589</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/b2963b9127309fd8ef897bb24a5d79761d566111"><code>b2963b9</code></a> Derive trigger timestamps for issues and pull_request events (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1592">#1592</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/86180fa9e4d311eed10c9cc49854c53dab5d517a"><code>86180fa</code></a> chore: bump Claude Code to 2.1.221 and Agent SDK to 0.3.221</li> <li>See full diff in <a href="https://github.com/anthropics/claude-code-action/compare/be7b93b1907a4abad570368f3c74b6fe3807510b...9db594c7a0e82298c121c18b7f08aa1579ce7341">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
2cab683f0e |
chore(deps-dev): bump the npm-development group with 6 updates (#4091)
Bumps the npm-development group with 6 updates: | Package | From | To | | --- | --- | --- | | [lint-staged](https://github.com/lint-staged/lint-staged) | `17.2.0` | `17.3.0` | | [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) | `1.76.0` | `1.77.0` | | [oxlint-plugin-eslint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint) | `1.76.0` | `1.77.0` | | [@types/semver](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/semver) | `7.7.1` | `7.8.0` | | [@earendil-works/pi-coding-agent](https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent) | `0.82.1` | `0.83.0` | | [eve](https://github.com/vercel/eve/tree/HEAD/packages/eve) | `0.27.13` | `0.29.5` | Updates `lint-staged` from 17.2.0 to 17.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/lint-staged/lint-staged/releases">lint-staged's releases</a>.</em></p> <blockquote> <h2>v17.3.0</h2> <h3>Minor Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/lint-staged/lint-staged/pull/1825">#1825</a> <a href="https://github.com/lint-staged/lint-staged/commit/16b3f74850e5d2811b5fbaea6c136733a71ad3e4"><code>16b3f74</code></a> - It is now possible to run multiple tasks in parallel for a single glob by configuring it with an array of tasks (which run sequentially), and then placing another array inside it (where the tasks will run in parallel). The following demonstrates the order tasks will start in:</p> <pre lang="json"><code>{ "*.ts": ["first", "second", ["third", "third"], "fourth"] } </code></pre> <p>As a concrete example, <em>lint-staged</em>'s own configuration is:</p> <pre lang="js"><code>/** @type {import('./lib/index.js').Configuration} */ export default { "*": [ [ "oxfmt --check --no-error-on-unmatched-pattern", "oxlint --no-error-on-unmatched-pattern", ], ], "*.ts": () => "tsc", }; </code></pre> <p>which means:</p> <ol> <li>for all staged files, run the two commands in parallel with staged filenames appended, for example: <ul> <li><code>oxfmt --check --no-error-on-unmatched-pattern lib/index.js</code></li> <li><code>oxlint --no-error-on-unmatched-pattern lib/index.js</code></li> </ul> </li> <li>additionally, if any <code>*.ts</code> files are staged, run <code>tsc</code> without appending any arguments</li> <li>The two sets of commands also run in parallel</li> </ol> </li> </ul> <h3>Patch Changes</h3> <ul> <li><a href="https://redirect.github.com/lint-staged/lint-staged/pull/1829">#1829</a> <a href="https://github.com/lint-staged/lint-staged/commit/15f7e5314b4afe4702808d978758b22d42437f43"><code>15f7e53</code></a> - During an in-progress merge, files that are unchanged from the branch being merged are now skipped. Technically, files are only included if there are staged changes against both <code>HEAD</code> and <code>MERGE_HEAD</code>.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md">lint-staged's changelog</a>.</em></p> <blockquote> <h2>17.3.0</h2> <h3>Minor Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/lint-staged/lint-staged/pull/1825">#1825</a> <a href="https://github.com/lint-staged/lint-staged/commit/16b3f74850e5d2811b5fbaea6c136733a71ad3e4"><code>16b3f74</code></a> - It is now possible to run multiple tasks in parallel for a single glob by configuring it with an array of tasks (which run sequentially), and then placing another array inside it (where the tasks will run in parallel). The following demonstrates the order tasks will start in:</p> <pre lang="json"><code>{ "*.ts": ["first", "second", ["third", "third"], "fourth"] } </code></pre> <p>As a concrete example, <em>lint-staged</em>'s own configuration is:</p> <pre lang="js"><code>/** @type {import('./lib/index.js').Configuration} */ export default { "*": [ [ "oxfmt --check --no-error-on-unmatched-pattern", "oxlint --no-error-on-unmatched-pattern", ], ], "*.ts": () => "tsc", }; </code></pre> <p>which means:</p> <ol> <li>for all staged files, run the two commands in parallel with staged filenames appended, for example: <ul> <li><code>oxfmt --check --no-error-on-unmatched-pattern lib/index.js</code></li> <li><code>oxlint --no-error-on-unmatched-pattern lib/index.js</code></li> </ul> </li> <li>additionally, if any <code>*.ts</code> files are staged, run <code>tsc</code> without appending any arguments</li> <li>The two sets of commands also run in parallel</li> </ol> </li> </ul> <h3>Patch Changes</h3> <ul> <li><a href="https://redirect.github.com/lint-staged/lint-staged/pull/1829">#1829</a> <a href="https://github.com/lint-staged/lint-staged/commit/15f7e5314b4afe4702808d978758b22d42437f43"><code>15f7e53</code></a> - During an in-progress merge, files that are unchanged from the branch being merged are now skipped. Technically, files are only included if there are staged changes against both <code>HEAD</code> and <code>MERGE_HEAD</code>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/lint-staged/lint-staged/commit/d15344350d914f5ce24df2c85f3ffebb9b387f3b"><code>d153443</code></a> Merge pull request <a href="https://redirect.github.com/lint-staged/lint-staged/issues/1828">#1828</a> from lint-staged/changeset-release/main</li> <li><a href="https://github.com/lint-staged/lint-staged/commit/5162c149bbfa09b8a5ad4d37c647d63946568ca8"><code>5162c14</code></a> chore(changeset): release</li> <li><a href="https://github.com/lint-staged/lint-staged/commit/a4db9a4c32f108d1397436752be7e9dda956baa2"><code>a4db9a4</code></a> Merge pull request <a href="https://redirect.github.com/lint-staged/lint-staged/issues/1831">#1831</a> from lint-staged/linter-updates</li> <li><a href="https://github.com/lint-staged/lint-staged/commit/ea96cab0109ab44a5b2562927b890648ee32b4cc"><code>ea96cab</code></a> style: enable oxlint "suspicious" category</li> <li><a href="https://github.com/lint-staged/lint-staged/commit/2fae00778cea0c99da9bcb8bad4718dce08ea04e"><code>2fae007</code></a> style: add <code>@e18e/eslint-plugin</code></li> <li><a href="https://github.com/lint-staged/lint-staged/commit/2280c38a09ff4ca4db60320b5879e0029527afaa"><code>2280c38</code></a> Merge pull request <a href="https://redirect.github.com/lint-staged/lint-staged/issues/1829">#1829</a> from lint-staged/fix-merge-conflict-files</li> <li><a href="https://github.com/lint-staged/lint-staged/commit/1453ae6ae0e05275d714ad0cad7cd090885f504d"><code>1453ae6</code></a> test: relax assertion so that it passes in worktree</li> <li><a href="https://github.com/lint-staged/lint-staged/commit/15f7e5314b4afe4702808d978758b22d42437f43"><code>15f7e53</code></a> fix: lint only files changed against HEAD and MERGE_HEAD, during a merge</li> <li><a href="https://github.com/lint-staged/lint-staged/commit/dedfc31007aed50e1c9c5591a11085cb485ba41c"><code>dedfc31</code></a> Merge pull request <a href="https://redirect.github.com/lint-staged/lint-staged/issues/1825">#1825</a> from lint-staged/parallel-tasks-inside-sequence</li> <li><a href="https://github.com/lint-staged/lint-staged/commit/286e25cef9fde2fb6e77d2312fd91ac99020d69d"><code>286e25c</code></a> feat: allow running parallel tasks by nesting arrays</li> <li>Additional commits viewable in <a href="https://github.com/lint-staged/lint-staged/compare/v17.2.0...v17.3.0">compare view</a></li> </ul> </details> <br /> Updates `oxlint` from 1.76.0 to 1.77.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/oxc-project/oxc/releases">oxlint's releases</a>.</em></p> <blockquote> <h2>oxlint v1.27.0 && oxfmt v0.12.0</h2> <h1>Oxlint v1.27.0</h1> <h3>🚀 Features</h3> <ul> <li>222a8f0 linter/plugins: Implement <code>SourceCode#isSpaceBetween</code> (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15498">#15498</a>) (overlookmotel)</li> <li>2f9735d linter/plugins: Implement <code>context.languageOptions</code> (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15486">#15486</a>) (overlookmotel)</li> <li>bc731ff linter/plugins: Stub out all <code>Context</code> APIs (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15479">#15479</a>) (overlookmotel)</li> <li>5822cb4 linter/plugins: Add <code>extend</code> method to <code>FILE_CONTEXT</code> (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15477">#15477</a>) (overlookmotel)</li> <li>7b1e6f3 apps: Add pure rust binaries and release to github (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15469">#15469</a>) (Boshen)</li> <li>2a89b43 linter: Introduce debug assertions after fixes to assert validity (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15389">#15389</a>) (camc314)</li> <li>ad3c45a editor: Add <code>oxc.path.node</code> option (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15040">#15040</a>) (Sysix)</li> </ul> <h3>🐛 Bug Fixes</h3> <ul> <li>6f3cd77 linter/no-var: Incorrect warning for blocks (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15504">#15504</a>) (Hamir Mahal)</li> <li>6957fb9 linter/plugins: Do not allow access to <code>Context#id</code> in <code>createOnce</code> (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15489">#15489</a>) (overlookmotel)</li> <li>7409630 linter/plugins: Allow access to <code>cwd</code> in <code>createOnce</code> in ESLint interop mode (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15488">#15488</a>) (overlookmotel)</li> <li>732205e parser: Reject <code>using</code> / <code>await using</code> in a switch <code>case</code> / <code>default</code> clause (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15225">#15225</a>) (sapphi-red)</li> <li>a17ca32 linter/plugins: Replace <code>Context</code> class (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15448">#15448</a>) (overlookmotel)</li> <li>ecf2f7b language_server: Fail gracefully when tsgolint executable not found (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15436">#15436</a>) (camc314)</li> <li>3c8d3a7 lang-server: Improve logging in failure case for tsgolint (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15299">#15299</a>) (camc314)</li> <li>ef71410 linter: Use jsx if source type is JS in fix debug assertion (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15434">#15434</a>) (camc314)</li> <li>e32bbf6 linter/no-var: Handle TypeScript declare keyword in fixer (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15426">#15426</a>) (camc314)</li> <li>6565dbe linter/switch-case-braces: Skip comments when searching for <code>:</code> token (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15425">#15425</a>) (camc314)</li> <li>85bd19a linter/prefer-class-fields: Insert value after type annotation in fixer (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15423">#15423</a>) (camc314)</li> <li>fde753e linter/plugins: Block access to <code>context.settings</code> in <code>createOnce</code> (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15394">#15394</a>) (overlookmotel)</li> <li>ddd9f9f linter/forward-ref-uses-ref: Dont suggest removing wrapper in invalid positions (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15388">#15388</a>) (camc314)</li> <li>dac2a9c linter/no-template-curly-in-string: Remove fixer (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15387">#15387</a>) (camc314)</li> <li>989b8e3 linter/no-var: Only fix to <code>const</code> if the var has an initializer (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15385">#15385</a>) (camc314)</li> <li>cc403f5 linter/plugins: Return empty object for unimplemented parserServices (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15364">#15364</a>) (magic-akari)</li> </ul> <h3>⚡ Performance</h3> <ul> <li>25d577e language_server: Start tools in parallel (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15500">#15500</a>) (Sysix)</li> <li>3c57291 linter/plugins: Optimize loops (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15449">#15449</a>) (overlookmotel)</li> <li>3166233 linter/plugins: Remove <code>Arc</code>s (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15431">#15431</a>) (overlookmotel)</li> <li>9de1322 linter/plugins: Lazily deserialize settings JSON (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15395">#15395</a>) (overlookmotel)</li> <li>3049ec2 linter/plugins: Optimize <code>deepFreezeSettings</code> (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15392">#15392</a>) (overlookmotel)</li> <li>444ebfd linter/plugins: Use single object for <code>parserServices</code> (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15378">#15378</a>) (overlookmotel)</li> </ul> <h3>📚 Documentation</h3> <ul> <li>97d2104 linter: Update comment in lint.rs about default value for tsconfig path (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15530">#15530</a>) (Connor Shea)</li> <li>2c6bd9e linter: Always refer as "ES2015" instead of "ES6" (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15411">#15411</a>) (sapphi-red)</li> <li>a0c5203 linter/import/named: Update "ES7" comment in examples (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15410">#15410</a>) (sapphi-red)</li> <li>3dc24b5 linter,minifier: Always refer as "ES Modules" instead of "ES6 Modules" (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15409">#15409</a>) (sapphi-red)</li> <li>2ad77fb linter/no-this-before-super: Correct "Why is this bad?" section (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15408">#15408</a>) (sapphi-red)</li> <li>57f0ce1 linter: Add backquotes where appropriate (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15407">#15407</a>) (sapphi-red)</li> </ul> <h1>Oxfmt v0.12.0</h1> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md">oxlint's changelog</a>.</em></p> <blockquote> <h2>[1.77.0] - 2026-08-03</h2> <h3>🐛 Bug Fixes</h3> <ul> <li>5c0fa61 linter/eslint/no-warning-comments: Unify config structs and remove manual options docs (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25151">#25151</a>) (Mikhail Baev)</li> </ul> <h3>📚 Documentation</h3> <ul> <li>9dc7756 linter/typescript/no-unnecessary-condition: Clarify options (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25110">#25110</a>) (camc314)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/oxc-project/oxc/commit/9a423f2f485b79c2353c49442c0c7f60f900261d"><code>9a423f2</code></a> release(apps): oxlint v1.77.0 && oxfmt v0.62.0 (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25251">#25251</a>)</li> <li><a href="https://github.com/oxc-project/oxc/commit/5c0fa61ddbd098fea5101dff356dc9b67adbee95"><code>5c0fa61</code></a> fix(linter/eslint/no-warning-comments): unify config structs and remove manua...</li> <li><a href="https://github.com/oxc-project/oxc/commit/9dc77567291db6ebd0641284f80bf50163c6a257"><code>9dc7756</code></a> docs(linter/typescript/no-unnecessary-condition): clarify options (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25110">#25110</a>)</li> <li>See full diff in <a href="https://github.com/oxc-project/oxc/commits/oxlint_v1.77.0/npm/oxlint">compare view</a></li> </ul> </details> <br /> Updates `oxlint-plugin-eslint` from 1.76.0 to 1.77.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/oxc-project/oxc/commit/9a423f2f485b79c2353c49442c0c7f60f900261d"><code>9a423f2</code></a> release(apps): oxlint v1.77.0 && oxfmt v0.62.0 (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25251">#25251</a>)</li> <li>See full diff in <a href="https://github.com/oxc-project/oxc/commits/apps_v1.77.0/npm/oxlint-plugin-eslint">compare view</a></li> </ul> </details> <br /> Updates `@types/semver` from 7.7.1 to 7.8.0 <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/semver">compare view</a></li> </ul> </details> <br /> Updates `@earendil-works/pi-coding-agent` from 0.82.1 to 0.83.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/earendil-works/pi/releases">@earendil-works/pi-coding-agent's releases</a>.</em></p> <blockquote> <h2>v0.83.0</h2> <h3>New Features</h3> <ul> <li><strong>Credential export for external clients</strong> — <code>pi auth print-api-key</code> and <code>pi auth print-bearer-token</code> export configured credentials with automatic OAuth refresh and minimum-validity enforcement.</li> <li><strong>Headless OpenRouter sign-in</strong> — Complete <code>/login</code> over SSH by pasting the redirect URL or authorization code when the loopback callback is unavailable. See <a href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/providers.md#openrouter">OpenRouter</a>.</li> <li><strong>Claude Opus 5 on GitHub Copilot</strong> — Use Claude Opus 5 through GitHub Copilot with adaptive thinking and a 1M context window. See <a href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/providers.md#github-copilot">GitHub Copilot</a>.</li> </ul> <h3>Breaking Changes</h3> <ul> <li>Upgraded bundled TypeBox aliases to 1.3.7, removing deprecated APIs including <code>Type.Base</code>, <code>Type.Awaited</code>, <code>Type.Promise</code>, <code>Type.AsyncIterator</code>, <code>Type.Iterator</code>, <code>Type.Options</code>, and <code>Value.Mutate</code>, while fixing compiled validation of nullable array tool arguments. Extensions using removed APIs must migrate to supported TypeBox APIs. See <a href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/packages.md#dependencies">Package Dependencies</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7243">#7243</a> by <a href="https://github.com/petrroll"><code>@petrroll</code></a>).</li> </ul> <h3>Added</h3> <ul> <li>Added <code>pi auth print-api-key</code> and <code>pi auth print-bearer-token</code> commands for exporting configured credentials to external clients, including automatic OAuth refresh and configurable minimum token validity (<a href="https://redirect.github.com/earendil-works/pi/pull/7168">#7168</a>).</li> <li>Exposed the session's resolved model scope as <code>ctx.scopedModels</code> to extensions. See <a href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/extensions.md#ctxmodelregistry--ctxmodel--ctxthinkinglevel--ctxscopedmodels">Extension Context</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7191">#7191</a> by <a href="https://github.com/pungggi"><code>@pungggi</code></a>, <a href="https://redirect.github.com/earendil-works/pi/pull/7215">#7215</a>).</li> <li>Added inherited per-request <code>fetch</code> injection for supported text and image provider transports.</li> <li>Added the inherited <code>"pending"</code> stop reason for partial streaming messages. See <a href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/custom-provider.md#stream-pattern">Custom Provider Stream Pattern</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7151">#7151</a> by <a href="https://github.com/lucasmeijer"><code>@lucasmeijer</code></a>).</li> <li>Added inherited raw provider stop reasons across Google, Anthropic, Amazon Bedrock, Mistral, and OpenAI streams; unmapped terminal reasons now surface as provider errors instead of successful stops (<a href="https://redirect.github.com/earendil-works/pi/pull/7272">#7272</a>).</li> <li>Added manual redirect URL and authorization-code entry to OpenRouter login for remote and headless environments. See <a href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/providers.md#openrouter">OpenRouter</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7114">#7114</a> by <a href="https://github.com/rgarcia"><code>@rgarcia</code></a>).</li> <li>Added inherited Claude Opus 5 support for GitHub Copilot with adaptive thinking and a 1M context window. See <a href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/providers.md#github-copilot">GitHub Copilot</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7158">#7158</a> by <a href="https://github.com/jay-aye-see-kay"><code>@jay-aye-see-kay</code></a>).</li> </ul> <h3>Changed</h3> <ul> <li>Changed inherited OAuth credential resolution to refresh tokens with less than five minutes of validity remaining instead of waiting until expiration (<a href="https://redirect.github.com/earendil-works/pi/pull/7168">#7168</a>).</li> </ul> <h3>Fixed</h3> <ul> <li>Added a status line when the tool output expansion is toggled (<a href="https://redirect.github.com/earendil-works/pi/issues/7180">#7180</a>).</li> <li>Fixed file-backed <code>SYSTEM.md</code> and <code>APPEND_SYSTEM.md</code> prompts being omitted from the interactive startup context listing. See <a href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/usage.md#system-prompt-files">System Prompt Files</a> (<a href="https://redirect.github.com/earendil-works/pi/issues/7096">#7096</a>).</li> <li>Fixed context files loading twice when a linked Git worktree is nested under its main repository. See <a href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/usage.md#context-files">Context Files</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7221">#7221</a> by <a href="https://github.com/arajkumar"><code>@arajkumar</code></a>).</li> <li>Fixed llama.cpp streamed responses reporting zero token usage and leaving session context accounting empty. See <a href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/llama-cpp.md">llama.cpp</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7258">#7258</a> by <a href="https://github.com/SteveImmanuel"><code>@SteveImmanuel</code></a>).</li> <li>Fixed session replacement and committed tree navigation during an active response to abort and persist the outgoing turn instead of leaving dangling tool calls. See <a href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/usage.md#sessions">Sessions</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7022">#7022</a> by <a href="https://github.com/tmustier"><code>@tmustier</code></a>).</li> <li>Fixed failed Git package installs leaving partial directories that blocked clean retries. See <a href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/packages.md#install-and-manage">Install and Manage</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7210">#7210</a> by <a href="https://github.com/haoqixu"><code>@haoqixu</code></a>).</li> <li>Fixed the <code>/model</code> selector retaining a stale selection while filtering instead of highlighting the top match (<a href="https://redirect.github.com/earendil-works/pi/pull/7211">#7211</a> by <a href="https://github.com/christianbasch"><code>@christianbasch</code></a>).</li> <li>Fixed direct RPC bash commands bypassing extension <code>user_bash</code> handlers. See <a href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/extensions.md#user-bash-events">User Bash Events</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7214">#7214</a>).</li> <li>Fixed skills, prompts, and themes losing package source metadata after extensions reload resources. See <a href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/extensions.md#resource-events">Resource Events</a> (<a href="https://redirect.github.com/earendil-works/pi/issues/6968">#6968</a>).</li> <li>Fixed cancellation of concurrently running user bash commands so every active command is aborted (<a href="https://redirect.github.com/earendil-works/pi/pull/7103">#7103</a> by <a href="https://github.com/yzhg1983"><code>@yzhg1983</code></a>).</li> <li>Fixed duplicate messages appearing when extensions switch sessions during interactive startup (<a href="https://redirect.github.com/earendil-works/pi/pull/7110">#7110</a> by <a href="https://github.com/yzhg1983"><code>@yzhg1983</code></a>).</li> <li>Fixed inherited Qwen Token Plan reasoning models to send their service-specific thinking controls and supported reasoning-effort levels (<a href="https://redirect.github.com/earendil-works/pi/issues/6951">#6951</a>, <a href="https://redirect.github.com/earendil-works/pi/issues/6998">#6998</a>).</li> <li>Fixed inherited Z.AI output limits being sent through an unsupported parameter. See <a href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/providers.md">Providers</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7174">#7174</a> by <a href="https://github.com/HyeokjaeLee"><code>@HyeokjaeLee</code></a>).</li> <li>Fixed explicitly configured Amazon Bedrock profiles being overridden by ambient AWS access keys. See <a href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/providers.md#amazon-bedrock">Amazon Bedrock</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7176">#7176</a> by <a href="https://github.com/christianbasch"><code>@christianbasch</code></a>).</li> <li>Fixed inherited image fallback paths overflowing narrow terminals, shortened home-directory paths, and made absolute paths clickable when terminal hyperlinks are available (<a href="https://redirect.github.com/earendil-works/pi/pull/7262">#7262</a>).</li> <li>Fixed inherited OpenAI-compatible tool calls losing their function arguments when malformed deltas also contain an empty <code>custom</code> object (<a href="https://redirect.github.com/earendil-works/pi/pull/7288">#7288</a> by <a href="https://github.com/sunnyyoung"><code>@sunnyyoung</code></a>).</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/CHANGELOG.md">@earendil-works/pi-coding-agent's changelog</a>.</em></p> <blockquote> <h2>[0.83.0] - 2026-07-29</h2> <h3>New Features</h3> <ul> <li><strong>Credential export for external clients</strong> — <code>pi auth print-api-key</code> and <code>pi auth print-bearer-token</code> export configured credentials with automatic OAuth refresh and minimum-validity enforcement.</li> <li><strong>Headless OpenRouter sign-in</strong> — Complete <code>/login</code> over SSH by pasting the redirect URL or authorization code when the loopback callback is unavailable. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#openrouter">OpenRouter</a>.</li> <li><strong>Claude Opus 5 on GitHub Copilot</strong> — Use Claude Opus 5 through GitHub Copilot with adaptive thinking and a 1M context window. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#github-copilot">GitHub Copilot</a>.</li> </ul> <h3>Breaking Changes</h3> <ul> <li>Upgraded bundled TypeBox aliases to 1.3.7, removing deprecated APIs including <code>Type.Base</code>, <code>Type.Awaited</code>, <code>Type.Promise</code>, <code>Type.AsyncIterator</code>, <code>Type.Iterator</code>, <code>Type.Options</code>, and <code>Value.Mutate</code>, while fixing compiled validation of nullable array tool arguments. Extensions using removed APIs must migrate to supported TypeBox APIs. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/packages.md#dependencies">Package Dependencies</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7243">#7243</a> by <a href="https://github.com/petrroll"><code>@petrroll</code></a>).</li> </ul> <h3>Added</h3> <ul> <li>Added <code>pi auth print-api-key</code> and <code>pi auth print-bearer-token</code> commands for exporting configured credentials to external clients, including automatic OAuth refresh and configurable minimum token validity (<a href="https://redirect.github.com/earendil-works/pi/pull/7168">#7168</a>).</li> <li>Exposed the session's resolved model scope as <code>ctx.scopedModels</code> to extensions. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/extensions.md#ctxmodelregistry--ctxmodel--ctxthinkinglevel--ctxscopedmodels">Extension Context</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7191">#7191</a> by <a href="https://github.com/pungggi"><code>@pungggi</code></a>, <a href="https://redirect.github.com/earendil-works/pi/pull/7215">#7215</a>).</li> <li>Added inherited per-request <code>fetch</code> injection for supported text and image provider transports.</li> <li>Added the inherited <code>"pending"</code> stop reason for partial streaming messages. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/custom-provider.md#stream-pattern">Custom Provider Stream Pattern</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7151">#7151</a> by <a href="https://github.com/lucasmeijer"><code>@lucasmeijer</code></a>).</li> <li>Added inherited raw provider stop reasons across Google, Anthropic, Amazon Bedrock, Mistral, and OpenAI streams; unmapped terminal reasons now surface as provider errors instead of successful stops (<a href="https://redirect.github.com/earendil-works/pi/pull/7272">#7272</a>).</li> <li>Added manual redirect URL and authorization-code entry to OpenRouter login for remote and headless environments. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#openrouter">OpenRouter</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7114">#7114</a> by <a href="https://github.com/rgarcia"><code>@rgarcia</code></a>).</li> <li>Added inherited Claude Opus 5 support for GitHub Copilot with adaptive thinking and a 1M context window. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#github-copilot">GitHub Copilot</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7158">#7158</a> by <a href="https://github.com/jay-aye-see-kay"><code>@jay-aye-see-kay</code></a>).</li> </ul> <h3>Changed</h3> <ul> <li>Changed inherited OAuth credential resolution to refresh tokens with less than five minutes of validity remaining instead of waiting until expiration (<a href="https://redirect.github.com/earendil-works/pi/pull/7168">#7168</a>).</li> </ul> <h3>Fixed</h3> <ul> <li>Added a status line when the tool output expansion is toggled (<a href="https://redirect.github.com/earendil-works/pi/issues/7180">#7180</a>).</li> <li>Fixed file-backed <code>SYSTEM.md</code> and <code>APPEND_SYSTEM.md</code> prompts being omitted from the interactive startup context listing. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/usage.md#system-prompt-files">System Prompt Files</a> (<a href="https://redirect.github.com/earendil-works/pi/issues/7096">#7096</a>).</li> <li>Fixed context files loading twice when a linked Git worktree is nested under its main repository. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/usage.md#context-files">Context Files</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7221">#7221</a> by <a href="https://github.com/arajkumar"><code>@arajkumar</code></a>).</li> <li>Fixed llama.cpp streamed responses reporting zero token usage and leaving session context accounting empty. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/llama-cpp.md">llama.cpp</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7258">#7258</a> by <a href="https://github.com/SteveImmanuel"><code>@SteveImmanuel</code></a>).</li> <li>Fixed session replacement and committed tree navigation during an active response to abort and persist the outgoing turn instead of leaving dangling tool calls. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/usage.md#sessions">Sessions</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7022">#7022</a> by <a href="https://github.com/tmustier"><code>@tmustier</code></a>).</li> <li>Fixed failed Git package installs leaving partial directories that blocked clean retries. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/packages.md#install-and-manage">Install and Manage</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7210">#7210</a> by <a href="https://github.com/haoqixu"><code>@haoqixu</code></a>).</li> <li>Fixed the <code>/model</code> selector retaining a stale selection while filtering instead of highlighting the top match (<a href="https://redirect.github.com/earendil-works/pi/pull/7211">#7211</a> by <a href="https://github.com/christianbasch"><code>@christianbasch</code></a>).</li> <li>Fixed direct RPC bash commands bypassing extension <code>user_bash</code> handlers. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/extensions.md#user-bash-events">User Bash Events</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7214">#7214</a>).</li> <li>Fixed skills, prompts, and themes losing package source metadata after extensions reload resources. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/extensions.md#resource-events">Resource Events</a> (<a href="https://redirect.github.com/earendil-works/pi/issues/6968">#6968</a>).</li> <li>Fixed cancellation of concurrently running user bash commands so every active command is aborted (<a href="https://redirect.github.com/earendil-works/pi/pull/7103">#7103</a> by <a href="https://github.com/yzhg1983"><code>@yzhg1983</code></a>).</li> <li>Fixed duplicate messages appearing when extensions switch sessions during interactive startup (<a href="https://redirect.github.com/earendil-works/pi/pull/7110">#7110</a> by <a href="https://github.com/yzhg1983"><code>@yzhg1983</code></a>).</li> <li>Fixed inherited Qwen Token Plan reasoning models to send their service-specific thinking controls and supported reasoning-effort levels (<a href="https://redirect.github.com/earendil-works/pi/issues/6951">#6951</a>, <a href="https://redirect.github.com/earendil-works/pi/issues/6998">#6998</a>).</li> <li>Fixed inherited Z.AI output limits being sent through an unsupported parameter. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md">Providers</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7174">#7174</a> by <a href="https://github.com/HyeokjaeLee"><code>@HyeokjaeLee</code></a>).</li> <li>Fixed explicitly configured Amazon Bedrock profiles being overridden by ambient AWS access keys. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#amazon-bedrock">Amazon Bedrock</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7176">#7176</a> by <a href="https://github.com/christianbasch"><code>@christianbasch</code></a>).</li> <li>Fixed inherited image fallback paths overflowing narrow terminals, shortened home-directory paths, and made absolute paths clickable when terminal hyperlinks are available (<a href="https://redirect.github.com/earendil-works/pi/pull/7262">#7262</a>).</li> <li>Fixed inherited OpenAI-compatible tool calls losing their function arguments when malformed deltas also contain an empty <code>custom</code> object (<a href="https://redirect.github.com/earendil-works/pi/pull/7288">#7288</a> by <a href="https://github.com/sunnyyoung"><code>@sunnyyoung</code></a>).</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/earendil-works/pi/commit/845d6ff1f6643aba440341cce877ce1c43ebbc39"><code>845d6ff</code></a> Release v0.83.0</li> <li><a href="https://github.com/earendil-works/pi/commit/f0499a63ff5563ff041c689f680ecbf01436a5e2"><code>f0499a6</code></a> docs: audit changelogs since v0.82.1</li> <li><a href="https://github.com/earendil-works/pi/commit/bff5ab71743b442efa234dbed369e0a96da791f3"><code>bff5ab7</code></a> fix(coding-agent): show system prompt files in startup context (<a href="https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent/issues/7266">#7266</a>)</li> <li><a href="https://github.com/earendil-works/pi/commit/cced6a21da273b26ee4a23a803680614bbe8dd1e"><code>cced6a2</code></a> fix(coding-agent): stop loading AGENTS.md twice in nested git worktrees (<a href="https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent/issues/7221">#7221</a>)</li> <li><a href="https://github.com/earendil-works/pi/commit/f9476a61e557bfdce2fbf3ffeaad0988fe47c184"><code>f9476a6</code></a> fix(ai): update TypeBox nullable array validation (<a href="https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent/issues/7243">#7243</a>)</li> <li><a href="https://github.com/earendil-works/pi/commit/0c32e83a352a4284133b2544f730a23814948ac3"><code>0c32e83</code></a> fix(coding-agent): enable streaming usage for llama.cpp provider (<a href="https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent/issues/7258">#7258</a>)</li> <li><a href="https://github.com/earendil-works/pi/commit/47ca25fcd8535b80710fad5be758f1f2cf81443c"><code>47ca25f</code></a> Revert "fix(coding-agent): build-check-test (<a href="https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent/issues/7206">#7206</a>)"</li> <li><a href="https://github.com/earendil-works/pi/commit/0d008b746892ad33d3fe15c0c4bc86a14369e0e8"><code>0d008b7</code></a> fix(coding-agent): show tool expansion status</li> <li><a href="https://github.com/earendil-works/pi/commit/f14519551682cd0fddac2e4b4e8b1f333667e94c"><code>f145195</code></a> fix(coding-agent): build-check-test (<a href="https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent/issues/7206">#7206</a>)</li> <li><a href="https://github.com/earendil-works/pi/commit/cefa40ed8f8dbcd6ffd67b5e7a0eaa75a5050d1a"><code>cefa40e</code></a> ***WIP it's a PoC *** fix(coding-agent): guard tree navigation during respons...</li> <li>Additional commits viewable in <a href="https://github.com/earendil-works/pi/commits/v0.83.0/packages/coding-agent">compare view</a></li> </ul> </details> <br /> Updates `eve` from 0.27.13 to 0.29.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/eve/releases">eve's releases</a>.</em></p> <blockquote> <h2>eve@0.29.5</h2> <h3>Patch Changes</h3> <ul> <li>c0dc572: Rename the TUI <code>/new</code> command to <code>/reset</code> so session reset uses the same name across the client, HTTP, channel, and TUI APIs.</li> <li>3dce30a: Add manual session compaction through custom-channel helpers, the eve HTTP client, and the <code>eve dev</code> TUI's <code>/compact</code> command. Compaction preserves the session, queues behind an active turn, and does not send synthetic model input.</li> <li>910805e: Make a single <code>Esc</code> cancel the running turn in the eve dev TUI when no message is queued. Queued messages still use <code>Esc</code> to steer the oldest message into the next turn.</li> <li>9c51755: Connection search and discovered connection tools now use the same <code>defineDynamic</code> and <code>defineTool</code> pipeline as authored tools. Dynamic tool maps now reject entries that omit <code>defineTool</code> instead of accepting unsupported raw objects.</li> <li>84aa671: Clarify the dev TUI’s <code>/add</code> flow with consistent integration categories and category-specific browsing labels. MCP connections are now named explicitly, and the flow more clearly explains channels, extensions, and observability integrations.</li> <li>0c28eb7: Allow declared subagents to export <code>defineDynamic</code> from <code>agent.ts</code>. Session and turn resolvers can now return an agent configuration to expose it or nil to omit it from direct and Workflow delegation.</li> <li>f3bb60d: Add manual session-context clearing through custom-channel helpers, the eve HTTP client, and the <code>eve dev</code> TUI's <code>/clear</code> command. Clearing removes model-message history while preserving the session, agent configuration, durable state, limits, and sandbox.</li> <li>ac7d3c6: Add <code>/cancel</code> to the eve dev TUI. The command cooperatively cancels a running turn from either the live streaming input or the idle prompt while preserving the session and settled context.</li> </ul> <h2>eve@0.29.4</h2> <h3>Patch Changes</h3> <ul> <li>e90a8c2: Launch local or deployed eve applications as stable ACP v1 agents with <code>eve acp [url]</code>, including streamed messages, tool activity, human input, cancellation, concurrent sessions, and verified Vercel authentication.</li> <li>cec672d: Add guided Discord setup through <code>eve add channel/discord</code>, including Vercel Connect provisioning, trigger attachment, interactions endpoint configuration, slash-command registration, and channel scaffolding.</li> <li>ed328e7: Render registry item titles with their exact registry-provided casing by loading manifests for each page of catalog results.</li> <li>c875a67: Update the generated <code>AGENTS.md</code> to direct coding agents to the eve registry for discovering and installing integrations.</li> <li>5153b13: Add JSON output to <code>eve registry list</code> and <code>eve registry search</code> for scripts that inspect registry catalogs.</li> <li>155d46a: Connection registry items now configure their Vercel Connect connector during <code>eve add</code>, and registry setup commands close their IPC channel after reporting an outcome so <code>/add</code> returns instead of remaining stuck.</li> <li>6f3daca: Add <code>ClientSession.snapshot()</code> for reading a finite, cursor-consistent session event prefix that can hydrate server-rendered applications.</li> <li>67bfc76: Resolve sandbox skill roots and seed-file paths through the same <code>$HOME</code> resolver the file tools use, so the skills location is spelled once instead of twice.</li> <li>a5acde8: Ensure exiting the dev TUI shuts down its owned server and any surviving workflow processes before the CLI exits. Persisted workflow messages now reach the ready worker during restart instead of being rejected while the file watcher starts.</li> <li>731464f: Give the local trace spool's on-disk layout a single owner: the shared trace reader now exposes the listing and segment-read primitives that <code>eve traces</code> and the <code>/traces</code> viewer both use, and payload formatting is shared between the detail panel and the conversation view.</li> <li>f7ba3b3: Derive the <code>/traces</code> conversation viewer's line geometry from one prefix-sum helper so scroll, click, and wheel math cannot disagree, and reset the view through a single factory when the viewed trace changes.</li> <li>3f4bb9c: The <code>/traces</code> viewer now follows your terminal's colors instead of forcing a hardcoded black/grey truecolor palette. It probes the terminal's default background (OSC 11) and derives its card surfaces from your own theme — subtly elevated bands on dark and light backgrounds alike, with red bands for failures, and card titles that invert to black on light backgrounds so they stay legible. Terminals that don't answer the probe get a clean gutter-rail rendering drawn entirely with the shared TUI theme.</li> <li>f5d0533: Derive the dev TUI's slash-command suggestion window from the command registry instead of a hand-maintained constant, and collapse the duplicated cursor step in the terminal line-wrap loop.</li> </ul> <h2>eve@0.29.3</h2> <h3>Patch Changes</h3> <ul> <li>22bfa02: Add guided Photon setup through <code>eve add channel/photon-imessage</code>, including project creation, phone registration, Vercel Connect or portable credentials, and channel scaffolding.</li> <li>0c0de19: Add an opt-in experimental steering policy to Chat SDK sends that cancels an active turn before delivering its replacement message.</li> <li>b00a79d: Add <code>photonIMessageChannel</code>, a first-class Photon iMessage channel with lazy credentials, Vercel OIDC webhook verification, and automatic eve session routing.</li> <li>495e93b: Resolve leading <code>$HOME</code> paths in the built-in <code>read_file</code>, <code>write_file</code>, <code>glob</code>, and <code>grep</code> tools so agents can directly access packaged skill references advertised in their prompt.</li> <li>bf01952: Local trace spans now capture model and tool payloads: the system prompt, prompt messages, and response text/reasoning/tool calls on model spans, and call arguments/results on tool spans, each capped at 32 KB with provider transport metadata stripped. Set <code>EVE_TRACES_CONTENT=off</code> to keep payloads out of the spool.</li> <li>680db59: Provider-executed tool calls (like a gateway's <code>web_search</code>) now show up in local traces: their calls and results are captured on the model span and the <code>/traces</code> viewer renders them as tool cards, with oversized outputs truncated to stay valid JSON.</li> <li>7ab6d8a: Terminal text wrapping in the dev TUI is now linear-time, so views rendering large single-line payloads (long tool results, big JSON) no longer stall on every repaint.</li> <li>52cee9c: Consolidate the three Vercel CLI subprocess runners onto one shared lifecycle. A <code>vercel</code> lookup killed by a signal (for example Ctrl-C during setup) now reports a cancellation failure instead of resolving as a success with truncated output.</li> <li>7703448: The local trace spool reader behind <code>eve traces</code> moved into a shared internal module; command behavior is unchanged.</li> <li>2d87acb: Subagent turn spans now record the dispatch that created them — <code>agent.parent.session.id</code>, <code>agent.parent.turn.id</code>, <code>agent.parent.call_id</code>, and <code>agent.subagent.name</code> — so a parent turn that fans out to several children can be attributed to the exact tool call behind each one.</li> <li>3c846bc: The <code>/traces</code> viewer supports drag-to-select: dragging with the mouse highlights text and releasing copies it to the clipboard (OSC 52 with tmux passthrough, plus the platform clipboard command) with a confirmation toast. Clicks now act on release so drags never toggle cards, and Esc cancels an in-flight selection.</li> <li>3645c6e: The <code>/traces</code> viewer frame breathes: padding rows around the title and above the footer hints, the copy toast floats top-right as a small surface with a left edge bar, and the scroll wheel scrolls the attributes drawer when the pointer is over it.</li> <li>8858403: The local tracing subsystem (spool writer/reader, retention, the zero-config local OTel runtime, and agent span capture) moved from <code>src/harness</code> into its own <code>src/tracing</code> module; no behavior change.</li> <li>9adb455: Adds a <code>/traces</code> command to the dev TUI: a full-screen live viewer over the local trace spool that re-tells each trace as a chat-style conversation — system prompt, user and assistant messages, and tool calls render as expandable cards (arrow keys or mouse click to expand/collapse), with a right-side metadata drawer. Subagent turns are badged with their dispatch lineage (<code>subagent:<name></code>), and the viewer opens on the trace containing the current session — including windowed sessions and subagent children recorded into a parent's trace. Expanded cards scroll line-by-line so content taller than the viewport is fully readable. Model spans with errors, token usage, or tool calls (but no text) now appear as cards instead of disappearing. Terminal escape sequences in trace payloads are stripped at render time. Tool-call arguments and results are captured without stripping domain-level <code>providerOptions</code>/<code>providerMetadata</code> keys. A single prompt message over 32 KiB is truncated at the text level so the serialized JSON stays parseable. Local spans capture system prompt, prompt messages, responses, reasoning, and tool arguments/results (<code>EVE_TRACES_CONTENT=off</code> to disable); long conversations truncate oldest messages first with an omission marker.</li> <li>275271d: Subagent runs now record into the trace of the session that dispatched them instead of a disconnected trace of their own, and <code>eve traces</code> resolves either session id to it. Local traces also open a real <code>agent.session</code> root span rather than a synthesized parent, so an authored OTel sampler's root rule decides whether a session is sampled, and a session long enough to outgrow one trace rolls into numbered windows that <code>eve traces <session-id></code> lists oldest first. Rows whose lifetime outlives the worker that opened them — <code>agent.session</code> and <code>agent.turn</code> — now show the extent of their descendants instead of <code>0ms</code>.</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vercel/eve/blob/main/packages/eve/CHANGELOG.md">eve's changelog</a>.</em></p> <blockquote> <h2>0.29.5</h2> <h3>Patch Changes</h3> <ul> <li>c0dc572: Rename the TUI <code>/new</code> command to <code>/reset</code> so session reset uses the same name across the client, HTTP, channel, and TUI APIs.</li> <li>3dce30a: Add manual session compaction through custom-channel helpers, the eve HTTP client, and the <code>eve dev</code> TUI's <code>/compact</code> command. Compaction preserves the session, queues behind an active turn, and does not send synthetic model input.</li> <li>910805e: Make a single <code>Esc</code> cancel the running turn in the eve dev TUI when no message is queued. Queued messages still use <code>Esc</code> to steer the oldest message into the next turn.</li> <li>9c51755: Connection search and discovered connection tools now use the same <code>defineDynamic</code> and <code>defineTool</code> pipeline as authored tools. Dynamic tool maps now reject entries that omit <code>defineTool</code> instead of accepting unsupported raw objects.</li> <li>84aa671: Clarify the dev TUI’s <code>/add</code> flow with consistent integration categories and category-specific browsing labels. MCP connections are now named explicitly, and the flow more clearly explains channels, extensions, and observability integrations.</li> <li>0c28eb7: Allow declared subagents to export <code>defineDynamic</code> from <code>agent.ts</code>. Session and turn resolvers can now return an agent configuration to expose it or nil to omit it from direct and Workflow delegation.</li> <li>f3bb60d: Add manual session-context clearing through custom-channel helpers, the eve HTTP client, and the <code>eve dev</code> TUI's <code>/clear</code> command. Clearing removes model-message history while preserving the session, agent configuration, durable state, limits, and sandbox.</li> <li>ac7d3c6: Add <code>/cancel</code> to the eve dev TUI. The command cooperatively cancels a running turn from either the live streaming input or the idle prompt while preserving the session and settled context.</li> </ul> <h2>0.29.4</h2> <h3>Patch Changes</h3> <ul> <li>e90a8c2: Launch local or deployed eve applications as stable ACP v1 agents with <code>eve acp [url]</code>, including streamed messages, tool activity, human input, cancellation, concurrent sessions, and verified Vercel authentication.</li> <li>cec672d: Add guided Discord setup through <code>eve add channel/discord</code>, including Vercel Connect provisioning, trigger attachment, interactions endpoint configuration, slash-command registration, and channel scaffolding.</li> <li>ed328e7: Render registry item titles with their exact registry-provided casing by loading manifests for each page of catalog results.</li> <li>c875a67: Update the generated <code>AGENTS.md</code> to direct coding agents to the eve registry for discovering and installing integrations.</li> <li>5153b13: Add JSON output to <code>eve registry list</code> and <code>eve registry search</code> for scripts that inspect registry catalogs.</li> <li>155d46a: Connection registry items now configure their Vercel Connect connector during <code>eve add</code>, and registry setup commands close their IPC channel after reporting an outcome so <code>/add</code> returns instead of remaining stuck.</li> <li>6f3daca: Add <code>ClientSession.snapshot()</code> for reading a finite, cursor-consistent session event prefix that can hydrate server-rendered applications.</li> <li>67bfc76: Resolve sandbox skill roots and seed-file paths through the same <code>$HOME</code> resolver the file tools use, so the skills location is spelled once instead of twice.</li> <li>a5acde8: Ensure exiting the dev TUI shuts down its owned server and any surviving workflow processes before the CLI exits. Persisted workflow messages now reach the ready worker during restart instead of being rejected while the file watcher starts.</li> <li>731464f: Give the local trace spool's on-disk layout a single owner: the shared trace reader now exposes the listing and segment-read primitives that <code>eve traces</code> and the <code>/traces</code> viewer both use, and payload formatting is shared between the detail panel and the conversation view.</li> <li>f7ba3b3: Derive the <code>/traces</code> conversation viewer's line geometry from one prefix-sum helper so scroll, click, and wheel math cannot disagree, and reset the view through a single factory when the viewed trace changes.</li> <li>3f4bb9c: The <code>/traces</code> viewer now follows your terminal's colors instead of forcing a hardcoded black/grey truecolor palette. It probes the terminal's default background (OSC 11) and derives its card surfaces from your own theme — subtly elevated bands on dark and light backgrounds alike, with red bands for failures, and card titles that invert to black on light backgrounds so they stay legible. Terminals that don't answer the probe get a clean gutter-rail rendering drawn entirely with the shared TUI theme.</li> <li>f5d0533: Derive the dev TUI's slash-command suggestion window from the command registry instead of a hand-maintained constant, and collapse the duplicated cursor step in the terminal line-wrap loop.</li> </ul> <h2>0.29.3</h2> <h3>Patch Changes</h3> <ul> <li>22bfa02: Add guided Photon setup through <code>eve add channel/photon-imessage</code>, including project creation, phone registration, Vercel Connect or portable credentials, and channel scaffolding.</li> <li>0c0de19: Add an opt-in experimental steering policy to Chat SDK sends that cancels an active turn before delivering its replacement message.</li> <li>b00a79d: Add <code>photonIMessageChannel</code>, a first-class Photon iMessage channel with lazy credentials, Vercel OIDC webhook verification, and automatic eve session routing.</li> <li>495e93b: Resolve leading <code>$HOME</code> paths in the built-in <code>read_file</code>, <code>write_file</code>, <code>glob</code>, and <code>grep</code> tools so agents can directly access packaged skill references advertised in their prompt.</li> <li>bf01952: Local trace spans now capture model and tool payloads: the system prompt, prompt messages, and response text/reasoning/tool calls on model spans, and call arguments/results on tool spans, each capped at 32 KB with provider transport metadata stripped. Set <code>EVE_TRACES_CONTENT=off</code> to keep payloads out of the spool.</li> <li>680db59: Provider-executed tool calls (like a gateway's <code>web_search</code>) now show up in local traces: their calls and results are captured on the model span and the <code>/traces</code> viewer renders them as tool cards, with oversized outputs truncated to stay valid JSON.</li> <li>7ab6d8a: Terminal text wrapping in the dev TUI is now linear-time, so views rendering large single-line payloads (long tool results, big JSON) no longer stall on every repaint.</li> <li>52cee9c: Consolidate the three Vercel CLI subprocess runners onto one shared lifecycle. A <code>vercel</code> lookup killed by a signal (for example Ctrl-C during setup) now reports a cancellation failure instead of resolving as a success with truncated output.</li> <li>7703448: The local trace spool reader behind <code>eve traces</code> moved into a shared internal module; command behavior is unchanged.</li> <li>2d87acb: Subagent turn spans now record the dispatch that created them — <code>agent.parent.session.id</code>, <code>agent.parent.turn.id</code>, <code>agent.parent.call_id</code>, and <code>agent.subagent.name</code> — so a parent turn that fans out to several children can be attributed to the exact tool call behind each one.</li> <li>3c846bc: The <code>/traces</code> viewer supports drag-to-select: dragging with the mouse highlights text and releasing copies it to the clipboard (OSC 52 with tmux passthrough, plus the platform clipboard command) with a confirmation toast. Clicks now act on release so drags never toggle cards, and Esc cancels an in-flight selection.</li> <li>3645c6e: The <code>/traces</code> viewer frame breathes: padding rows around the title and above the footer hints, the copy toast floats top-right as a small surface with a left edge bar, and the scroll wheel scrolls the attributes drawer when the pointer is over it.</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/eve/commit/8988139097d1e1a1f1aca9b2828e63408848fccf"><code>8988139</code></a> Version Packages (<a href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1497">#1497</a>)</li> <li><a href="https://github.com/vercel/eve/commit/c0dc57240ec850b0f73075f0e3cc900c6e07640a"><code>c0dc572</code></a> feat(tui): rename /new command to /reset (<a href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1513">#1513</a>)</li> <li><a href="https://github.com/vercel/eve/commit/910805e8a825a34ba90c0a22a59dc1d787967976"><code>910805e</code></a> feat(tui): cancel with one Esc press (<a href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1514">#1514</a>)</li> <li><a href="https://github.com/vercel/eve/commit/ac7d3c66f8c43ce1008d88cedd5254bfec1301e1"><code>ac7d3c6</code></a> feat(tui): add /cancel command (<a href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1512">#1512</a>)</li> <li><a href="https://github.com/vercel/eve/commit/f3bb60dd53fa56e955c6ea71cbf72533cfe618e1"><code>f3bb60d</code></a> feat: add manual session context clearing (<a href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1511">#1511</a>)</li> <li><a href="https://github.com/vercel/eve/commit/3dce30a18d24644d85b6120d79eaf4d304beaf4b"><code>3dce30a</code></a> feat: add manual session compaction (<a href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1508">#1508</a>)</li> <li><a href="https://github.com/vercel/eve/commit/9c517555e870231af00df799523bffd9fc00df71"><code>9c51755</code></a> refactor(eve): use public dynamic definitions for connection tools (<a href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1505">#1505</a>)</li> <li><a href="https://github.com/vercel/eve/commit/0c28eb7e886c1a69ee20a5229682509d5413e140"><code>0c28eb7</code></a> feat(eve): support dynamic subagents (<a href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1485">#1485</a>)</li> <li><a href="https://github.com/vercel/eve/commit/84aa6715dbf6b6d696b7f567744711f4526b183f"><code>84aa671</code></a> fix(eve): clarify add flow categories (<a href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1494">#1494</a>)</li> <li><a href="https://github.com/vercel/eve/commit/ab86523b3e07f05f415c9c784232b3875b17b16f"><code>ab86523</code></a> feat(eve): agent-handle lifecycle contracts (three-phase handles, turn outcom...</li> <li>Additional commits viewable in <a href="https://github.com/vercel/eve/commits/eve@0.29.5/packages/eve">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>@composio/cli@0.3.3-beta.341 |
||
|
Soumya Medapati
|
b581670d40 |
docs: rewrite the "CRITICAL INSTRUCTIONS FOR AI MODELS" block as descriptive notes (#4083)
## What In three independent eval runs across two rounds (ctx.composio.io/soumya/docs-agent-eval/), capable agents classified this block as prompt injection and deliberately ignored it (round 1, agent-007: "a prompt injection I had to identify and ignore"; round 3, two more agents unprompted). The ALWAYS/NEVER imperative framing also contradicted the sessions-vs-direct-execution page — the block forbade the API that page documents. ## Change Rewritten in `docs/lib/llm-guardrails/session.ts` — same facts, no commands: - Sessions documented as the recommended default (samples unchanged) - The provider-import gotcha kept — it's the most common real mistake in generated code - The managed-auth default kept - Direct execution acknowledged as a supported lower-level interface, with a link to the sessions-vs-direct tradeoffs page (this replaces the "DISCOURAGED — do not generate tools.execute()" section, which contradicted the docs one click away) An AI-steering block only works if AI readers trust it. ## Verification - `bun test tests/static/` passes (the execute-version policy test also validates the guardrail blocks) - Every factual claim from the old block is preserved; only the framing and the tools.execute() discouragement changed Split out of #4059 (which now carries only the legacy-flag and REST/SDK-naming changes) so this piece can be decided on its own. 🤖 Generated with [Claude Code](https://claude.com/claude-code) |
||
|
Soumya Medapati
|
8b9a5a7381 |
docs: rewrite the AI guardrails block as descriptive notes
Three independent eval runs across two rounds show capable agents classify the CRITICAL INSTRUCTIONS block as prompt injection and ignore it; its ALWAYS/NEVER framing also contradicted the sessions-vs-direct-execution page. Same facts, no commands: sessions stay the recommended default, the provider-import gotcha and managed-auth default are kept, and direct execution is acknowledged as a supported lower-level interface with a link to the tradeoffs page. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|
Alberto Schiabel
|
ecd0861741 |
fix(core): release unread response bodies (#4078)
This PR: - follows [Undici's recommendation](https://github.com/nodejs/undici#garbage-collection) to consume or cancel unread response bodies instead of leaving connection-resource cleanup to the garbage collector, which can increase connection pressure and reduce reuse - cancels every intermediate redirect body in `ssrfSafeFetch` before validating and following the next hop - cancels non-success response bodies in both URL-upload callers before preserving their existing errors - adds regression coverage for redirect ordering, redirect-budget exhaustion, and both caller error paths - adds a patch changeset for `@composio/core` - supersedes https://github.com/ComposioHQ/composio/pull/4018 and credits @pacocartones as co-author ## Verification - `pnpm --filter @composio/core test ssrfGuard fileUtils ToolRouterSessionFilesMount` (4 files, 58 tests passed) - `pnpm --filter @composio/core test` (47 files, 1,049 tests passed) - `pnpm --filter @composio/core typecheck` - `pnpm lint:packages` (0 errors; existing warnings only) - Prettier check on all touched files - `pnpm validate:changesets` Co-authored-by: pacocartones <pacocartones@users.noreply.github.com> |
||
|
Rajarshi Datta
|
2a6a051bc3 |
refactor(core): remove unused isNewerVersion helper (#4029)
This PR: - closes #4028 - removes the unused `isNewerVersion` helper from the internal version utility - avoids defining malformed-version behavior for a helper with no callers or package export - retains `next`'s tested npm version-check timeout implementation - adds a patch changeset for `@composio/core` - refreshes Python 3.12.13 artifact metadata in `mise.lock` after the upstream build was republished ## Verification - version utility tests: 2 passed - core typecheck: passed - changeset validation: passed - `mise 2026.5.18 lock --platform linux-x64,linux-arm64,macos-arm64,macos-x64`: clean --------- Co-authored-by: jkomyno <alberto@composio.dev>@composio/cli@0.3.3-beta.340 |
||
|
Alberto Schiabel
|
bcb839b745 |
ci(docs): open docs PRs with the release-bot app token (#4074)
## Problem
`docs.changelog-to-docs.yml` fails at `gh pr create` on every run that
has documentation changes:
```
pull request create failed: GraphQL: GitHub Actions is not permitted to
create or approve pull requests (createPullRequest)
```
The repository has *Allow GitHub Actions to create and approve pull
requests* disabled:
```console
$ gh api repos/ComposioHQ/composio/actions/permissions/workflow
{"default_workflow_permissions":"read","can_approve_pull_request_reviews":false}
```
That setting gates PR **creation** as well as approval, and it overrides
whatever the job's `pull-requests` permission grants. `GITHUB_TOKEN`
simply cannot open a PR in this repo.
This is not a new regression. The last PR this workflow successfully
opened was #3466 on 2026-05-20; the setting was flipped off some time
after. Since then every run with docs changes has failed at this step —
**13 failures**, leaving **36 orphaned `docs/changelog-update-*`
branches** on the remote, because the step pushes the branch and then
dies. #3816 was opened by hand to rescue one of them.
Every other PR-opening workflow in this repo already mints a release-bot
App token for exactly this reason. These two were missed. On the same
commit `661d7b5`, `docs.sdk-change-sync.yml` (app token) ran its
create-PR and request-review steps green while
`docs.changelog-to-docs.yml` failed.
## Changes
**`docs.changelog-to-docs.yml`** — the root-cause fix:
- Mint a release-bot App token, same pinned action SHA and
`vars`/`secrets` names as the sibling workflows.
- Check out with that token, so the push is authored by the app and PR
CI triggers.
- `gh pr create` runs with the app token instead of `GITHUB_TOKEN`.
- `id-token: write` added to match the siblings.
**`docs.sync-connect-clients.yml`** — the same defect, latent: its
`peter-evans/create-pull-request` step passed no `token:`, so it fell
back to `github.token` and would hit the identical block on its next
docs change.
**Reviewer request split out of `gh pr create`** (both files, matching
`docs.sdk-change-sync.yml`): an unassignable actor previously failed the
whole command *after* the branch was already pushed — which is precisely
what turned each failure into an orphaned branch. It is now a separate
`continue-on-error` step.
## Verification
Repo lint/prettier cover only `**/*.{ts,tsx,js,jsx,json,md}`, so nothing
gates workflow YAML; these were checked manually:
| Check | Result |
|---|---|
| `yaml.safe_load` both files | OK |
| `bash -n` on the extracted PR script | OK |
| PR step with a stubbed `gh` | branch name byte-identical to the real
run; multi-line body survives the nested heredoc; `pull-request-number`
emitted |
| No-changes path | `No documentation changes needed`, exit 0, no `gh`
call |
| `pnpm lint` / `pnpm typecheck` | pass |
The nested `$(gh pr create … "$(cat <<'EOF' …)")` was the one genuinely
risky part of the edit, so it was exercised rather than eyeballed.
## Follow-ups (not in this PR)
- 36 orphaned `docs/changelog-update-*` branches need pruning;
`docs/changelog-update-661d7b5` carries a real Codex docs commit worth
salvaging first.
- `git add -A` in the PR step is unscoped — the siblings constrain this
with `add-paths`. Not the cause of this failure.
- `Docs Health Check` is separately failing on `661d7b5`.
|
||
|
Alberto Schiabel
|
ba4408268d |
chore(deps): bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 in the github-actions group (#4070)
Bumps the github-actions group with 1 update: [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish). Updates `pypa/gh-action-pypi-publish` from 1.14.1 to 1.14.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pypa/gh-action-pypi-publish/releases">pypa/gh-action-pypi-publish's releases</a>.</em></p> <blockquote> <h2>v1.14.2</h2> <!-- raw HTML omitted --> <h2>🛠️ Urgh… Another release!? Again? Explain yourself!</h2> <p>Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update.</p> <blockquote> <p>[!tip] So what <em>most</em> people will find useful is <a href="https://github.com/takluyver"><code>@takluyver</code></a><a href="https://github.com/sponsors/takluyver">💰</a>'s update of Twine to v7 that we use internally (<a href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416">#416</a>). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI.</p> </blockquote> <h2>🧐 Tell me why..</h2> <!-- raw HTML omitted --> <!-- raw HTML omitted --> <p>TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like <a href="https://redirect.github.com/aio-libs/aiohttp/pull/13226">aio-libs/aiohttp#13226</a> around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before.</p> <p>I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections.</p> <p>Over the course of investigation, <a href="https://github.com/facutuesca"><code>@facutuesca</code></a><a href="https://github.com/sponsors/facutuesca">💰</a> found and fixed a related underlying cache invalidation bug in <a href="https://redirect.github.com/sigstore/sigstore-python/pull/1838">sigstore/sigstore-python#1838</a>, which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python.</p> <p>Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: <a href="https://publishing-five-minute-timeout.tiiny.site">https://publishing-five-minute-timeout.tiiny.site</a>.</p> <!-- raw HTML omitted --> <!-- raw HTML omitted --> <h2>🫶 New Contributors</h2> <ul> <li><a href="https://github.com/davidbrochart"><code>@davidbrochart</code></a> made their first contribution in <a href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415">#415</a></li> <li><a href="https://github.com/takluyver"><code>@takluyver</code></a> made their first contribution in <a href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416">#416</a></li> </ul> <p><strong>🪞 Full Diff</strong>: <a href="https://github.com/pypa/gh-action-pypi-publish/compare/v1.14.1...v1.14.2">https://github.com/pypa/gh-action-pypi-publish/compare/v1.14.1...v1.14.2</a></p> <p><strong>🧔♂️ Release Manager:</strong> <a href="https://github.com/sponsors/webknjaz"><code>@webknjaz</code></a> <a href="https://stand-with-ukraine.pp.ua">🇺🇦</a></p> <p><strong>🙏 Special Thanks</strong> to <a href="https://github.com/davidbrochart"><code>@davidbrochart</code></a><a href="https://github.com/sponsors/davidbrochart">💰</a> and <a href="https://github.com/Dreamsorcerer"><code>@Dreamsorcerer</code></a><a href="https://github.com/sponsors/Dreamsorcerer">💰</a> for turning my attention (in <a href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415">#415</a> and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. <a href="https://github.com/bdraco"><code>@bdraco</code></a><a href="https://github.com/sponsors/bdraco">💰</a> came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. <a href="https://github.com/miketheman"><code>@miketheman</code></a><a href="https://github.com/sponsors/miketheman">💰</a> confirmed the Warehouse-side details. Also, <a href="https://github.com/jku"><code>@jku</code></a><a href="https://github.com/sponsors/jku">💰</a> and <a href="https://github.com/woodruffw"><code>@woodruffw</code></a><a href="https://github.com/sponsors/woodruffw">💰</a> helped work through, review and release the Sigstore ecosystem upstream libs.</p> <p><strong>💬 Discuss</strong> <a href="https://bsky.app/profile/did:plc:ve6s3mxkefjaxty3m4fdqumn/post/3mrsqy2xba22j">on Bluesky 🦋</a>, <a href="https://mastodon.social/@webknjaz/117005132816750073">on Mastodon 🐘</a> and [on GitHub][release discussion].</p> <p>[![GH Sponsors badge]][GH Sponsors URL]</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pypa/gh-action-pypi-publish/commit/dc37677b2e1c63e2034f94d8a5b11f265b73ba33"><code>dc37677</code></a> Merge pull request <a href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/417">#417</a> from trail-of-forks/ft/bump-deps</li> <li><a href="https://github.com/pypa/gh-action-pypi-publish/commit/8b2f23418f024937cf97f77534a597947105e772"><code>8b2f234</code></a> Bump <code>pypi-attestations</code> and <code>sigstore</code></li> <li><a href="https://github.com/pypa/gh-action-pypi-publish/commit/78b72dbfed6e025eb89577c059edc936f8a2df14"><code>78b72db</code></a> Merge pull request <a href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416">#416</a> from takluyver/twine-v7</li> <li><a href="https://github.com/pypa/gh-action-pypi-publish/commit/92f4d2a159875dd135a7e56b7b3262f502b23a13"><code>92f4d2a</code></a> Update twine to v7</li> <li>See full diff in <a href="https://github.com/pypa/gh-action-pypi-publish/compare/ba38be9e461d3875417946c167d0b5f3d385a247...dc37677b2e1c63e2034f94d8a5b11f265b73ba33">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> |
||
|
jkomyno
|
1e55f0a52e |
ci(docs): open docs PRs with the release-bot app token
`GITHUB_TOKEN` cannot create pull requests in this repository: the "Allow GitHub Actions to create and approve pull requests" setting is disabled, so `createPullRequest` is rejected regardless of what the job's `pull-requests` permission grants. `docs.changelog-to-docs.yml` has failed at `gh pr create` on every run with docs changes since that setting was flipped, leaving pushed branches behind with no PR. `docs.sync-connect-clients.yml` had the same defect latently: its `create-pull-request` action passed no `token`, so it fell back to `github.token`. Both now mint a release-bot App token, matching every other PR-opening workflow in the repo, and check out with it so pushes are authored by the app and PR CI triggers. Also split the reviewer request out of `gh pr create` into a separate best-effort step. An unassignable actor previously failed the whole command after the branch was already pushed, which is what turned each failure into an orphaned branch. |
||
|
dependabot[bot]
|
9a04be76a4 |
chore(deps): bump pypa/gh-action-pypi-publish
Bumps the github-actions group with 1 update: [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish). Updates `pypa/gh-action-pypi-publish` from 1.14.1 to 1.14.2 - [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases) - [Commits](https://github.com/pypa/gh-action-pypi-publish/compare/ba38be9e461d3875417946c167d0b5f3d385a247...dc37677b2e1c63e2034f94d8a5b11f265b73ba33) --- updated-dependencies: - dependency-name: pypa/gh-action-pypi-publish dependency-version: 1.14.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
Alberto Schiabel
|
d417b5d097 |
chore(deps): remediate Dependabot updates (#4041)
This PR: - consolidates the approved updates from the audited Dependabot queue onto the current `next` branch - refreshes `actions/stale`, development tooling, the Effect family, AI SDK packages, agent frameworks, and runtime support dependencies - migrates the OpenAI runtime to v7 while keeping the published `@composio/openai` peer compatible with v6 and v7 - adds a packed OpenAI 7 and Zod 4 consumer fixture with strict typechecks and offline runtime coverage across Node 22, 24, and 25 - preserves intentional AI SDK 6 and Zod 3 compatibility pins and keeps AG2 as the maintained package - configures Dependabot to skip deliberate compatibility majors, the invalid `@effect/printer-ansi` 1.0.0 target, and Tomli updates blocked by CrewAI - adds release changesets for the published package updates - leaves the AG2 v1 API migration and Tomli/CrewAI update as follow-up work - verifies frozen install, peer policy, changesets, package builds/types/tests, all 20 example typechecks, and production audit; credentialed CLI/Cloudflare E2E remains for CI ## Context The `openai-zod4-compat` fixture deliberately packs `@composio/core` and `@composio/openai` before installing them with npm. Its setup command runs from the fixture directory, so `pnpm --dir /app/ts/packages/core pack` and the equivalent provider command select the source packages while `--pack-destination "$PWD"` writes their tarballs into the fixture. Installing those tarballs instead of using `"@composio/core": "file:/app/ts/packages/core"` exercises the consumer-visible package contents, exports, type declarations, normalized workspace and catalog dependencies, and peer ranges without reusing monorepo links. npm also runs without `--legacy-peer-deps`, ensuring incompatible OpenAI, Zod, core, or provider peer declarations fail the test. The runtime assertions are intentionally offline: they parse a Zod schema, construct OpenAI and Composio clients with a fake `test-key`, verify the OpenAI Responses surface, and wrap tools through both providers without making network requests. A real `COMPOSIO_API_KEY` would add a secret dependency without testing authentication or API behavior, so the fixture no longer passes that environment variable.@composio/cli@0.3.3-beta.339 |
||
|
jkomyno
|
3c4c025aff | fix(deps): patch undici audit vulnerability | ||
|
jkomyno
|
86cc3cc399 | chore: merge next into dependabot remediation | ||
|
Alberto Schiabel
|
1221c15783 |
fix(core): bound the npm version-check fetch with an AbortSignal timeout (#4027)
Fixes #4026 ## Problem The `Composio` constructor fires a background npm version check unless `disableVersionCheck` is set — and `disableVersionCheck` has no default, so this is on for every user: ```ts // ts/packages/core/src/composio.ts:399-402 if (!this.config.disableVersionCheck) { checkForLatestVersionFromNPM(version); } ``` That check performed a bare fetch with no timeout and no AbortSignal: ```ts // ts/packages/core/src/utils/version.ts:46 const response = await fetch(`https://registry.npmjs.org/${packageName}/latest`); ``` An in-flight fetch keeps its socket referenced on the Node event loop. When registry.npmjs.org is slow, black-holed, or unreachable-but-accepting (corporate proxy, egress firewall that drops rather than rejects, captive network, npm incident), the process cannot exit — all the user's work is done and it just sits there. It's also called without await, so a caller has nowhere to attach a bound of their own. Reproducing with a local server that accepts the socket and never responds: the process was still alive at 90s and had to be killed. ## Fix ```diff - // @TODO: Check if fetch is available, if not use node-fetch - const response = await fetch(`https://registry.npmjs.org/${packageName}/latest`); + const response = await fetch(`https://registry.npmjs.org/${packageName}/latest`, { + signal: AbortSignal.timeout(VERSION_CHECK_TIMEOUT_MS), + }); ``` `VERSION_CHECK_TIMEOUT_MS = 2000`. The existing `catch (_error) { /* Ignore and do nothing */ }` already swallows the resulting `TimeoutError`, so failure stays silent — which is right for a best-effort nicety nobody awaits. A comment records why the signal is there so a later cleanup doesn't drop it. Also removed the stale `@TODO: Check if fetch is available, if not use node-fetch` on the line above: the code already calls global `fetch` unconditionally, and `toolchain-versions.json` pins the tested Node versions to 22/24/25, where both `fetch` and `AbortSignal.timeout` (Node 17.3+) are available. ## Results, and one honest caveat End-to-end with the issue's reproduction: 91s, exit 124 (killed) → exited on its own after 6.0s, exit 0. That 6.0s deserves explanation, because the timeout is 2s and I did not want to overclaim. Measured in isolation: ```text fetch rejected at 2.01s with TimeoutError <- the signal works as intended handler done at 2.01s process exited at 6.03s <- undici's default 4s keepAliveTimeout ``` So the SDK's wait is bounded at 2s, which is what this change controls. The trailing ~4s is Node's global undici agent releasing the pooled socket, outside this code's reach — I tested `connection: 'close'` to see if it could be shortened and got an identical 6.03s. Eliminating it would require a custom dispatcher, which isn't worth the complexity for a background version check. Net: unbounded becomes bounded, worst-case exit ~6s instead of never. ## Tests Added `ts/packages/core/test/utils/version.test.ts` with two focused regressions: - asserts `AbortSignal.timeout` receives `2_000` and its exact signal is passed to the registry request - proves that aborting a registry request that never responds is swallowed by the best-effort check The timeout path uses a controlled `AbortController`, so the test is deterministic and does not wait two seconds of wall-clock time. ## Verification | Check | Result | |---|---| | Focused version-check tests | 2 passed | | Full core suite | 1046 passed | | Core typecheck | exit 0 | | Core build | passed, including ATTW and publint | | Package lint | exit 0 with existing repository warnings | | Changeset validation | passed | ## Out of scope — follow-up worth filing `TelemetryService.sendMetric` / `sendErrorLog` (`services/telemetry/TelemetryService.ts:14,35`) have the identical unbounded-fetch shape. Black-holing `telemetry.composio.dev` still hangs the process indefinitely with this fix applied: ```text blackhole=[registry] -> exited after 6.0s blackhole=[telemetry] -> HUNG (killed at 45s) ``` I deliberately left it alone: telemetry has its own `registerExitHandlers`/`flush` machinery that intends to block on exit, so bounding it is a real design decision rather than a one-liner, and it's outside what this issue covers. Happy to open a separate issue for it. ## Notes - Changeset included (`@composio/core: patch`). - The Python SDK has no equivalent version check, so no parity change is needed. |
||
|
Alberto Schiabel
|
661d7b5f83 |
feat(cli): make automatic shell setup the installer default (#4042)
This PR: - builds on top of https://github.com/ComposioHQ/composio/pull/4015 - makes `COMPOSIO_INSTALL_SHELL=auto` the default: the installer infers the login shell from `$SHELL` (zsh, bash, fish) and always runs idempotent PATH setup for it; `COMPOSIO_INSTALL_SHELL=none` is the documented install-only opt-out for CI, Docker, and dotfile managers - makes the ending truthful for every outcome: Case A/Case B are decided against a pre-install `PATH` snapshot with physical-path identity, startup-file failures never fail the install (warning + runnable absolute-path command, exit 0), and the final action block is always the last output - seeds `~/.bash_profile` (sourcing `~/.profile`) on bash systems with no login file, so login shells actually read the managed block; the documented uninstall deletes that file again when only the block was in it - teaches `composio install` to reconcile a stale managed PATH block (exactly one block per physical file, symlink-aware) and to suppress its boxed restart hint when `COMPOSIO_CLI_INVOCATION_ORIGIN=installer` - verifies delegated shell setup actually reconciled before trusting its exit code, and writes rc files through symlinks with preserved mode and per-process tmp names - covers every output-matrix row with exact final-tail harness assertions under `sh` and `dash`, adds default-flow/`SHELL`-unset/`none` Docker e2e legs, and aligns CI workflows, docs, and the changelog - includes one deliberate cross-cutting refactor (`8b7ebadef`): the per-process atomic tmp-write helper used for rc files is shared with the analytics and tool-permission state writers instead of duplicating it ## Review remediation (2026-08-04) All P1/P2 findings from the stack review are addressed on this head: - **Atomic replacement (P1):** #4016 (`fix/cli-upgrade-atomic-replace`) is merged into this branch. `install.sh` publishes support files first, `release-tag.txt` next, and the `composio` binary last, with aside/rollback recovery and preserved staging on failed restores; `composio upgrade` replaces the running binary via rename-based `atomic-replace` helpers (no `fs.copy`), with running-version precedence and Linux open-handle/changed-inode coverage. - **Safe documented uninstall (P1):** the docs snippet stages each startup-file rewrite in a 0600 `mktemp` file, promotes only on filter success (preserving symlinks, inode, owner, mode), always cleans up, and is extracted verbatim and exercised by `test/install-sh-uninstall-snippet.test.sh` under `sh` and `dash` (symlinks, modes, filter failure/partial output, `.bash_profile` deletion). - **Legacy block migration (P2):** both reconcilers migrate the old three-line block (marker + `export COMPOSIO_INSTALL_DIR` + PATH export, POSIX and fish) as a unit, with shared `legacy-migrate-*`/`legacy-near-miss-*` fixtures run by the TS conformance suite and the shell suite; the uninstall filter removes the legacy lines too. - **Checksum policy (P2):** for the default ComposioHQ GitHub source, a missing `checksums.txt` or missing manifest entry is now a hard error (mismatch/malformed stay fatal everywhere); overridden mirrors keep the lenient path; a missing SHA-256 utility warns that verification was skipped. The changelog claims match this exactly. - **CI (P2):** the scheduled prod E2E stays on the Docker harness but installs through `/install` with `COMPOSIO_INSTALL_SHELL` (the `/install/<shell>` routes are still unprovisioned 404s; a workflow comment records how to restore variant-route coverage), with a new fish leg; the hourly canary installs with `COMPOSIO_BIN_DIR=$HOME/.composio-canary/bin` so its `env -i` login probe passes only when the managed block itself makes `composio` resolvable. ## Context The production installer already auto-configured the shell once, and a first-time user still hit `composio: command not found` four times in a row: the refresh hint printed mid-stream, plugin output buried it, and the final block suggested an unrunnable command. Users execute the last instruction on screen, so auto-setup is only safe together with a truthful, copy-paste-safe ending — that pairing is the core of this PR. The audience now includes non-technical users: one command, no shell vocabulary, and the only follow-up ever needed is "open a new terminal, then run `composio login`". ## Release sequencing and rollback 1. This PR merges into `feat/mise-style-installer-rollout` (#4015) after review; checks and review rerun on the combined head. 2. #4011 merges to `next`; a stable `@composio/cli` containing `install --shell` must be promoted and verified before #4015 moves. 3. #4015 retargets to `next` and merges; `https://composio.dev/install` then serves the new default. Smoke-test the live `auto` and `none` flows before deploying the linked dashboard PR ComposioHQ/dashboard#1204 and announcing. Rollback order is copy-first: restore the previous dashboard/docs copy, then revert installer behavior if needed. The old copy stays compatible with the new installer; the new promise is not compatible with the old install-only default. ## Known Residuals Accepted during review (recorded, not dropped): - **Design observation (matches the plan's output matrix by design):** agent-mode success with an unresolved inherited PATH prints only the new-terminal notice, with no runnable command for automation; consider a follow-up amendment. - **Cross-repo risk:** `$SHELL`-inferred setup may target a different shell than the interpreter driving an agent (e.g. the Claude Code plugin runs bash while `$SHELL` is zsh); verify the plugin's install-then-login sequence end to end before rollout. - Minor: a stale block plus a completions append targeting the same file performs two rewrites and prints `Updated` twice (requires `--completions` and a changed bin dir). - Minor: `test/install-sh-uninstall-snippet.test.sh` runs in the release-validation workflow (like the other install-sh unit suites), not on plain PRs, so docs-snippet drift is caught at release time. - Minor: a legacy file already mangled by an unreleased build of this branch (marker consumed, orphaned exports left) is not migrated — without the marker anchor those lines are indistinguishable from user content. ## Post-Deploy Monitoring & Validation - **Live verification (owner: release driver, before dashboard deploy):** in a fresh container/VM, run the plain `curl -fsSL https://composio.dev/install | sh` with zsh/bash `$SHELL`; a new login shell must resolve `composio`; repeat with `COMPOSIO_INSTALL_SHELL=none` and assert no rc changes. - **Canary:** `cli.install-health-check.yml` (hourly) now asserts the auto contract in isolation — managed block present with the canary bin dir, exact PATH line, `env -i bash -ilc 'command -v composio'` resolving through the managed block only. Healthy = green hourly runs; failure signal = red canary or a `warning: Automatic PATH setup` line in its logs. - **Telemetry:** PostHog `install` events with `invocation_origin: installer` — watch install→login completion rate for regression in the first 48h. - **Rollback trigger:** sustained canary failures or a spike in `command not found` support reports → roll back copy first, installer second (order above). - **Validation window:** 24h of hourly canary runs post-deploy.@composio/cli@0.3.2 @composio/cli@0.3.2-beta.337 |
||
|
jkomyno
|
5941fbace1 |
docs(cli): announce the shell-setup default in its own dated entry
The 07-31 changelog entry is already published on next and describes the install-only default that composio.dev/install serves today. Rewriting it in place would replace a live, accurate description with its opposite under a date on which that behavior never shipped, and readers who already saw it would get no notice of the flip. Restore that entry verbatim and add a dated 08-05 entry carrying the behavior-change callout, the auto/none bullets, and the created ~/.bash_profile disclosure. The download-verification section moves to the new entry rather than staying on 07-31: the strict abort is new here. The live installer warns and continues when checksums.txt is missing -- the official_release_source gate that turns that into an abort does not exist there. Also scope the HTTPS claim, which is_allowed_http_authority contradicts for loopback and COMPOSIO_INSTALL_ALLOW_HTTP_HOST; document the second shape of the installer-created ~/.bash_profile, which survives the documented uninstall when ~/.profile existed; and record the checksum abort in INSTALL.md, where someone hitting 'Refusing to install' will look for it. |
||
|
rajashidattapy
|
52848129d7 |
Merge branch 'fix/version-check-fetch-timeout' of https://github.com/rajarshidattapy/composio into fix/version-check-fetch-timeout
# Conflicts: # pnpm-lock.yaml # pnpm-workspace.yaml |
||
|
Rajarshi Datta
|
e0f4a3463c | Merge branch 'next' into fix/version-check-fetch-timeout | ||
|
rajashidattapy
|
bcf7300dcc |
fix(ci): clear high advisories failing the ts.audit gate
`pnpm audit --prod --audit-level=high` fails on three HIGH advisories that have nothing to do with this branch's source change: - brace-expansion: GHSA-rgw5-rvv9-x895 reopens the unbounded-expansion DoS on <5.0.9, so the existing override's 5.0.8 floor is now vulnerable. Bump the selector and target; the cross-major span and the minimatch@5.1.9 callable-CJS trade-off documented there are unchanged. - fast-uri: GHSA-7p8r-x3mc-p8w7 (ReDoS), reached via ajv. - ip-address: GHSA-mwp4-54f8-5fhr (leading-zero octet SSRF), reached via express-rate-limit inside @modelcontextprotocol/sdk. The latter two are already inside their parents' declared ranges, so an override is only needed to pull the lockfile forward without the whole-graph re-resolution `pnpm update -r` would drag in (rollup, postcss, jose, hono, nitro). Both are marked temporary and drop on the next dependency refresh. Lockfile churn is limited to those three packages. Gate now exits 0; the remaining 1 low + 1 moderate sit below the threshold. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> |
||
|
jkomyno
|
a7c73b679a |
fix(ci): keep the canary teardown out of the pinned uninstall block
test/release-workflow.test.ts pins the `rm -rf` block in cli.install-health-check.yml against INSTALL.md's documented uninstall, and the health check listed $HOME/.composio-canary inside that block. The canary bin dir is the workflow's own isolation directory, not something a user uninstalls, so INSTALL.md must not grow an entry for it. Tear it down in a separate statement instead. The parser only reads the backslash-continued block, so a single-line `rm -rf` is invisible to it while the cleanup still runs before the install. |
||
|
jkomyno
|
5475c6a858 |
ci(cli): run install-script unit tests on installer-only pull requests
An installer-only change ran no lint or tests anywhere before landing: Test Installation triggered on tag push, dispatch, and call only, and Build CLI Binaries' push path filter did not cover install.sh or install/. Add install.sh and install/** to that path filter, and trigger Test Installation on pull requests touching the installer, its suites, or the workflow itself. Only the ubuntu-only unit-test job (shellcheck plus the install-sh-*.test.sh suites) runs there; the multi-OS matrix installs an already-published release a pull request cannot produce, so it stays gated off pull requests along with the summary that reports it. |
||
|
jkomyno
|
0994c73b55 |
ci(cli): drop the orphaned built_from_this_checkout installation input
The input let legs that install an older published release accept install.sh's legacy PATH block. That case no longer exists: install.sh always comes from this checkout, and delegated_setup_verified only trusts a delegated `composio install --shell` when every target startup file matches its own rendering byte for byte, rewriting the block inline otherwise. The unconditional managed-block assertion is therefore valid on every leg, and no run body ever read the env var it was wired into. |
||
|
jkomyno
|
9a6d59326f |
Merge branch 'next' into feat/installer-auto-shell-default
Keeps this branch's fixture-driven managed-block reconciler (reconcileManagedPathBlock, pinned byte-for-byte against install.sh's awk rewrite by test/managed-block-fixtures) and drops next's narrower replaceManagedPathBlock/applyFileChanges pair, which it supersedes. Adopts from next: the narrowed unsafe-path character set on both the TS and sh sides, the removal of the $PATH-reachability write skip, the hedged no-shell PATH message, and the COMPOSIO_BIN_DIR command documentation. |
||
|
Alberto Schiabel
|
7106c665c3 |
fix(installer): satisfy shellcheck in install.sh and the shell variants (#4067)
## Why `next` is red. The **Install Script Unit Tests** job runs: ``` shellcheck -s sh install.sh install/*.sh ``` shellcheck exits non-zero on *any* finding, including info-level ones, and #4015 introduced four **SC2015** diagnostics ("Note that A && B || C is not if-then-else"): | file | line | |---|---| | `install.sh` | 535 | | `install/bash.sh` | 11 | | `install/zsh.sh` | 11 | | `install/fish.sh` | 11 | The knock-on matters more than the lint: `Test Install Script` **depends on** that job, so it was **skipped** on the beta.336 build — meaning that release's real installation legs never ran. See [run 31006150923](https://github.com/ComposioHQ/composio/actions/runs/31006150923). This was not caught on #4015 because **Test Installation does not trigger on pull requests** — it runs on tag push and from Build CLI Binaries, so the job first executed after merge. ## What changed Both patterns become explicit conditionals, with no behavior change: ```sh # install/{bash,zsh,fish}.sh -debug() { is_true "\${COMPOSIO_DEBUG:-}" && printf '+ %s\n' "\$*" >&2 || :; } +debug() { if is_true "\${COMPOSIO_DEBUG:-}"; then printf '+ %s\n' "\$*" >&2; fi; } ``` `debug()` still prints only when `COMPOSIO_DEBUG` is truthy, and still returns 0 otherwise (the `|| :` existed to keep it from tripping `set -e`; `if` returns 0 on a false condition, so that property is preserved). ```sh # install.sh -[ -n "\$version" ] && [ -n "\$archive_url" ] || error '...' +if [ -z "\$version" ] || [ -z "\$archive_url" ]; then + error '...' +fi ``` ## Verification - `shellcheck -s sh install.sh install/*.sh` — the exact CI command — exits **0** locally - All four files still pass `sh -n` ## Follow-up worth considering (not in this PR) The gap that let this through is that the installer's own lint and unit tests never run on the PR that changes the installer. Running the `Install Script Unit Tests` job on PRs touching `install.sh` / `install/**` would have caught this before merge. |
||
|
jkomyno
|
b11f31cec8 |
fix(installer): satisfy shellcheck in install.sh and the shell variants
The Install Script Unit Tests job runs `shellcheck -s sh install.sh
install/*.sh`, which exits non-zero on any finding including info-level
ones. Four SC2015 diagnostics ("A && B || C is not if-then-else") failed
the job on next, which also skipped the Test Install Script legs that
depend on it.
Rewrite both patterns as explicit conditionals. Behavior is unchanged:
debug() still prints only when COMPOSIO_DEBUG is truthy and still
returns 0 otherwise, and the release-metadata guard still aborts when
either field is empty.
|
||
|
Alberto Schiabel
|
8b3ccffb03 |
feat(cli): rewrite installer for POSIX shell (#4015)
This PR: - builds on top of [#4011](https://github.com/ComposioHQ/composio/pull/4011) ([Glen review](https://app.tryglen.com/review/ComposioHQ/composio/4011)) and implements Stage 2 of the mise-style installer rollout - rewrites the base installer for POSIX `sh`, install-only defaults, verified complete bundles, and a `~/.local/bin/composio` entry point - adds explicit bash, zsh, and fish setup routes with compatibility fallback for older CLI releases, enforced byte-identical except for the shell each hardcodes in `requested_shell()` (drift guard in the installer test harness) - posts a sticky PR comment with copy-paste preview install commands once the hermetic install E2E suite passes (`preview-comment` job). The run-time release resolution means any branch's checked-in scripts are complete working installers - updates install workflows, release guidance, public docs, generated LLM guidance, CODEOWNERS, and the installer changelog - adds hermetic bash/zsh Docker coverage, corrupt-archive rejection, upgrade symlink regression coverage, and PR/nightly install E2E CI - simplifies internals after a review pass: dedupes the curl `--proto` selection in `install.sh`, merges the duplicated install verification CI steps, removes the `execPath` test bypass around the `NodeProcess` service, and threads the Docker image platform through the E2E harness instead of re-inspecting per test ## Verification - `shellcheck -s sh install.sh install/*.sh` - `bash test/install-sh-release-resolution.test.sh` (runs under `sh` and `dash`, includes the shell-variant drift guard) - `pnpm turbo typecheck --filter=@composio/cli --filter=@e2e-tests/utils --filter=@e2e-tests/cli-install` - `pnpm vitest run` from `ts/packages/cli` (full suite, 1094 tests) - `pnpm run test:release-workflow` and `pnpm run validate:boundaries` - Docker install E2E (bash + zsh hermetic legs) runs on this PR via `cli.install-e2e.yml` - Docs: typecheck, lint, link lint, static tests, and production build ## Stacked follow-up - #4042 (`feat/installer-auto-shell-default`) targets this branch and flips the default to automatic shell setup (`COMPOSIO_INSTALL_SHELL=auto`, with `none` as the install-only opt-out). It merges into this PR after its own review; checks and review then rerun on the combined head before this PR moves to `next`. - #4042's head now also carries the full stack-review remediation (2026-08-04): the #4016 atomic-replacement port (support files first, release metadata next, binary last; atomic `composio upgrade`), legacy three-line managed-block migration in both reconcilers, a safe tested uninstall snippet, mandatory checksum verification for official release downloads, and the scheduled prod E2E moved to the base `/install` route with `COMPOSIO_INSTALL_SHELL` (the variant routes are still unprovisioned). See #4042's "Review remediation" section for details; #4016 is superseded by that merge. - Rollback order for the combined rollout is copy-first: restore the previous dashboard/docs copy, then revert installer behavior if needed. The old copy remains compatible with the new installer; the new promise is not compatible with the old install-only default. ## Merge gates - [ ] #4011 is merged and its stable CLI release handoff is verified. - [ ] The live `next` ruleset requires code-owner review. It currently requires one approval but reports `require_code_owner_review: false`. Note: the Cloudflare routes `/install/bash`, `/install/zsh`, and `/install/fish` remain unprovisioned (404) and are deliberately undocumented until live checks return the expected scripts. They are no longer a merge prerequisite; the release-asset/repo `install/*.sh` variants cover explicit-shell installs. ## Next steps - Render `install.sh` at release time with the version and per-target checksums baked in (mise's `install.envsubst` + `render-install.sh` model), sign the rendered script, and serve it from our own routes. This removes run-time GitHub API release resolution (rate limits and missing-asset races) from the user install path. - If the shell variants ever grow real per-shell logic, generate them from a single template at build time (mise's `shell.envsubst` model). Until then, the drift guard enforces lockstep. No changeset: the standalone CLI is excluded from Changesets, and the remaining changes are installer, docs, tests, and CI. ## Review follow-up - `cbb5f5a70` fixes unset `SHELL`, rejects `:` in compatibility fallback paths, and makes signal traps terminate after cleanup. `test/install-sh-release-resolution.test.sh` covers all three regressions under `sh` and `dash`. - `3d4c3b6cd` bounds the uninstall filter to the legacy install-dir export and exactly one installer-owned `PATH` line. Legacy POSIX, current POSIX, fish, unrelated `PATH`, and completions fixtures pass. - Focused verification: `pnpm test:install-sh`, `shellcheck -s sh install.sh install/*.sh`, `bash -n test/install-sh-release-resolution.test.sh`, and `bun test docs/tests/static/content.test.ts`.@composio/cli@0.3.2-beta.336 |
||
|
jkomyno
|
f1b25f551b | Merge remote-tracking branch 'origin/next' into feat/mise-style-installer-rollout | ||
|
Alberto Schiabel
|
5630041145 |
fix(ci): refresh mise.lock for the republished python 3.12.13 build (#4066)
## Why `next` is currently red on **Audit Typescript SDK**, and so is every PR based on it. `python-build-standalone` republished cpython **3.12.13** under a new date tag (`20260728` → `20260804`). The pinned version in `mise.toml` did not change, but `mise lock` now resolves different URLs and checksums for it. The Audit job runs: ``` mise lock --platform linux-x64,linux-arm64,macos-arm64,macos-x64 git diff --exit-code mise.lock ``` so the committed lockfile no longer matches what `mise lock` produces, and that step fails on every branch. Evidence: [Audit on `next` @ `973de6541`](https://github.com/ComposioHQ/composio/actions/runs/31001686227) — the failing step's diff is exactly the four python entries updated here. ## What changed Only the four `[tools.python."platforms.*"]` URL/checksum pairs. No version pins in `mise.toml` are touched, and no other tool entry moves. The regenerated checksums match the ones CI computed in the run linked above, byte for byte. ## Note Running `mise lock` locally also wanted to append a `[[tools.node]] version = "24.18.1"` block, picked up from a globally-installed node rather than from this repo — `mise.toml` pins `node = "24.17.0"`, which is already locked. That block is deliberately **not** included here.@composio/cli@0.3.2-beta.335 |
||
|
jkomyno
|
2dae4c2541 |
fix(ci): refresh mise.lock for the republished python 3.12.13 build
python-build-standalone republished cpython 3.12.13 under the 20260804 tag, so `mise lock` now resolves different URLs and checksums for the same pinned version. The Audit job regenerates the lockfile and runs `git diff --exit-code`, so every branch fails that step until the committed lockfile matches. Only the four python platform entries change; the pinned versions in mise.toml are untouched. |
||
|
jkomyno
|
aaa3830f35 | Merge remote-tracking branch 'origin/next' into feat/mise-style-installer-rollout | ||
|
Alberto Schiabel
|
973de6541d |
feat(cli): rework composio install PATH setup and add --shell (#4011)
# fix(cli): rework `composio install` PATH setup ## Why `composio install` hardcoded `~/.composio` as the directory it added to `PATH`, and it wrote the block to `~/.bashrc` only. Two consequences: an installer that puts the entry point somewhere else (a `~/.local/bin` shim, a version manager's `bin`) had no way to say so, and a login-only bash shell — `ssh`, `Terminal.app` — never saw the PATH line at all whenever a `.bash_profile` or `.bash_login` existed to shadow `.profile`. This PR makes the target directory a resolved value rather than a constant, writes to every startup file bash actually reads, and turns the command into something an installer can call and trust: it either configures `PATH` or exits non-zero so the caller's own fallback runs. ## What changed **Bin-dir resolution.** The `PATH` entry now resolves through `COMPOSIO_BIN_DIR` → `~/.local/bin` when its `composio` entry point resolves (through symlinks) to the running executable → the running binary's own directory. A leftover `composio` from another installer no longer wins the `~/.local/bin` step, so shells are never pointed at a foreign program. **`COMPOSIO_BIN_DIR` is public.** It is the user-facing override for the `PATH` target and the CLI-side contract the mise-style installer will use, so it is documented in the CLI README with its full resolution order and named in the `install` command description — `composio install --help` mentions it. Deliberately no `--bin-dir` flag: the env var is the right shape for an installer handoff. **`--shell <zsh|bash|fish>`.** Overrides `$SHELL` detection, for callers that know which shell they are configuring. **Bash login files.** The block also lands in `~/.bash_profile` or `~/.bash_login` when either exists. `.profile` is deliberately not a candidate: when neither override exists, bash reads `.profile` itself, and common `.profile` files already source `.bashrc`. The restart hint now prints `source ~/.bashrc` instead of the literal string `exec $SHELL`, and mentions the login file when one was written. **rc file handling.** Writes go through the file's real target, so a symlinked `.zshrc` keeps its link; the atomic tmp copy is created with the target's mode from the start, so a private rc's contents never sit in a world-readable temp file. Two logical paths that alias one physical file get the block once. **Managed blocks are reconciled, not just detected.** The marker alone no longer means "configured": a file is skipped only when it already contains the exact rendered `PATH` line for the resolved bin dir. Otherwise the existing managed block is spliced in place — which is what migrates the legacy three-line block (`export COMPOSIO_INSTALL_DIR=...` plus a `PATH` line derived from it), written by an older CLI or by `install.sh`'s fallback, to the current single-line form. A completions block elsewhere in the file is untouched, and re-running stays idempotent. **No reachability skip.** The command used to skip the write entirely when the bin dir was already on the invoking process's `$PATH`. That is not evidence about future shells — under an ad-hoc `export` or a mise/direnv shim it exited 0 having persisted nothing. A redundant-but-correct `PATH` line is harmless and the content check already prevents duplicates. The separate early return for "no shell detected *and* already on `$PATH`" stays (there is no rc file to write in that case) with wording that says the conclusion came from the current process. **Abort contract.** `composio install` aborts, writing nothing and exiting non-zero, on two conditions: the resolved bin dir is not absolute, or it contains a character that cannot be embedded safely in a quoted rc line. The non-zero exit is load-bearing — `install.sh` only runs its inline PATH fallback when the CLI fails, so an aborting run still leaves the user with a working `PATH` instead of a green install and `command not found`. **Narrow unsafe-character set.** The bin dir is only ever emitted inside double quotes (`export PATH="<dir>:$PATH"`, `set --export PATH "<dir>" $PATH`), where bash and zsh expand only `` ` ``, `$`, `\`, `"` and fish a subset of those. `;`, `|`, `&`, `(`, `)`, `'` are literal there, so they no longer abort — `/Users/o'brien/.composio` is a legitimate path. Newline/carriage return and `:` remain rejected as structural: one splits the block into extra lines, the other is the PATH separator. **`install.sh` injection fix.** Because an abort now hands PATH setup to `install.sh`'s inline fallback, that writer's escaping matters. It interpolated `COMPOSIO_INSTALL_DIR` raw into the fish and zsh rc lines and escaped only `"` in the bash arm — so a directory the CLI rejects was written unescaped into `~/.zshrc` or `config.fish`, where `$(...)` or a backtick becomes live command substitution at the next shell start. All three arms now escape backslash, backtick, `$`, and `"` before embedding, skipping the backtick for fish (which neither substitutes it nor recognizes `` \` `` inside double quotes). The `$HOME` prefix is re-applied after escaping, so the intended variable reference survives while a user-supplied `$` does not. **CI guard.** `cli.test-installation.yml`'s shell-config check accepted the legacy `install.sh` block on every leg, justified by a comment claiming no leg installs a binary built from this checkout. That was false: `build-cli-binaries.yml` calls the workflow with the tag it just released, so a completely broken `composio install` silently falling through to `install.sh`'s writer still reported success. Callers now declare `built_from_this_checkout`, and those legs must show the CLI-managed line. `promote-stable` keeps the permissive check because it rebuilds the promoted beta's own commit, which can predate the writer. ## Known behavior, documented rather than coded around The rc block no longer records `export COMPOSIO_INSTALL_DIR=`. A user who installed to a custom directory and later re-runs `curl ... | bash` without re-specifying the variable gets a second install under `~/.composio` while their rc `PATH` still resolves the old binary. Reachability is narrow — existing users are unaffected and `composio upgrade`, the documented path, replaces `process.execPath` in place and never consults this. The obvious fix (`command -v composio` + `readlink -f` inside `install.sh`) can misfire on a foreign `composio`, so this is a CHANGELOG note telling custom-dir users to re-specify `COMPOSIO_INSTALL_DIR` or use `composio upgrade`. ## Testing - `ts/packages/cli/test/src/commands/install.cmd.test.ts` — 47 cases covering per-shell rendering (full rendered lines, including fish), bash login-file selection, symlink and mode preservation, legacy-block migration, idempotency, bin-dir resolution order, and both abort conditions. - `test/install-sh-release-resolution.test.sh` — adds a case asserting that an install directory containing `$(...)` lands in `.bashrc` as literal text and does not execute when the file is sourced. Verified locally: `vitest run` for the CLI package (113 files, 1103 passed / 1 skipped), `pnpm run typecheck`, `pnpm run validate:boundaries`, `pnpm run lint`, `bash -n install.sh`, and `bash test/install-sh-release-resolution.test.sh`. ## Notes for reviewers - `@composio/cli` is in `.changeset/config.json`'s ignore list, so this edits `ts/packages/cli/CHANGELOG.md` directly instead of adding a changeset. - No new lint-boundary disables; the two previously registered for this file (`process.env.SHELL`, `process.env.COMPOSIO_INSTALL_DIR`) are gone, since both reads now go through `effect/Config`. - `install.sh` is rewritten wholesale by the follow-up installer PR, so the change here is the minimum that closes the injection. - Follow-up #4042 ships a fuller managed-block reconciler with fixtures; the migration here is its core behavior landed early, without the fixture harness.@composio/cli@0.3.2-beta.334 |
||
|
jkomyno
|
2024fc4403 | Merge remote-tracking branch 'origin/next' into feat/cli-install-shell-flag | ||
|
Alberto Schiabel
|
85ce22401d |
fix(deps): let the hono security bump through the release-age floor (#4057)
## Why `next` is red. Dependabot #4051 bumped the `hono` catalog entry to `^4.12.34`, which pnpm resolved to `4.13.0`. Both that and `4.12.34` were published inside the 4320-minute (72h) `minimumReleaseAge` floor, so `pnpm install --frozen-lockfile` rejects the lockfile — on `next` itself and on every PR branched from it. ``` [ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION] 1 lockfile entries failed verification: hono@4.13.0 was published at 2026-08-03T21:47:05.000Z, within the minimumReleaseAge cutoff ``` Waiting it out is not neutral, because of which versions sit on which side of the floor: | Version | Published | Clears the 72h floor | Has the CORS ReDoS fix | |---|---|---|---| | 4.12.33 | 2026-07-31 10:42 | yes | **no** | | 4.12.34 | 2026-08-03 02:36 | not until Aug 6 02:36 | yes | | 4.13.0 | 2026-08-03 21:54 | not until Aug 6 21:54 | yes | The newest version old enough to pass the gate is the one the advisory flags as vulnerable. So pinning back to a compliant version means deliberately shipping the vulnerable release for two days. ## What changed One entry added to `minimumReleaseAgeExclude`, with its removal condition inline. No lockfile change — `pnpm install --frozen-lockfile` goes from exit 1 to exit 0 with the lockfile untouched. ## Why this is a safe trade The floor exists to catch compromised fresh releases. `hono` is only pulled in by `ts/e2e-tests/runtimes/cloudflare/*` and `ts/examples/cloudflare-wrangler` — test fixtures and examples. It ships in no published package, so the blast radius of taking it early is CI-only, while the advisory it fixes is real. ## Verification ``` pnpm install --frozen-lockfile # exit 0, pnpm-lock.yaml unmodified ``` ## Follow-up Delete the `hono` entry once the resolved version is past the floor (after 2026-08-06). The inline comment says so. |
||
|
jkomyno
|
fdb366d090 |
Merge branch 'feat/cli-install-shell-flag' into feat/mise-style-installer-rollout
# Conflicts: # install.sh # test/install-sh-release-resolution.test.sh # ts/packages/cli/test/__utils__/services/test-layer.ts # ts/packages/cli/test/src/commands/install.cmd.test.ts |
||
|
dependabot[bot]
|
02c7af88ae |
chore(deps): bump hono from 4.12.31 to 4.12.34 in the npm-security group across 1 directory (#4051)
Bumps the npm-security group with 1 update in the / directory: [hono](https://github.com/honojs/hono). Updates `hono` from 4.12.31 to 4.12.34 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/honojs/hono/releases">hono's releases</a>.</em></p> <blockquote> <h2>v4.12.34</h2> <h2>Security fixes</h2> <p>This release includes fixes for the following security issues:</p> <h3><code>memo()</code> retains SSR output across requests, leading to cross-user data disclosure</h3> <p>Affects: <code>hono/jsx</code> (server-side rendering). Fixes <code>memo()</code> reusing a retained render result across requests when props compare equal, where a component reading request-scoped values from ambient context — <code>useContext()</code>, <code>useRequestContext()</code>, or <code>getContext()</code> — could serve HTML rendered for another user's request, disclosing account data or request-scoped secrets such as CSRF tokens. GHSA-f23p-vx2j-j53r</p> <h3>ReDoS in CORS middleware via <code>Access-Control-Request-Headers</code></h3> <p>Affects: <code>hono/cors</code>. Fixes a whitespace-tolerant regular expression with quadratic backtracking used to parse the <code>Access-Control-Request-Headers</code> preflight header when <code>allowHeaders</code> is not configured (the default), where a single preflight request carrying a long whitespace run could consume seconds of CPU and stall request processing. GHSA-8j4g-w8fx-2239</p> <h3>Algorithmic complexity DoS in Language Middleware</h3> <p>Affects: <code>hono/language</code>. Fixes quadratic string processing in language-tag normalization, where a crafted language tag with a large number of hyphen-separated subtags — supplied via a query parameter, cookie, or <code>Accept-Language</code> header — could cause excessive CPU consumption and block the event loop. GHSA-54fx-42gc-7vw4</p> <h3>Proxy Helper does not remove response headers listed in the <code>Connection</code> header</h3> <p>Affects: <code>hono/proxy</code>. Fixes <code>proxy()</code> forwarding response headers that the origin's <code>Connection</code> header designates as connection-scoped, where headers intended only for the immediate peer — per RFC 9110 Section 7.6.1 — could be exposed to clients, disclosing connection-scoped or internal metadata. GHSA-79qm-7rj5-m7r9</p> <hr /> <p>Users who use <code>hono/jsx</code> for server-side rendering, <code>hono/cors</code>, <code>hono/language</code>, or <code>hono/proxy</code> are strongly encouraged to upgrade to this version.</p> <h2>v4.12.33</h2> <h2>What's Changed</h2> <ul> <li>fix(cookie): relax name validation when parsing Cookie header in <a href="https://redirect.github.com/honojs/hono/pull/5164">honojs/hono#5164</a></li> <li>chore: bump <code>@hono/node-server</code> in <a href="https://redirect.github.com/honojs/hono/pull/5167">honojs/hono#5167</a></li> <li>fix(jsx): handle useSyncExternalStore subscription and snapshot changes in <a href="https://redirect.github.com/honojs/hono/pull/5166">honojs/hono#5166</a></li> <li>chore: remove undici in favor of global fetch in <a href="https://redirect.github.com/honojs/hono/pull/5168">honojs/hono#5168</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/hono/compare/v4.12.32...v4.12.33">https://github.com/honojs/hono/compare/v4.12.32...v4.12.33</a></p> <h2>v4.12.32</h2> <h2>What's Changed</h2> <ul> <li>ci: enable reports for type & bundle size check in <a href="https://redirect.github.com/honojs/hono/pull/5148">honojs/hono#5148</a></li> <li>fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 in <a href="https://redirect.github.com/honojs/hono/pull/5142">honojs/hono#5142</a></li> <li>fix(sse): emit empty id field to reset Last-Event-ID in <a href="https://redirect.github.com/honojs/hono/pull/5138">honojs/hono#5138</a></li> <li>test(cloudflare-workers): add coverage for onClose, onError, send, and close in Cloudflare Workers websocket adapter in <a href="https://redirect.github.com/honojs/hono/pull/5145">honojs/hono#5145</a></li> <li>fix: use <code>Object.create(null)</code> when parsing query, headers, and params in <a href="https://redirect.github.com/honojs/hono/pull/5161">honojs/hono#5161</a></li> <li>fix(secure-headers): keep CSP callbacks scoped to their header in <a href="https://redirect.github.com/honojs/hono/pull/5147">honojs/hono#5147</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/hono/compare/v4.12.31...v4.12.32">https://github.com/honojs/hono/compare/v4.12.31...v4.12.32</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/honojs/hono/commit/734755ace341607628219ea1dd8ca17f01bf1a5c"><code>734755a</code></a> 4.12.34</li> <li><a href="https://github.com/honojs/hono/commit/9839ff32a349bf088b6ddfa604010879dd2d3a05"><code>9839ff3</code></a> chore: update <code>bun.lock</code> (<a href="https://redirect.github.com/honojs/hono/issues/5182">#5182</a>)</li> <li><a href="https://github.com/honojs/hono/commit/0c45036d6b0ddf42ab2fa44639dc8710825d5c0f"><code>0c45036</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/hono/commit/720b566290793d4358bf39843adcb7cf4da4548f"><code>720b566</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/hono/commit/f70e2c31684387b3231cc38512a31df6ca76a1c7"><code>f70e2c3</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/hono/commit/93fc250d8b4df58ea542cb945171de8013d5e6d5"><code>93fc250</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/hono/commit/51db3131d5e97076327edaa0afdb60ebb77c264f"><code>51db313</code></a> 4.12.33</li> <li><a href="https://github.com/honojs/hono/commit/aed146364d5c48a8336b8c82fedfabebf8063d07"><code>aed1463</code></a> chore: remove undici in favor of global fetch (<a href="https://redirect.github.com/honojs/hono/issues/5168">#5168</a>)</li> <li><a href="https://github.com/honojs/hono/commit/224d2f5cbf2b4bc2ebb7482d0592149a8d9f0574"><code>224d2f5</code></a> fix(jsx): handle useSyncExternalStore subscription and snapshot changes (<a href="https://redirect.github.com/honojs/hono/issues/5166">#5166</a>)</li> <li><a href="https://github.com/honojs/hono/commit/df653cea0450657977887d56a5188368387456c8"><code>df653ce</code></a> chore: bump <code>@hono/node-server</code> (<a href="https://redirect.github.com/honojs/hono/issues/5167">#5167</a>)</li> <li>Additional commits viewable in <a href="https://github.com/honojs/hono/compare/v4.12.31...v4.12.34">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/ComposioHQ/composio/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |