Python SDK 0.17.0 (mirrors the TS `@composio/core` 0.13.0 surface).
`make bump` (minor) bumped `pyproject.toml` + all provider packages to
0.17.0; this PR also syncs `composio/__version__.py` and adds the `##
[0.17.0]` CHANGELOG entry so the release guard (`__version__` ==
`pyproject` == `CHANGELOG[0]`) passes — verified locally (`release
workflow test passed`).
## 0.17.0 surface
- `triggers.parse()` (parse + optionally verify a webhook; empty
`verify_secret` now raises instead of silently skipping) and
`triggers.set_webhook_subscription()`
- `composio.sessions` is the canonical sessions mount;
`composio.tool_router` deprecated alias
- MCP is opt-in (`mcp=True`); default sessions return native tools
- Prefer the `sandbox` session config key (`workbench` still accepted)
- `connected_accounts.update_acl()` (graduated from experimental)
Merging this triggers the Python publish.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This PR:
- completes the Python `0.16.0` CHANGELOG entry, which previously
documented only the version + dependency bump even though six
user-facing fixes landed on the unreleased `0.16.0` since the entry was
written (`py@0.15.0..HEAD`)
- refreshes the `0.16.0` date to its actual release date (`2026-06-25`)
- is a prerequisite for tagging `py@0.16.0` and publishing to PyPI —
PyPI is currently at `0.15.0`; `0.16.0` was bumped in-repo but never
tagged or published, and no further version bump was made for the six
follow-up fixes
## Context
`0.16.0` is unreleased (PyPI's latest stable is `0.15.0`, there is no
`py@0.16.0` tag), and `pyproject.toml` / `__version__.py` were never
bumped past `0.16.0`. So these six fixes belong to `0.16.0`, not a new
version. The newly documented changes:
- file `$ref`/`$defs` dereferencing so auto upload/download flags behind
a reference aren't dropped (e.g. `GMAIL_GET_ATTACHMENT`)
- disabling retries on non-idempotent `tools.execute()` /
`tools.proxy()` writes to prevent duplicate side effects
- bounded `(connect, read)` timeouts on session file transfers and
presigned S3 paths
- centralized provider-visible tool schema aliasing across Anthropic,
Claude Agent SDK, Gemini, Google ADK, and OpenAI Agents
- deep-copying the OpenAI Agents tool schema before stripping
`examples`/`default`
Plus the already-noted `composio-client` `1.39.0` → `1.41.0` bump and
the dependency-range / uv-lock refresh.
Once merged, release with:
\`\`\`bash
git tag py@0.16.0 <merge-commit> && git push origin py@0.16.0
\`\`\`
This PR:
- fixes
https://github.com/ComposioHQ/composio/actions/runs/27964338497/job/82754032484
- aligns `python/composio/__version__.py` with the current Python
package version `0.16.0`
- adds the missing `0.16.0` Python changelog entry for the dependency
refresh
- restores `pnpm run test:release-workflow` on `next`
This PR:
- documents the pending Python `0.14.0` and `0.15.0` releases in
`python/CHANGELOG.md`
- aligns `python/composio/__version__.py` with `python/pyproject.toml`
at `0.15.0`
- adds a release guard so Python package/provider versions, runtime
version, and changelog entries cannot drift silently
- leaves Python release tags and PyPI publishing untouched; `py@0.14.0`
should still be published before `py@0.15.0`
Adds a `0.13.1` entry to `python/CHANGELOG.md` covering the changes
accumulated on `next` since the last Python release (`py@0.13.0`, May
7).
The CHANGELOG had been quietly abandoned since `0.8.11` (Sept 2025);
rather than try to backfill the 4-minor gap, this PR draws a line and
adds a banner pointing readers at the git log for that window. Future
releases start fresh from here.
## What's in 0.13.1
- **SHARED connected accounts (experimental)** —
`composio.experimental.update_acl`, `experimental={...}` on `link()` /
`session.authorize()`, `account_type` filter on `list()`. Mirrors
`@composio/core@0.10.0` shipping in #3425.
- **`initiate()` deprecation warning** — gated on response `Deprecation`
header (RFC 9745) instead of `auth_scheme`, eliminating false positives
for custom auth configs and non-OAuth schemes.
- **Schema converter** — preserves nullability on `null`-only `anyOf`
blocks.
- **Dep bump** — `composio-client` 1.36.0 → 1.39.0.
## Release plan
Documentation only — does NOT trigger a release on its own. The Python
release flow is tag-triggered:
```bash
# After this PR merges and after #3425 ships:
git tag py@0.13.1 <next HEAD sha>
git push origin py@0.13.1
```
That fires `.github/workflows/py.release.yml` which builds and publishes
to PyPI.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: jkomyno <12381818+jkomyno@users.noreply.github.com>
Alberto Schiabel