composiohq__composio

mirror of https://github.com/ComposioHQ/composio.git synced 2026-09-22 11:46:35 +08:00

Author	SHA1	Message	Date
sdkrelease[bot]	13cba53b1d	Release: update version (#4038 ) This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to next, this PR will be updated. # Releases ## @composio/core@0.15.0 ### Minor Changes - `1503786`: Replace the loose JSON Schema property type with a recursive, type-safe definition. `JSONSchemaProperty` (re-exported from `@composio/core` and reachable through `Tool.input_parameters` / `Tool.output_parameters`) is now a concrete recursive interface instead of effectively `any`. Runtime behavior is unchanged, but consumer code that indexed into it without narrowing (for example `schema.properties.foo.type` or `schema.default.someField`) may see new type errors: `properties` entries are now possibly `undefined` and `default` / `enum` values are `unknown`. Narrow with optional chaining or explicit type guards when upgrading. ### Patch Changes - `2ac6ad3`: Bound the background npm version check so registry outages cannot leave the request pending indefinitely. - `5105612`: Match sensitive upload path segments using the target filesystem's actual case sensitivity so case-insensitive mounts cannot bypass the denylist without over-blocking distinct paths on case-sensitive mounts. - `051c8c5`: Redact secrets that appear inside JSON payloads in telemetry error text. The key/value rule required the separator to follow the key name directly, so a serialized body such as `{"api_key": "..."}` — the shape error messages usually carry — was sent unredacted. - `e5c9ada`: Refresh the OpenAI runtime dependency to version 7. - `ecd0861`: Release unread response bodies on the paths the SDK knowingly abandons: cancel every intermediate redirect body in `ssrfSafeFetch`, and the response body before throwing on `!response.ok` in both URL-upload call sites, instead of leaving them for the garbage collector to reclaim. - `2a6a051`: Remove the unused internal `isNewerVersion` helper. - Updated dependencies [`1503786`] - @composio/json-schema-to-zod@0.2.2 ## @composio/openai@0.11.0 ### Minor Changes - `e5c9ada`: Add support for OpenAI versions 6 and 7. ## @composio/experimental@0.2.2 ### Patch Changes - `4ceaede`: Refresh the TypeBox runtime dependency. ## @composio/json-schema-to-zod@0.2.2 ### Patch Changes - `1503786`: Model the parser-supported `min`, `max`, and `example` JSON Schema extensions in the exported recursive schema type. ## @composio/slim@0.15.0 ### Patch Changes - `e5c9ada`: Refresh the OpenAI runtime dependency to version 7. - Updated dependencies [`1503786`] - @composio/json-schema-to-zod@0.2.2 Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-08-07 22:16:46 +05:30
Alberto Schiabel	b9a715e055	fix(e2e): pack core's workspace dependency in the openai-zod4 fixture (#4097 ) The `openai-zod4-compat` E2E fixture fails on every release branch that bumps an internal workspace package. It is currently blocking the Python 0.18.2 / TypeScript 0.15.0 train (https://github.com/ComposioHQ/composio/pull/4038). ## Root cause The fixture packs `@composio/core` and `@composio/openai` and installs the tarballs. `pnpm pack` rewrites `@composio/core`'s `workspace:*` dependency on `@composio/json-schema-to-zod` to the exact workspace version, so the tarball carries a hard pin: ```json "@composio/json-schema-to-zod": "0.2.2" ``` On `next` that pin points at an already-published version, so the install resolves from the registry and the fixture passes. On a release branch it points at the version about to be published, which does not exist yet: ``` npm error code ETARGET npm error notarget No matching version found for @composio/json-schema-to-zod@0.2.2. ``` The setup step then exits non-zero and all 7 assertions fail with empty output. That is exactly what https://github.com/ComposioHQ/composio/pull/4038 shows: `@composio/json-schema-to-zod` is bumped to `0.2.2` there, which is the first release train to bump an internal dependency of `@composio/core` since this fixture was added. ## Fix Pack `@composio/json-schema-to-zod` alongside the other two and install all three tarballs. npm satisfies core's pin from the top-level tarball, so the fixture resolves entirely from local builds and no longer depends on publication order. Behavior on `next` is unchanged — it just prefers the local build over the identical published one. ## Verification Reproduced and fixed against the release branch (`changeset-release/next` @ `8068225d7`, core `0.15.0` / json-schema-to-zod `0.2.2`) in a local worktree, since Docker was not available to run the containerized suite here: - packing core alone and running the fixture's install command reproduces the ETARGET failure verbatim - packing all three and installing them succeeds; `node_modules/@composio/json-schema-to-zod` resolves to `0.2.2` and `@composio/core`'s pin is satisfied locally - `node ts/scripts/validate-changesets.mjs` passes; no changeset needed, the fixture is a private package CI runs the real containerized suite on this PR.	2026-08-07 22:04:34 +05:30
LHMQ878	051c8c5357	fix(telemetry): redact secrets inside JSON payloads (#4043 ) ## Summary Telemetry error text is redacted before it leaves the process, but the key/value rule only matches when the separator follows the key name directly: ``` \b(authorization\|api[-_]?key\|...\|pwd)\b(\s[:=]+\s)(["']?)([^\s"',}&]+)\3 ``` In JSON — and in a Python `dict` repr — the key's own closing quote sits between the name and the colon, so `{"api_key": "..."}` never matches and the value is sent verbatim. That is the shape error messages usually carry: an API error envelope, a rejected request body echoed back, or an f-string interpolating a config dict. Both SDKs share the pattern and both are affected. The fix moves the optional quote into the separator group (`(["']?\s[:=]+\s)`). The key name, separator, and quoting are all preserved in the output; only the value is replaced. Measured with `redact_sensitive_text` / `redactSensitiveText` directly, before and after: \| input \| before \| after \| \|---\|---\|---\| \| `api_key=sk-1` \| redacted \| redacted \| \| `api_key: "sk-1"` \| redacted \| redacted \| \| `x-api-key: sk-live-hdr` \| redacted \| redacted \| \| `{"api_key": "sk-live-abc"}` \| leaks \| `{"api_key": "[REDACTED]"}` \| \| `{"api_key":"sk-live-abc"}` \| leaks \| redacted \| \| `{"api_key" : "sk-live-abc"}` \| leaks \| redacted \| \| `{"refresh_token":"rt-abc.def-123"}` \| leaks \| redacted \| \| `{"x-api-key":"sk-hdr","user":"bob"}` \| leaks \| redacted, `"user":"bob"` kept \| \| `{'client_secret': 'cs-live-abc'}` \| leaks \| redacted \| \| `the password field is required` \| untouched \| untouched \| \| `no separator here "api_key" and nothing else` \| untouched \| untouched \| The end-to-end path in Python is `composio/core/models/base.py:60-61`, which passes `str(e)` and `traceback.format_exc()` through the redactor into the telemetry `error` field. A tool failure whose message interpolates the rejected request body — `Error executing tool: request body was rejected: {"toolkit": "GMAIL", "arguments": {"api_key": "...", ...}}` — leaked the customer's key today. ## Changes - `python/composio/utils/redaction.py`, `ts/packages/core/src/telemetry/redact.ts`: allow a quote between the key name and the separator. - Tests on both sides for JSON, minified JSON, spaced-colon JSON, dict repr, the realistic serialized-payload shape, key/quote preservation, and no-false-positive cases. - Changeset for `@composio/core`. ## Type of change - [x] Bug fix ## How Has This Been Tested? Node 24.13.0 / pnpm 11.8.0 / Python 3.10.20 (uv), Windows. - `uv run pytest tests/test_redaction.py` — 13 passed. With `redaction.py` reverted and the new tests kept, 9 of them fail; the 4 that still pass are the pre-existing test plus the three no-false-positive controls. - `npx vitest run test/telemetry/redact.test.ts` in `ts/packages/core` — 10 passed. With `redact.ts` reverted, the 3 new cases fail. - Full Python suite: 913 passed, same 4 failures as on `next` unchanged (3 are `ModuleNotFoundError: composio_langchain` from providers not installed in my env; 1 is `test_empty_name_safe_fails_at_write_time`, which expects `IsADirectoryError` but Windows raises `PermissionError` when opening a directory). Collection 944 → 956, exactly the 12 tests added. - Full `@composio/core` vitest: 798 passed / 2 failed, byte-identical to the unchanged baseline (794 passed / same 2 failed — both Windows path-and-symlink cases). 11 test files fail to load in both runs because I installed with `--ignore-scripts`; the repo's `preinstall` hook doesn't run in my shell. - `ruff format --check` and `ruff check` clean on the two Python files; `prettier --write` applied to the two TypeScript files. ## Checklist - [x] I have read the Code of Conduct and this PR adheres to it - [x] I ran linters/tests locally and they passed - [ ] I updated documentation as needed — no user-facing behavior change to document - [x] I added tests or explain why not applicable - [x] I added a changeset if this change affects published packages ## Additional context This is defence-in-depth, so it stays deliberately narrow: same denylist of key names, same value character class, no new rules. Bare-prefix secrets (`sk-...`, `ghp_...`) and PEM blocks are still not matched by either SDK — worth a separate look, but widening the pattern is a different risk trade-off than closing a shape the rule already intends to cover.	2026-08-07 19:14:49 +05:30
dependabot[bot]	0c4c5a360a	chore(deps): bump the npm-production group across 1 directory with 17 updates (#4090 ) Bumps the npm-production group with 17 updates in the / directory: \| Package \| From \| To \| \| --- \| --- \| --- \| \| [@anthropic-ai/claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-typescript) \| `0.3.220` \| `0.3.221` \| \| [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai) \| `6.0.235` \| `6.0.241` \| \| [@google/genai](https://github.com/googleapis/js-genai) \| `2.13.0` \| `2.15.0` \| \| [@langchain/core](https://github.com/langchain-ai/langchainjs) \| `1.2.3` \| `1.2.4` \| \| [@langchain/langgraph](https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core) \| `1.4.8` \| `1.4.9` \| \| [typebox](https://github.com/sinclairzx81/typebox) \| `1.3.9` \| `1.3.10` \| \| [@ai-sdk/mcp](https://github.com/vercel/ai/tree/HEAD/packages/mcp) \| `2.0.22` \| `2.0.24` \| \| [@ai-sdk/openai](https://github.com/vercel/ai/tree/HEAD/packages/openai) \| `4.0.27` \| `4.0.29` \| \| [@cloudflare/vitest-pool-workers](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers) \| `0.18.8` \| `0.20.1` \| \| [@cloudflare/workers-types](https://github.com/cloudflare/workerd) \| `5.20260801.1` \| `5.20260804.1` \| \| [@mastra/core](https://github.com/mastra-ai/mastra/tree/HEAD/packages/core) \| `1.52.1` \| `1.55.0` \| \| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) \| `1.26.0` \| `1.30.0` \| \| [hono](https://github.com/honojs/hono) \| `4.12.31` \| `4.13.0` \| \| [pnpm](https://github.com/pnpm/pnpm/tree/HEAD/pnpm11/pnpm) \| `11.17.0` \| `11.20.0` \| \| [publint](https://github.com/publint/publint/tree/HEAD/packages/publint) \| `0.3.22` \| `0.3.23` \| \| [tsx](https://github.com/privatenumber/tsx) \| `4.23.1` \| `4.23.5` \| \| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) \| `4.114.0` \| `4.118.0` \| Updates `@anthropic-ai/claude-agent-sdk` from 0.3.220 to 0.3.221 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/anthropics/claude-agent-sdk-typescript/releases">@anthropic-ai/claude-agent-sdk's releases</a>.</em></p> <blockquote> <h2>v0.3.221</h2> <h2>What's changed</h2> <ul> <li>Improved <code>skills</code> option validation: malformed names (delimiters or control characters) and wildcard-form names are rejected with a clear error; use <code>skills: 'all'</code> to enable every skill</li> <li>Fixed external MCP servers passed via the <code>mcpServers</code> option not being connected before the first turn, which caused the model to emit tool calls as literal text</li> </ul> <h2>Update</h2> <pre lang="sh"><code>npm install @anthropic-ai/claude-agent-sdk@0.3.221 # or yarn add @anthropic-ai/claude-agent-sdk@0.3.221 # or pnpm add @anthropic-ai/claude-agent-sdk@0.3.221 # or bun add @anthropic-ai/claude-agent-sdk@0.3.221 </code></pre> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/anthropics/claude-agent-sdk-typescript/blob/main/CHANGELOG.md">@anthropic-ai/claude-agent-sdk's changelog</a>.</em></p> <blockquote> <h2>0.3.221</h2> <ul> <li>Improved <code>skills</code> option validation: malformed names (delimiters or control characters) and wildcard-form names are rejected with a clear error; use <code>skills: 'all'</code> to enable every skill</li> <li>Fixed external MCP servers passed via the <code>mcpServers</code> option not being connected before the first turn, which caused the model to emit tool calls as literal text</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/31fbbfd403b3289933abc297e66cec775301e15e"><code>31fbbfd</code></a> chore: Update CHANGELOG.md</li> <li>See full diff in <a href="https://github.com/anthropics/claude-agent-sdk-typescript/compare/v0.3.220...v0.3.221">compare view</a></li> </ul> </details> <br /> Updates `ai` from 6.0.235 to 6.0.241 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vercel/ai/blob/ai@6.0.241/packages/ai/CHANGELOG.md">ai's changelog</a>.</em></p> <blockquote> <h2>6.0.241</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [7e50c52] <ul> <li><code>@ai-sdk/gateway</code><a href="https://github.com/3"><code>@3</code></a>.0.163</li> </ul> </li> </ul> <h2>6.0.240</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [b28367e] <ul> <li><code>@ai-sdk/gateway</code><a href="https://github.com/3"><code>@3</code></a>.0.162</li> </ul> </li> </ul> <h2>6.0.239</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [d3d9e0b] <ul> <li><code>@ai-sdk/gateway</code><a href="https://github.com/3"><code>@3</code></a>.0.161</li> </ul> </li> </ul> <h2>6.0.238</h2> <h3>Patch Changes</h3> <ul> <li>9ecdefe: Prevent validated downloads on Node.js from reaching private or internal services through DNS aliases or DNS rebinding by validating and pinning every resolved address at connection time.</li> <li>26d10c0: support overriding model call settings for individual <code>prepareStep</code> invocations</li> <li>7767170: Preserve provider metadata from empty text deltas in <code>streamText</code>.</li> <li>Updated dependencies [9ecdefe]</li> <li>Updated dependencies [87fb433] <ul> <li><code>@ai-sdk/provider-utils</code><a href="https://github.com/4"><code>@4</code></a>.0.41</li> <li><code>@ai-sdk/gateway</code><a href="https://github.com/3"><code>@3</code></a>.0.160</li> </ul> </li> </ul> <h2>6.0.237</h2> <h3>Patch Changes</h3> <ul> <li>f6020d7: Avoid synthesizing client tool errors for invalid provider-executed tool calls.</li> <li>Updated dependencies [de438f5] <ul> <li><code>@ai-sdk/gateway</code><a href="https://github.com/3"><code>@3</code></a>.0.159</li> </ul> </li> </ul> <h2>6.0.236</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [8418710] <ul> <li><code>@ai-sdk/gateway</code><a href="https://github.com/3"><code>@3</code></a>.0.158</li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/ai/commit/5b4cf0ef925c6dfac12167e9e986e2e2e796e68e"><code>5b4cf0e</code></a> Version Packages (<a href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18345">#18345</a>)</li> <li><a href="https://github.com/vercel/ai/commit/b878ce998fbe53bb27d8124b59c94cb9c109899b"><code>b878ce9</code></a> Version Packages (<a href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18314">#18314</a>)</li> <li><a href="https://github.com/vercel/ai/commit/fbb507af0398516dc4db212a6dcdfff48744a4fd"><code>fbb507a</code></a> Version Packages (<a href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18280">#18280</a>)</li> <li><a href="https://github.com/vercel/ai/commit/6e37b23980716390f878881f0e39a878295d1dd4"><code>6e37b23</code></a> v6.0: docs: document GenerateTextResult.output getter errors (<a href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18252">#18252</a>)</li> <li><a href="https://github.com/vercel/ai/commit/006a2f87a3ca3409973d1a11ed21002b37d38c74"><code>006a2f8</code></a> Version Packages (<a href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18089">#18089</a>)</li> <li><a href="https://github.com/vercel/ai/commit/2deee5b27ec31ba38a2e2b20966fe1a868b5f117"><code>2deee5b</code></a> v6.0: docs: clarify generateText text aggregation and empty-string behavior (...</li> <li><a href="https://github.com/vercel/ai/commit/26d10c0b30ca68d5c7b618b8d54b06ae01930a68"><code>26d10c0</code></a> [v6.0] feat: support per-step model call setting overrides in prepareStep (<a href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/1">#1</a>...</li> <li><a href="https://github.com/vercel/ai/commit/9ecdefe4eb4db14c76bcc7c04813663d2012fb8e"><code>9ecdefe</code></a> [v6] fix(provider-utils): prevent DNS alias SSRF in validated downloads (<a href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18095">#18095</a>)</li> <li><a href="https://github.com/vercel/ai/commit/776717089720a00a29a7b72b86f7bdc54ea8c0bd"><code>7767170</code></a> [v6.0] fix: preserve provider metadata from empty streamText text deltas (<a href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18">#18</a>...</li> <li><a href="https://github.com/vercel/ai/commit/98d8c433aa6a0d3ec05c201e0355f876c6349c47"><code>98d8c43</code></a> Version Packages (<a href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18028">#18028</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vercel/ai/commits/ai@6.0.241/packages/ai">compare view</a></li> </ul> </details> <br /> Updates `@google/genai` from 2.13.0 to 2.15.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/googleapis/js-genai/releases">@google/genai's releases</a>.</em></p> <blockquote> <h2>v2.15.0</h2> <h2><a href="https://github.com/googleapis/js-genai/compare/v2.14.0...v2.15.0">2.15.0</a> (2026-07-30)</h2> <h3>Features</h3> <ul> <li>add environment resource (<a href="https://github.com/googleapis/js-genai/commit/2c911befbf839fc250a296783cbedbd3b668a9f7">2c911be</a>)</li> <li>Support GoogleMaps Tool grounding_types places and routing (<a href="https://github.com/googleapis/js-genai/commit/52655c192848942d2d866c3b256de27c94583f78">52655c1</a>)</li> <li>Support per-request retryOptions in the JS GenAI SDK API Client (<a href="https://github.com/googleapis/js-genai/commit/124b606bc5be0d5e70673dc28e16e739c9a25d7c">124b606</a>)</li> <li>Wire environment service into genai sdk (<a href="https://github.com/googleapis/js-genai/commit/70d79389536821f1323ae5016f63ee95afa6b48a">70d7938</a>)</li> </ul> <h2>v2.14.0</h2> <h2><a href="https://github.com/googleapis/js-genai/compare/v2.13.0...v2.14.0">2.14.0</a> (2026-07-28)</h2> <h3>Features</h3> <ul> <li>[GenerateContentConfig] Add GenerationConfig.audio_transcription_config and Part.audio_transcription. (<a href="https://github.com/googleapis/js-genai/commit/4b2e67aebbb713321c095ccad34618f2a98fdd7d">4b2e67a</a>)</li> <li>Add flat <code>language_codes</code> field to <code>AudioTranscriptionConfig</code>. (<a href="https://github.com/googleapis/js-genai/commit/cc808ebcbe76beb8e54fd5ca24ac358643104853">cc808eb</a>)</li> <li>Allow api key + proj/location for enterprise mode (<a href="https://github.com/googleapis/js-genai/commit/9c0540a26694e6a2896a433e43d1bac963af10e5">9c0540a</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>add deprecation warnings to Imagen generate_images, edit_images, generate_videos (if using prompt/text/image args), LiveConnectConfig.GenerationConfig which will be removed in the next major version (<a href="https://github.com/googleapis/js-genai/commit/bb6610199a76f7a99e28ed77974e6a3af21a52b1">bb66101</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/googleapis/js-genai/blob/main/CHANGELOG.md">@google/genai's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/googleapis/js-genai/compare/v2.14.0...v2.15.0">2.15.0</a> (2026-07-30)</h2> <h3>Features</h3> <ul> <li>add environment resource (<a href="https://github.com/googleapis/js-genai/commit/2c911befbf839fc250a296783cbedbd3b668a9f7">2c911be</a>)</li> <li>Support GoogleMaps Tool grounding_types places and routing (<a href="https://github.com/googleapis/js-genai/commit/52655c192848942d2d866c3b256de27c94583f78">52655c1</a>)</li> <li>Support per-request retryOptions in the JS GenAI SDK API Client (<a href="https://github.com/googleapis/js-genai/commit/124b606bc5be0d5e70673dc28e16e739c9a25d7c">124b606</a>)</li> <li>Wire environment service into genai sdk (<a href="https://github.com/googleapis/js-genai/commit/70d79389536821f1323ae5016f63ee95afa6b48a">70d7938</a>)</li> </ul> <h2><a href="https://github.com/googleapis/js-genai/compare/v2.13.0...v2.14.0">2.14.0</a> (2026-07-28)</h2> <h3>Features</h3> <ul> <li>[GenerateContentConfig] Add GenerationConfig.audio_transcription_config and Part.audio_transcription. (<a href="https://github.com/googleapis/js-genai/commit/4b2e67aebbb713321c095ccad34618f2a98fdd7d">4b2e67a</a>)</li> <li>Add flat <code>language_codes</code> field to <code>AudioTranscriptionConfig</code>. (<a href="https://github.com/googleapis/js-genai/commit/cc808ebcbe76beb8e54fd5ca24ac358643104853">cc808eb</a>)</li> <li>Allow api key + proj/location for enterprise mode (<a href="https://github.com/googleapis/js-genai/commit/9c0540a26694e6a2896a433e43d1bac963af10e5">9c0540a</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>add deprecation warnings to Imagen generate_images, edit_images, generate_videos (if using prompt/text/image args), LiveConnectConfig.GenerationConfig which will be removed in the next major version (<a href="https://github.com/googleapis/js-genai/commit/bb6610199a76f7a99e28ed77974e6a3af21a52b1">bb66101</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/googleapis/js-genai/commit/a76a3eab126e5b7c6a46f6c43795ec3cc65b5488"><code>a76a3ea</code></a> chore(main): release 2.15.0 (<a href="https://redirect.github.com/googleapis/js-genai/issues/1815">#1815</a>)</li> <li><a href="https://github.com/googleapis/js-genai/commit/124b606bc5be0d5e70673dc28e16e739c9a25d7c"><code>124b606</code></a> feat: Support per-request retryOptions in the JS GenAI SDK API Client</li> <li><a href="https://github.com/googleapis/js-genai/commit/52655c192848942d2d866c3b256de27c94583f78"><code>52655c1</code></a> feat: Support GoogleMaps Tool grounding_types places and routing</li> <li><a href="https://github.com/googleapis/js-genai/commit/70d79389536821f1323ae5016f63ee95afa6b48a"><code>70d7938</code></a> feat: Wire environment service into genai sdk</li> <li><a href="https://github.com/googleapis/js-genai/commit/2c911befbf839fc250a296783cbedbd3b668a9f7"><code>2c911be</code></a> feat: add environment resource</li> <li><a href="https://github.com/googleapis/js-genai/commit/1895d5793954cb62e3ab4d90aab2f636b4285497"><code>1895d57</code></a> docs: Communicate on upcoming updates in the next major version</li> <li><a href="https://github.com/googleapis/js-genai/commit/ebeba1cda039d43e821d519afb8ce1d0dc9d0f74"><code>ebeba1c</code></a> chore(main): release 2.14.0 (<a href="https://redirect.github.com/googleapis/js-genai/issues/1799">#1799</a>)</li> <li><a href="https://github.com/googleapis/js-genai/commit/cc808ebcbe76beb8e54fd5ca24ac358643104853"><code>cc808eb</code></a> feat: Add flat <code>language_codes</code> field to <code>AudioTranscriptionConfig</code>.</li> <li><a href="https://github.com/googleapis/js-genai/commit/9c0540a26694e6a2896a433e43d1bac963af10e5"><code>9c0540a</code></a> feat: Allow api key + proj/location for enterprise mode</li> <li><a href="https://github.com/googleapis/js-genai/commit/d221cf34c94ad558ab22d59e3163b60122d72948"><code>d221cf3</code></a> chore: internal update</li> <li>Additional commits viewable in <a href="https://github.com/googleapis/js-genai/compare/v2.13.0...v2.15.0">compare view</a></li> </ul> </details> <br /> Updates `@langchain/core` from 1.2.3 to 1.2.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langchainjs/releases">@langchain/core's releases</a>.</em></p> <blockquote> <h2><code>@langchain/core</code><a href="https://github.com/1"><code>@1</code></a>.2.4</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/11190">#11190</a> <a href="https://github.com/langchain-ai/langchainjs/commit/9654bde694af4e78080a76a0b39d7edd35683449"><code>9654bde</code></a> Thanks <a href="https://github.com/pawel-twardziak"><code>@pawel-twardziak</code></a>! - Coalesce nested LangChain tracer callbacks that share run bookkeeping.</p> </li> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/11153">#11153</a> <a href="https://github.com/langchain-ai/langchainjs/commit/84ce6d65ef0ab2c556d5a5a3b5651b5cf3d73303"><code>84ce6d6</code></a> Thanks <a href="https://github.com/parveshsaini"><code>@parveshsaini</code></a>! - fix(core): bind splitText when trimMessages receives a TextSplitter instance</p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langchainjs/commit/f6dbb882d1d4a591d69020145b6a871fe7801b35"><code>f6dbb88</code></a> chore: version packages (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/11268">#11268</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/9654bde694af4e78080a76a0b39d7edd35683449"><code>9654bde</code></a> fix(core): coalesce duplicate tracer copies sharing run state (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/11190">#11190</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/84ce6d65ef0ab2c556d5a5a3b5651b5cf3d73303"><code>84ce6d6</code></a> fix(core): bind splitText when trimMessages receives a TextSplitter instance ...</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/710d74f3fc0ff98d5088c8e0c86752829cfaaa2c"><code>710d74f</code></a> fix: resolve open Dependabot alerts (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/11259">#11259</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/5226cddb0d0b31d33bb78fc51230e4283cd6cc64"><code>5226cdd</code></a> chore(deps-dev): bump <code>@hono/node-server</code> from 2.0.4 to 2.0.10 in /libs/langcha...</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/d829cb490112454b3cf8718a526f28450ff37062"><code>d829cb4</code></a> chore: version packages (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/11204">#11204</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/c8bd4c4a6dbde07fb24deb5870c02dc29c51ab53"><code>c8bd4c4</code></a> feat(anthropic): add Claude Opus 5 support (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/11255">#11255</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/741f380ae54afd2e920495b3042ea6346865836a"><code>741f380</code></a> chore(deps): bump <code>@hono/node-server</code> from 2.0.4 to 2.0.10 (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/11244">#11244</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/5103cee12ae0e3e56038f0c20edda5159b252daa"><code>5103cee</code></a> chore(deps): bump js-yaml from 5.1.0 to 5.2.2 (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/11256">#11256</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/db29a6a8060d9d8998f5fb566368e3bad5b32a5b"><code>db29a6a</code></a> chore(deps): bump axios from 1.16.1 to 1.18.0 (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/11228">#11228</a>)</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langchainjs/compare/@langchain/core@1.2.3...@langchain/core@1.2.4">compare view</a></li> </ul> </details> <br /> Updates `@langchain/langgraph` from 1.4.8 to 1.4.9 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langgraphjs/releases">@langchain/langgraph's releases</a>.</em></p> <blockquote> <h2><code>@langchain/langgraph</code><a href="https://github.com/1"><code>@1</code></a>.4.9</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2653">#2653</a> <a href="https://github.com/langchain-ai/langgraphjs/commit/7880055ac7303483e424380cdd52f54cd094e311"><code>7880055</code></a> Thanks <a href="https://github.com/christian-bromann"><code>@christian-bromann</code></a>! - fix(langgraph): checkpoint Topic as a flat values list</p> <p>Match Python Topic checkpoints so Host JS graphs no longer put <code>__pregel_tasks: [[], []]</code> through the Python checkpointer. Keep reading legacy <code>[seen, values]</code> checkpoints for restore compatibility.</p> </li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langgraphjs/blob/main/libs/langgraph-core/CHANGELOG.md">@langchain/langgraph's changelog</a>.</em></p> <blockquote> <h2>1.4.9</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2653">#2653</a> <a href="https://github.com/langchain-ai/langgraphjs/commit/7880055ac7303483e424380cdd52f54cd094e311"><code>7880055</code></a> Thanks <a href="https://github.com/christian-bromann"><code>@christian-bromann</code></a>! - fix(langgraph): checkpoint Topic as a flat values list</p> <p>Match Python Topic checkpoints so Host JS graphs no longer put <code>__pregel_tasks: [[], []]</code> through the Python checkpointer. Keep reading legacy <code>[seen, values]</code> checkpoints for restore compatibility.</p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langgraphjs/commit/5f9915234a5dca861ef01180fde28e52f42c6e15"><code>5f99152</code></a> chore: version packages (<a href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2655">#2655</a>)</li> <li><a href="https://github.com/langchain-ai/langgraphjs/commit/7880055ac7303483e424380cdd52f54cd094e311"><code>7880055</code></a> fix(langgraph): checkpoint Topic as a flat values list (<a href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2653">#2653</a>)</li> <li><a href="https://github.com/langchain-ai/langgraphjs/commit/cac6d3106599b5c9ecff8c00d99a7e78571c5202"><code>cac6d31</code></a> chore(deps): bump the vite-vitest group across 1 directory with 6 updates (<a href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2">#2</a>...</li> <li><a href="https://github.com/langchain-ai/langgraphjs/commit/fa9892117d56398ce0f02f1a73bafb807a61ce2e"><code>fa98921</code></a> chore(deps-dev): bump <code>@vitest/browser</code> from 4.1.9 to 4.1.10 (<a href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2624">#2624</a>)</li> <li><a href="https://github.com/langchain-ai/langgraphjs/commit/cdffd18d192eaa87375bc2d45b343418af8bd024"><code>cdffd18</code></a> chore(deps): bump the langchain group across 1 directory with 6 updates (<a href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2616">#2616</a>)</li> <li>See full diff in <a href="https://github.com/langchain-ai/langgraphjs/commits/@langchain/langgraph@1.4.9/libs/langgraph-core">compare view</a></li> </ul> </details> <br /> Updates `typebox` from 1.3.9 to 1.3.10 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sinclairzx81/typebox/commit/221a1de804f08471600ebd4dc8a4460340797d56"><code>221a1de</code></a> Version 1.3.10 (<a href="https://redirect.github.com/sinclairzx81/typebox/issues/1662">#1662</a>)</li> <li><a href="https://github.com/sinclairzx81/typebox/commit/4992c53f930a675d78acdf5d61a1a12e64e8037a"><code>4992c53</code></a> Specification</li> <li>See full diff in <a href="https://github.com/sinclairzx81/typebox/compare/1.3.9...1.3.10">compare view</a></li> </ul> </details> <br /> Updates `@ai-sdk/mcp` from 2.0.22 to 2.0.24 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vercel/ai/blob/main/packages/mcp/CHANGELOG.md">@ai-sdk/mcp's changelog</a>.</em></p> <blockquote> <h2>2.0.24</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [160ccdb] <ul> <li><code>@ai-sdk/provider-utils</code><a href="https://github.com/5"><code>@5</code></a>.0.20</li> </ul> </li> </ul> <h2>2.0.23</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [79e133c] <ul> <li><code>@ai-sdk/provider</code><a href="https://github.com/4"><code>@4</code></a>.0.5</li> <li><code>@ai-sdk/provider-utils</code><a href="https://github.com/5"><code>@5</code></a>.0.19</li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/ai/commit/22095f409fdf70dc858546fe26b1cf92f12f87f1"><code>22095f4</code></a> Version Packages (<a href="https://github.com/vercel/ai/tree/HEAD/packages/mcp/issues/18381">#18381</a>)</li> <li><a href="https://github.com/vercel/ai/commit/9df82a8bc70f569ae0fbb701a81fd6209ec2a2b7"><code>9df82a8</code></a> Version Packages (<a href="https://github.com/vercel/ai/tree/HEAD/packages/mcp/issues/18368">#18368</a>)</li> <li>See full diff in <a href="https://github.com/vercel/ai/commits/@ai-sdk/mcp@2.0.24/packages/mcp">compare view</a></li> </ul> </details> <br /> Updates `@ai-sdk/openai` from 4.0.27 to 4.0.29 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vercel/ai/blob/main/packages/openai/CHANGELOG.md">@ai-sdk/openai's changelog</a>.</em></p> <blockquote> <h2>4.0.29</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [160ccdb] <ul> <li><code>@ai-sdk/provider-utils</code><a href="https://github.com/5"><code>@5</code></a>.0.20</li> </ul> </li> </ul> <h2>4.0.28</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [79e133c] <ul> <li><code>@ai-sdk/provider</code><a href="https://github.com/4"><code>@4</code></a>.0.5</li> <li><code>@ai-sdk/provider-utils</code><a href="https://github.com/5"><code>@5</code></a>.0.19</li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/ai/commit/22095f409fdf70dc858546fe26b1cf92f12f87f1"><code>22095f4</code></a> Version Packages (<a href="https://github.com/vercel/ai/tree/HEAD/packages/openai/issues/18381">#18381</a>)</li> <li><a href="https://github.com/vercel/ai/commit/9df82a8bc70f569ae0fbb701a81fd6209ec2a2b7"><code>9df82a8</code></a> Version Packages (<a href="https://github.com/vercel/ai/tree/HEAD/packages/openai/issues/18368">#18368</a>)</li> <li>See full diff in <a href="https://github.com/vercel/ai/commits/@ai-sdk/openai@4.0.29/packages/openai">compare view</a></li> </ul> </details> <br /> Updates `@cloudflare/vitest-pool-workers` from 0.18.8 to 0.20.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/cloudflare/workers-sdk/releases">@cloudflare/vitest-pool-workers's releases</a>.</em></p> <blockquote> <h2><code>@cloudflare/vitest-pool-workers</code><a href="https://github.com/0"><code>@0</code></a>.20.1</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [<a href="https://github.com/cloudflare/workers-sdk/commit/cc63aae658c39ae33169c6dc89f2e6ec1071fc53"><code>cc63aae</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/f92d1fc1316ba4e5f7e308c79943cb9e34b308c2"><code>f92d1fc</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/a249591473321cc2fb88a7b62a8c2b8663ebd4ef"><code>a249591</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/f92d1fc1316ba4e5f7e308c79943cb9e34b308c2"><code>f92d1fc</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/f92d1fc1316ba4e5f7e308c79943cb9e34b308c2"><code>f92d1fc</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/cec9d8875d3f103acc813724ded980867bd25ed7"><code>cec9d88</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/e0bbf55fdce5239a88c78a4350d3287f52d77964"><code>e0bbf55</code></a>]: <ul> <li>wrangler@4.118.0</li> </ul> </li> </ul> <h2><code>@cloudflare/vitest-pool-workers</code><a href="https://github.com/0"><code>@0</code></a>.20.0</h2> <h3>Minor Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/cloudflare/workers-sdk/pull/14586">#14586</a> <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a> Thanks <a href="https://github.com/emily-shen"><code>@emily-shen</code></a>! - Breaking change: Remove several options from the <code>miniflare</code> override options</p> <p>The following options have been removed from the <code>miniflare</code> override options, as they were not intended to be exposed, were not functional, or have been superseded by other options:</p> <ul> <li><code>wrappedBindings</code></li> <li><code>cacheWarnUsage</code></li> <li><code>fetchMock</code>: you should use <code>outboundService</code> instead</li> <li><code>containerEngine</code>: containers were not supported in vitest-pool-workers. Consider using <a href="https://developers.cloudflare.com/workers/testing/test-harness/"><code>createTestHarness()</code></a> instead if you want to test against actual containers.</li> </ul> <p>Additionally, <code>cache</code> has been deprecated and renamed to <code>cacheAPI</code>, but <code>cache</code> remains functional.</p> </li> </ul> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/cloudflare/workers-sdk/pull/14586">#14586</a> <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a> Thanks <a href="https://github.com/emily-shen"><code>@emily-shen</code></a>! - Preserve the deprecated Miniflare <code>cache</code> option</p> <p>Vitest configurations using <code>cache</code> continue to work after the internal Miniflare v5 upgrade. The option is translated to <code>cacheAPI</code>; new configurations should use <code>cacheAPI</code> directly.</p> </li> <li> <p><a href="https://redirect.github.com/cloudflare/workers-sdk/pull/14586">#14586</a> <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a> Thanks <a href="https://github.com/emily-shen"><code>@emily-shen</code></a>! - Stop enabling Miniflare's removed <code>unsafeStickyBlobs</code> option</p> <p>The pool no longer sets the <code>unsafeStickyBlobs</code> Miniflare option, which has been removed. This option was only needed for the Durable Object isolated storage feature that was dropped in 0.13.0, so there is no change in behaviour.</p> </li> <li> <p>Updated dependencies [<a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>]:</p> <ul> <li><a href="mailto:miniflare@5.20260730.0-alpha">miniflare@5.20260730.0-alpha</a></li> <li>wrangler@4.117.0</li> </ul> </li> </ul> <h2><code>@cloudflare/vitest-pool-workers</code><a href="https://github.com/0"><code>@0</code></a>.19.1</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [<a href="https://github.com/cloudflare/workers-sdk/commit/01d7020806dd523158cf9f26a4575365117f5381"><code>01d7020</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/beec0fbc9d3adec24bc42e31a21fe7f82badb543"><code>beec0fb</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/48f0c6cbbc50dfac02e2d76554c181ced233a792"><code>48f0c6c</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/8049ca451c9561e8b72f3eeeb7916a8712f06133"><code>8049ca4</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/d7f38c311e8cd0f29f56a25250da45f62b20f8ca"><code>d7f38c3</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/1394867d1dc357d9bddabf8c16aede47d052fb18"><code>1394867</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/cc5447865022ebc602258cfbeb79953181a62ae0"><code>cc54478</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5c25cfe4e03e0d3d42ddab57adc3274d6f6a1a30"><code>5c25cfe</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/b21eac24878f060296915f198fae910268c465ef"><code>b21eac2</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/bb09f1bd77a194520db3e61d733996f4bbe4bad8"><code>bb09f1b</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/1f61001e5f7a807db7856f5d89e0b26e12a0d0a0"><code>1f61001</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/01d7020806dd523158cf9f26a4575365117f5381"><code>01d7020</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/e31ab0f40c5310babd8b493490c0e1ca677e9a8c"><code>e31ab0f</code></a>]: <ul> <li>miniflare@4.20260730.0</li> <li>wrangler@4.116.0</li> </ul> </li> </ul> <h2><code>@cloudflare/vitest-pool-workers</code><a href="https://github.com/0"><code>@0</code></a>.19.0</h2> <h3>Minor Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/cloudflare/workers-sdk/pull/14879">#14879</a> <a href="https://github.com/cloudflare/workers-sdk/commit/e6480e3c26e849034e9e511a2fd1216257975656"><code>e6480e3</code></a> Thanks <a href="https://github.com/dmmulroy"><code>@dmmulroy</code></a>! - Add a <code>verbose</code> option to <code>cloudflareTest()</code> and <code>cloudflarePool()</code> configuration</p> <p>Set <code>verbose: false</code> to suppress verbose workerd runtime logs, such as caught Durable Object RPC errors. The option defaults to <code>true</code> to preserve existing output.</p> </li> </ul> <h3>Patch Changes</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/cloudflare/workers-sdk/blob/main/packages/vitest-pool-workers/CHANGELOG.md">@cloudflare/vitest-pool-workers's changelog</a>.</em></p> <blockquote> <h2>0.20.1</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [<a href="https://github.com/cloudflare/workers-sdk/commit/cc63aae658c39ae33169c6dc89f2e6ec1071fc53"><code>cc63aae</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/f92d1fc1316ba4e5f7e308c79943cb9e34b308c2"><code>f92d1fc</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/a249591473321cc2fb88a7b62a8c2b8663ebd4ef"><code>a249591</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/f92d1fc1316ba4e5f7e308c79943cb9e34b308c2"><code>f92d1fc</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/f92d1fc1316ba4e5f7e308c79943cb9e34b308c2"><code>f92d1fc</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/cec9d8875d3f103acc813724ded980867bd25ed7"><code>cec9d88</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/e0bbf55fdce5239a88c78a4350d3287f52d77964"><code>e0bbf55</code></a>]: <ul> <li>wrangler@4.118.0</li> </ul> </li> </ul> <h2>0.20.0</h2> <h3>Minor Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/cloudflare/workers-sdk/pull/14586">#14586</a> <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a> Thanks <a href="https://github.com/emily-shen"><code>@emily-shen</code></a>! - Breaking change: Remove several options from the <code>miniflare</code> override options</p> <p>The following options have been removed from the <code>miniflare</code> override options, as they were not intended to be exposed, were not functional, or have been superseded by other options:</p> <ul> <li><code>wrappedBindings</code></li> <li><code>cacheWarnUsage</code></li> <li><code>fetchMock</code>: you should use <code>outboundService</code> instead</li> <li><code>containerEngine</code>: containers were not supported in vitest-pool-workers. Consider using <a href="https://developers.cloudflare.com/workers/testing/test-harness/"><code>createTestHarness()</code></a> instead if you want to test against actual containers.</li> </ul> <p>Additionally, <code>cache</code> has been deprecated and renamed to <code>cacheAPI</code>, but <code>cache</code> remains functional.</p> </li> </ul> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/cloudflare/workers-sdk/pull/14586">#14586</a> <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a> Thanks <a href="https://github.com/emily-shen"><code>@emily-shen</code></a>! - Preserve the deprecated Miniflare <code>cache</code> option</p> <p>Vitest configurations using <code>cache</code> continue to work after the internal Miniflare v5 upgrade. The option is translated to <code>cacheAPI</code>; new configurations should use <code>cacheAPI</code> directly.</p> </li> <li> <p><a href="https://redirect.github.com/cloudflare/workers-sdk/pull/14586">#14586</a> <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a> Thanks <a href="https://github.com/emily-shen"><code>@emily-shen</code></a>! - Stop enabling Miniflare's removed <code>unsafeStickyBlobs</code> option</p> <p>The pool no longer sets the <code>unsafeStickyBlobs</code> Miniflare option, which has been removed. This option was only needed for the Durable Object isolated storage feature that was dropped in 0.13.0, so there is no change in behaviour.</p> </li> <li> <p>Updated dependencies [<a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>]:</p> <ul> <li><a href="mailto:miniflare@5.20260730.0-alpha">miniflare@5.20260730.0-alpha</a></li> <li>wrangler@4.117.0</li> </ul> </li> </ul> <h2>0.19.1</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [<a href="https://github.com/cloudflare/workers-sdk/commit/01d7020806dd523158cf9f26a4575365117f5381"><code>01d7020</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/beec0fbc9d3adec24bc42e31a21fe7f82badb543"><code>beec0fb</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/48f0c6cbbc50dfac02e2d76554c181ced233a792"><code>48f0c6c</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/8049ca451c9561e8b72f3eeeb7916a8712f06133"><code>8049ca4</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/d7f38c311e8cd0f29f56a25250da45f62b20f8ca"><code>d7f38c3</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/1394867d1dc357d9bddabf8c16aede47d052fb18"><code>1394867</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/cc5447865022ebc602258cfbeb79953181a62ae0"><code>cc54478</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/5c25cfe4e03e0d3d42ddab57adc3274d6f6a1a30"><code>5c25cfe</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/b21eac24878f060296915f198fae910268c465ef"><code>b21eac2</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/bb09f1bd77a194520db3e61d733996f4bbe4bad8"><code>bb09f1b</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/1f61001e5f7a807db7856f5d89e0b26e12a0d0a0"><code>1f61001</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/01d7020806dd523158cf9f26a4575365117f5381"><code>01d7020</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/e31ab0f40c5310babd8b493490c0e1ca677e9a8c"><code>e31ab0f</code></a>]: <ul> <li>miniflare@4.20260730.0</li> <li>wrangler@4.116.0</li> </ul> </li> </ul> <h2>0.19.0</h2> <h3>Minor Changes</h3> <ul> <li><a href="https://redirect.github.com/cloudflare/workers-sdk/pull/14879">#14879</a> <a href="https://github.com/cloudflare/workers-sdk/commit/e6480e3c26e849034e9e511a2fd1216257975656"><code>e6480e3</code></a> Thanks <a href="https://github.com/dmmulroy"><code>@dmmulroy</code></a>! - Add a <code>verbose</code> option to <code>cloudflareTest()</code> and <code>cloudflarePool()</code> configuration</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/cloudflare/workers-sdk/commit/95d9b12f2c707f254b66b446e0bd9fd6b8b7d96d"><code>95d9b12</code></a> Version Packages (<a href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers/issues/14946">#14946</a>)</li> <li><a href="https://github.com/cloudflare/workers-sdk/commit/83a37e3ef05d6930f29df904978e7f6eacde2203"><code>83a37e3</code></a> docs: point vitest-pool-workers BUILD section at the tsdown config (<a href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers/issues/14940">#14940</a>)</li> <li><a href="https://github.com/cloudflare/workers-sdk/commit/fcb5402346b2424008c7a0d0612ee8ba2f65bf3e"><code>fcb5402</code></a> Version Packages (<a href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers/issues/14939">#14939</a>)</li> <li><a href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a> Miniflare v5 alpha (<a href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers/issues/14586">#14586</a>)</li> <li><a href="https://github.com/cloudflare/workers-sdk/commit/96fd16f0e06e82eb99001c70e4935e992e69cb87"><code>96fd16f</code></a> Version Packages (<a href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers/issues/14898">#14898</a>)</li> <li><a href="https://github.com/cloudflare/workers-sdk/commit/760a85b6fac60b0a73298c99df54ae0058653c76"><code>760a85b</code></a> Version Packages (<a href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers/issues/14824">#14824</a>)</li> <li><a href="https://github.com/cloudflare/workers-sdk/commit/e6480e3c26e849034e9e511a2fd1216257975656"><code>e6480e3</code></a> [vitest-pool-workers] Make workerd verbose logging configurable (<a href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers/issues/14879">#14879</a>)</li> <li><a href="https://github.com/cloudflare/workers-sdk/commit/edc203e42a10a52f8d2af305fecd2fed4807274e"><code>edc203e</code></a> [vitest-pool-workers] Ignore workerd's ungraceful TLS disconnect exception lo...</li> <li>See full diff in <a href="https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vitest-pool-workers@0.20.1/packages/vitest-pool-workers">compare view</a></li> </ul> </details> <br /> Updates `@cloudflare/workers-types` from 5.20260801.1 to 5.20260804.1 <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/cloudflare/workerd/commits">compare view</a></li> </ul> </details> <br /> Updates `@mastra/core` from 1.52.1 to 1.55.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/mastra-ai/mastra/releases">@mastra/core's releases</a>.</em></p> <blockquote> <h2>July 30, 2026</h2> <h2>Highlights</h2> <h3>In-process Code Mode execution (no workspace sandbox required)</h3> <p>Code Mode transports can now declare <code>requiresSandbox: false</code>, letting <code>createCodeMode()</code> run without a workspace sandbox for in-process execution boundaries. This enables secure in-process runtimes like V8 isolates and exports <code>sanitizeToolId</code> so transports can share consistent <code>external_</code> naming.</p> <h3>New <code>@mastra/isolated-vm</code> package for V8-isolated Code Mode</h3> <p>Introduces <code>@mastra/isolated-vm</code> with <code>IsolatedVmCodeModeTransport</code>, running model-authored programs inside an in-process V8 isolate with no filesystem/network/process access (only bridged <code>external_</code> tools). Note: requires <code>isolated-vm</code> native addon and Node 20+ hosts must start with <code>--no-node-snapshot</code>.</p> <h3>Built-in provider-native Web Search tool</h3> <p><code>@mastra/core</code> adds <code>webSearchTool</code>, a first-party web search tool that resolves to provider-native search when supported by the configured model/provider, simplifying “current info” agent setups.</p> <h3>Stored agent drafts via <code>autoPublish</code> (Server + JS SDK)</h3> <p>Both <code>@mastra/server</code> and <code>@mastra/client-js</code> add <code>autoPublish</code> to stored agent creation so you can create an initial unpublished draft for review before publishing (existing calls still publish immediately by default).</p> <h3>New Factory channel identity domain + channels integration slot</h3> <p><code>@mastra/factory</code> adds a <code>channel-identity</code> storage domain to link chat-platform senders to Factory users, plus a <code>channels()</code> integration slot to attach an <code>AgentControllerChannels</code> during <code>prepare()</code> so inbound platform messages can drive the same agents as the web UI.</p> <h3>Breaking Changes</h3> <ul> <li><code>ChannelHandler</code> context parameter is now required: the 4th parameter is <code>ctx: ChannelHandlerContext</code> (non-optional). Code that <em>calls</em> a <code>ChannelHandler</code>-typed function with only three args must be updated to pass <code>ctx</code>.</li> </ul> <h2>Changelog</h2> <h3><a href="https://github.com/mastra-ai/mastra/blob/@mastra/core@1.55.0/packages/core/CHANGELOG.md">@mastra/core@1.55.0</a></h3> <h4>Minor Changes</h4> <ul> <li> <p>Added support for Code Mode transports that provide their own execution boundary. A transport can now declare <code>requiresSandbox: false</code> and <code>createCodeMode()</code> will run it without a workspace sandbox, which enables in-process transports such as <code>IsolatedVmCodeModeTransport</code> from <code>@mastra/isolated-vm</code>: (<a href="https://redirect.github.com/mastra-ai/mastra/pull/20359">#20359</a>)</p> <pre lang="typescript"><code>import { createCodeMode } from '@mastra/core/tools'; import { IsolatedVmCodeModeTransport } from '@mastra/isolated-vm'; <p>// No sandbox needed — the V8 isolate is the execution boundary const { tool, instructions } = createCodeMode({ tools }, new IsolatedVmCodeModeTransport()); </code></pre></p> <p>Also fixed the generated Code Mode instructions to describe isolation accurately instead of always claiming the program runs fully sandboxed, since the actual boundary depends on the configured sandbox and transport. The <code>sanitizeToolId</code> helper used for <code>external_*</code> naming is now exported from <code>@mastra/core/tools</code> so transports can reuse it instead of duplicating it.</p> </li> <li> <p>Added retry callbacks for stream error policies and ensured explicit matcher policies override provider retry metadata. (<a href="https://redirect.github.com/mastra-ai/mastra/pull/19724">#19724</a>)</p> </li> <li> <p>Channel handlers can now contribute to the request context of the run they start. (<a href="https://redirect.github.com/mastra-ai/mastra/pull/20060">#20060</a>)</p> <p><code>ChannelHandlerContext</code> gains a <code>requestContext</code> field holding the <code>RequestContext</code> for the run the inbound message is about to start. It is constructed fresh for every message, and a handler may write to it before calling <code>defaultHandler</code>. Core then adds its own channel and render-context entries and dispatches with the same instance, so anything the handler wrote reaches the run.</p> <pre lang="ts"><code>import { AgentControllerChannels } from '@mastra/core/channels'; <p>const channels = new AgentControllerChannels({ adapters, handlers: { </code></pre></p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/mastra-ai/mastra/commit/bccb45d579ae7a914b9c03733f919127952c2300"><code>bccb45d</code></a> chore: version - exit prerelease mode</li> <li><a href="https://github.com/mastra-ai/mastra/commit/469696312ac4c618bc8475b0c5ed7949b8a3455e"><code>4696963</code></a> fix(core): persist delegation prompt exactly once in sub-agent threads (<a href="https://github.com/mastra-ai/mastra/tree/HEAD/packages/core/issues/20174">#20174</a>)</li> <li><a href="https://github.com/mastra-ai/mastra/commit/6b861234d6728e50c7b424d504024b468d6db2b8"><code>6b86123</code></a> chore: version packages (alpha) (<a href="https://github.com/mastra-ai/mastra/tree/HEAD/packages/core/issues/20419">#20419</a>)</li> <li><a href="https://github.com/mastra-ai/mastra/commit/723aa5437106bdb708ae03c0ef6b77aa11291e73"><code>723aa54</code></a> feat(factory): stricter review agent — weigh existing comments, calibrated ve...</li> <li><a href="https://github.com/mastra-ai/mastra/commit/ef8a7ceb6d663723e5e09aa6ebabc716665325af"><code>ef8a7ce</code></a> chore: version packages (alpha) (<a href="https://github.com/mastra-ai/mastra/tree/HEAD/packages/core/issues/20358">#20358</a>)</li> <li><a href="https://github.com/mastra-ai/mastra/commit/07f5b4ba9d608d88865030732e580298296adf99"><code>07f5b4b</code></a> fix(core): avoid serializing result comparisons (<a href="https://github.com/mastra-ai/mastra/tree/HEAD/packages/core/issues/20340">#20340</a>)</li> <li><a href="https://github.com/mastra-ai/mastra/commit/9c16d7b20f02b5bfd1152861a69fd6694c26f4b3"><code>9c16d7b</code></a> chore: regenerate providers and docs [skip ci]</li> <li><a href="https://github.com/mastra-ai/mastra/commit/55c9e248c27c1d72b5bb7e94ea6b8a3999eee49f"><code>55c9e24</code></a> Run Slack messages as the sender's Mastra tenant (<a href="https://github.com/mastra-ai/mastra/tree/HEAD/packages/core/issues/20060">#20060</a>)</li> <li><a href="https://github.com/mastra-ai/mastra/commit/cfb2899d510252f39ddf46fb75c35c11fb4a36f4"><code>cfb2899</code></a> chore: version packages</li> <li><a href="https://github.com/mastra-ai/mastra/commit/ba369f2a0aaf998da0d6aa033d26f64f96bef8ac"><code>ba369f2</code></a> feat(isolated-vm): add IsolatedVmCodeModeTransport for in-process Code Mode i...</li> <li>Additional commits viewable in <a href="https://github.com/mastra-ai/mastra/commits/@mastra/core@1.55.0/packages/core">compare view</a></li> </ul> </details> <br /> Updates `@modelcontextprotocol/sdk` from 1.26.0 to 1.30.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/modelcontextprotocol/typescript-sdk/releases">@modelcontextprotocol/sdk's releases</a>.</em></p> <blockquote> <h2>1.30.0</h2> <h2>What's Changed</h2> <ul> <li>fix(server): prioritize zod issues and format them by <a href="https://github.com/mozmo15"><code>@mozmo15</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1503">modelcontextprotocol/typescript-sdk#1503</a></li> <li>chore(ci): switch publish to OIDC trusted publishing by <a href="https://github.com/felixweinberger"><code>@felixweinberger</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1839">modelcontextprotocol/typescript-sdk#1839</a></li> <li>Add end-to-end test suite by <a href="https://github.com/felixweinberger"><code>@felixweinberger</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2167">modelcontextprotocol/typescript-sdk#2167</a></li> <li>v1 stdio buffer limit by <a href="https://github.com/KKonstantinov"><code>@KKonstantinov</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2239">modelcontextprotocol/typescript-sdk#2239</a></li> <li>fix: support Zod 3.25 method literals by <a href="https://github.com/mattzcarey"><code>@mattzcarey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2368">modelcontextprotocol/typescript-sdk#2368</a></li> <li>Validate Content-Type by parsed media type instead of substring match (v1.x) by <a href="https://github.com/felixweinberger"><code>@felixweinberger</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2444">modelcontextprotocol/typescript-sdk#2444</a></li> <li>fix: send SSE keep-alive comment frames from Streamable HTTP server transport (v1.x) by <a href="https://github.com/mattzcarey"><code>@mattzcarey</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2538">modelcontextprotocol/typescript-sdk#2538</a></li> <li>fix(deps): widen <code>@hono/node-server</code> past GHSA-frvp-7c67-39w9 by <a href="https://github.com/arimu1"><code>@arimu1</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2549">modelcontextprotocol/typescript-sdk#2549</a></li> <li>Fix SSE keep-alive timer lifecycle in Streamable HTTP server transport (v1.x) by <a href="https://github.com/felixweinberger"><code>@felixweinberger</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2547">modelcontextprotocol/typescript-sdk#2547</a></li> <li>chore: bump version to 1.30.0 by <a href="https://github.com/felixweinberger"><code>@felixweinberger</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2563">modelcontextprotocol/typescript-sdk#2563</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/mozmo15"><code>@mozmo15</code></a> made their first contribution in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1503">modelcontextprotocol/typescript-sdk#1503</a></li> <li><a href="https://github.com/arimu1"><code>@arimu1</code></a> made their first contribution in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2549">modelcontextprotocol/typescript-sdk#2549</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/modelcontextprotocol/typescript-sdk/compare/v1.29.0...1.30.0">https://github.com/modelcontextprotocol/typescript-sdk/compare/v1.29.0...1.30.0</a></p> <h2>v1.29.0</h2> <h2>What's Changed</h2> <ul> <li>fix: treat v1.x as primary branch for npm latest tag (backport <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/1577">#1577</a>) by <a href="https://github.com/felixweinberger"><code>@felixweinberger</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1749">modelcontextprotocol/typescript-sdk#1749</a></li> <li>[v1.x] fix: disallow null (infinite) requested TTL by <a href="https://github.com/LucaButBoring"><code>@LucaButBoring</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1339">modelcontextprotocol/typescript-sdk#1339</a></li> <li>[v1.x] fix: add missing size field to ResourceSchema by <a href="https://github.com/olaservo"><code>@olaservo</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1575">modelcontextprotocol/typescript-sdk#1575</a></li> <li>Add typings exports by <a href="https://github.com/tdraier"><code>@tdraier</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1623">modelcontextprotocol/typescript-sdk#1623</a></li> <li>v1.x npm audit fix by <a href="https://github.com/KKonstantinov"><code>@KKonstantinov</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1780">modelcontextprotocol/typescript-sdk#1780</a></li> <li>v1.x <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/1623">#1623</a> follow up -add missing types to package.json by <a href="https://github.com/KKonstantinov"><code>@KKonstantinov</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1773">modelcontextprotocol/typescript-sdk#1773</a></li> <li>[v1.x backport] Allow servers / clients to advertise extensions in the capability object by <a href="https://github.com/localden"><code>@localden</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1811">modelcontextprotocol/typescript-sdk#1811</a></li> <li>fix(stdio): always set windowsHide on Windows, not just in Electron by <a href="https://github.com/jnMetaCode"><code>@jnMetaCode</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1640">modelcontextprotocol/typescript-sdk#1640</a></li> <li>chore: bump version to 1.29.0 by <a href="https://github.com/felixweinberger"><code>@felixweinberger</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1820">modelcontextprotocol/typescript-sdk#1820</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/tdraier"><code>@tdraier</code></a> made their first contribution in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1623">modelcontextprotocol/typescript-sdk#1623</a></li> <li><a href="https://github.com/jnMetaCode"><code>@jnMetaCode</code></a> made their first contribution in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1640">modelcontextprotocol/typescript-sdk#1640</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/modelcontextprotocol/typescript-sdk/compare/v1.28.0...v1.29.0">https://github.com/modelcontextprotocol/typescript-sdk/compare/v1.28.0...v1.29.0</a></p> <h2>v1.28.0</h2> <h2>What's Changed</h2> <ul> <li>feat: use scopes_supported from resource metadata by default (fixes <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/580">#580</a>) by <a href="https://github.com/antogyn"><code>@antogyn</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/757">modelcontextprotocol/typescript-sdk#757</a></li> <li>[v1.x backport] Default to client_secret_basic when server omits token_endpoint_auth_methods_supported by <a href="https://github.com/pcarleton"><code>@pcarleton</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1611">modelcontextprotocol/typescript-sdk#1611</a></li> <li>fix: reject plain JSON Schema objects passed as inputSchema by <a href="https://github.com/tiluckdave"><code>@tiluckdave</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1596">modelcontextprotocol/typescript-sdk#1596</a></li> <li>fix: clear _timeoutInfo in _onclose() and scope .finally() abort controller cleanup by <a href="https://github.com/pcarleton"><code>@pcarleton</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1462">modelcontextprotocol/typescript-sdk#1462</a></li> <li>fix(server/auth): RFC 8252 loopback port relaxation by <a href="https://github.com/poteat"><code>@poteat</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1738">modelcontextprotocol/typescript-sdk#1738</a></li> <li>chore: bump version to 1.28.0 by <a href="https://github.com/felixweinberger"><code>@felixweinberger</code></a> in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1746">modelcontextprotocol/typescript-sdk#1746</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/antogyn"><code>@antogyn</code></a> made their first contribution in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/757">modelcontextprotocol/typescript-sdk#757</a></li> <li><a href="https://github.com/tiluckdave"><code>@tiluckdave</code></a> made their first contribution in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1596">modelcontextprotocol/typescript-sdk#1596</a></li> <li><a href="https://github.com/poteat"><code>@poteat</code></a> made their first contribution in <a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1738">modelcontextprotocol/typescript-sdk#1738</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/2d889f2b329e46680ec9bdd565de4616c497825a"><code>2d889f2</code></a> chore: bump version to 1.30.0 (<a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2563">#2563</a>)</li> <li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/e3f3daa12cc2603919939b72136ce9d9e800b868"><code>e3f3daa</code></a> Fix SSE keep-alive timer lifecycle in Streamable HTTP server transport (v1.x)...</li> <li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/bb5a718cbf90796bacbf62218b359196d210426b"><code>bb5a718</code></a> fix(deps): widen <code>@hono/node-server</code> past GHSA-frvp-7c67-39w9 (<a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2549">#2549</a>)</li> <li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/1dad2634ce5799fb386283d14291d1b4935a9a52"><code>1dad263</code></a> fix: send SSE keep-alive comment frames from Streamable HTTP server transport...</li> <li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/69749aa5081ddfe675d36da8d96c7e27d83742b8"><code>69749aa</code></a> Validate Content-Type by parsed media type instead of substring match (v1.x) ...</li> <li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/369513df7b0e9d8a979c86f68ba1930e0d5f27f0"><code>369513d</code></a> fix: support Zod 3.25 method literals (<a href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2368">#2368</a>)</li> <li><a href="https://github.com/modelcontextprotocol/typescript-sdk/commit/e7ee57c2f33b8290a78a3cefa27ab635fe67fbff"><code>e7ee57c</code></a> v1 stdio buffer limit (<a href="https://redirect.github.com/modelcontextprotocol... _Description has been truncated_ --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: jkomyno <12381818+jkomyno@users.noreply.github.com>	2026-08-07 18:41:15 +05:30
dependabot[bot]	2cab683f0e	chore(deps-dev): bump the npm-development group with 6 updates (#4091 ) Bumps the npm-development group with 6 updates: \| Package \| From \| To \| \| --- \| --- \| --- \| \| [lint-staged](https://github.com/lint-staged/lint-staged) \| `17.2.0` \| `17.3.0` \| \| [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) \| `1.76.0` \| `1.77.0` \| \| [oxlint-plugin-eslint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint) \| `1.76.0` \| `1.77.0` \| \| [@types/semver](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/semver) \| `7.7.1` \| `7.8.0` \| \| [@earendil-works/pi-coding-agent](https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent) \| `0.82.1` \| `0.83.0` \| \| [eve](https://github.com/vercel/eve/tree/HEAD/packages/eve) \| `0.27.13` \| `0.29.5` \| Updates `lint-staged` from 17.2.0 to 17.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/lint-staged/lint-staged/releases">lint-staged's releases</a>.</em></p> <blockquote> <h2>v17.3.0</h2> <h3>Minor Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/lint-staged/lint-staged/pull/1825">#1825</a> <a href="https://github.com/lint-staged/lint-staged/commit/16b3f74850e5d2811b5fbaea6c136733a71ad3e4"><code>16b3f74</code></a> - It is now possible to run multiple tasks in parallel for a single glob by configuring it with an array of tasks (which run sequentially), and then placing another array inside it (where the tasks will run in parallel). The following demonstrates the order tasks will start in:</p> <pre lang="json"><code>{ ".ts": ["first", "second", ["third", "third"], "fourth"] } </code></pre> <p>As a concrete example, <em>lint-staged</em>'s own configuration is:</p> <pre lang="js"><code>/* @type {import('./lib/index.js').Configuration} / export default { "": [ [ "oxfmt --check --no-error-on-unmatched-pattern", "oxlint --no-error-on-unmatched-pattern", ], ], ".ts": () => "tsc", }; </code></pre> <p>which means:</p> <ol> <li>for all staged files, run the two commands in parallel with staged filenames appended, for example: <ul> <li><code>oxfmt --check --no-error-on-unmatched-pattern lib/index.js</code></li> <li><code>oxlint --no-error-on-unmatched-pattern lib/index.js</code></li> </ul> </li> <li>additionally, if any <code>.ts</code> files are staged, run <code>tsc</code> without appending any arguments</li> <li>The two sets of commands also run in parallel</li> </ol> </li> </ul> <h3>Patch Changes</h3> <ul> <li><a href="https://redirect.github.com/lint-staged/lint-staged/pull/1829">#1829</a> <a href="https://github.com/lint-staged/lint-staged/commit/15f7e5314b4afe4702808d978758b22d42437f43"><code>15f7e53</code></a> - During an in-progress merge, files that are unchanged from the branch being merged are now skipped. Technically, files are only included if there are staged changes against both <code>HEAD</code> and <code>MERGE_HEAD</code>.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md">lint-staged's changelog</a>.</em></p> <blockquote> <h2>17.3.0</h2> <h3>Minor Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/lint-staged/lint-staged/pull/1825">#1825</a> <a href="https://github.com/lint-staged/lint-staged/commit/16b3f74850e5d2811b5fbaea6c136733a71ad3e4"><code>16b3f74</code></a> - It is now possible to run multiple tasks in parallel for a single glob by configuring it with an array of tasks (which run sequentially), and then placing another array inside it (where the tasks will run in parallel). The following demonstrates the order tasks will start in:</p> <pre lang="json"><code>{ ".ts": ["first", "second", ["third", "third"], "fourth"] } </code></pre> <p>As a concrete example, <em>lint-staged</em>'s own configuration is:</p> <pre lang="js"><code>/* @type {import('./lib/index.js').Configuration} / export default { "": [ [ "oxfmt --check --no-error-on-unmatched-pattern", "oxlint --no-error-on-unmatched-pattern", ], ], ".ts": () => "tsc", }; </code></pre> <p>which means:</p> <ol> <li>for all staged files, run the two commands in parallel with staged filenames appended, for example: <ul> <li><code>oxfmt --check --no-error-on-unmatched-pattern lib/index.js</code></li> <li><code>oxlint --no-error-on-unmatched-pattern lib/index.js</code></li> </ul> </li> <li>additionally, if any <code>.ts</code> files are staged, run <code>tsc</code> without appending any arguments</li> <li>The two sets of commands also run in parallel</li> </ol> </li> </ul> <h3>Patch Changes</h3> <ul> <li><a href="https://redirect.github.com/lint-staged/lint-staged/pull/1829">#1829</a> <a href="https://github.com/lint-staged/lint-staged/commit/15f7e5314b4afe4702808d978758b22d42437f43"><code>15f7e53</code></a> - During an in-progress merge, files that are unchanged from the branch being merged are now skipped. Technically, files are only included if there are staged changes against both <code>HEAD</code> and <code>MERGE_HEAD</code>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/lint-staged/lint-staged/commit/d15344350d914f5ce24df2c85f3ffebb9b387f3b"><code>d153443</code></a> Merge pull request <a href="https://redirect.github.com/lint-staged/lint-staged/issues/1828">#1828</a> from lint-staged/changeset-release/main</li> <li><a href="https://github.com/lint-staged/lint-staged/commit/5162c149bbfa09b8a5ad4d37c647d63946568ca8"><code>5162c14</code></a> chore(changeset): release</li> <li><a href="https://github.com/lint-staged/lint-staged/commit/a4db9a4c32f108d1397436752be7e9dda956baa2"><code>a4db9a4</code></a> Merge pull request <a href="https://redirect.github.com/lint-staged/lint-staged/issues/1831">#1831</a> from lint-staged/linter-updates</li> <li><a href="https://github.com/lint-staged/lint-staged/commit/ea96cab0109ab44a5b2562927b890648ee32b4cc"><code>ea96cab</code></a> style: enable oxlint "suspicious" category</li> <li><a href="https://github.com/lint-staged/lint-staged/commit/2fae00778cea0c99da9bcb8bad4718dce08ea04e"><code>2fae007</code></a> style: add <code>@e18e/eslint-plugin</code></li> <li><a href="https://github.com/lint-staged/lint-staged/commit/2280c38a09ff4ca4db60320b5879e0029527afaa"><code>2280c38</code></a> Merge pull request <a href="https://redirect.github.com/lint-staged/lint-staged/issues/1829">#1829</a> from lint-staged/fix-merge-conflict-files</li> <li><a href="https://github.com/lint-staged/lint-staged/commit/1453ae6ae0e05275d714ad0cad7cd090885f504d"><code>1453ae6</code></a> test: relax assertion so that it passes in worktree</li> <li><a href="https://github.com/lint-staged/lint-staged/commit/15f7e5314b4afe4702808d978758b22d42437f43"><code>15f7e53</code></a> fix: lint only files changed against HEAD and MERGE_HEAD, during a merge</li> <li><a href="https://github.com/lint-staged/lint-staged/commit/dedfc31007aed50e1c9c5591a11085cb485ba41c"><code>dedfc31</code></a> Merge pull request <a href="https://redirect.github.com/lint-staged/lint-staged/issues/1825">#1825</a> from lint-staged/parallel-tasks-inside-sequence</li> <li><a href="https://github.com/lint-staged/lint-staged/commit/286e25cef9fde2fb6e77d2312fd91ac99020d69d"><code>286e25c</code></a> feat: allow running parallel tasks by nesting arrays</li> <li>Additional commits viewable in <a href="https://github.com/lint-staged/lint-staged/compare/v17.2.0...v17.3.0">compare view</a></li> </ul> </details> <br /> Updates `oxlint` from 1.76.0 to 1.77.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/oxc-project/oxc/releases">oxlint's releases</a>.</em></p> <blockquote> <h2>oxlint v1.27.0 && oxfmt v0.12.0</h2> <h1>Oxlint v1.27.0</h1> <h3>🚀 Features</h3> <ul> <li>222a8f0 linter/plugins: Implement <code>SourceCode#isSpaceBetween</code> (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15498">#15498</a>) (overlookmotel)</li> <li>2f9735d linter/plugins: Implement <code>context.languageOptions</code> (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15486">#15486</a>) (overlookmotel)</li> <li>bc731ff linter/plugins: Stub out all <code>Context</code> APIs (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15479">#15479</a>) (overlookmotel)</li> <li>5822cb4 linter/plugins: Add <code>extend</code> method to <code>FILE_CONTEXT</code> (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15477">#15477</a>) (overlookmotel)</li> <li>7b1e6f3 apps: Add pure rust binaries and release to github (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15469">#15469</a>) (Boshen)</li> <li>2a89b43 linter: Introduce debug assertions after fixes to assert validity (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15389">#15389</a>) (camc314)</li> <li>ad3c45a editor: Add <code>oxc.path.node</code> option (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15040">#15040</a>) (Sysix)</li> </ul> <h3>🐛 Bug Fixes</h3> <ul> <li>6f3cd77 linter/no-var: Incorrect warning for blocks (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15504">#15504</a>) (Hamir Mahal)</li> <li>6957fb9 linter/plugins: Do not allow access to <code>Context#id</code> in <code>createOnce</code> (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15489">#15489</a>) (overlookmotel)</li> <li>7409630 linter/plugins: Allow access to <code>cwd</code> in <code>createOnce</code> in ESLint interop mode (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15488">#15488</a>) (overlookmotel)</li> <li>732205e parser: Reject <code>using</code> / <code>await using</code> in a switch <code>case</code> / <code>default</code> clause (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15225">#15225</a>) (sapphi-red)</li> <li>a17ca32 linter/plugins: Replace <code>Context</code> class (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15448">#15448</a>) (overlookmotel)</li> <li>ecf2f7b language_server: Fail gracefully when tsgolint executable not found (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15436">#15436</a>) (camc314)</li> <li>3c8d3a7 lang-server: Improve logging in failure case for tsgolint (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15299">#15299</a>) (camc314)</li> <li>ef71410 linter: Use jsx if source type is JS in fix debug assertion (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15434">#15434</a>) (camc314)</li> <li>e32bbf6 linter/no-var: Handle TypeScript declare keyword in fixer (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15426">#15426</a>) (camc314)</li> <li>6565dbe linter/switch-case-braces: Skip comments when searching for <code>:</code> token (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15425">#15425</a>) (camc314)</li> <li>85bd19a linter/prefer-class-fields: Insert value after type annotation in fixer (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15423">#15423</a>) (camc314)</li> <li>fde753e linter/plugins: Block access to <code>context.settings</code> in <code>createOnce</code> (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15394">#15394</a>) (overlookmotel)</li> <li>ddd9f9f linter/forward-ref-uses-ref: Dont suggest removing wrapper in invalid positions (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15388">#15388</a>) (camc314)</li> <li>dac2a9c linter/no-template-curly-in-string: Remove fixer (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15387">#15387</a>) (camc314)</li> <li>989b8e3 linter/no-var: Only fix to <code>const</code> if the var has an initializer (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15385">#15385</a>) (camc314)</li> <li>cc403f5 linter/plugins: Return empty object for unimplemented parserServices (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15364">#15364</a>) (magic-akari)</li> </ul> <h3>⚡ Performance</h3> <ul> <li>25d577e language_server: Start tools in parallel (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15500">#15500</a>) (Sysix)</li> <li>3c57291 linter/plugins: Optimize loops (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15449">#15449</a>) (overlookmotel)</li> <li>3166233 linter/plugins: Remove <code>Arc</code>s (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15431">#15431</a>) (overlookmotel)</li> <li>9de1322 linter/plugins: Lazily deserialize settings JSON (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15395">#15395</a>) (overlookmotel)</li> <li>3049ec2 linter/plugins: Optimize <code>deepFreezeSettings</code> (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15392">#15392</a>) (overlookmotel)</li> <li>444ebfd linter/plugins: Use single object for <code>parserServices</code> (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15378">#15378</a>) (overlookmotel)</li> </ul> <h3>📚 Documentation</h3> <ul> <li>97d2104 linter: Update comment in lint.rs about default value for tsconfig path (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15530">#15530</a>) (Connor Shea)</li> <li>2c6bd9e linter: Always refer as "ES2015" instead of "ES6" (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15411">#15411</a>) (sapphi-red)</li> <li>a0c5203 linter/import/named: Update "ES7" comment in examples (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15410">#15410</a>) (sapphi-red)</li> <li>3dc24b5 linter,minifier: Always refer as "ES Modules" instead of "ES6 Modules" (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15409">#15409</a>) (sapphi-red)</li> <li>2ad77fb linter/no-this-before-super: Correct "Why is this bad?" section (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15408">#15408</a>) (sapphi-red)</li> <li>57f0ce1 linter: Add backquotes where appropriate (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15407">#15407</a>) (sapphi-red)</li> </ul> <h1>Oxfmt v0.12.0</h1> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md">oxlint's changelog</a>.</em></p> <blockquote> <h2>[1.77.0] - 2026-08-03</h2> <h3>🐛 Bug Fixes</h3> <ul> <li>5c0fa61 linter/eslint/no-warning-comments: Unify config structs and remove manual options docs (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25151">#25151</a>) (Mikhail Baev)</li> </ul> <h3>📚 Documentation</h3> <ul> <li>9dc7756 linter/typescript/no-unnecessary-condition: Clarify options (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25110">#25110</a>) (camc314)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/oxc-project/oxc/commit/9a423f2f485b79c2353c49442c0c7f60f900261d"><code>9a423f2</code></a> release(apps): oxlint v1.77.0 && oxfmt v0.62.0 (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25251">#25251</a>)</li> <li><a href="https://github.com/oxc-project/oxc/commit/5c0fa61ddbd098fea5101dff356dc9b67adbee95"><code>5c0fa61</code></a> fix(linter/eslint/no-warning-comments): unify config structs and remove manua...</li> <li><a href="https://github.com/oxc-project/oxc/commit/9dc77567291db6ebd0641284f80bf50163c6a257"><code>9dc7756</code></a> docs(linter/typescript/no-unnecessary-condition): clarify options (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25110">#25110</a>)</li> <li>See full diff in <a href="https://github.com/oxc-project/oxc/commits/oxlint_v1.77.0/npm/oxlint">compare view</a></li> </ul> </details> <br /> Updates `oxlint-plugin-eslint` from 1.76.0 to 1.77.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/oxc-project/oxc/commit/9a423f2f485b79c2353c49442c0c7f60f900261d"><code>9a423f2</code></a> release(apps): oxlint v1.77.0 && oxfmt v0.62.0 (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25251">#25251</a>)</li> <li>See full diff in <a href="https://github.com/oxc-project/oxc/commits/apps_v1.77.0/npm/oxlint-plugin-eslint">compare view</a></li> </ul> </details> <br /> Updates `@types/semver` from 7.7.1 to 7.8.0 <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/semver">compare view</a></li> </ul> </details> <br /> Updates `@earendil-works/pi-coding-agent` from 0.82.1 to 0.83.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/earendil-works/pi/releases">@earendil-works/pi-coding-agent's releases</a>.</em></p> <blockquote> <h2>v0.83.0</h2> <h3>New Features</h3> <ul> <li><strong>Credential export for external clients</strong> — <code>pi auth print-api-key</code> and <code>pi auth print-bearer-token</code> export configured credentials with automatic OAuth refresh and minimum-validity enforcement.</li> <li><strong>Headless OpenRouter sign-in</strong> — Complete <code>/login</code> over SSH by pasting the redirect URL or authorization code when the loopback callback is unavailable. See <a href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/providers.md#openrouter">OpenRouter</a>.</li> <li><strong>Claude Opus 5 on GitHub Copilot</strong> — Use Claude Opus 5 through GitHub Copilot with adaptive thinking and a 1M context window. See <a href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/providers.md#github-copilot">GitHub Copilot</a>.</li> </ul> <h3>Breaking Changes</h3> <ul> <li>Upgraded bundled TypeBox aliases to 1.3.7, removing deprecated APIs including <code>Type.Base</code>, <code>Type.Awaited</code>, <code>Type.Promise</code>, <code>Type.AsyncIterator</code>, <code>Type.Iterator</code>, <code>Type.Options</code>, and <code>Value.Mutate</code>, while fixing compiled validation of nullable array tool arguments. Extensions using removed APIs must migrate to supported TypeBox APIs. See <a href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/packages.md#dependencies">Package Dependencies</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7243">#7243</a> by <a href="https://github.com/petrroll"><code>@petrroll</code></a>).</li> </ul> <h3>Added</h3> <ul> <li>Added <code>pi auth print-api-key</code> and <code>pi auth print-bearer-token</code> commands for exporting configured credentials to external clients, including automatic OAuth refresh and configurable minimum token validity (<a href="https://redirect.github.com/earendil-works/pi/pull/7168">#7168</a>).</li> <li>Exposed the session's resolved model scope as <code>ctx.scopedModels</code> to extensions. See <a href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/extensions.md#ctxmodelregistry--ctxmodel--ctxthinkinglevel--ctxscopedmodels">Extension Context</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7191">#7191</a> by <a href="https://github.com/pungggi"><code>@pungggi</code></a>, <a href="https://redirect.github.com/earendil-works/pi/pull/7215">#7215</a>).</li> <li>Added inherited per-request <code>fetch</code> injection for supported text and image provider transports.</li> <li>Added the inherited <code>"pending"</code> stop reason for partial streaming messages. See <a href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/custom-provider.md#stream-pattern">Custom Provider Stream Pattern</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7151">#7151</a> by <a href="https://github.com/lucasmeijer"><code>@lucasmeijer</code></a>).</li> <li>Added inherited raw provider stop reasons across Google, Anthropic, Amazon Bedrock, Mistral, and OpenAI streams; unmapped terminal reasons now surface as provider errors instead of successful stops (<a href="https://redirect.github.com/earendil-works/pi/pull/7272">#7272</a>).</li> <li>Added manual redirect URL and authorization-code entry to OpenRouter login for remote and headless environments. See <a href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/providers.md#openrouter">OpenRouter</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7114">#7114</a> by <a href="https://github.com/rgarcia"><code>@rgarcia</code></a>).</li> <li>Added inherited Claude Opus 5 support for GitHub Copilot with adaptive thinking and a 1M context window. See <a href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/providers.md#github-copilot">GitHub Copilot</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7158">#7158</a> by <a href="https://github.com/jay-aye-see-kay"><code>@jay-aye-see-kay</code></a>).</li> </ul> <h3>Changed</h3> <ul> <li>Changed inherited OAuth credential resolution to refresh tokens with less than five minutes of validity remaining instead of waiting until expiration (<a href="https://redirect.github.com/earendil-works/pi/pull/7168">#7168</a>).</li> </ul> <h3>Fixed</h3> <ul> <li>Added a status line when the tool output expansion is toggled (<a href="https://redirect.github.com/earendil-works/pi/issues/7180">#7180</a>).</li> <li>Fixed file-backed <code>SYSTEM.md</code> and <code>APPEND_SYSTEM.md</code> prompts being omitted from the interactive startup context listing. See <a href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/usage.md#system-prompt-files">System Prompt Files</a> (<a href="https://redirect.github.com/earendil-works/pi/issues/7096">#7096</a>).</li> <li>Fixed context files loading twice when a linked Git worktree is nested under its main repository. See <a href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/usage.md#context-files">Context Files</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7221">#7221</a> by <a href="https://github.com/arajkumar"><code>@arajkumar</code></a>).</li> <li>Fixed llama.cpp streamed responses reporting zero token usage and leaving session context accounting empty. See <a href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/llama-cpp.md">llama.cpp</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7258">#7258</a> by <a href="https://github.com/SteveImmanuel"><code>@SteveImmanuel</code></a>).</li> <li>Fixed session replacement and committed tree navigation during an active response to abort and persist the outgoing turn instead of leaving dangling tool calls. See <a href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/usage.md#sessions">Sessions</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7022">#7022</a> by <a href="https://github.com/tmustier"><code>@tmustier</code></a>).</li> <li>Fixed failed Git package installs leaving partial directories that blocked clean retries. See <a href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/packages.md#install-and-manage">Install and Manage</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7210">#7210</a> by <a href="https://github.com/haoqixu"><code>@haoqixu</code></a>).</li> <li>Fixed the <code>/model</code> selector retaining a stale selection while filtering instead of highlighting the top match (<a href="https://redirect.github.com/earendil-works/pi/pull/7211">#7211</a> by <a href="https://github.com/christianbasch"><code>@christianbasch</code></a>).</li> <li>Fixed direct RPC bash commands bypassing extension <code>user_bash</code> handlers. See <a href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/extensions.md#user-bash-events">User Bash Events</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7214">#7214</a>).</li> <li>Fixed skills, prompts, and themes losing package source metadata after extensions reload resources. See <a href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/extensions.md#resource-events">Resource Events</a> (<a href="https://redirect.github.com/earendil-works/pi/issues/6968">#6968</a>).</li> <li>Fixed cancellation of concurrently running user bash commands so every active command is aborted (<a href="https://redirect.github.com/earendil-works/pi/pull/7103">#7103</a> by <a href="https://github.com/yzhg1983"><code>@yzhg1983</code></a>).</li> <li>Fixed duplicate messages appearing when extensions switch sessions during interactive startup (<a href="https://redirect.github.com/earendil-works/pi/pull/7110">#7110</a> by <a href="https://github.com/yzhg1983"><code>@yzhg1983</code></a>).</li> <li>Fixed inherited Qwen Token Plan reasoning models to send their service-specific thinking controls and supported reasoning-effort levels (<a href="https://redirect.github.com/earendil-works/pi/issues/6951">#6951</a>, <a href="https://redirect.github.com/earendil-works/pi/issues/6998">#6998</a>).</li> <li>Fixed inherited Z.AI output limits being sent through an unsupported parameter. See <a href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/providers.md">Providers</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7174">#7174</a> by <a href="https://github.com/HyeokjaeLee"><code>@HyeokjaeLee</code></a>).</li> <li>Fixed explicitly configured Amazon Bedrock profiles being overridden by ambient AWS access keys. See <a href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/providers.md#amazon-bedrock">Amazon Bedrock</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7176">#7176</a> by <a href="https://github.com/christianbasch"><code>@christianbasch</code></a>).</li> <li>Fixed inherited image fallback paths overflowing narrow terminals, shortened home-directory paths, and made absolute paths clickable when terminal hyperlinks are available (<a href="https://redirect.github.com/earendil-works/pi/pull/7262">#7262</a>).</li> <li>Fixed inherited OpenAI-compatible tool calls losing their function arguments when malformed deltas also contain an empty <code>custom</code> object (<a href="https://redirect.github.com/earendil-works/pi/pull/7288">#7288</a> by <a href="https://github.com/sunnyyoung"><code>@sunnyyoung</code></a>).</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/CHANGELOG.md">@earendil-works/pi-coding-agent's changelog</a>.</em></p> <blockquote> <h2>[0.83.0] - 2026-07-29</h2> <h3>New Features</h3> <ul> <li><strong>Credential export for external clients</strong> — <code>pi auth print-api-key</code> and <code>pi auth print-bearer-token</code> export configured credentials with automatic OAuth refresh and minimum-validity enforcement.</li> <li><strong>Headless OpenRouter sign-in</strong> — Complete <code>/login</code> over SSH by pasting the redirect URL or authorization code when the loopback callback is unavailable. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#openrouter">OpenRouter</a>.</li> <li><strong>Claude Opus 5 on GitHub Copilot</strong> — Use Claude Opus 5 through GitHub Copilot with adaptive thinking and a 1M context window. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#github-copilot">GitHub Copilot</a>.</li> </ul> <h3>Breaking Changes</h3> <ul> <li>Upgraded bundled TypeBox aliases to 1.3.7, removing deprecated APIs including <code>Type.Base</code>, <code>Type.Awaited</code>, <code>Type.Promise</code>, <code>Type.AsyncIterator</code>, <code>Type.Iterator</code>, <code>Type.Options</code>, and <code>Value.Mutate</code>, while fixing compiled validation of nullable array tool arguments. Extensions using removed APIs must migrate to supported TypeBox APIs. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/packages.md#dependencies">Package Dependencies</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7243">#7243</a> by <a href="https://github.com/petrroll"><code>@petrroll</code></a>).</li> </ul> <h3>Added</h3> <ul> <li>Added <code>pi auth print-api-key</code> and <code>pi auth print-bearer-token</code> commands for exporting configured credentials to external clients, including automatic OAuth refresh and configurable minimum token validity (<a href="https://redirect.github.com/earendil-works/pi/pull/7168">#7168</a>).</li> <li>Exposed the session's resolved model scope as <code>ctx.scopedModels</code> to extensions. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/extensions.md#ctxmodelregistry--ctxmodel--ctxthinkinglevel--ctxscopedmodels">Extension Context</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7191">#7191</a> by <a href="https://github.com/pungggi"><code>@pungggi</code></a>, <a href="https://redirect.github.com/earendil-works/pi/pull/7215">#7215</a>).</li> <li>Added inherited per-request <code>fetch</code> injection for supported text and image provider transports.</li> <li>Added the inherited <code>"pending"</code> stop reason for partial streaming messages. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/custom-provider.md#stream-pattern">Custom Provider Stream Pattern</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7151">#7151</a> by <a href="https://github.com/lucasmeijer"><code>@lucasmeijer</code></a>).</li> <li>Added inherited raw provider stop reasons across Google, Anthropic, Amazon Bedrock, Mistral, and OpenAI streams; unmapped terminal reasons now surface as provider errors instead of successful stops (<a href="https://redirect.github.com/earendil-works/pi/pull/7272">#7272</a>).</li> <li>Added manual redirect URL and authorization-code entry to OpenRouter login for remote and headless environments. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#openrouter">OpenRouter</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7114">#7114</a> by <a href="https://github.com/rgarcia"><code>@rgarcia</code></a>).</li> <li>Added inherited Claude Opus 5 support for GitHub Copilot with adaptive thinking and a 1M context window. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#github-copilot">GitHub Copilot</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7158">#7158</a> by <a href="https://github.com/jay-aye-see-kay"><code>@jay-aye-see-kay</code></a>).</li> </ul> <h3>Changed</h3> <ul> <li>Changed inherited OAuth credential resolution to refresh tokens with less than five minutes of validity remaining instead of waiting until expiration (<a href="https://redirect.github.com/earendil-works/pi/pull/7168">#7168</a>).</li> </ul> <h3>Fixed</h3> <ul> <li>Added a status line when the tool output expansion is toggled (<a href="https://redirect.github.com/earendil-works/pi/issues/7180">#7180</a>).</li> <li>Fixed file-backed <code>SYSTEM.md</code> and <code>APPEND_SYSTEM.md</code> prompts being omitted from the interactive startup context listing. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/usage.md#system-prompt-files">System Prompt Files</a> (<a href="https://redirect.github.com/earendil-works/pi/issues/7096">#7096</a>).</li> <li>Fixed context files loading twice when a linked Git worktree is nested under its main repository. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/usage.md#context-files">Context Files</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7221">#7221</a> by <a href="https://github.com/arajkumar"><code>@arajkumar</code></a>).</li> <li>Fixed llama.cpp streamed responses reporting zero token usage and leaving session context accounting empty. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/llama-cpp.md">llama.cpp</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7258">#7258</a> by <a href="https://github.com/SteveImmanuel"><code>@SteveImmanuel</code></a>).</li> <li>Fixed session replacement and committed tree navigation during an active response to abort and persist the outgoing turn instead of leaving dangling tool calls. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/usage.md#sessions">Sessions</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7022">#7022</a> by <a href="https://github.com/tmustier"><code>@tmustier</code></a>).</li> <li>Fixed failed Git package installs leaving partial directories that blocked clean retries. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/packages.md#install-and-manage">Install and Manage</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7210">#7210</a> by <a href="https://github.com/haoqixu"><code>@haoqixu</code></a>).</li> <li>Fixed the <code>/model</code> selector retaining a stale selection while filtering instead of highlighting the top match (<a href="https://redirect.github.com/earendil-works/pi/pull/7211">#7211</a> by <a href="https://github.com/christianbasch"><code>@christianbasch</code></a>).</li> <li>Fixed direct RPC bash commands bypassing extension <code>user_bash</code> handlers. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/extensions.md#user-bash-events">User Bash Events</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7214">#7214</a>).</li> <li>Fixed skills, prompts, and themes losing package source metadata after extensions reload resources. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/extensions.md#resource-events">Resource Events</a> (<a href="https://redirect.github.com/earendil-works/pi/issues/6968">#6968</a>).</li> <li>Fixed cancellation of concurrently running user bash commands so every active command is aborted (<a href="https://redirect.github.com/earendil-works/pi/pull/7103">#7103</a> by <a href="https://github.com/yzhg1983"><code>@yzhg1983</code></a>).</li> <li>Fixed duplicate messages appearing when extensions switch sessions during interactive startup (<a href="https://redirect.github.com/earendil-works/pi/pull/7110">#7110</a> by <a href="https://github.com/yzhg1983"><code>@yzhg1983</code></a>).</li> <li>Fixed inherited Qwen Token Plan reasoning models to send their service-specific thinking controls and supported reasoning-effort levels (<a href="https://redirect.github.com/earendil-works/pi/issues/6951">#6951</a>, <a href="https://redirect.github.com/earendil-works/pi/issues/6998">#6998</a>).</li> <li>Fixed inherited Z.AI output limits being sent through an unsupported parameter. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md">Providers</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7174">#7174</a> by <a href="https://github.com/HyeokjaeLee"><code>@HyeokjaeLee</code></a>).</li> <li>Fixed explicitly configured Amazon Bedrock profiles being overridden by ambient AWS access keys. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#amazon-bedrock">Amazon Bedrock</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7176">#7176</a> by <a href="https://github.com/christianbasch"><code>@christianbasch</code></a>).</li> <li>Fixed inherited image fallback paths overflowing narrow terminals, shortened home-directory paths, and made absolute paths clickable when terminal hyperlinks are available (<a href="https://redirect.github.com/earendil-works/pi/pull/7262">#7262</a>).</li> <li>Fixed inherited OpenAI-compatible tool calls losing their function arguments when malformed deltas also contain an empty <code>custom</code> object (<a href="https://redirect.github.com/earendil-works/pi/pull/7288">#7288</a> by <a href="https://github.com/sunnyyoung"><code>@sunnyyoung</code></a>).</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/earendil-works/pi/commit/845d6ff1f6643aba440341cce877ce1c43ebbc39"><code>845d6ff</code></a> Release v0.83.0</li> <li><a href="https://github.com/earendil-works/pi/commit/f0499a63ff5563ff041c689f680ecbf01436a5e2"><code>f0499a6</code></a> docs: audit changelogs since v0.82.1</li> <li><a href="https://github.com/earendil-works/pi/commit/bff5ab71743b442efa234dbed369e0a96da791f3"><code>bff5ab7</code></a> fix(coding-agent): show system prompt files in startup context (<a href="https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent/issues/7266">#7266</a>)</li> <li><a href="https://github.com/earendil-works/pi/commit/cced6a21da273b26ee4a23a803680614bbe8dd1e"><code>cced6a2</code></a> fix(coding-agent): stop loading AGENTS.md twice in nested git worktrees (<a href="https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent/issues/7221">#7221</a>)</li> <li><a href="https://github.com/earendil-works/pi/commit/f9476a61e557bfdce2fbf3ffeaad0988fe47c184"><code>f9476a6</code></a> fix(ai): update TypeBox nullable array validation (<a href="https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent/issues/7243">#7243</a>)</li> <li><a href="https://github.com/earendil-works/pi/commit/0c32e83a352a4284133b2544f730a23814948ac3"><code>0c32e83</code></a> fix(coding-agent): enable streaming usage for llama.cpp provider (<a href="https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent/issues/7258">#7258</a>)</li> <li><a href="https://github.com/earendil-works/pi/commit/47ca25fcd8535b80710fad5be758f1f2cf81443c"><code>47ca25f</code></a> Revert "fix(coding-agent): build-check-test (<a href="https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent/issues/7206">#7206</a>)"</li> <li><a href="https://github.com/earendil-works/pi/commit/0d008b746892ad33d3fe15c0c4bc86a14369e0e8"><code>0d008b7</code></a> fix(coding-agent): show tool expansion status</li> <li><a href="https://github.com/earendil-works/pi/commit/f14519551682cd0fddac2e4b4e8b1f333667e94c"><code>f145195</code></a> fix(coding-agent): build-check-test (<a href="https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent/issues/7206">#7206</a>)</li> <li><a href="https://github.com/earendil-works/pi/commit/cefa40ed8f8dbcd6ffd67b5e7a0eaa75a5050d1a"><code>cefa40e</code></a> *WIP it's a PoC * fix(coding-agent): guard tree navigation during respons...</li> <li>Additional commits viewable in <a href="https://github.com/earendil-works/pi/commits/v0.83.0/packages/coding-agent">compare view</a></li> </ul> </details> <br /> Updates `eve` from 0.27.13 to 0.29.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/eve/releases">eve's releases</a>.</em></p> <blockquote> <h2>eve@0.29.5</h2> <h3>Patch Changes</h3> <ul> <li>c0dc572: Rename the TUI <code>/new</code> command to <code>/reset</code> so session reset uses the same name across the client, HTTP, channel, and TUI APIs.</li> <li>3dce30a: Add manual session compaction through custom-channel helpers, the eve HTTP client, and the <code>eve dev</code> TUI's <code>/compact</code> command. Compaction preserves the session, queues behind an active turn, and does not send synthetic model input.</li> <li>910805e: Make a single <code>Esc</code> cancel the running turn in the eve dev TUI when no message is queued. Queued messages still use <code>Esc</code> to steer the oldest message into the next turn.</li> <li>9c51755: Connection search and discovered connection tools now use the same <code>defineDynamic</code> and <code>defineTool</code> pipeline as authored tools. Dynamic tool maps now reject entries that omit <code>defineTool</code> instead of accepting unsupported raw objects.</li> <li>84aa671: Clarify the dev TUI’s <code>/add</code> flow with consistent integration categories and category-specific browsing labels. MCP connections are now named explicitly, and the flow more clearly explains channels, extensions, and observability integrations.</li> <li>0c28eb7: Allow declared subagents to export <code>defineDynamic</code> from <code>agent.ts</code>. Session and turn resolvers can now return an agent configuration to expose it or nil to omit it from direct and Workflow delegation.</li> <li>f3bb60d: Add manual session-context clearing through custom-channel helpers, the eve HTTP client, and the <code>eve dev</code> TUI's <code>/clear</code> command. Clearing removes model-message history while preserving the session, agent configuration, durable state, limits, and sandbox.</li> <li>ac7d3c6: Add <code>/cancel</code> to the eve dev TUI. The command cooperatively cancels a running turn from either the live streaming input or the idle prompt while preserving the session and settled context.</li> </ul> <h2>eve@0.29.4</h2> <h3>Patch Changes</h3> <ul> <li>e90a8c2: Launch local or deployed eve applications as stable ACP v1 agents with <code>eve acp [url]</code>, including streamed messages, tool activity, human input, cancellation, concurrent sessions, and verified Vercel authentication.</li> <li>cec672d: Add guided Discord setup through <code>eve add channel/discord</code>, including Vercel Connect provisioning, trigger attachment, interactions endpoint configuration, slash-command registration, and channel scaffolding.</li> <li>ed328e7: Render registry item titles with their exact registry-provided casing by loading manifests for each page of catalog results.</li> <li>c875a67: Update the generated <code>AGENTS.md</code> to direct coding agents to the eve registry for discovering and installing integrations.</li> <li>5153b13: Add JSON output to <code>eve registry list</code> and <code>eve registry search</code> for scripts that inspect registry catalogs.</li> <li>155d46a: Connection registry items now configure their Vercel Connect connector during <code>eve add</code>, and registry setup commands close their IPC channel after reporting an outcome so <code>/add</code> returns instead of remaining stuck.</li> <li>6f3daca: Add <code>ClientSession.snapshot()</code> for reading a finite, cursor-consistent session event prefix that can hydrate server-rendered applications.</li> <li>67bfc76: Resolve sandbox skill roots and seed-file paths through the same <code>$HOME</code> resolver the file tools use, so the skills location is spelled once instead of twice.</li> <li>a5acde8: Ensure exiting the dev TUI shuts down its owned server and any surviving workflow processes before the CLI exits. Persisted workflow messages now reach the ready worker during restart instead of being rejected while the file watcher starts.</li> <li>731464f: Give the local trace spool's on-disk layout a single owner: the shared trace reader now exposes the listing and segment-read primitives that <code>eve traces</code> and the <code>/traces</code> viewer both use, and payload formatting is shared between the detail panel and the conversation view.</li> <li>f7ba3b3: Derive the <code>/traces</code> conversation viewer's line geometry from one prefix-sum helper so scroll, click, and wheel math cannot disagree, and reset the view through a single factory when the viewed trace changes.</li> <li>3f4bb9c: The <code>/traces</code> viewer now follows your terminal's colors instead of forcing a hardcoded black/grey truecolor palette. It probes the terminal's default background (OSC 11) and derives its card surfaces from your own theme — subtly elevated bands on dark and light backgrounds alike, with red bands for failures, and card titles that invert to black on light backgrounds so they stay legible. Terminals that don't answer the probe get a clean gutter-rail rendering drawn entirely with the shared TUI theme.</li> <li>f5d0533: Derive the dev TUI's slash-command suggestion window from the command registry instead of a hand-maintained constant, and collapse the duplicated cursor step in the terminal line-wrap loop.</li> </ul> <h2>eve@0.29.3</h2> <h3>Patch Changes</h3> <ul> <li>22bfa02: Add guided Photon setup through <code>eve add channel/photon-imessage</code>, including project creation, phone registration, Vercel Connect or portable credentials, and channel scaffolding.</li> <li>0c0de19: Add an opt-in experimental steering policy to Chat SDK sends that cancels an active turn before delivering its replacement message.</li> <li>b00a79d: Add <code>photonIMessageChannel</code>, a first-class Photon iMessage channel with lazy credentials, Vercel OIDC webhook verification, and automatic eve session routing.</li> <li>495e93b: Resolve leading <code>$HOME</code> paths in the built-in <code>read_file</code>, <code>write_file</code>, <code>glob</code>, and <code>grep</code> tools so agents can directly access packaged skill references advertised in their prompt.</li> <li>bf01952: Local trace spans now capture model and tool payloads: the system prompt, prompt messages, and response text/reasoning/tool calls on model spans, and call arguments/results on tool spans, each capped at 32 KB with provider transport metadata stripped. Set <code>EVE_TRACES_CONTENT=off</code> to keep payloads out of the spool.</li> <li>680db59: Provider-executed tool calls (like a gateway's <code>web_search</code>) now show up in local traces: their calls and results are captured on the model span and the <code>/traces</code> viewer renders them as tool cards, with oversized outputs truncated to stay valid JSON.</li> <li>7ab6d8a: Terminal text wrapping in the dev TUI is now linear-time, so views rendering large single-line payloads (long tool results, big JSON) no longer stall on every repaint.</li> <li>52cee9c: Consolidate the three Vercel CLI subprocess runners onto one shared lifecycle. A <code>vercel</code> lookup killed by a signal (for example Ctrl-C during setup) now reports a cancellation failure instead of resolving as a success with truncated output.</li> <li>7703448: The local trace spool reader behind <code>eve traces</code> moved into a shared internal module; command behavior is unchanged.</li> <li>2d87acb: Subagent turn spans now record the dispatch that created them — <code>agent.parent.session.id</code>, <code>agent.parent.turn.id</code>, <code>agent.parent.call_id</code>, and <code>agent.subagent.name</code> — so a parent turn that fans out to several children can be attributed to the exact tool call behind each one.</li> <li>3c846bc: The <code>/traces</code> viewer supports drag-to-select: dragging with the mouse highlights text and releasing copies it to the clipboard (OSC 52 with tmux passthrough, plus the platform clipboard command) with a confirmation toast. Clicks now act on release so drags never toggle cards, and Esc cancels an in-flight selection.</li> <li>3645c6e: The <code>/traces</code> viewer frame breathes: padding rows around the title and above the footer hints, the copy toast floats top-right as a small surface with a left edge bar, and the scroll wheel scrolls the attributes drawer when the pointer is over it.</li> <li>8858403: The local tracing subsystem (spool writer/reader, retention, the zero-config local OTel runtime, and agent span capture) moved from <code>src/harness</code> into its own <code>src/tracing</code> module; no behavior change.</li> <li>9adb455: Adds a <code>/traces</code> command to the dev TUI: a full-screen live viewer over the local trace spool that re-tells each trace as a chat-style conversation — system prompt, user and assistant messages, and tool calls render as expandable cards (arrow keys or mouse click to expand/collapse), with a right-side metadata drawer. Subagent turns are badged with their dispatch lineage (<code>subagent:<name></code>), and the viewer opens on the trace containing the current session — including windowed sessions and subagent children recorded into a parent's trace. Expanded cards scroll line-by-line so content taller than the viewport is fully readable. Model spans with errors, token usage, or tool calls (but no text) now appear as cards instead of disappearing. Terminal escape sequences in trace payloads are stripped at render time. Tool-call arguments and results are captured without stripping domain-level <code>providerOptions</code>/<code>providerMetadata</code> keys. A single prompt message over 32 KiB is truncated at the text level so the serialized JSON stays parseable. Local spans capture system prompt, prompt messages, responses, reasoning, and tool arguments/results (<code>EVE_TRACES_CONTENT=off</code> to disable); long conversations truncate oldest messages first with an omission marker.</li> <li>275271d: Subagent runs now record into the trace of the session that dispatched them instead of a disconnected trace of their own, and <code>eve traces</code> resolves either session id to it. Local traces also open a real <code>agent.session</code> root span rather than a synthesized parent, so an authored OTel sampler's root rule decides whether a session is sampled, and a session long enough to outgrow one trace rolls into numbered windows that <code>eve traces <session-id></code> lists oldest first. Rows whose lifetime outlives the worker that opened them — <code>agent.session</code> and <code>agent.turn</code> — now show the extent of their descendants instead of <code>0ms</code>.</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vercel/eve/blob/main/packages/eve/CHANGELOG.md">eve's changelog</a>.</em></p> <blockquote> <h2>0.29.5</h2> <h3>Patch Changes</h3> <ul> <li>c0dc572: Rename the TUI <code>/new</code> command to <code>/reset</code> so session reset uses the same name across the client, HTTP, channel, and TUI APIs.</li> <li>3dce30a: Add manual session compaction through custom-channel helpers, the eve HTTP client, and the <code>eve dev</code> TUI's <code>/compact</code> command. Compaction preserves the session, queues behind an active turn, and does not send synthetic model input.</li> <li>910805e: Make a single <code>Esc</code> cancel the running turn in the eve dev TUI when no message is queued. Queued messages still use <code>Esc</code> to steer the oldest message into the next turn.</li> <li>9c51755: Connection search and discovered connection tools now use the same <code>defineDynamic</code> and <code>defineTool</code> pipeline as authored tools. Dynamic tool maps now reject entries that omit <code>defineTool</code> instead of accepting unsupported raw objects.</li> <li>84aa671: Clarify the dev TUI’s <code>/add</code> flow with consistent integration categories and category-specific browsing labels. MCP connections are now named explicitly, and the flow more clearly explains channels, extensions, and observability integrations.</li> <li>0c28eb7: Allow declared subagents to export <code>defineDynamic</code> from <code>agent.ts</code>. Session and turn resolvers can now return an agent configuration to expose it or nil to omit it from direct and Workflow delegation.</li> <li>f3bb60d: Add manual session-context clearing through custom-channel helpers, the eve HTTP client, and the <code>eve dev</code> TUI's <code>/clear</code> command. Clearing removes model-message history while preserving the session, agent configuration, durable state, limits, and sandbox.</li> <li>ac7d3c6: Add <code>/cancel</code> to the eve dev TUI. The command cooperatively cancels a running turn from either the live streaming input or the idle prompt while preserving the session and settled context.</li> </ul> <h2>0.29.4</h2> <h3>Patch Changes</h3> <ul> <li>e90a8c2: Launch local or deployed eve applications as stable ACP v1 agents with <code>eve acp [url]</code>, including streamed messages, tool activity, human input, cancellation, concurrent sessions, and verified Vercel authentication.</li> <li>cec672d: Add guided Discord setup through <code>eve add channel/discord</code>, including Vercel Connect provisioning, trigger attachment, interactions endpoint configuration, slash-command registration, and channel scaffolding.</li> <li>ed328e7: Render registry item titles with their exact registry-provided casing by loading manifests for each page of catalog results.</li> <li>c875a67: Update the generated <code>AGENTS.md</code> to direct coding agents to the eve registry for discovering and installing integrations.</li> <li>5153b13: Add JSON output to <code>eve registry list</code> and <code>eve registry search</code> for scripts that inspect registry catalogs.</li> <li>155d46a: Connection registry items now configure their Vercel Connect connector during <code>eve add</code>, and registry setup commands close their IPC channel after reporting an outcome so <code>/add</code> returns instead of remaining stuck.</li> <li>6f3daca: Add <code>ClientSession.snapshot()</code> for reading a finite, cursor-consistent session event prefix that can hydrate server-rendered applications.</li> <li>67bfc76: Resolve sandbox skill roots and seed-file paths through the same <code>$HOME</code> resolver the file tools use, so the skills location is spelled once instead of twice.</li> <li>a5acde8: Ensure exiting the dev TUI shuts down its owned server and any surviving workflow processes before the CLI exits. Persisted workflow messages now reach the ready worker during restart instead of being rejected while the file watcher starts.</li> <li>731464f: Give the local trace spool's on-disk layout a single owner: the shared trace reader now exposes the listing and segment-read primitives that <code>eve traces</code> and the <code>/traces</code> viewer both use, and payload formatting is shared between the detail panel and the conversation view.</li> <li>f7ba3b3: Derive the <code>/traces</code> conversation viewer's line geometry from one prefix-sum helper so scroll, click, and wheel math cannot disagree, and reset the view through a single factory when the viewed trace changes.</li> <li>3f4bb9c: The <code>/traces</code> viewer now follows your terminal's colors instead of forcing a hardcoded black/grey truecolor palette. It probes the terminal's default background (OSC 11) and derives its card surfaces from your own theme — subtly elevated bands on dark and light backgrounds alike, with red bands for failures, and card titles that invert to black on light backgrounds so they stay legible. Terminals that don't answer the probe get a clean gutter-rail rendering drawn entirely with the shared TUI theme.</li> <li>f5d0533: Derive the dev TUI's slash-command suggestion window from the command registry instead of a hand-maintained constant, and collapse the duplicated cursor step in the terminal line-wrap loop.</li> </ul> <h2>0.29.3</h2> <h3>Patch Changes</h3> <ul> <li>22bfa02: Add guided Photon setup through <code>eve add channel/photon-imessage</code>, including project creation, phone registration, Vercel Connect or portable credentials, and channel scaffolding.</li> <li>0c0de19: Add an opt-in experimental steering policy to Chat SDK sends that cancels an active turn before delivering its replacement message.</li> <li>b00a79d: Add <code>photonIMessageChannel</code>, a first-class Photon iMessage channel with lazy credentials, Vercel OIDC webhook verification, and automatic eve session routing.</li> <li>495e93b: Resolve leading <code>$HOME</code> paths in the built-in <code>read_file</code>, <code>write_file</code>, <code>glob</code>, and <code>grep</code> tools so agents can directly access packaged skill references advertised in their prompt.</li> <li>bf01952: Local trace spans now capture model and tool payloads: the system prompt, prompt messages, and response text/reasoning/tool calls on model spans, and call arguments/results on tool spans, each capped at 32 KB with provider transport metadata stripped. Set <code>EVE_TRACES_CONTENT=off</code> to keep payloads out of the spool.</li> <li>680db59: Provider-executed tool calls (like a gateway's <code>web_search</code>) now show up in local traces: their calls and results are captured on the model span and the <code>/traces</code> viewer renders them as tool cards, with oversized outputs truncated to stay valid JSON.</li> <li>7ab6d8a: Terminal text wrapping in the dev TUI is now linear-time, so views rendering large single-line payloads (long tool results, big JSON) no longer stall on every repaint.</li> <li>52cee9c: Consolidate the three Vercel CLI subprocess runners onto one shared lifecycle. A <code>vercel</code> lookup killed by a signal (for example Ctrl-C during setup) now reports a cancellation failure instead of resolving as a success with truncated output.</li> <li>7703448: The local trace spool reader behind <code>eve traces</code> moved into a shared internal module; command behavior is unchanged.</li> <li>2d87acb: Subagent turn spans now record the dispatch that created them — <code>agent.parent.session.id</code>, <code>agent.parent.turn.id</code>, <code>agent.parent.call_id</code>, and <code>agent.subagent.name</code> — so a parent turn that fans out to several children can be attributed to the exact tool call behind each one.</li> <li>3c846bc: The <code>/traces</code> viewer supports drag-to-select: dragging with the mouse highlights text and releasing copies it to the clipboard (OSC 52 with tmux passthrough, plus the platform clipboard command) with a confirmation toast. Clicks now act on release so drags never toggle cards, and Esc cancels an in-flight selection.</li> <li>3645c6e: The <code>/traces</code> viewer frame breathes: padding rows around the title and above the footer hints, the copy toast floats top-right as a small surface with a left edge bar, and the scroll wheel scrolls the attributes drawer when the pointer is over it.</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/eve/commit/8988139097d1e1a1f1aca9b2828e63408848fccf"><code>8988139</code></a> Version Packages (<a href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1497">#1497</a>)</li> <li><a href="https://github.com/vercel/eve/commit/c0dc57240ec850b0f73075f0e3cc900c6e07640a"><code>c0dc572</code></a> feat(tui): rename /new command to /reset (<a href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1513">#1513</a>)</li> <li><a href="https://github.com/vercel/eve/commit/910805e8a825a34ba90c0a22a59dc1d787967976"><code>910805e</code></a> feat(tui): cancel with one Esc press (<a href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1514">#1514</a>)</li> <li><a href="https://github.com/vercel/eve/commit/ac7d3c66f8c43ce1008d88cedd5254bfec1301e1"><code>ac7d3c6</code></a> feat(tui): add /cancel command (<a href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1512">#1512</a>)</li> <li><a href="https://github.com/vercel/eve/commit/f3bb60dd53fa56e955c6ea71cbf72533cfe618e1"><code>f3bb60d</code></a> feat: add manual session context clearing (<a href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1511">#1511</a>)</li> <li><a href="https://github.com/vercel/eve/commit/3dce30a18d24644d85b6120d79eaf4d304beaf4b"><code>3dce30a</code></a> feat: add manual session compaction (<a href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1508">#1508</a>)</li> <li><a href="https://github.com/vercel/eve/commit/9c517555e870231af00df799523bffd9fc00df71"><code>9c51755</code></a> refactor(eve): use public dynamic definitions for connection tools (<a href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1505">#1505</a>)</li> <li><a href="https://github.com/vercel/eve/commit/0c28eb7e886c1a69ee20a5229682509d5413e140"><code>0c28eb7</code></a> feat(eve): support dynamic subagents (<a href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1485">#1485</a>)</li> <li><a href="https://github.com/vercel/eve/commit/84aa6715dbf6b6d696b7f567744711f4526b183f"><code>84aa671</code></a> fix(eve): clarify add flow categories (<a href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1494">#1494</a>)</li> <li><a href="https://github.com/vercel/eve/commit/ab86523b3e07f05f415c9c784232b3875b17b16f"><code>ab86523</code></a> feat(eve): agent-handle lifecycle contracts (three-phase handles, turn outcom...</li> <li>Additional commits viewable in <a href="https://github.com/vercel/eve/commits/eve@0.29.5/packages/eve">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-07 16:53:51 +05:30
Alberto Schiabel	ecd0861741	fix(core): release unread response bodies (#4078 ) This PR: - follows [Undici's recommendation](https://github.com/nodejs/undici#garbage-collection) to consume or cancel unread response bodies instead of leaving connection-resource cleanup to the garbage collector, which can increase connection pressure and reduce reuse - cancels every intermediate redirect body in `ssrfSafeFetch` before validating and following the next hop - cancels non-success response bodies in both URL-upload callers before preserving their existing errors - adds regression coverage for redirect ordering, redirect-budget exhaustion, and both caller error paths - adds a patch changeset for `@composio/core` - supersedes https://github.com/ComposioHQ/composio/pull/4018 and credits @pacocartones as co-author ## Verification - `pnpm --filter @composio/core test ssrfGuard fileUtils ToolRouterSessionFilesMount` (4 files, 58 tests passed) - `pnpm --filter @composio/core test` (47 files, 1,049 tests passed) - `pnpm --filter @composio/core typecheck` - `pnpm lint:packages` (0 errors; existing warnings only) - Prettier check on all touched files - `pnpm validate:changesets` Co-authored-by: pacocartones <pacocartones@users.noreply.github.com>	2026-08-06 17:52:02 +05:30
Rajarshi Datta	2a6a051bc3	refactor(core): remove unused `isNewerVersion` helper (#4029 ) This PR: - closes #4028 - removes the unused `isNewerVersion` helper from the internal version utility - avoids defining malformed-version behavior for a helper with no callers or package export - retains `next`'s tested npm version-check timeout implementation - adds a patch changeset for `@composio/core` - refreshes Python 3.12.13 artifact metadata in `mise.lock` after the upstream build was republished ## Verification - version utility tests: 2 passed - core typecheck: passed - changeset validation: passed - `mise 2026.5.18 lock --platform linux-x64,linux-arm64,macos-arm64,macos-x64`: clean --------- Co-authored-by: jkomyno <alberto@composio.dev>	2026-08-06 09:32:53 +05:30
jkomyno	86cc3cc399	chore: merge next into dependabot remediation	2026-08-05 21:29:53 +05:30
Alberto Schiabel	1221c15783	fix(core): bound the npm version-check fetch with an AbortSignal timeout (#4027 ) Fixes #4026 ## Problem The `Composio` constructor fires a background npm version check unless `disableVersionCheck` is set — and `disableVersionCheck` has no default, so this is on for every user: ```ts // ts/packages/core/src/composio.ts:399-402 if (!this.config.disableVersionCheck) { checkForLatestVersionFromNPM(version); } ``` That check performed a bare fetch with no timeout and no AbortSignal: ```ts // ts/packages/core/src/utils/version.ts:46 const response = await fetch(`https://registry.npmjs.org/${packageName}/latest`); ``` An in-flight fetch keeps its socket referenced on the Node event loop. When registry.npmjs.org is slow, black-holed, or unreachable-but-accepting (corporate proxy, egress firewall that drops rather than rejects, captive network, npm incident), the process cannot exit — all the user's work is done and it just sits there. It's also called without await, so a caller has nowhere to attach a bound of their own. Reproducing with a local server that accepts the socket and never responds: the process was still alive at 90s and had to be killed. ## Fix ```diff - // @TODO: Check if fetch is available, if not use node-fetch - const response = await fetch(`https://registry.npmjs.org/${packageName}/latest`); + const response = await fetch(`https://registry.npmjs.org/${packageName}/latest`, { + signal: AbortSignal.timeout(VERSION_CHECK_TIMEOUT_MS), + }); ``` `VERSION_CHECK_TIMEOUT_MS = 2000`. The existing `catch (_error) { /* Ignore and do nothing */ }` already swallows the resulting `TimeoutError`, so failure stays silent — which is right for a best-effort nicety nobody awaits. A comment records why the signal is there so a later cleanup doesn't drop it. Also removed the stale `@TODO: Check if fetch is available, if not use node-fetch` on the line above: the code already calls global `fetch` unconditionally, and `toolchain-versions.json` pins the tested Node versions to 22/24/25, where both `fetch` and `AbortSignal.timeout` (Node 17.3+) are available. ## Results, and one honest caveat End-to-end with the issue's reproduction: 91s, exit 124 (killed) → exited on its own after 6.0s, exit 0. That 6.0s deserves explanation, because the timeout is 2s and I did not want to overclaim. Measured in isolation: ```text fetch rejected at 2.01s with TimeoutError <- the signal works as intended handler done at 2.01s process exited at 6.03s <- undici's default 4s keepAliveTimeout ``` So the SDK's wait is bounded at 2s, which is what this change controls. The trailing ~4s is Node's global undici agent releasing the pooled socket, outside this code's reach — I tested `connection: 'close'` to see if it could be shortened and got an identical 6.03s. Eliminating it would require a custom dispatcher, which isn't worth the complexity for a background version check. Net: unbounded becomes bounded, worst-case exit ~6s instead of never. ## Tests Added `ts/packages/core/test/utils/version.test.ts` with two focused regressions: - asserts `AbortSignal.timeout` receives `2_000` and its exact signal is passed to the registry request - proves that aborting a registry request that never responds is swallowed by the best-effort check The timeout path uses a controlled `AbortController`, so the test is deterministic and does not wait two seconds of wall-clock time. ## Verification \| Check \| Result \| \|---\|---\| \| Focused version-check tests \| 2 passed \| \| Full core suite \| 1046 passed \| \| Core typecheck \| exit 0 \| \| Core build \| passed, including ATTW and publint \| \| Package lint \| exit 0 with existing repository warnings \| \| Changeset validation \| passed \| ## Out of scope — follow-up worth filing `TelemetryService.sendMetric` / `sendErrorLog` (`services/telemetry/TelemetryService.ts:14,35`) have the identical unbounded-fetch shape. Black-holing `telemetry.composio.dev` still hangs the process indefinitely with this fix applied: ```text blackhole=[registry] -> exited after 6.0s blackhole=[telemetry] -> HUNG (killed at 45s) ``` I deliberately left it alone: telemetry has its own `registerExitHandlers`/`flush` machinery that intends to block on exit, so bounding it is a real design decision rather than a one-liner, and it's outside what this issue covers. Happy to open a separate issue for it. ## Notes - Changeset included (`@composio/core: patch`). - The Python SDK has no equivalent version check, so no parity change is needed.	2026-08-05 21:07:04 +05:30
Rajarshi Datta	e0f4a3463c	Merge branch 'next' into fix/version-check-fetch-timeout	2026-08-05 19:27:36 +05:30
jkomyno	9a6d59326f	Merge branch 'next' into feat/installer-auto-shell-default Keeps this branch's fixture-driven managed-block reconciler (reconcileManagedPathBlock, pinned byte-for-byte against install.sh's awk rewrite by test/managed-block-fixtures) and drops next's narrower replaceManagedPathBlock/applyFileChanges pair, which it supersedes. Adopts from next: the narrowed unsafe-path character set on both the TS and sh sides, the removal of the $PATH-reachability write skip, the hedged no-shell PATH message, and the COMPOSIO_BIN_DIR command documentation.	2026-08-05 19:12:05 +05:30
jkomyno	fdb366d090	Merge branch 'feat/cli-install-shell-flag' into feat/mise-style-installer-rollout # Conflicts: # install.sh # test/install-sh-release-resolution.test.sh # ts/packages/cli/test/__utils__/services/test-layer.ts # ts/packages/cli/test/src/commands/install.cmd.test.ts	2026-08-04 20:02:22 +05:30
jkomyno	16b167c94a	docs(cli): document COMPOSIO_BIN_DIR and the install abort contract COMPOSIO_BIN_DIR was discoverable only by reading the changelog: it is read through a raw ConfigProvider and appeared in no help text. Add it to the README env-var table with its resolution order, and name it in the install command description so `composio install --help` mentions it. No --bin-dir flag: the env var is the right shape for an installer handoff. The changelog entry also picks up the behavior changes it was missing — the non-zero exit on abort and what it means for install.sh's fallback, both abort conditions, the narrowed character set, legacy-block migration, and a note for custom-install-dir users reinstalling without re-specifying COMPOSIO_INSTALL_DIR.	2026-08-04 19:17:14 +05:30
jkomyno	745bd67cef	fix(cli): make composio install reconcile stale managed blocks Three changes to the PATH writer, all around the same failure mode: the command reporting success while leaving a shell unable to find composio. - The unsafe-path denylist rejected characters that are literal inside the double quotes the bin dir is always written in. Keep only what bash, zsh, and fish still expand there, plus newline and the PATH separator, which are structural. /Users/o'brien/.composio now works. - A file carrying the marker was treated as configured forever, so the legacy three-line block written by install.sh's fallback or by an older CLI was never migrated. Skip only on the exact rendered PATH line for the resolved bin dir; otherwise splice the current block over the stale one in place. - The reachability skip used the invoking process's $PATH as evidence about future shells, so an ad-hoc export or a mise/direnv shim made the command persist nothing and exit 0. A redundant PATH line is harmless, and the content check already prevents duplicates. installShellIntegration no longer takes an execPath override; it always reads NodeProcess, and tests thread their exec path through the test layer instead.	2026-08-04 19:16:09 +05:30
Alberto Schiabel	331a1373de	Merge branch 'next' into feat/cli-install-shell-flag	2026-08-04 18:25:57 +05:30
jkomyno	4a179f8fdc	ci(cli): avoid unavailable installer routes	2026-08-04 18:17:00 +05:30
Alberto Schiabel	15c07ec6c7	docs(cli): restore 0.3.0 and 0.3.1 changelog entries (#4048 ) This PR: - restores missing `0.3.0` and `0.3.1` sections in `ts/packages/cli/CHANGELOG.md` - moves the plugin hint and telemetry changes out of `0.2.33` - records post-`0.3.1` connected-account and login fixes under `Unreleased` - rewrites the restored notes as concise, user-facing bullets - validates the ignored-package boundary with `pnpm validate:changesets`	2026-08-04 17:10:43 +05:30
rajashidattapy	0330637a18	Merge branch 'fix/version-check-fetch-timeout' of https://github.com/rajarshidattapy/composio into fix/version-check-fetch-timeout	2026-08-04 12:03:45 +05:30
rajashidattapy	b08b18d73b	fix(version): improve timeout handling in NPM version check and add related tests	2026-08-04 11:59:34 +05:30
Rajarshi Datta	27fbb464f7	Merge branch 'next' into fix/version-check-fetch-timeout	2026-08-04 11:48:10 +05:30
jkomyno	558d1344dd	ci(cli): keep scheduled prod install E2E off unprovisioned shell routes The /install/<shell> variant routes still 404 in production, so the harness's prod mode now selects the shell with COMPOSIO_INSTALL_SHELL on the base /install route, and the scheduled matrix gains a fish leg. The Docker harness invocation stays in place; a workflow comment records how to restore variant-route coverage once the routes ship.	2026-08-04 00:16:03 +05:30
jkomyno	6e3f5af66d	fix(cli): migrate legacy three-line managed blocks in both reconcilers The previous installer wrote marker + export COMPOSIO_INSTALL_DIR + PATH export. Both the shell and TypeScript reconcilers now consume that triple as one managed block instead of orphaning the export lines, with shared legacy-migrate and near-miss fixtures keeping the two implementations byte-identical.	2026-08-04 00:15:38 +05:30
jkomyno	f5be51665f	Merge branch 'fix/cli-upgrade-atomic-replace' into feat/installer-auto-shell-default Port the atomic replacement work from #4016: support files publish first, release metadata next, the binary last, with aside/rollback recovery for directory entries and preserved staging on failed restores.	2026-08-03 22:35:33 +05:30
Alberto Schiabel	1503786358	refactor(core): forbid explicit any and type JSON Schema recursively (#3968 ) This PR: - is refreshed directly onto the current next branch now that #3966 and #3967 have merged; the PR contains only its intended type-safety work - enforces no explicit any through the standard .oxlintrc.json, pnpm lint, and plain oxlint --fix in lint-staged; docs remain covered by their nested configuration - replaces the loose JSONSchemaProperty in @composio/core with a concrete recursive interface, removing explicit any reachable through Tool.inputParameters and Tool.outputParameters - includes a minor changeset documenting the type narrowing for properties, default, and enum consumers - adds a compile-only public-contract test for recursive schemas, known-key validation, extension keywords, and Tool reachability - removes explicit any from FileToolModifier, ts-builders, core and CLI tests, provider tests, and json-schema-to-zod tests - keeps TypeScript ESLint-parity rules enabled and closes the tool-router example lint/typecheck gap - makes no lockfile changes and no runtime behavior changes ## Context Final PR from the original #3958 split. The migration foundations are already on next via #3966 and #3967, so this branch no longer carries a stacked base commit.	2026-08-03 22:24:57 +05:30
Alberto Schiabel	d40a74f02a	Merge branch 'next' into chore/dependabot-remediation	2026-08-03 22:00:14 +05:30
jkomyno	be3942042a	Merge branch 'feat/mise-style-installer-rollout' into feat/installer-auto-shell-default	2026-08-03 21:41:26 +05:30
jkomyno	6b964237b9	Merge branch 'feat/cli-install-shell-flag' into feat/mise-style-installer-rollout	2026-08-03 21:41:22 +05:30
jkomyno	7198dcce8d	docs(cli): explain the bash login-override special case	2026-08-03 21:41:18 +05:30
jkomyno	2655e30c70	docs(cli): state installer design constraints inline instead of KD tags Ten comments across install.sh, install.cmd.ts, and the harness cited KD2/KD3/KD4/KD7 decisions from a plan file that exists on no branch. Rewrite each comment to carry its constraint inline — the truthful final action block, delegation trust via physical path comparison, non-fatal setup failures, and copy-paste-safe endings — and drop the dangling references.	2026-08-03 21:12:07 +05:30
jkomyno	124e896ed7	fix(cli): align the TS and sh managed-block reconcilers on one contract The CLI and install.sh implemented the managed-PATH-block contract twice with three divergences: TS matched marker lines after trimming while the sh awk program matches byte-exact (CRLF or padded markers reconciled on one side and duplicated on the other), TS replaced stale blocks in place while sh removes managed lines and appends the fresh block, and renderWithHome rendered a bin dir equal to $HOME as the $HOME literal while render_bin_dir left it as the raw path — making delegated verification permanently stale for that layout. Align both sides: TS goes byte-exact and remove-then-append (mirroring the awk program including its newline normalization), and render_bin_dir learns the $HOME-exact case. A shared fixture suite under test/managed-block-fixtures now runs against both reconcilers — vitest drives the exported TS functions, the harness sources install.sh's definitions and runs write_path_block under sh and dash — so future edits to one side fail loudly until the other matches byte for byte.	2026-08-03 21:10:37 +05:30
jkomyno	8b7ebadef9	refactor(cli): share one atomic tmp-write helper with per-process tmp names Three from-scratch tmp-write→rename implementations coexisted (install.cmd.ts, tool-permissions writeCacheFile, analytics writeAnalyticsStateFile), and the install ones raced concurrent installs through a fixed .composio-tmp suffix. Extract src/utils/atomic-write.ts: the tmp name embeds the pid, an optional preserveMode creates the tmp with the target's mode and pins it via chmod, and the best-effort tmp cleanup now also covers a failure of the initial write itself (ENOSPC mid-write no longer leaves tmp litter). All three call sites migrate with their semantics intact; tests scan for any .composio-tmp remnant instead of probing the old fixed name. Extracting the block-append loop also brings installShellIntegration back under the function-length lint that the merge had pushed over.	2026-08-03 21:00:24 +05:30
jkomyno	54258e2551	Merge branch 'feat/mise-style-installer-rollout' into feat/installer-auto-shell-default	2026-08-03 20:54:15 +05:30
jkomyno	32b84ab192	Merge branch 'feat/cli-install-shell-flag' into feat/mise-style-installer-rollout	2026-08-03 20:44:57 +05:30
jkomyno	aa28325394	test(cli): add a fish leg to the local install e2e	2026-08-03 20:32:36 +05:30
jkomyno	b52dd3c0af	refactor(e2e): share docker env args and add the install-image race retry	2026-08-03 20:32:36 +05:30
jkomyno	ba4fa222ab	test(cli): exercise the installer extraction-failure branch in the install e2e	2026-08-03 20:32:36 +05:30
jkomyno	648e95727a	fix(cli): exit non-zero when shell setup aborts Both abort branches (unsafe or relative resolved bin dir) printed an error and returned, so the effect succeeded and the process exited 0. install.sh gates its inline PATH fallback on a non-zero exit from 'composio install', so an aborted setup looked green and left the user with no PATH setup at all. Raise a typed ShellSetupAbortError after printing the abort reason; cli-main.ts maps it to exit code 1 without printing anything further, so install.sh now takes its fallback branch.	2026-08-03 20:29:52 +05:30
jkomyno	48f3ebe2a1	refactor(cli): type the install test helper's shell param with the Shell union The helper widened shell to string and cast it back to the union, bypassing the checker. Export Shell from install.cmd.ts and use it directly.	2026-08-03 20:26:09 +05:30
jkomyno	021125b7a8	fix(cli): create the rc tmp copy with the preserved file mode The tmp copy was written with the default 0644 mode and only chmod'd to the target's mode afterwards, so a 0600 private rc's contents sat world-readable in <target>.composio-tmp for the duration of the window. Create the tmp file with the preserved mode from the start; open(2) masks that mode with the umask (only ever clearing bits), so the follow-up chmod stays to pin the exact mode before the rename.	2026-08-03 20:25:37 +05:30
jkomyno	b381210c2d	test(cli): align the installer analytics guard with the shell-delegation flow	2026-08-03 20:23:55 +05:30
jkomyno	6d0e14f155	fix(cli): only prefer ~/.local/bin when its composio entry is this executable A bare exists-check let any leftover ~/.local/bin/composio (e.g. a pip or pipx install) win bin-dir resolution, so the PATH line pointed shells at a foreign program while the installer reported success. Prefer ~/.local/bin only when its entry realpath-resolves, following symlinks, to the running executable; otherwise fall through to the runtime executable's directory. The COMPOSIO_BIN_DIR override stays highest precedence.	2026-08-03 20:23:14 +05:30
jkomyno	aaf2d250cf	fix(installer): configure a login-mode startup file for bash A login bash reads /etc/profile and then only the first existing of ~/.bash_profile, ~/.bash_login, ~/.profile; it never reads ~/.bashrc. macOS Terminal.app starts exactly such a shell, so a terminal opened after installation could not resolve composio even though the installer reported success. Always configure a login-mode startup file alongside ~/.bashrc: reuse an existing ~/.bash_profile or ~/.bash_login, otherwise create ~/.bash_profile seeded to keep sourcing ~/.profile, which it shadows. ~/.profile itself is never rewritten. Also refine the shell setup reporting: - capture the delegated `composio install --shell` output so the installer keeps sole ownership of its presentation, replaying it under COMPOSIO_DEBUG so failures stay diagnosable - drop the internal (cli)/(fallback) labels from user-facing output - name the configured startup files from both the delegated and inline paths, so piped installs disclose which files changed	2026-08-03 19:24:51 +05:30
Rajarshi Datta	578d358b74	Merge branch 'next' into fix/version-check-fetch-timeout	2026-08-03 19:23:03 +05:30
Alberto Schiabel	10e93add6b	fix(cli): address bugbot review findings from the guardrails stack (#3886 ) Follow-up to https://github.com/ComposioHQ/composio/pull/3885, which is now merged into `next`. This PR: - reports pending-login cache read failures as I/O errors instead of masking them as decode failures (`composio login --poll`) - restores pairwise polarity assertions for the `semverComparator` Array.sort compatibility case - consolidates the duplicated ephemeral HTTP server test helper in `test/__utils__/http-server.ts` - makes server-owned connected-account statuses forward-compatible while preserving the credential-stripping schema allowlist - redacts raw payload values from connected-account parse warnings and adds regression coverage for unknown statuses and secret-bearing malformed payloads - documents why the client-singleton test re-derives the consumer cache cwd hash ## Rebase notes Rebased onto `origin/next` at `ef1ec9148`. - Dropped the empty `GITHUB_*` compatibility commit; that contract is already present on `next` through https://github.com/ComposioHQ/composio/pull/3880. - Adapted the connected-account decoder rename to the service extracted upstream in `connected-account-selection.ts`. ## Context Fix-forward PR for actionable Cursor Bugbot findings on the guardrails stack (#3877–#3885). The stale decode-error string match and unused release helper were already resolved upstream, and the `vi.stubEnv(..., undefined)` concern is not actionable on Vitest 4.1.10.	2026-08-03 19:20:45 +05:30
jkomyno	2ac6ad320a	fix(core): complete version check timeout guard	2026-08-03 18:53:18 +05:30
jkomyno	55de1cad7e	Merge remote-tracking branch 'origin/next' into fix/version-check-fetch-timeout-review	2026-08-03 18:51:28 +05:30
jkomyno	7198144863	fix(e2e): restore runtime compatibility coverage	2026-08-03 18:04:45 +05:30
jkomyno	d5b425bd56	fix(review): harden inline rewrite, delegation trust, and reconciliation Apply verified code-review findings: write through symlinked startup files with preserved mode and a per-process tmp name; verify delegated CLI setup actually reconciled the managed block before trusting exit 0; make managed-block reconciliation assignment-aware so annotated blocks never lose user content or PATH precedence; clean up the CLI's tmp file when an atomic write fails; assert the auto contract in the install health-check canary; recommend composio install --shell in generated release docs; record the new default in the CLI changelog.	2026-08-03 17:48:04 +05:30
jkomyno	32b414305c	refactor(cli): deduplicate setup-failure warning and atomic writes Also track the installer plan documents that the KD-tagged comments in install.sh and the shell harness reference.	2026-08-03 17:18:17 +05:30
jkomyno	2ff9d9f97e	feat(cli): make automatic shell setup the installer default COMPOSIO_INSTALL_SHELL grows auto (the new default) and none. auto infers the login shell from $SHELL and always runs idempotent setup for recognized shells; none keeps install-only behavior for CI and dotfile managers. Final output follows the KD4 state matrix against a pre-install PATH snapshot with physical-path identity, setup failures never fail the install, and the managed PATH block reconciles stale bin directories.	2026-08-03 17:08:54 +05:30

1 2 3 4 5 ...

1161 Commits