skills/composiohq__composio
1
0
Fork 0
mirror of https://github.com/ComposioHQ/composio.git synced 2026-09-22 11:46:35 +08:00
Code Issues Packages Projects Releases Wiki Activity
4,866 Commits 338 Branches 1,550 Tags
py@0.20.0
Commit Graph

1195 Commits

Author SHA1 Message Date
sdkrelease[bot] f031c27cd1 Release: update version (#4161) 
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to next, this PR will
be updated.


# Releases
## @composio/core@0.17.0

### Minor Changes

- 760f8d0: Allow OpenAI and Anthropic provider tool-call helpers to
execute through a supplied Tool Router session. Session meta-tools now
retain their session context while provider argument normalization
remains intact; existing user-ID calls continue to use direct execution.
Anthropic helper failures now preserve their error text in `{ error }`
results without changing successful payloads. Custom provider subclasses
overriding `executeToolCall` or `handleToolCalls` may require updates
because these methods now accept session targets.

### Patch Changes

- 6ba9179: Validate the URLs that come from API responses before
fetching them. Tool-execution downloads (`s3Url`), S3 presigned uploads
(`new_presigned_url`), Tool Router session file downloads
(`RemoteFile.buffer()` / `blob()` / `text()` / `save()`) and session
file uploads (`upload_url`) now go through the same SSRF guard that
already covered user-supplied URLs, so a response naming a private,
loopback, or link-local address is refused instead of fetched. Redirect
hops are re-validated. Edge runtimes keep their current behavior:
session file transfers are not blocked there, since a Worker cannot
resolve DNS to check and its `fetch` does not originate inside the
caller's network.
## @composio/anthropic@0.11.0

### Minor Changes

- 760f8d0: Allow OpenAI and Anthropic provider tool-call helpers to
execute through a supplied Tool Router session. Session meta-tools now
retain their session context while provider argument normalization
remains intact; existing user-ID calls continue to use direct execution.
Anthropic helper failures now preserve their error text in `{ error }`
results without changing successful payloads. Custom provider subclasses
overriding `executeToolCall` or `handleToolCalls` may require updates
because these methods now accept session targets.
## @composio/openai@0.12.0

### Minor Changes

- 760f8d0: Allow OpenAI and Anthropic provider tool-call helpers to
execute through a supplied Tool Router session. Session meta-tools now
retain their session context while provider argument normalization
remains intact; existing user-ID calls continue to use direct execution.
Anthropic helper failures now preserve their error text in `{ error }`
results without changing successful payloads. Custom provider subclasses
overriding `executeToolCall` or `handleToolCalls` may require updates
because these methods now accept session targets.
## @composio/slim@0.17.0

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-08-19 00:37:19 +02:00
Soumya Medapati 760f8d0367 fix(sdk): route provider tool calls through sessions (#4098) 
## Problem

Provider tool-call helpers always used the globally injected direct
`Tools.execute` function. When a model received tools from
`session.tools()`, calling `handleToolCalls` or `handle_tool_calls`
therefore discarded the Tool Router session context and caused session
meta-tools such as `COMPOSIO_SEARCH_TOOLS` to fail.

Calling `session.execute()` manually preserved the session, but bypassed
provider behavior such as Anthropic input normalization and schema-alias
restoration.

## Root fix

- Add an explicit execution target to the non-agentic provider helpers:
- TypeScript: `handleToolCalls(session, response)` and
`executeToolCall(session, call)`
- Python: `handle_tool_calls(response=response, session=session)` and
`execute_tool_call(tool_call=call, session=session)`
- Route normalized provider arguments through the supplied Tool Router
session.
- Map session responses back to each helper's existing result shape.
- Keep provider-specific normalization before execution, including
Anthropic schema-alias restoration.
- Reject direct-only options and modifiers when the selected target is a
session, including plain JavaScript calls that bypass the TypeScript
overloads.
- Update OpenAI and Anthropic examples to use the session-aware helpers.
- Harden the docs policy test so setup and execution split across fences
in one sample are still detected.

## Docs review follow-ups

- Reword the concepts-page prohibition so it forbids user-ID-bound
helper calls, not the helpers themselves, matching the provider pages in
this PR.
- Add minimum-version callouts to the OpenAI and Anthropic provider
pages (Python `composio` newer than 0.19.0; TypeScript `@composio/core`
≥ 0.17.0 with `@composio/openai` ≥ 0.12.0 / `@composio/anthropic` ≥
0.11.0), pointing older versions at `session.execute()`.
- Bump `docs/package.json` to `@composio/core` `^0.15.0` and
`@composio/openai` `^0.11.0` (the published majors at the time of the
bump; `@composio/core` 0.16.0 and `composio` 0.19.0 have since released
from `next` without this PR, so its changeset will publish core 0.17.0
and the next Python minor) and annotate each `@errors: 2345` Twoslash
marker with a TODO naming the minor version that retires it; since this
changeset releases minors, all three pins need a manual range bump to
retire the markers. This version of twoslash only throws on *unlisted*
errors, so a stale marker cannot break the build — it would only mask
future TS2345s, which the TODOs now track.
- Update `SESSION_GUARDRAILS` (the block appended to `.md` responses for
agents): add a session-execution bullet (scoped to the OpenAI and
Anthropic helpers, with `session.execute()` for every other provider)
and qualify the direct-execution list with "with a user ID". The
session-execution static test now scans the guardrail blocks like the
execute-version test already did.
- Tighten the docs detector: the Python branch is bounded to the helper
call's argument list (tolerating one level of nested calls) instead of
running past the closing paren, and the TypeScript branch catches whole
user-ID identifiers (`userId`, `user_id`, `uid`) without flagging
session variables like `userSession` — each edge has a regression test.
- Note on the Google provider page that its `executeToolCall` is not
session-aware yet.

## Compatibility and release

Existing user-ID calls remain unchanged and continue to use direct tool
execution. The new session call forms are additive.

The changeset applies minor releases to `@composio/core`,
`@composio/openai`, and `@composio/anthropic` — the new session
overloads are a type-level break for provider subclasses, so patch was
too small. The configured fixed group also includes `@composio/slim`.

The docs site intentionally checks examples against currently published
SDK declarations. The three new TypeScript calls therefore carry exact
Twoslash `TS2345` release-skew annotations; remove them (per the inline
TODOs) once `docs/package.json` picks up `@composio/core` ≥ 0.17.0,
`@composio/openai` ≥ 0.12.0, and `@composio/anthropic` ≥ 0.11.0.

## Verification

- `@composio/core`: 1,061 tests passed; typecheck passed
- `@composio/openai`: 34 tests passed; typecheck passed
- `@composio/anthropic`: 53 tests passed; typecheck passed
- Python provider and aliasing suites: 40 passed, 4 skipped
- Focused Python mypy and Ruff checks passed
- Docs static suite: 208 tests passed (including the new guardrail-scan
and detector cases)
- Docs production build passed with the bumped `@composio/core` 0.15.0 /
`@composio/openai` 0.11.0, including Twoslash, TypeScript, and all
generated pages
- Docs lint passed; lint reports only existing warnings
- Changeset status reports the expected minor packages

---------

Co-authored-by: Soumya Medapati <soumyamedapati@soumyas-air.local.meter>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: jkomyno <alberto@composio.dev>
 2026-08-18 23:55:11 +02:00
dependabot[bot] 389902f0ac chore(deps): bump the npm-production group across 1 directory with 25 updates (#4160) 
Bumps the npm-production group with 25 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
|
[@anthropic-ai/claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-typescript)
| `0.3.221` | `0.3.233` |
|
[@mastra/mcp](https://github.com/mastra-ai/mastra/tree/HEAD/packages/mcp)
| `1.15.0` | `1.16.0` |
| [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai) | `6.0.241` |
`6.0.256` |
|
[@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript)
| `0.115.0` | `0.117.1` |
| [@google/genai](https://github.com/googleapis/js-genai) | `2.15.0` |
`2.17.1` |
| [@langchain/core](https://github.com/langchain-ai/langchainjs) |
`1.2.4` | `1.2.8` |
|
[@langchain/langgraph](https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core)
| `1.4.9` | `1.4.10` |
| [@langchain/openai](https://github.com/langchain-ai/langchainjs) |
`1.5.5` | `1.5.8` |
| [langchain](https://github.com/langchain-ai/langchainjs) | `1.5.4` |
`1.5.9` |
| [@openai/agents](https://github.com/openai/openai-agents-js) |
`0.14.2` | `0.16.0` |
| [@langchain/anthropic](https://github.com/langchain-ai/langchainjs) |
`1.5.2` | `1.5.6` |
| [open](https://github.com/sindresorhus/open) | `11.0.0` | `11.0.1` |
| [typebox](https://github.com/sinclairzx81/typebox) | `1.3.10` |
`1.3.14` |
|
[@mastra/schema-compat](https://github.com/mastra-ai/mastra/tree/HEAD/packages/schema-compat)
| `1.3.4` | `1.3.7` |
| [@ai-sdk/mcp](https://github.com/vercel/ai/tree/HEAD/packages/mcp) |
`2.0.24` | `2.0.32` |
|
[@ai-sdk/openai](https://github.com/vercel/ai/tree/HEAD/packages/openai)
| `4.0.29` | `4.0.42` |
|
[@cloudflare/vitest-pool-workers](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers)
| `0.20.1` | `0.21.3` |
| [@cloudflare/workers-types](https://github.com/cloudflare/workerd) |
`5.20260804.1` | `5.20260815.1` |
|
[@effect/language-service](https://github.com/Effect-TS/language-service)
| `0.87.1` | `0.87.2` |
|
[@mastra/core](https://github.com/mastra-ai/mastra/tree/HEAD/packages/core)
| `1.52.1` | `1.59.0` |
|
[@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk)
| `1.26.0` | `1.30.0` |
| [hono](https://github.com/honojs/hono) | `4.13.1` | `4.13.2` |
| [pnpm](https://github.com/pnpm/pnpm/tree/HEAD/pnpm11/pnpm) | `11.20.0`
| `11.21.0` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.5` | `4.23.12` |
|
[wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler)
| `4.118.0` | `4.123.0` |


Updates `@anthropic-ai/claude-agent-sdk` from 0.3.221 to 0.3.233
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/releases">@​anthropic-ai/claude-agent-sdk's
releases</a>.</em></p>
<blockquote>
<h2>v0.3.233</h2>
<h2>What's changed</h2>
<ul>
<li>Notification hooks now fire for pending permission prompts on the
SDK path, matching the interactive REPL behavior</li>
<li>Todo/task-tracking tools
(<code>TaskCreate</code>/<code>TaskGet</code>/<code>TaskUpdate</code>/<code>TaskList</code>,
<code>TodoWrite</code>) are no longer in the default tool surface on
Opus 4.8, Sonnet 5, Fable 5, Mythos 5, and newer models; name them in
the <code>tools</code> option or reference them in
<code>allowedTools</code> (or set
<code>CLAUDE_CODE_ENABLE_TODO_TOOLS=1</code>) to keep them</li>
</ul>
<h2>Update</h2>
<pre lang="sh"><code>npm install @anthropic-ai/claude-agent-sdk@0.3.233
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.233
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.233
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.233
</code></pre>
<h2>v0.3.232</h2>
<h2>What's changed</h2>
<ul>
<li>Subagent MCP <code>tool_result</code> frames whose result carries
<code>_meta</code> now emit <code>tool_use_result</code> as <code>{
content, _meta }</code> (matching main-loop frames) instead of a bare
value</li>
<li><code>/context</code> result messages now carry a structured
<code>context_usage</code> payload (new <code>SDKContextUsage</code>
type), so consumers can render the context-usage card without parsing
the markdown table</li>
<li><code>vcs_state_changed</code> events now populate the
<code>branch</code> field for push operations, sourced from the pushed
ref</li>
</ul>
<h2>Update</h2>
<pre lang="sh"><code>npm install @anthropic-ai/claude-agent-sdk@0.3.232
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.232
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.232
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.232
</code></pre>
<h2>v0.3.231</h2>
<h2>What's changed</h2>
<ul>
<li>Updated to parity with Claude Code v2.1.231</li>
</ul>
<h2>Update</h2>
<pre lang="sh"><code>npm install @anthropic-ai/claude-agent-sdk@0.3.231
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.231
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.231
&lt;/tr&gt;&lt;/table&gt; 
</code></pre>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/blob/main/CHANGELOG.md">@​anthropic-ai/claude-agent-sdk's
changelog</a>.</em></p>
<blockquote>
<h2>0.3.233</h2>
<ul>
<li>Notification hooks now fire for pending permission prompts on the
SDK path, matching the interactive REPL behavior</li>
<li>Todo/task-tracking tools
(<code>TaskCreate</code>/<code>TaskGet</code>/<code>TaskUpdate</code>/<code>TaskList</code>,
<code>TodoWrite</code>) are no longer in the default tool surface on
Opus 4.8, Sonnet 5, Fable 5, Mythos 5, and newer models; name them in
the <code>tools</code> option or reference them in
<code>allowedTools</code> (or set
<code>CLAUDE_CODE_ENABLE_TODO_TOOLS=1</code>) to keep them</li>
</ul>
<h2>0.3.232</h2>
<ul>
<li>Subagent MCP <code>tool_result</code> frames whose result carries
<code>_meta</code> now emit <code>tool_use_result</code> as <code>{
content, _meta }</code> (matching main-loop frames) instead of a bare
value</li>
<li><code>/context</code> result messages now carry a structured
<code>context_usage</code> payload (new <code>SDKContextUsage</code>
type), so consumers can render the context-usage card without parsing
the markdown table</li>
<li><code>vcs_state_changed</code> events now populate the
<code>branch</code> field for push operations, sourced from the pushed
ref</li>
</ul>
<h2>0.3.231</h2>
<ul>
<li>Updated to parity with Claude Code v2.1.231</li>
</ul>
<h2>0.3.230</h2>
<ul>
<li>Updated to parity with Claude Code v2.1.230</li>
</ul>
<h2>0.3.229</h2>
<ul>
<li>Added <code>terminal_slash_commands</code> to the system init
message so Remote Control clients can hide terminal-oriented
commands</li>
<li>Changed conversations whose messages alone exceed the API's 32 MB
limit to end the turn with <code>terminal_reason</code>
<code>&quot;api_error&quot;</code> instead of
<code>&quot;image_error&quot;</code>; <code>StopFailure</code>
<code>error_details</code> is <code>&quot;request_body_over_limit:
…&quot;</code></li>
</ul>
<h2>0.3.228</h2>
<ul>
<li>Agent tool results (<code>AgentOutput</code>):
<code>usage.output_tokens_details</code> is now carried through</li>
</ul>
<h2>0.3.227</h2>
<ul>
<li>Updated to parity with Claude Code v2.1.227</li>
</ul>
<h2>0.3.226</h2>
<ul>
<li>Updated to parity with Claude Code v2.1.226</li>
</ul>
<h2>0.3.225</h2>
<ul>
<li>Fixed background subagents in headless/SDK sessions never resuming
when a background shell command or Monitor they left running completed,
so the subagent never saw the result</li>
</ul>
<h2>0.3.224</h2>
<ul>
<li>Added <code>crossSessionInbound</code> and <code>dialogExpiry</code>
settings: cross-session messages sent to a session running with bypassed
permissions are held for your approval, and messages to other sessions
auto-deliver</li>
<li>Added <code>subkind: 'peer-send-message'</code> to the
<code>task-notification</code> member of <code>SDKMessageOrigin</code>,
marking a notification raised by a cross-session
<code>SendMessage</code></li>
<li>Added <code>source: 'archive'</code> plugin config variant to
<code>Settings</code>, with <code>url</code> and optional
<code>sha256</code>, for installing plugins from a zip over HTTPS</li>
<li>Added sandbox credential-masking fields to <code>Settings</code>:
<code>decode: 'jwt'</code> with <code>maskClaims</code>,
<code>extract</code>/<code>onExtractNoMatch</code> on
<code>envVars</code>, and <code>awsPairs</code>/<code>sigv4</code> for
AWS SigV4 re-signing</li>
<li>Fixed long (&gt;200 char) project paths resolving to another
project's session directory under a shared sanitized prefix; session
list/get/rename/tag/fork/delete and <code>/resume</code> no longer cross
projects</li>
</ul>
<h2>0.3.223</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/73a28abad0d5015568404ecfe0d9cad3ed479fe3"><code>73a28ab</code></a>
chore: Update CHANGELOG.md</li>
<li><a
href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/8716a39f83dd7506e6421199caface603d4941ab"><code>8716a39</code></a>
chore: Update CHANGELOG.md</li>
<li><a
href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/b5321a4b65ec1b034fea19f684e2d8db728875da"><code>b5321a4</code></a>
chore: Update CHANGELOG.md</li>
<li><a
href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/71dfabbc343457793684e21d3085bb7a5f8c3f46"><code>71dfabb</code></a>
chore: Update CHANGELOG.md</li>
<li><a
href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/0a2639d6b561af90342d4a98c93f9cc807d0e5ce"><code>0a2639d</code></a>
chore: Update CHANGELOG.md</li>
<li><a
href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/22847067d63ef74234a0542a302cc3608de5e837"><code>2284706</code></a>
chore: Update CHANGELOG.md</li>
<li><a
href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/d13c50c54d591cb2355672c8259fbb6e159687f9"><code>d13c50c</code></a>
chore: Update CHANGELOG.md</li>
<li><a
href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/4cae4b76341d9a17a2e30915cbd84a79aba1b305"><code>4cae4b7</code></a>
chore: Update CHANGELOG.md</li>
<li><a
href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/86e3e9464ea31b62b94de39412d70ff2b8b5f97b"><code>86e3e94</code></a>
chore: Update CHANGELOG.md</li>
<li><a
href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/064793e6da11fbaf00509ef1ab66f374fb379cbc"><code>064793e</code></a>
chore: Update CHANGELOG.md</li>
<li>Additional commits viewable in <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/compare/v0.3.221...v0.3.233">compare
view</a></li>
</ul>
</details>
<br />

Updates `@mastra/mcp` from 1.15.0 to 1.16.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/mastra-ai/mastra/releases">@​mastra/mcp's
releases</a>.</em></p>
<blockquote>
<h2>Mar 25, 2026</h2>
<h2>Highlights</h2>
<h3>Smarter Model Selection for Observational Memory</h3>
<p><code>@mastra/memory</code> now lets you route observer and reflector
calls to different models based on input size using
<code>ModelByInputTokens</code>. Short inputs can go to a fast, cheap
model while longer ones get sent to a more capable one -- all configured
declaratively with token thresholds. Tracing shows which model was
selected and why.</p>
<h3>MongoDB Support for Datasets and Experiments</h3>
<p><code>@mastra/mongodb</code> now stores versioned datasets with full
item history and time-travel queries, plus experiment results and CRUD.
If you're already using <code>MongoDBStore</code>, this works
automatically with no extra setup.</p>
<h3>Okta Auth and RBAC</h3>
<p>New <code>@mastra/auth-okta</code> package brings SSO authentication
and role-based access control via Okta. Map Okta groups to Mastra
permissions, verify JWTs against Okta's JWKS endpoint, and manage
sessions -- or pair Okta RBAC with a different auth provider like Auth0
or Clerk.</p>
<h3>Breaking Changes</h3>
<ul>
<li>None called out in this changelog.</li>
</ul>
<h2>Changelog</h2>
<h3><a
href="https://github.com/mastra-ai/mastra/blob/@mastra/core@1.16.0//private/var/folders/d4/mn8gvlx91cz80s_9c4gjr12r0000gn/T/mastra-mastra-ai-mastra-_mastra_core_1.16.0/packages/core/CHANGELOG.md">@​mastra/core@1.16.0</a></h3>
<h4>Minor Changes</h4>
<ul>
<li>
<p>Added dataset-agent association and experiment status tracking for
the Evaluate workflow. (<a
href="https://redirect.github.com/mastra-ai/mastra/pull/14470">#14470</a>)</p>
<ul>
<li><strong>Dataset targeting</strong>: Added <code>targetType</code>
and <code>targetIds</code> fields to datasets, enabling association with
agents, scorers, or workflows. Datasets can now be linked to multiple
entities.</li>
<li><strong>Experiment status</strong>: Added <code>status</code> field
to experiment results (<code>'needs-review'</code>,
<code>'reviewed'</code>, <code>'complete'</code>) for review queue
workflow.</li>
<li><strong>Dataset experiment routes</strong>: Added API endpoints for
triggering experiments from a dataset with configurable target type and
target ID.</li>
<li><strong>LLM data generation</strong>: Added endpoint for generating
dataset items using an LLM with configurable count and prompt.</li>
<li><strong>Failure analysis</strong>: Added endpoint for clustering
experiment failures and proposing tags using LLM analysis.</li>
</ul>
</li>
<li>
<p>Added agent version support for experiments. When triggering an
experiment, you can now pass an <code>agentVersion</code> parameter to
pin which agent version to use. The agent version is stored with the
experiment and returned in experiment responses. (<a
href="https://redirect.github.com/mastra-ai/mastra/pull/14562">#14562</a>)</p>
<pre lang="ts"><code>const client = new MastraClient();
<p>await client.triggerDatasetExperiment({
datasetId: &quot;my-dataset&quot;,
targetType: &quot;agent&quot;,
targetId: &quot;my-agent&quot;,
version: 3, // pin to dataset version 3
agentVersion: &quot;ver_abc123&quot; // pin to a specific agent version
});
</code></pre></p>
</li>
<li>
<p>Added tool suspension handling to the Harness. (<a
href="https://redirect.github.com/mastra-ai/mastra/pull/14611">#14611</a>)</p>
<p>When a tool calls <code>suspend()</code> during execution, the
harness now emits a <code>tool_suspended</code> event, reports
<code>agent_end</code> with reason <code>'suspended'</code>, and exposes
<code>respondToToolSuspension()</code> to resume execution with
user-provided data.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/mastra-ai/mastra/blob/main/packages/mcp/CHANGELOG.md">@​mastra/mcp's
changelog</a>.</em></p>
<blockquote>
<h2>1.16.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>
<p>Updated the MCP client and server to run on the MCP 2.0 packages.
Request context, authentication, logging, and progress behavior are
unchanged, so tools that read <code>context.mcp.extra.authInfo</code>,
send progress, or use elicitation keep working as before. (<a
href="https://redirect.github.com/mastra-ai/mastra/pull/18683">#18683</a>)</p>
<p>Tool schemas advertised over MCP no longer declare a draft-07
<code>$schema</code> dialect. The MCP 2.0 default validator rejects that
dialect, which previously made tools with output schemas fail on the
client.</p>
<p><strong>If you pass a custom schema validator</strong></p>
<p>The optional <code>jsonSchemaValidator</code> option now takes its
validator from the MCP packages. Update the import path:</p>
<pre lang="ts"><code>// Before
import { CfWorkerJsonSchemaValidator } from
'@modelcontextprotocol/sdk/validation/cfworker';
<p>// After
import { CfWorkerJsonSchemaValidator } from
'<code>@​modelcontextprotocol/client/</code>validators/cf-worker';</p>
<p>const mcp = new MCPClient({
servers: {
weather: { url: new URL('<a
href="https://example.com/mcp">https://example.com/mcp</a>'),
jsonSchemaValidator: new CfWorkerJsonSchemaValidator() },
},
});
</code></pre></p>
<p><strong>If you import MCP protocol types directly</strong></p>
<p>Types re-exported by <code>@mastra/mcp</code> (such as
<code>ToolAnnotations</code>, <code>LoggingLevel</code>, and the OAuth
helpers) are unchanged and need no edits. Only imports that reached past
<code>@mastra/mcp</code> into <code>@modelcontextprotocol/sdk</code>
need repointing to <code>@modelcontextprotocol/client</code> or
<code>@modelcontextprotocol/server</code>.</p>
</li>
<li>
<p>Add opt-in security hardening options to the MCP client. Both options
are opt-in; default behavior is unchanged. (<a
href="https://redirect.github.com/mastra-ai/mastra/pull/20868">#20868</a>)</p>
<ul>
<li><code>allowedHosts</code> on HTTP server configs restricts which
hosts the client's HTTP requests may target, covering the initial
connection, the SSE fallback, and OAuth discovery. On the default fetch
path redirect hops are blocked before they are sent; with a custom
<code>fetch</code>, the final response URL is validated after the
request runs, so custom fetch implementations must enforce redirect
policy themselves when preventing outbound contact is required.</li>
<li><code>inheritDefaultEnv: false</code> on stdio server configs stops
the subprocess from inheriting the SDK's default environment variables;
only the entries you list in <code>env</code> are passed.</li>
</ul>
<pre lang="typescript"><code>const mcp = new MCPClient({
  servers: {
    weather: {
      url: new URL('https://weather.example/mcp'),
      allowedHosts: ['weather.example'],
    },
    local: {
      command: 'npx',
      args: ['tsx', 'stdio-server.ts'],
      inheritDefaultEnv: false,
      env: { WEATHER_API_KEY: process.env.WEATHER_API_KEY! },
    },
  },
});
</code></pre>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/mastra-ai/mastra/commit/387c6b7f5a76e34bc3e2a1ec34cd5893abf4dcf4"><code>387c6b7</code></a>
chore: version - exit prerelease mode</li>
<li><a
href="https://github.com/mastra-ai/mastra/commit/361c421ca280e3fe6955ae91625931416bf4a731"><code>361c421</code></a>
chore: version packages</li>
<li><a
href="https://github.com/mastra-ai/mastra/commit/1b1dd7bc0e59b7a8bfabd09a3eec1ccd95b4c2f3"><code>1b1dd7b</code></a>
Cache MCP tool definitions and rebuild tools without reconnecting at
startup ...</li>
<li><a
href="https://github.com/mastra-ai/mastra/commit/ac0a3b8bcd5777b803b6b6aba2b6b60026919adc"><code>ac0a3b8</code></a>
chore: version packages (alpha) (<a
href="https://github.com/mastra-ai/mastra/tree/HEAD/packages/mcp/issues/20769">#20769</a>)</li>
<li><a
href="https://github.com/mastra-ai/mastra/commit/9ba12470c77f1c03642d720ce67e517e878f666e"><code>9ba1247</code></a>
fix(mcp): send MCP content text to the model via toModelOutput (<a
href="https://github.com/mastra-ai/mastra/tree/HEAD/packages/mcp/issues/20176">#20176</a>)</li>
<li><a
href="https://github.com/mastra-ai/mastra/commit/289f4ce16e3293370440172132c52ee787cbc09f"><code>289f4ce</code></a>
fix(core,mcp): coerce sub-agent maxSteps and prevent spurious MCP
reconnects ...</li>
<li><a
href="https://github.com/mastra-ai/mastra/commit/8e23a0b207f34b84bd28f3bf554c6931d8025b97"><code>8e23a0b</code></a>
chore: version packages</li>
<li><a
href="https://github.com/mastra-ai/mastra/commit/e7a5da4ef8e4dd452d2f232961b4e682a85ffe43"><code>e7a5da4</code></a>
feat: MCP v2 (draft) (<a
href="https://github.com/mastra-ai/mastra/tree/HEAD/packages/mcp/issues/18683">#18683</a>)</li>
<li><a
href="https://github.com/mastra-ai/mastra/commit/c71e3077e69eae3f25aa628e3778f153a9d6ab36"><code>c71e307</code></a>
feat(mcp): opt-in allowedHosts URL policy and inheritDefaultEnv stdio
isolati...</li>
<li><a
href="https://github.com/mastra-ai/mastra/commit/03348e6bea7d4b44edb3298e286506afdbcc04f0"><code>03348e6</code></a>
chore(deps): update security updates [security] (major) (<a
href="https://github.com/mastra-ai/mastra/tree/HEAD/packages/mcp/issues/19265">#19265</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/mastra-ai/mastra/commits/@mastra/mcp@1.16.0/packages/mcp">compare
view</a></li>
</ul>
</details>
<br />

Updates `ai` from 6.0.241 to 6.0.256
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/vercel/ai/releases">ai's
releases</a>.</em></p>
<blockquote>
<h2>ai@6.0.256</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [31205a4]
<ul>
<li><code>@​ai-sdk/provider-utils</code><a
href="https://github.com/4"><code>@​4</code></a>.0.46</li>
<li><code>@​ai-sdk/gateway</code><a
href="https://github.com/3"><code>@​3</code></a>.0.174</li>
</ul>
</li>
</ul>
<h2>ai@6.0.255</h2>
<h3>Patch Changes</h3>
<ul>
<li>35a94b0: Keep chat status submitted until response content begins
streaming.</li>
<li>93d24c6: Avoid repeatedly cloning accumulated text in
<code>readUIMessageStream</code> while
preserving independent snapshots for mutable nested values.</li>
<li>1bd1caf: Fix declaration emit for exported values that infer an
<code>Output</code> type.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/ai/blob/ai@6.0.256/packages/ai/CHANGELOG.md">ai's
changelog</a>.</em></p>
<blockquote>
<h2>6.0.256</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [31205a4]
<ul>
<li><code>@​ai-sdk/provider-utils</code><a
href="https://github.com/4"><code>@​4</code></a>.0.46</li>
<li><code>@​ai-sdk/gateway</code><a
href="https://github.com/3"><code>@​3</code></a>.0.174</li>
</ul>
</li>
</ul>
<h2>6.0.255</h2>
<h3>Patch Changes</h3>
<ul>
<li>35a94b0: Keep chat status submitted until response content begins
streaming.</li>
<li>93d24c6: Avoid repeatedly cloning accumulated text in
<code>readUIMessageStream</code> while
preserving independent snapshots for mutable nested values.</li>
<li>1bd1caf: Fix declaration emit for exported values that infer an
<code>Output</code> type.</li>
</ul>
<h2>6.0.254</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [71e94ad]
<ul>
<li><code>@​ai-sdk/gateway</code><a
href="https://github.com/3"><code>@​3</code></a>.0.173</li>
</ul>
</li>
</ul>
<h2>6.0.253</h2>
<h3>Patch Changes</h3>
<ul>
<li>d91d30b: Preserve reasoning block IDs from UI message streams on
reasoning UI parts.</li>
<li>Updated dependencies [0ec239b]
<ul>
<li><code>@​ai-sdk/gateway</code><a
href="https://github.com/3"><code>@​3</code></a>.0.172</li>
</ul>
</li>
</ul>
<h2>6.0.252</h2>
<h3>Patch Changes</h3>
<ul>
<li>2f96d3f: Allow providers without reranking model support to satisfy
the <code>Provider</code> type.</li>
<li>afb1965: Propagate errors thrown by the Chat <code>onFinish</code>
callback to the initiating request.</li>
<li>Updated dependencies [18b0965]</li>
<li>Updated dependencies [451d2c3]
<ul>
<li><code>@​ai-sdk/gateway</code><a
href="https://github.com/3"><code>@​3</code></a>.0.171</li>
</ul>
</li>
</ul>
<h2>6.0.251</h2>
<h3>Patch Changes</h3>
<ul>
<li>d13c2e9: Respect ToolLoopAgent timeouts configured in agent
settings.</li>
</ul>
<h2>6.0.250</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/ai/commit/85464f4e2026d9fc0274424c0171a25742836411"><code>85464f4</code></a>
Version Packages (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18920">#18920</a>)</li>
<li><a
href="https://github.com/vercel/ai/commit/4b050c0884f1f3c8f66867e8a91e3c5d70f8ac20"><code>4b050c0</code></a>
Version Packages (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18865">#18865</a>)</li>
<li><a
href="https://github.com/vercel/ai/commit/1bd1caf15fd87dd74c2c2e4af70800b3107b9af0"><code>1bd1caf</code></a>
[v6.0] fix: declaration emit failure for exported utilities using Prompt
and ...</li>
<li><a
href="https://github.com/vercel/ai/commit/93d24c6d8b664f4bb218d2e725eae3a9d6115f05"><code>93d24c6</code></a>
[v6.0] fix: prevent quadratic readUIMessageStream allocation without
weakenin...</li>
<li><a
href="https://github.com/vercel/ai/commit/9190ea8c3766862cb4bf6262a0061a4c3b8e6c2a"><code>9190ea8</code></a>
Version Packages (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18855">#18855</a>)</li>
<li><a
href="https://github.com/vercel/ai/commit/35a94b09b323a9b30a7f2c3974e15f00092881a0"><code>35a94b0</code></a>
[v6.0] fix: keep chat submitted until response content starts streaming
(<a
href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18861">#18861</a>)</li>
<li><a
href="https://github.com/vercel/ai/commit/f8cf14d13c66794cac9be6b024c20e1e316cbf9a"><code>f8cf14d</code></a>
Version Packages (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18786">#18786</a>)</li>
<li><a
href="https://github.com/vercel/ai/commit/d91d30b0151c52120a6d791a47c4bfd1da4a4065"><code>d91d30b</code></a>
[v6.0] fix: reasoning UI message parts lose their SSE block IDs (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18753">#18753</a>)</li>
<li><a
href="https://github.com/vercel/ai/commit/1b0361cdd052701c9b043cd2bc87ab3035d4929d"><code>1b0361c</code></a>
Version Packages (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18745">#18745</a>)</li>
<li><a
href="https://github.com/vercel/ai/commit/afb19653c29338697ee7e3697752ebbe96bd62b5"><code>afb1965</code></a>
[v6.0] fix: propagate errors thrown by Chat onFinish callbacks (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18736">#18736</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/ai/commits/ai@6.0.256/packages/ai">compare
view</a></li>
</ul>
</details>
<br />

Updates `@anthropic-ai/sdk` from 0.115.0 to 0.117.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/anthropic-sdk-typescript/releases">@​anthropic-ai/sdk's
releases</a>.</em></p>
<blockquote>
<h2>sdk: v0.117.1</h2>
<h2>0.117.1 (2026-08-13)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.117.0...sdk-v0.117.1">sdk-v0.117.0...sdk-v0.117.1</a></p>
<h3>Chores</h3>
<ul>
<li><strong>ci:</strong> allow manually re-publishing a package to npm
from the release workflow (<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/af60c1f980557368fb10c3701d8dc8a1fa75d70e">af60c1f</a>)</li>
<li><strong>internal:</strong> tag uploaded preview builds with the
branch name (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/295">#295</a>)
(<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/228f44ee4848e6a26be27d26093635e2dba783ea">228f44e</a>)</li>
</ul>
<h2>sdk: v0.117.0</h2>
<h2>0.117.0 (2026-08-13)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.116.0...sdk-v0.117.0">sdk-v0.116.0...sdk-v0.117.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> add output_behavior to dream creation (create
a new memory store or update the input store in place) (<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/6a5bd0f34d214759f97d485e46b09203fff3ea99">6a5bd0f</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>build:</strong> include dotfiles when flattening dist during
git installs (<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/917dbbb40070dbd1f861b16fcf297720d96f691b">917dbbb</a>)</li>
<li><strong>client:</strong> add models (<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/a7bfbb1b31e9d1dffe9a83b90ec1d0dabf5c36db">a7bfbb1</a>)</li>
<li><strong>messages:</strong> honor per-request timeout in the
non-streaming long-request check (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/272">#272</a>)
(<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/0fdd8a8feb5d16fbb943490a2b1e8ecf915596d6">0fdd8a8</a>)</li>
<li><strong>streaming:</strong> apply all message_delta fields when
accumulating streamed messages (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/289">#289</a>)
(<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/7b82659d70201ae3edab846f1693366db7e62ce3">7b82659</a>)</li>
<li><strong>tool-runner:</strong> forward the response container id to
the next request (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/271">#271</a>)
(<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/5bdee4a8ddd83e2f1c71daa429345b3b0fea4602">5bdee4a</a>)</li>
<li><strong>tools:</strong> align path resolution, skill-archive
members, and heartbeat bounds with the other SDKs (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/264">#264</a>)
(<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/5fbc729c82ec3967c9f76428d0f733b5fa61ddd5">5fbc729</a>)</li>
</ul>
<h3>Chores</h3>
<ul>
<li><strong>ci:</strong> run breaking-change detection as a ci.yml job
on every push (<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/c34c1d53f3227b3978621590e67f5a33f5cad107">c34c1d5</a>)</li>
<li><strong>internal:</strong> switch from yarn to pnpm (<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/f4eeea09648620d35517513814ffdc3bd3080801">f4eeea0</a>)</li>
<li><strong>tools:</strong> escape backslashes in skill archive
exclusion patterns (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/311">#311</a>)
(<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/67ede1c665883b7785af3240c749601d7ca19255">67ede1c</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li><strong>api:</strong> clarify that user profile name is optional for
resold profiles (<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/1b6fed5868bd16dd92120440d373da22084be237">1b6fed5</a>)</li>
</ul>
<h2>sdk: v0.116.0</h2>
<h2>0.116.0 (2026-08-07)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.115.0...sdk-v0.116.0">sdk-v0.115.0...sdk-v0.116.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> add
<code>mid-conversation-tool-changes-2026-07-01</code> beta (<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/70e04f689baa233e7cb2fed6bb807562f5595928">70e04f6</a>)</li>
<li><strong>api:</strong> add support for session budgets, advisor tool,
pinned inference location and skills auto-loading from GitHub (<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/1336a4a90387a7005f6211b6df5e2b247f4cb6b3">1336a4a</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md">@​anthropic-ai/sdk's
changelog</a>.</em></p>
<blockquote>
<h2>0.117.1 (2026-08-13)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.117.0...sdk-v0.117.1">sdk-v0.117.0...sdk-v0.117.1</a></p>
<h3>Chores</h3>
<ul>
<li><strong>ci:</strong> allow manually re-publishing a package to npm
from the release workflow (<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/af60c1f980557368fb10c3701d8dc8a1fa75d70e">af60c1f</a>)</li>
<li><strong>internal:</strong> tag uploaded preview builds with the
branch name (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/295">#295</a>)
(<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/228f44ee4848e6a26be27d26093635e2dba783ea">228f44e</a>)</li>
</ul>
<h2>0.117.0 (2026-08-13)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.116.0...sdk-v0.117.0">sdk-v0.116.0...sdk-v0.117.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> add output_behavior to dream creation (create
a new memory store or update the input store in place) (<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/6a5bd0f34d214759f97d485e46b09203fff3ea99">6a5bd0f</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>build:</strong> include dotfiles when flattening dist during
git installs (<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/917dbbb40070dbd1f861b16fcf297720d96f691b">917dbbb</a>)</li>
<li><strong>client:</strong> add models (<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/a7bfbb1b31e9d1dffe9a83b90ec1d0dabf5c36db">a7bfbb1</a>)</li>
<li><strong>messages:</strong> honor per-request timeout in the
non-streaming long-request check (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/272">#272</a>)
(<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/0fdd8a8feb5d16fbb943490a2b1e8ecf915596d6">0fdd8a8</a>)</li>
<li><strong>streaming:</strong> apply all message_delta fields when
accumulating streamed messages (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/289">#289</a>)
(<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/7b82659d70201ae3edab846f1693366db7e62ce3">7b82659</a>)</li>
<li><strong>tool-runner:</strong> forward the response container id to
the next request (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/271">#271</a>)
(<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/5bdee4a8ddd83e2f1c71daa429345b3b0fea4602">5bdee4a</a>)</li>
<li><strong>tools:</strong> align path resolution, skill-archive
members, and heartbeat bounds with the other SDKs (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/264">#264</a>)
(<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/5fbc729c82ec3967c9f76428d0f733b5fa61ddd5">5fbc729</a>)</li>
</ul>
<h3>Chores</h3>
<ul>
<li><strong>ci:</strong> run breaking-change detection as a ci.yml job
on every push (<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/c34c1d53f3227b3978621590e67f5a33f5cad107">c34c1d5</a>)</li>
<li><strong>internal:</strong> switch from yarn to pnpm (<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/f4eeea09648620d35517513814ffdc3bd3080801">f4eeea0</a>)</li>
<li><strong>tools:</strong> escape backslashes in skill archive
exclusion patterns (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/311">#311</a>)
(<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/67ede1c665883b7785af3240c749601d7ca19255">67ede1c</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li><strong>api:</strong> clarify that user profile name is optional for
resold profiles (<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/1b6fed5868bd16dd92120440d373da22084be237">1b6fed5</a>)</li>
</ul>
<h2>0.116.0 (2026-08-07)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.115.0...sdk-v0.116.0">sdk-v0.115.0...sdk-v0.116.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> add
<code>mid-conversation-tool-changes-2026-07-01</code> beta (<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/70e04f689baa233e7cb2fed6bb807562f5595928">70e04f6</a>)</li>
<li><strong>api:</strong> add support for session budgets, advisor tool,
pinned inference location and skills auto-loading from GitHub (<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/1336a4a90387a7005f6211b6df5e2b247f4cb6b3">1336a4a</a>)</li>
<li><strong>tools:</strong> make bash timeout and abort errors matchable
by class (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/259">#259</a>)
(<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/201b12e8acd69d7ab7068fe078f7988ab23897d2">201b12e</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/64a1e8e285bbcc4cef2b15ebcadccd8e5f6987ff"><code>64a1e8e</code></a>
chore: release main</li>
<li><a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/0281a291359489284c116d1adea6d13aa7a94b6d"><code>0281a29</code></a>
chore(ci): allow manually re-publishing a package to npm from the
release wor...</li>
<li><a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/f3e060b568a09556fea9288b688e1191f28f0935"><code>f3e060b</code></a>
chore(internal): tag uploaded preview builds with the branch name (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/295">#295</a>)</li>
<li><a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/6fcfb2c3fce958e59750df3e4a8fda969c5ff171"><code>6fcfb2c</code></a>
chore: release main</li>
<li><a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/1a1af331442d9e9fc4ba172d87e4bc46a48255b1"><code>1a1af33</code></a>
codegen metadata</li>
<li><a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/d6b8f40ffe75a80a53b1464b8cce05b54ecac40d"><code>d6b8f40</code></a>
chore: release main</li>
<li><a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/5edda861559d809092bead9617a1073324a64585"><code>5edda86</code></a>
chore(tools): escape backslashes in skill archive exclusion patterns (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/311">#311</a>)</li>
<li><a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/07cf28ce9d07da7d7c2b96d064d7a370d261c5bc"><code>07cf28c</code></a>
chore(internal): switch from yarn to pnpm</li>
<li><a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/a751543f5e0ba2096cc49821c351f8b3a82216ab"><code>a751543</code></a>
docs(api): clarify that user profile name is optional for resold
profiles</li>
<li><a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/0c74ed0372883d85378e5f85526d072e12d1997b"><code>0c74ed0</code></a>
fix(build): include dotfiles when flattening dist during git
installs</li>
<li>Additional commits viewable in <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.115.0...sdk-v0.117.1">compare
view</a></li>
</ul>
</details>
<br />

Updates `@google/genai` from 2.15.0 to 2.17.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/js-genai/releases">@​google/genai's
releases</a>.</em></p>
<blockquote>
<h2>v2.17.1</h2>
<h2><a
href="https://github.com/googleapis/js-genai/compare/v2.17.0...v2.17.1">2.17.1</a>
(2026-08-13)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>Add gemini-3.7-flash (<a
href="https://github.com/googleapis/js-genai/commit/c495e82719486d90561eeb7dc476b9fbaa26077b">c495e82</a>)</li>
</ul>
<h2>v2.17.0</h2>
<h2><a
href="https://github.com/googleapis/js-genai/compare/v2.16.0...v2.17.0">2.17.0</a>
(2026-08-12)</h2>
<h3>Features</h3>
<ul>
<li>Add interaction_status to LiveServerContent (<a
href="https://github.com/googleapis/js-genai/commit/4489991a7c40b22dff75348748048b0b14ac687e">4489991</a>)</li>
<li><strong>api:</strong> make the deferred service tier publicly
available on Vertex (<a
href="https://github.com/googleapis/js-genai/commit/9dafee9cd0f6089221bce5269dbd53fe7fa69806">9dafee9</a>)</li>
<li>Make speech_config a structured object. (<a
href="https://github.com/googleapis/js-genai/commit/9c9066594a57bda7ee417d79f8ef15c8ed0b333d">9c90665</a>)</li>
</ul>
<h2>v2.16.0</h2>
<h2><a
href="https://github.com/googleapis/js-genai/compare/v2.15.0...v2.16.0">2.16.0</a>
(2026-08-06)</h2>
<h3>Features</h3>
<ul>
<li>Add the Gemini Robotics ER 2 Preview model (<a
href="https://github.com/googleapis/js-genai/commit/5647cedfcf3fc5f862b01fb908d6aae267d8bb91">5647ced</a>)</li>
<li>Add TOO_MANY_TOOL_CALLS to FinishReason enum. (<a
href="https://github.com/googleapis/js-genai/commit/a7fa5683bc86a3edce347f6259fca8face0df3a4">a7fa568</a>)</li>
<li>Add top-level errors array to Interaction resource (iAPI) (<a
href="https://github.com/googleapis/js-genai/commit/b9dfd814a16ae985685ebcf5cb99a82625167142">b9dfd81</a>)</li>
<li>Make HttpOptions.timeout a per-attempt deadline in the JS GenAI SDK.
(<a
href="https://github.com/googleapis/js-genai/commit/8268806b3090834870ca6b901bdf289415425bac">8268806</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>Add propertyOrdering auto-population for ResponseSchema and
ResponseJsonSchema for Dotnet SDK (<a
href="https://github.com/googleapis/js-genai/commit/e26542fc58f832e0b88affab5c266fd0c469d01c">e26542f</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/js-genai/blob/main/CHANGELOG.md">@​google/genai's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/googleapis/js-genai/compare/v2.17.0...v2.17.1">2.17.1</a>
(2026-08-13)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>Add gemini-3.7-flash (<a
href="https://github.com/googleapis/js-genai/commit/c495e82719486d90561eeb7dc476b9fbaa26077b">c495e82</a>)</li>
</ul>
<h2><a
href="https://github.com/googleapis/js-genai/compare/v2.16.0...v2.17.0">2.17.0</a>
(2026-08-12)</h2>
<h3>Features</h3>
<ul>
<li>Add interaction_status to LiveServerContent (<a
href="https://github.com/googleapis/js-genai/commit/4489991a7c40b22dff75348748048b0b14ac687e">4489991</a>)</li>
<li><strong>api:</strong> make the deferred service tier publicly
available on Vertex (<a
href="https://github.com/googleapis/js-genai/commit/9dafee9cd0f6089221bce5269dbd53fe7fa69806">9dafee9</a>)</li>
<li>Make speech_config a structured object. (<a
href="https://github.com/googleapis/js-genai/commit/9c9066594a57bda7ee417d79f8ef15c8ed0b333d">9c90665</a>)</li>
</ul>
<h2><a
href="https://github.com/googleapis/js-genai/compare/v2.15.0...v2.16.0">2.16.0</a>
(2026-08-06)</h2>
<h3>Features</h3>
<ul>
<li>Add the Gemini Robotics ER 2 Preview model (<a
href="https://github.com/googleapis/js-genai/commit/5647cedfcf3fc5f862b01fb908d6aae267d8bb91">5647ced</a>)</li>
<li>Add TOO_MANY_TOOL_CALLS to FinishReason enum. (<a
href="https://github.com/googleapis/js-genai/commit/a7fa5683bc86a3edce347f6259fca8face0df3a4">a7fa568</a>)</li>
<li>Add top-level errors array to Interaction resource (iAPI) (<a
href="https://github.com/googleapis/js-genai/commit/b9dfd814a16ae985685ebcf5cb99a82625167142">b9dfd81</a>)</li>
<li>Make HttpOptions.timeout a per-attempt deadline in the JS GenAI SDK.
(<a
href="https://github.com/googleapis/js-genai/commit/8268806b3090834870ca6b901bdf289415425bac">8268806</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>Add propertyOrdering auto-population for ResponseSchema and
ResponseJsonSchema for Dotnet SDK (<a
href="https://github.com/googleapis/js-genai/commit/e26542fc58f832e0b88affab5c266fd0c469d01c">e26542f</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/googleapis/js-genai/commit/7736083c6d062ef423a378aecef154aab6def8a2"><code>7736083</code></a>
chore(main): release 2.17.1 (<a
href="https://redirect.github.com/googleapis/js-genai/issues/1853">#1853</a>)</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/c495e82719486d90561eeb7dc476b9fbaa26077b"><code>c495e82</code></a>
fix: Add gemini 3.7</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/dec2d3cbbc3c3928520d5c22fbbb2333b00b4ac9"><code>dec2d3c</code></a>
chore: Update GCS references to Cloud Storage in descriptions</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/0e80b4275655ed21cf1c390772da3e22b2a5a1db"><code>0e80b42</code></a>
Copybara import of the project:</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/4d15a7b78f5fceae4dca09f343c065e18f42b282"><code>4d15a7b</code></a>
chore: remove deprecated Turn types</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/49153845ff8968dff7403ce01ebd24e261403cda"><code>4915384</code></a>
chore(main): release 2.17.0 (<a
href="https://redirect.github.com/googleapis/js-genai/issues/1833">#1833</a>)</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/9c9066594a57bda7ee417d79f8ef15c8ed0b333d"><code>9c90665</code></a>
feat: Make speech_config a structured object.</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/b98223e26e043c40f41369d9c5eb84a5c776f85c"><code>b98223e</code></a>
No public description</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/4489991a7c40b22dff75348748048b0b14ac687e"><code>4489991</code></a>
feat: Add interaction_status to LiveServerContent</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/9dafee9cd0f6089221bce5269dbd53fe7fa69806"><code>9dafee9</code></a>
feat(api): make the deferred service tier publicly available on
Vertex</li>
<li>Additional commits viewable in <a
href="https://github.com/googleapis/js-genai/compare/v2.15.0...v2.17.1">compare
view</a></li>
</ul>
</details>
<br />

Updates `@langchain/core` from 1.2.4 to 1.2.8
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchainjs/releases">@​langchain/core's
releases</a>.</em></p>
<blockquote>
<h2><code>@​langchain/core</code><a
href="https://github.com/1"><code>@​1</code></a>.2.8</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11369">#11369</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/d6ad9735640a6c729f81ef79361acc5e83c526f1"><code>d6ad973</code></a>
Thanks <a href="https://github.com/hntrl"><code>@​hntrl</code></a>! -
fix(langchain): use unified endpoint for gateway</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11342">#11342</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/3b0e4c48a31811031a460c4d95519a7c1163dc41"><code>3b0e4c4</code></a>
Thanks <a
href="https://github.com/thushanth-bengre-langchain"><code>@​thushanth-bengre-langchain</code></a>!
- feat(core): mark errors as retryable or not, and stop retrying the
ones that aren't</p>
<p>Retry middleware retried every failure up to <code>maxRetries</code>,
including deterministic ones like a bad API key or an unknown model.
Retries also nest, so a single such failure could cost dozens of API
calls.</p>
<p><code>@langchain/core/errors</code> adds <code>stampRetryable(error,
retryable)</code> and <code>getRetryable(error)</code>. Marking an error
leaves its class and shape untouched, so a provider SDK error can be
classified without breaking <code>instanceof</code>.
<code>getRetryable</code> returns <code>undefined</code> for errors
nobody classified, and both are exported so tool authors can mark their
own failures.</p>
<p><code>modelRetryMiddleware</code> and
<code>toolRetryMiddleware</code> now respect the mark by default, and
retries stop as soon as one is found rather than each layer spending its
own budget. Aborted calls, context overflow, and oversized payloads are
marked non-retryable out of the box.
Models accept a per-call <code>maxRetries</code> so a surrounding retry
loop can take over.</p>
<p><strong>Behavior change:</strong> errors marked non-retryable now
fail on the first attempt. Unclassified errors — including any from
third-party integrations or custom tools — retry exactly as before. Pass
<code>retryOn: () =&gt; true</code> to restore the old default. A custom
<code>onFailedAttempt</code> replaces the built-in handler and opts out
of marking.</p>
</li>
</ul>
<h2><code>@​langchain/core</code><a
href="https://github.com/1"><code>@​1</code></a>.2.7</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11366">#11366</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/c068bbf8c113132bf16ac7a8add44e486a147b41"><code>c068bbf</code></a>
Thanks <a href="https://github.com/hntrl"><code>@​hntrl</code></a>! -
fix(core,langchain): patch and release core, update peer
dependencies</li>
</ul>
<h2><code>@​langchain/core</code><a
href="https://github.com/1"><code>@​1</code></a>.2.6</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11344">#11344</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/f08e0c6d50156accf95a36469a3e107a5598a3a0"><code>f08e0c6</code></a>
Thanks <a href="https://github.com/hntrl"><code>@​hntrl</code></a>! -
fix: apply [Symbol.hasInstance] method to all comparable properties
using .isInstance()</p>
<p>We have some internal schemas that rely on
<code>z.instanceof()</code>. This uses a strict <code>instanceof</code>
check which can conflict if there are multiple versions of core
installed. This overrides the <a
href="https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Symbol/hasInstance">Symbol.hasInstance</a>
method to use the same logic as <code>.isInstance()</code> to compare
objects at runtime.</p>
</li>
</ul>
<h2><code>@​langchain/core</code><a
href="https://github.com/1"><code>@​1</code></a>.2.5</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11305">#11305</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/e654022e291b8dae54504ac2d1a3232332406723"><code>e654022</code></a>
Thanks <a
href="https://github.com/jacoblee93"><code>@​jacoblee93</code></a>! -
Add LangSmith Gateway environment configuration to OpenAI, Anthropic,
and Fireworks chat models.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11295">#11295</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/1a1b347d18bc68e842df8badffc987493c81d70a"><code>1a1b347</code></a>
Thanks <a
href="https://github.com/vladislav-nechakhin"><code>@​vladislav-nechakhin</code></a>!
- fix(core): pass the mustache escape override per render call</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/d0c905ddcc2471d0c89a2f1520d96782253ba5c3"><code>d0c905d</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11370">#11370</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/8ba1fd996ff9efe93e5cb75afa946204c00528a4"><code>8ba1fd9</code></a>
fix(aws): classify Bedrock stream-idle timeouts, cover pre-response hang
(<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11">#11</a>...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/3b0e4c48a31811031a460c4d95519a7c1163dc41"><code>3b0e4c4</code></a>
feat(core): mark errors as retryable or not, and stop retrying the ones
that ...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/d6ad9735640a6c729f81ef79361acc5e83c526f1"><code>d6ad973</code></a>
fix(langchain): use unified endpoint for gateway (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11369">#11369</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/3fedf7f1934a592b71da866bd16af886b4e0c00d"><code>3fedf7f</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11367">#11367</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/c068bbf8c113132bf16ac7a8add44e486a147b41"><code>c068bbf</code></a>
fix(core,langchain): patch and release core, update peer dependencies
(<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11366">#11366</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/242b986afd9b257ddbedd5d0dcc84f197289faef"><code>242b986</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11361">#11361</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/2d1f7449c95a554d429535abae0115b4f578bbac"><code>2d1f744</code></a>
chore(langchain): add missing changeset (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11363">#11363</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/f401396a21285d49804f1dc7e4e2fa2396d5317f"><code>f401396</code></a>
feat(langchain): add langsmith gateway to initChatModel (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11362">#11362</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/d36ec6a6f4b1c474b0d9f9cb6037ff37f54183bf"><code>d36ec6a</code></a>
fix(anthropic): preserve gateway cost on the native stream path (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11359">#11359</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchainjs/compare/@langchain/core@1.2.4...@langchain/core@1.2.8">compare
view</a></li>
</ul>
</details>
<br />

Updates `@langchain/langgraph` from 1.4.9 to 1.4.10
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langgraphjs/releases">@​langchain/langgraph's
releases</a>.</em></p>
<blockquote>
<h2><code>@​langchain/langgraph</code><a
href="https://github.com/1"><code>@​1</code></a>.4.10</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2690">#2690</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/00f68a1b002d820b95129bcdaf387d2678ead6f0"><code>00f68a1</code></a>
Thanks <a
href="https://github.com/saad-supports-langchain"><code>@​saad-supports-langchain</code></a>!
- fix(langgraph): keep <code>context</code> values out of tracer-derived
metadata</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langgraphjs/blob/main/libs/langgraph-core/CHANGELOG.md">@​langchain/langgraph's
changelog</a>.</em></p>
<blockquote>
<h2>1.4.10</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2690">#2690</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/00f68a1b002d820b95129bcdaf387d2678ead6f0"><code>00f68a1</code></a>
Thanks <a
href="https://github.com/saad-supports-langchain"><code>@​saad-supports-langchain</code></a>!
- fix(langgraph): keep <code>context</code> values out of tracer-derived
metadata</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/f6b41bf4861322e380e02f746285496e84b0f96b"><code>f6b41bf</code></a>
chore: version packages (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2698">#2698</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/00f68a1b002d820b95129bcdaf387d2678ead6f0"><code>00f68a1</code></a>
fix(langgraph): keep context values out of tracer-derived metadata (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2690">#2690</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/6ac60da74f6b9e29d20b111a7947ac3060f1d2dd"><code>6ac60da</code></a>
chore(deps): bump the langchain group across 1 directory with 5 updates
(<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2651">#2651</a>)</li>
<li>See full diff in <a
href="https://github.com/langchain-ai/langgraphjs/commits/@langchain/langgraph@1.4.10/libs/langgraph-core">compare
view</a></li>
</ul>
</details>
<br />

Updates `@langchain/openai` from 1.5.5 to 1.5.8
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchainjs/releases">@​langchain/openai's
releases</a>.</em></p>
<blockquote>
<h2><code>@​langchain/openai</code><a
href="https://github.com/1"><code>@​1</code></a>.5.8</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11342">#11342</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/3b0e4c48a31811031a460c4d95519a7c1163dc41"><code>3b0e4c4</code></a>
Thanks <a
href="https://github.com/thushanth-bengre-langchain"><code>@​thushanth-bengre-langchain</code></a>!
- feat(openai): mark OpenAI provider errors as retryable or not</p>
<p>Builds on <code>stampRetryable</code> in <code>@langchain/core</code>
so the retry middleware can tell a transient failure from a
deterministic one. Timeouts and rate limits are marked retryable;
aborts, context overflow, invalid tool results, bad credentials, and
unknown models non-retryable. Anything else stays unmarked and retries
as before.</p>
<p>Also forwards a per-call <code>maxRetries</code> to the retry loop,
so a surrounding retry loop such as <code>modelRetryMiddleware</code>
can take over instead of the two multiplying against each other.</p>
<p>Errors keep their original class, so <code>instanceof</code> against
the <code>openai</code> SDK error types is unaffected.</p>
</li>
</ul>
<h2><code>@​langchain/openai</code><a
href="https://github.com/1"><code>@​1</code></a>.5.7</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11347">#11347</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/3fe4c43ce3399ebf2391ed612d78fedcd3ea5ec6"><code>3fe4c43</code></a>
Thanks <a
href="https://github.com/talarari"><code>@​talarari</code></a>! -
fix(openai): include <code>usage</code> in
<code>response_metadata</code> when <code>system_fingerprint</code> is
absent</li>
</ul>
<h2><code>@​langchain/openai</code><a
href="https://github.com/1"><code>@​1</code></a>.5.6</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11305">#11305</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/e654022e291b8dae54504ac2d1a3232332406723"><code>e654022</code></a>
Thanks <a
href="https://github.com/jacoblee93"><code>@​jacoblee93</code></a>! -
Add LangSmith Gateway environment configuration to OpenAI, Anthropic,
and Fireworks chat models.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/d0c905ddcc2471d0c89a2f1520d96782253ba5c3"><code>d0c905d</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11370">#11370</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/8ba1fd996ff9efe93e5cb75afa946204c00528a4"><code>8ba1fd9</code></a>
fix(aws): classify Bedrock stream-idle timeouts, cover pre-response hang
(<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11">#11</a>...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/3b0e4c48a31811031a460c4d95519a7c1163dc41"><code>3b0e4c4</code></a>
feat(core): mark errors as retryable or not, and stop retrying the ones
that ...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/d6ad9735640a6c729f81ef79361acc5e83c526f1"><code>d6ad973</code></a>
fix(langchain): use unified endpoint for gateway (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11369">#11369</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/3fedf7f1934a592b71da866bd16af886b4e0c00d"><code>3fedf7f</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11367">#11367</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/c068bbf8c113132bf16ac7a8add44e486a147b41"><code>c068bbf</code></a>
fix(core,langchain): patch and release core, update peer dependencies
(<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11366">#11366</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/242b986afd9b257ddbedd5d0dcc84f197289faef"><code>242b986</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11361">#11361</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/2d1f7449c95a554d429535abae0115b4f578bbac"><code>2d1f744</code></a>
chore(langchain): add missing changeset (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11363">#11363</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/f401396a21285d49804f1dc7e4e2fa2396d5317f"><code>f401396</code></a>
feat(langchain): add langsmith gateway to initChatModel (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11362">#11362</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/d36ec6a6f4b1c474b0d9f9cb6037ff37f54183bf"><code>d36ec6a</code></a>
fix(anthropic): preserve gateway cost on the native stream path (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11359">#11359</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchainjs/compare/@langchain/openai@1.5.5...@langchain/openai@1.5.8">compare
view</a></li>
</ul>
</details>
<br />

Updates `langchain` from 1.5.4 to 1.5.9
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchainjs/releases">langchain's
releases</a>.</em></p>
<blockquote>
<h2>langchain@1.5.9</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11369">#11369</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/d6ad9735640a6c729f81ef79361acc5e83c526f1"><code>d6ad973</code></a>
Thanks <a href="https://github.com/hntrl"><code>@​hntrl</code></a>! -
fix(langchain): use unified endpoint for gateway</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11342">#11342</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/3b0e4c48a31811031a460c4d95519a7c1163dc41"><code>3b0e4c4</code></a>
Thanks <a
href="https://github.com/thushanth-bengre-langchain"><code>@​thushanth-bengre-langchain</code></a>!
- feat(core): mark errors as retryable or not, and stop retrying the
ones that aren't</p>
<p>Retry middleware retried every failure up to <code>maxRetries</code>,
including deterministic ones like a bad API key or an unknown model.
Retries also nest, so a single such failure could cost dozens of API
calls.</p>
<p><code>@langchain/core/errors</code> adds <code>stampRetryable(error,
retryable)</code> and <code>getRetryable(error)</code>. Marking an error
leaves its class and shape untouched, so a provider SDK error can be
classified without breaking <code>instanceof</code>.
<code>getRetryable</code> returns <code>undefined</code> for errors
nobody classified, and both are exported so tool authors can mark their
own failures.</p>
<p><code>modelRetryMiddleware</code> and
<code>toolRetryMiddleware</code> now respect the mark by default, and
retries stop as soon as one is found rather than each layer spending its
own budget. Aborted calls, context overflow, and oversized payloads are
marked non-retryable out of the box.
Models accept a per-call <code>maxRetries</code> so a surrounding retry
loop can take over.</p>
<p><strong>Behavior change:</strong> errors marked non-retryable now
fail on the first attempt. Unclassified errors — including any from
third-party integrations or custom tools — retry exactly as before. Pass
<code>retryOn: () =&gt; true</code> to restore the old default. A custom
<code>onFailedAttempt</code> replaces the built-in handler and opts out
of marking.</p>
</li>
</ul>
<h2>langchain@1.5.8</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11366">#11366</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/c068bbf8c113132bf16ac7a8add44e486a147b41"><code>c068bbf</code></a>
Thanks <a href="https://github.com/hntrl"><code>@​hntrl</code></a>! -
fix(core,langchain): patch and release core, update peer
dependencies</li>
</ul>
<h2>langchain@1.5.7</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11363">#11363</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/2d1f7449c95a554d429535abae0115b4f578bbac"><code>2d1f744</code></a>
Thanks <a href="https://github.com/hntrl"><code>@​hntrl</code></a>! -
feat(langchain): add langsmith gateway to initChatModel- <a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11362">#11362</a></li>
</ul>
<h2>langchain@1.5.6</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11331">#11331</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/18765b002c3819bc4dc42123a293cab27a35ce4f"><code>18765b0</code></a>
Thanks <a
href="https://github.com/thushanth-bengre-langchain"><code>@​thushanth-bengre-langchain</code></a>!
- fix(langchain): exclude middleware-internal model calls from the
message projection</p>
<p>Bookkeeping model calls made by <code>summarizationMiddleware</code>
and <code>toolEmulatorMiddleware</code> no longer appear in
<code>run.messages</code> or <code>stream({ streamMode:
&quot;messages&quot; })</code>, and the summary
<code>summarizationMiddleware</code> writes back to state is no longer
projected as a new message. These calls remain observable via
<code>streamEvents({ version: &quot;v2&quot; })</code>, identified by
<code>lc_source</code>.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11344">#11344</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/f08e0c6d50156accf95a36469a3e107...

_Description has been truncated_

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: jkomyno <alberto@composio.dev>
 2026-08-18 13:51:57 +02:00
Alberto Schiabel 6ba9179b48 fix(files): validate URLs from API responses before fetching them (#4146) 
This PR:

- builds on top of https://github.com/ComposioHQ/composio/pull/4144
- routes every fetch whose URL comes from an API response through the
SSRF guards that already existed — ten sinks, five per SDK: the
tool-execution download, both S3 presigned uploads,
`RemoteFile.buffer()`/`blob()`, and the Tool Router session file upload
- adds `safe_request()` (Python), which follows redirects itself and
re-validates each hop, so a validated URL cannot 302 into private space
and an S3 307 region redirect still works
- makes `RemoteFile.buffer()` (Python) share `_fetch_url_bytes` with the
user-supplied-URL path instead of duplicating it — it previously read
`response.content` with no size cap, no redirect control, and no target
validation
- adds `ssrfSafeFetchWhereSupported` (TypeScript): the full guard on
Node, a plain `fetch` on workerd, so Tool Router session file transfers
keep working in edge runtimes rather than failing closed
- documents DNS rebinding as a known residual in both guards
- adds tests that assert the guard *runs* — blocked URL, sink never
called, nothing written — rather than that a transfer succeeds

## Context

`python/AGENTS.md` states the trust boundary: every field of an API
response is untrusted input, because the backend may be compromised or
the connection MITM'd. Both SDKs enforced that for URLs a *user* passes
in (`composio.utils.url_safety`, `ssrfGuard.node.ts`) and left the URLs
an API *response* supplies unguarded — backwards relative to the stated
model. A response naming an internal address turned the SDK into a
request proxy for it, and the fetched bytes were written to disk or
returned to the caller, typically into an LLM context.

`RemoteFile.buffer()` was the weakest of the ten: four lines above it,
`_fetch_from_url` validated its target, refused redirects, and streamed
against a 100 MiB cap; `buffer()` did none of the three. The only
difference between them was which side of the trust boundary the URL
arrived from.

Three decisions worth review:

- **The guard is unconditional.** Presigned URLs are public, so nothing
legitimate should resolve to private space. There is no escape hatch,
and no new configuration surface.
- **The tool-execution download stays uncapped.** It streams straight to
disk, so `_MAX_RESPONSE_SIZE` — a memory-exhaustion bound — does not
apply, and tool attachments legitimately exceed it.
`RemoteFile.buffer()` *is* capped, because it buffers in memory.
- **Uploads follow redirects with re-validation rather than refusing
them**, since S3 can answer a PUT with a 307 region redirect. Downloads
keep `allow_redirects=False`, matching the existing fetch paths.

Python now matches the TypeScript guard's per-hop re-validation, which
was the better of the two implementations.

Verified locally: `make chk` and `make tst` clean on the Python side;
`pnpm -C packages/core test` 1095 passed, typecheck and lint clean.
 2026-08-18 13:25:01 +02:00
Alberto Schiabel 09f76b1c9f refactor(cli): eliminate raw environment access (#4134) 
This PR:
- routes Composio-prefixed runtime configuration through `APP_CONFIG`
and normalizes unprefixed host values through `HOST_CONFIG` in
`app-config.ts`
- removes `loadOptionalAppConfig`-style fallback loading so optional
strings, booleans, and CLI flag precedence resolve at the configuration
boundary
- removes every executable `process.env` reference from CLI source;
child commands inherit the ambient environment through
`@effect/platform` and receive explicit normalized overrides
- preserves arbitrary `CODEX_*`, `CLAUDE_*`, and `OPENCLAW_*` detection
through Effect config enumeration without exposing the raw environment
map
- propagates telemetry debug state through worker arguments instead of
mutating the process environment
- replaces removable filesystem, OS, subprocess, and error-handling
exceptions with Effect services and typed control flow
- documents supported and internal CLI environment variables, including
their `user_data.json` and `config.json` mappings
- reduces registered CLI lint boundaries from 45 to 4; the retained
entries are the detached-spawn, Node OS, synchronous preload filesystem,
and MD5 checksum implementations
- verifies the result with 1,201 passing CLI tests (1 skipped), strict
Oxlint, boundary validation, root typechecking across 19 packages, the
CLI build, and real `composio run` child-process checks
 2026-08-18 12:54:26 +02:00
dependabot[bot] c0c511bb4b chore(deps-dev): bump the npm-development group with 7 updates (#4133) 
Bumps the npm-development group with 7 updates:

| Package | From | To |
| --- | --- | --- |
|
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
| `26.1.2` | `26.2.0` |
| [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) |
`1.77.0` | `1.78.0` |
|
[oxlint-plugin-eslint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint)
| `1.77.0` | `1.78.0` |
| [turbo](https://github.com/vercel/turborepo) | `2.10.8` | `2.10.9` |
|
[chrome-devtools-mcp](https://github.com/ChromeDevTools/chrome-devtools-mcp)
| `1.6.0` | `1.7.0` |
|
[@earendil-works/pi-coding-agent](https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent)
| `0.83.0` | `0.84.1` |
| [eve](https://github.com/vercel/eve/tree/HEAD/packages/eve) | `0.29.5`
| `0.31.3` |

Updates `@types/node` from 26.1.2 to 26.2.0
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />

Updates `oxlint` from 1.77.0 to 1.78.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md">oxlint's
changelog</a>.</em></p>
<blockquote>
<h2>[1.78.0] - 2026-08-10</h2>
<h3>🚀 Features</h3>
<ul>
<li>ccb8fe8 linter/jsdoc: Implement <code>no-blank-blocks</code> rule
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25207">#25207</a>)
(Mikhail Baev)</li>
<li>d4a897c linter/eslint: Implement <code>one-var</code> rule (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/24470">#24470</a>)
(Cole Ellison)</li>
<li>5ab9340 linter/jsx-a11y/anchor-has-content: Add options to match
eslint (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/24571">#24571</a>)
(Cole Ellison)</li>
</ul>
<h3>🐛 Bug Fixes</h3>
<ul>
<li>9573937 linter/typescript: Validate <code>ban-ts-comment</code>
description_format (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25320">#25320</a>)
(Mikhail Baev)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/oxc-project/oxc/commit/c42d6397eab5b2d5bb2bd6746c57bc2a9cad21bd"><code>c42d639</code></a>
release(apps): oxlint v1.78.0 &amp;&amp; oxfmt v0.63.0 (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25473">#25473</a>)</li>
<li><a
href="https://github.com/oxc-project/oxc/commit/ccb8fe89db08123ff2b86d7fb2f39d0dd6c33df7"><code>ccb8fe8</code></a>
feat(linter/jsdoc): implement <code>no-blank-blocks</code> rule (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25207">#25207</a>)</li>
<li><a
href="https://github.com/oxc-project/oxc/commit/9573937df3cc01f29e1c65bc018ce378ec947e0e"><code>9573937</code></a>
fix(linter/typescript): validate <code>ban-ts-comment</code>
description_format (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25320">#25320</a>)</li>
<li><a
href="https://github.com/oxc-project/oxc/commit/d4a897ce2290bf853720b4fbf371304bfea2c980"><code>d4a897c</code></a>
feat(linter/eslint): implement <code>one-var</code> rule (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/24470">#24470</a>)</li>
<li><a
href="https://github.com/oxc-project/oxc/commit/5ab9340637eff80539bca89a494e162e94569358"><code>5ab9340</code></a>
feat(linter/jsx-a11y/anchor-has-content): add options to match eslint
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/24571">#24571</a>)</li>
<li>See full diff in <a
href="https://github.com/oxc-project/oxc/commits/oxlint_v1.78.0/npm/oxlint">compare
view</a></li>
</ul>
</details>
<br />

Updates `oxlint-plugin-eslint` from 1.77.0 to 1.78.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/oxc-project/oxc/releases">oxlint-plugin-eslint's
releases</a>.</em></p>
<blockquote>
<h2>oxlint v1.78.0 &amp; oxfmt v0.63.0</h2>
<h2>Table of Contents</h2>
<ul>
<li><a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/blob/HEAD/#oxlint-v1.78.0">Oxlint
v1.78.0</a></li>
<li><a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/blob/HEAD/#oxfmt-v0.63.0">Oxfmt
v0.63.0</a></li>
</ul>
<h2>Oxlint v1.78.0</h2>
<h3>🚀 Features</h3>
<ul>
<li>ccb8fe8 linter/jsdoc: Implement <code>no-blank-blocks</code> rule
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25207">#25207</a>)
(Mikhail Baev)</li>
<li>d4a897c linter/eslint: Implement <code>one-var</code> rule (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/24470">#24470</a>)
(Cole Ellison)</li>
<li>5ab9340 linter/jsx-a11y/anchor-has-content: Add options to match
eslint (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/24571">#24571</a>)
(Cole Ellison)</li>
</ul>
<h3>🐛 Bug Fixes</h3>
<ul>
<li>b746e00 linter/eslint/no-implicit-coercion: Preserve template
coercion whitespace (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25470">#25470</a>)
(camc314)</li>
<li>a92c541 linter: Preserve source text for JS plugin ignore fixes (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25280">#25280</a>)
(Norcleeh)</li>
<li>675c840 linter/eslint/prefer-promise-reject-errors: Handle
parenthesized calls (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25378">#25378</a>)
(camc314)</li>
<li>1703739 linter/unicorn/new-for-builtins: Ignore optional chains (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25411">#25411</a>)
(tanakalucky)</li>
<li>95ece63 linter/unicorn/prefer-code-point: Downgrade the auto-fix to
dangerous (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25412">#25412</a>)
(leemr)</li>
<li>c451a0e linter/vitest: Validate
<code>consistent-test-filename</code> regex patterns (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25408">#25408</a>)
(Mikhail Baev)</li>
<li>937825c react_compiler: Disable exhaustive memo validation by
default (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25417">#25417</a>)
(Boshen)</li>
<li>f0f7dae linter/eslint/no-unused-vars: Report invalid regex options
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25380">#25380</a>)
(Cameron)</li>
<li>44e73fd linter/unicorn/prefer-array-flat: Fix
<code>concat.apply</code> suggestions (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25373">#25373</a>)
(Cameron)</li>
<li>6846a9a linter/react/rules-of-hooks: Detect constructor callbacks
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25377">#25377</a>)
(camc314)</li>
<li>b247a9d linter/unicorn/new-for-builtins: Support
<code>Float16Array</code> (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25382">#25382</a>)
(tanakalucky)</li>
<li>19109cd linter/unicorn/error-message: Support
<code>SuppressedError</code> messages (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25375">#25375</a>)
(camc314)</li>
<li>9c13f5e linter: Assert token lookup invariants (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25368">#25368</a>)
(camc314)</li>
<li>bc35f83 linter/eslint/no-unused-vars: Bound catch parameter lookup
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25367">#25367</a>)
(camc314)</li>
<li>c159fb9 linter/unicorn/switch-case-braces: Bound token lookup (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25363">#25363</a>)
(camc314)</li>
<li>03b2eb2 linter/unicorn/no-static-only-class: Bound token lookup (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25361">#25361</a>)
(camc314)</li>
<li>0afc59e linter/unicorn/empty-brace-spaces: Bound token lookup (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25353">#25353</a>)
(camc314)</li>
<li>2963d98 linter/eslint/no-unreachable-loop: Do not report loops whose
body has a finally block (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25335">#25335</a>)
(Todor Andonov)</li>
<li>589e5fb linter/eslint/no-param-reassign: Validate
<code>ignorePropertyModificationsForRegex</code> property (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25346">#25346</a>)
(Mikhail Baev)</li>
<li>aae5d8b linter/eslint/no-throw-literal: False positive on variable
declared without initializer (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25275">#25275</a>)
(cjnoname)</li>
<li>6b1c479 oxlint: Normalize customized rule names (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25316">#25316</a>)
(camc314)</li>
<li>d494eb5 linter/unicorn/consistent-existence-index-check: Bound token
lookup (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25325">#25325</a>)
(camc314)</li>
<li>4266037 linter/typescript/prefer-namespace-keyword: Bound token
lookup (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25322">#25322</a>)
(camc314)</li>
<li>4745b4e linter/typescript/no-namespace: Bound token lookup (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25321">#25321</a>)
(camc314)</li>
<li>648a481 linter/eslint/one-var: Avoid joining exported declarations
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25314">#25314</a>)
(camc314)</li>
<li>9573937 linter/typescript: Validate <code>ban-ts-comment</code>
description_format (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25320">#25320</a>)
(Mikhail Baev)</li>
<li>ebf7d18 linter/typescript/consistent-type-definitions: Bound token
lookup (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25281">#25281</a>)
(camc314)</li>
<li>1501ccf linter/typescript/consistent-generic-constructors: Bound
token lookup (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25258">#25258</a>)
(camc314)</li>
</ul>
<h3>⚡ Performance</h3>
<ul>
<li>8f784f3 linter: Reduce rule config dispatch size (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25461">#25461</a>)
(Boshen)</li>
<li>2de4ec2 linter: Reduce visitor code size (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25441">#25441</a>)
(Boshen)</li>
<li>6fb7f47 linter/unicorn/prefer-export-from: Narrow
<code>ExportFromDeclaration</code> lookup (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25381">#25381</a>)
(camc314)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/oxc-project/oxc/commit/c42d6397eab5b2d5bb2bd6746c57bc2a9cad21bd"><code>c42d639</code></a>
release(apps): oxlint v1.78.0 &amp;&amp; oxfmt v0.63.0 (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25473">#25473</a>)</li>
<li>See full diff in <a
href="https://github.com/oxc-project/oxc/commits/apps_v1.78.0/npm/oxlint-plugin-eslint">compare
view</a></li>
</ul>
</details>
<br />

Updates `turbo` from 2.10.8 to 2.10.9
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/turborepo/releases">turbo's
releases</a>.</em></p>
<blockquote>
<h2>Turborepo v2.10.9</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Changelog</h3>
<ul>
<li>chore: Release Turborepo 2.10.8 by <a
href="https://github.com/github-actions"><code>@​github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13626">vercel/turborepo#13626</a></li>
<li>perf: Walk literal-prefix tree globs without wax compilation by <a
href="https://github.com/charpeni"><code>@​charpeni</code></a> in <a
href="https://redirect.github.com/vercel/turborepo/pull/13522">vercel/turborepo#13522</a></li>
<li>fix: Accept semver ranges in devEngines.packageManager.version by <a
href="https://github.com/bangseongbeom"><code>@​bangseongbeom</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13623">vercel/turborepo#13623</a></li>
<li>docs: Explain affected package invalidation reasons by <a
href="https://github.com/ghoullier"><code>@​ghoullier</code></a> in <a
href="https://redirect.github.com/vercel/turborepo/pull/13594">vercel/turborepo#13594</a></li>
<li>perf(lockfiles): Borrow field-name scalars in the pnpm fast parser
by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13648">vercel/turborepo#13648</a></li>
<li>perf(repository): Avoid discarded alias allocation in Relationship
by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13650">vercel/turborepo#13650</a></li>
<li>perf(lockfiles): Drop redundant human_name clone for pnpm v7/v9 by
<a href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13649">vercel/turborepo#13649</a></li>
<li>perf: Index workspace nodes by name in project_relationships by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13647">vercel/turborepo#13647</a></li>
<li>perf: Share resolution identity lists across identical workspace
closures by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13641">vercel/turborepo#13641</a></li>
<li>docs: Fix duplicated word in runtime dependencies guide summary by
<a href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13630">vercel/turborepo#13630</a></li>
<li>refactor: Remove turborepo-lsp dependency on turborepo-lib by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13631">vercel/turborepo#13631</a></li>
<li>perf: Index Bun nested lockfile entries by name for fallback
resolution by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13633">vercel/turborepo#13633</a></li>
<li>perf: Memoize framework inference per package during task hashing by
<a href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13634">vercel/turborepo#13634</a></li>
<li>perf: Avoid materializing transient declarations in
external_dependencies by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13646">vercel/turborepo#13646</a></li>
<li>perf: Enable shared closure DP for npm and yarn1 lockfiles by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13635">vercel/turborepo#13635</a></li>
<li>perf: Parse pnpm explicit-key entries in the lockfile fast path by
<a href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13640">vercel/turborepo#13640</a></li>
<li>perf: Parallelize resolution fingerprint hashing by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13642">vercel/turborepo#13642</a></li>
<li>perf: Build resolution identity lists in parallel by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13643">vercel/turborepo#13643</a></li>
<li>perf: Intern resolution identities as Arc&lt;str&gt; across closures
by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13645">vercel/turborepo#13645</a></li>
<li>fix: Compose affected tasks with package filters by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13656">vercel/turborepo#13656</a></li>
<li>docs: Explain worktree cache path isolation by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13657">vercel/turborepo#13657</a></li>
<li>fix: Upgrade brace-expansion to 5.0.9 by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13658">vercel/turborepo#13658</a></li>
<li>docs: Correct verified inaccuracies in the Turborepo Agent Skill by
<a href="https://github.com/charpeni"><code>@​charpeni</code></a> in <a
href="https://redirect.github.com/vercel/turborepo/pull/13644">vercel/turborepo#13644</a></li>
<li>chore: Update Next.js to 16.3.0 by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13659">vercel/turborepo#13659</a></li>
<li>fix: Don't use <code>eprintln!</code> in the panic hook by <a
href="https://github.com/molofsky"><code>@​molofsky</code></a> in <a
href="https://redirect.github.com/vercel/turborepo/pull/13637">vercel/turborepo#13637</a></li>
<li>fix: Invalidate only when Git ignore sources change by <a
href="https://github.com/smasato"><code>@​smasato</code></a> in <a
href="https://redirect.github.com/vercel/turborepo/pull/13632">vercel/turborepo#13632</a></li>
<li>docs: Update Geistdocs to 1.19.4 by <a
href="https://github.com/christopherkindl"><code>@​christopherkindl</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13680">vercel/turborepo#13680</a></li>
<li>docs: Exclude Turborepo from its own OSS products menu by <a
href="https://github.com/christopherkindl"><code>@​christopherkindl</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13681">vercel/turborepo#13681</a></li>
<li>docs: Use the geistdocs Turborepo logo in the navbar by <a
href="https://github.com/christopherkindl"><code>@​christopherkindl</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13682">vercel/turborepo#13682</a></li>
<li>docs: Update redirected vercel.com/nextjs.org links to current
targets by <a
href="https://github.com/molebox"><code>@​molebox</code></a> in <a
href="https://redirect.github.com/vercel/turborepo/pull/13685">vercel/turborepo#13685</a></li>
<li>refactor: Generalize native command arguments by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13664">vercel/turborepo#13664</a></li>
<li>refactor: Move native contracts to tasks by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13665">vercel/turborepo#13665</a></li>
<li>docs: Fix loadTransformers reference in turbo-codemod README by <a
href="https://github.com/latent-9"><code>@​latent-9</code></a> in <a
href="https://redirect.github.com/vercel/turborepo/pull/13683">vercel/turborepo#13683</a></li>
<li>refactor: Model native task execution explicitly by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13666">vercel/turborepo#13666</a></li>
<li>feat: Compose aggregate native task dependencies by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13667">vercel/turborepo#13667</a></li>
<li>fix: Respect aggregate task overrides by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13668">vercel/turborepo#13668</a></li>
<li>test: Stabilize watch task inputs regression test by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13686">vercel/turborepo#13686</a></li>
<li>feat: Parse Python quality tool declarations by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13669">vercel/turborepo#13669</a></li>
<li>feat: Resolve Python quality plans by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13670">vercel/turborepo#13670</a></li>
<li>refactor: Extract uv native task specs by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13671">vercel/turborepo#13671</a></li>
<li>feat: Synthesize Python quality tasks by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13672">vercel/turborepo#13672</a></li>
<li>test: Cover Python quality task commands by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13673">vercel/turborepo#13673</a></li>
<li>feat: Hash Python quality task inputs by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13674">vercel/turborepo#13674</a></li>
<li>test: Cover Python quality task graph by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13675">vercel/turborepo#13675</a></li>
<li>chore: Release Turborepo 2.10.9-canary.1 by <a
href="https://github.com/github-actions"><code>@​github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13687">vercel/turborepo#13687</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/turborepo/commit/33237d4be13d7b74768c2cf3353b19cfa8d1af7c"><code>33237d4</code></a>
publish 2.10.9 to registry</li>
<li><a
href="https://github.com/vercel/turborepo/commit/3b0e57f1289b2a6b3d6dd402bce928469d3b25fa"><code>3b0e57f</code></a>
fix: Prevent Windows process cleanup PID reuse (<a
href="https://redirect.github.com/vercel/turborepo/issues/13695">#13695</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/efe4e1bdf665f2950cf89d7968907de36c2f0737"><code>efe4e1b</code></a>
fix: Prune Bun wildcard workspace dev dependencies (<a
href="https://redirect.github.com/vercel/turborepo/issues/13694">#13694</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/a98e5cde97796088c6107684a64a40a967cd1ef0"><code>a98e5cd</code></a>
docs: Document dependency-driven Python tasks (<a
href="https://redirect.github.com/vercel/turborepo/issues/13676">#13676</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/c09a92f526b6dca9ea0243922f680803779759cd"><code>c09a92f</code></a>
chore: Release Turborepo 2.10.9-canary.1 (<a
href="https://redirect.github.com/vercel/turborepo/issues/13687">#13687</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/09bd548dddbff2a29086bdef7cb07b02d5e5458a"><code>09bd548</code></a>
test: Cover Python quality task graph (<a
href="https://redirect.github.com/vercel/turborepo/issues/13675">#13675</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/3584a5fb8edac9efc826fdea57e92088505fc76a"><code>3584a5f</code></a>
feat: Hash Python quality task inputs (<a
href="https://redirect.github.com/vercel/turborepo/issues/13674">#13674</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/0d43ff3cbf5ac8873c646a84b2fd7ae53097e08d"><code>0d43ff3</code></a>
test: Cover Python quality task commands (<a
href="https://redirect.github.com/vercel/turborepo/issues/13673">#13673</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/94708adc6bc19b41805741cc5a15ac5467a481cf"><code>94708ad</code></a>
feat: Synthesize Python quality tasks (<a
href="https://redirect.github.com/vercel/turborepo/issues/13672">#13672</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/e14f04ec6c2dc2791b0a3beb32df7515b31b3d4b"><code>e14f04e</code></a>
refactor: Extract uv native task specs (<a
href="https://redirect.github.com/vercel/turborepo/issues/13671">#13671</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/turborepo/compare/v2.10.8...v2.10.9">compare
view</a></li>
</ul>
</details>
<br />

Updates `chrome-devtools-mcp` from 1.6.0 to 1.7.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/releases">chrome-devtools-mcp's
releases</a>.</em></p>
<blockquote>
<h2>chrome-devtools-mcp: v1.7.0</h2>
<h2><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/compare/chrome-devtools-mcp-v1.6.0...chrome-devtools-mcp-v1.7.0">1.7.0</a>
(2026-08-10)</h2>
<h3>🎉 Features</h3>
<ul>
<li>add a utility function to check for localhost. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2454">#2454</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/c5ebf9e2023ec37c77d2ee355a345249ac91d192">c5ebf9e</a>)</li>
<li>Add get_heapsnapshot_object_details MCP tool (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2374">#2374</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/8432cb97a2a18f48afcb542f27dd88d7e5a11f36">8432cb9</a>)</li>
<li>Emit native contexts in snapshot summary (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2375">#2375</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/f78a911dc0ce843b08549560d0357712d3b18609">f78a911</a>)</li>
<li>Filter heap snapshot objects by native context (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2377">#2377</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/76fd2424984827802867672fcc8d0e0036f4a3af">76fd242</a>)</li>
<li><strong>telemetry:</strong> log devtools data. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2460">#2460</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/df2c753006ce77cdc8df8c7715d0b5c6675560d4">df2c753</a>)</li>
<li><strong>telemetry:</strong> log is_devtools_open with each tool
call. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2445">#2445</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/6f60eabf59dd197bcad244846ea5bbdd2e172286">6f60eab</a>)</li>
<li><strong>telemetry:</strong> report whether tool call is made on
localhost. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2455">#2455</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/6398b7e9a4ee91e50a1f1fd31aee45b0a80b14e4">6398b7e</a>)</li>
<li>update lighthouse to 13.4.1 (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2398">#2398</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/745ffe7132f8de97cba58b10e6501427fe254cfc">745ffe7</a>)</li>
</ul>
<h3>🛠️ Fixes</h3>
<ul>
<li>bound per-navigation network request retention (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2435">#2435</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/b08c73c8d8887813fdf358e81a43925b84ef10e4">b08c73c</a>)</li>
<li><strong>cli:</strong> validate session ids (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2475">#2475</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5ca9121d1805ba11215ddc36d6fb18d40403c1fc">5ca9121</a>)</li>
<li><strong>cli:</strong> warn about version mismatch between cli and
daemon (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2461">#2461</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/3afc44dac95757fcaa94e0e9296594bdf2ec97d1">3afc44d</a>)</li>
<li><strong>daemon:</strong> preserve hyphenated browser flags in arg
serialization and lazy daemon startup (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2405">#2405</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/d79f3ba24f3c38f7391ea7c9d886f9f7f404743c">d79f3ba</a>)</li>
<li>dispose heap snapshot workers on context teardown (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2428">#2428</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/f245c760570680fd808c8c034d138cf4a5c699e0">f245c76</a>)</li>
<li>do not throw synchronously when a CDP session is gone (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2466">#2466</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/ba4fe3eaa4c20e4e32ef6af3b78b4d9d9bbdc1d2">ba4fe3e</a>)</li>
<li>don't throw if Dialog was handled (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2437">#2437</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/574c3207ac5376f104960c5ba425dc4a2e0e3232">574c320</a>)</li>
<li>downscale viewport screenshots when no viewport is emulated (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2380">#2380</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/39c4140f119307bf9b4253ab368512a3aab6ebfc">39c4140</a>)</li>
<li>improve daemon lifecycle (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2360">#2360</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/3ee6a2710029f3718792da634c048bf4de90eaa6">3ee6a27</a>)</li>
<li>improve file writing (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2447">#2447</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/1da4bb06e2e598ec9cab9158e8d818aa8a344dc4">1da4bb0</a>)</li>
<li>include the tab id in <code>get_tab_id</code>'s text response (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2381">#2381</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/dcbaf495183a34d9bb0e3d9e8f3e566de6b425f8">dcbaf49</a>)</li>
<li><strong>memory:</strong> dispose the heap-snapshot worker when
loading fails (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2449">#2449</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/744738deaaa93e931628b8c42a38a317d0ae3c93">744738d</a>)</li>
<li><strong>performance:</strong> reset trace-running flag when
start_trace setup fails (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2420">#2420</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/40240c033f8ef91596b16e1b5b53974b385f8b5d">40240c0</a>)</li>
<li>regression after the <a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2443">#2443</a>
(<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2462">#2462</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/4c80ce46f3a456cbbc379a569506bcf44fc2bc48">4c80ce4</a>)</li>
<li>rename maxRetainedSize column (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2402">#2402</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/75c7048c80033d1826352f5f4464427e4235a526">75c7048</a>)</li>
<li><strong>screenshot:</strong> dispose element handle after
take_screenshot (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2422">#2422</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/fffb40e58bd5f7ff7e7110f07238b93d56f390ec">fffb40e</a>)</li>
<li>toggle lazy loading for source maps. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2486">#2486</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/8028bfe3abaecb67422530d05327c5ec72c53753">8028bfe</a>)</li>
<li><strong>wait:</strong> avoid 180s mutex stall when a dialog opens
during an action (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2427">#2427</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/b4e8f74ae5da327a5968c4836d9f5450a3bc2532">b4e8f74</a>)</li>
</ul>
<h3>📄 Documentation</h3>
<ul>
<li>Add devin cli install instruction to README (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2361">#2361</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/45262c0a5ca433e4d9d5700e3c1e006ac41f45f5">45262c0</a>)</li>
<li>correct the user data directory documentation (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2473">#2473</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5ddbffd0f364ecd073f4d42a56109950b1421a57">5ddbffd</a>)</li>
<li><strong>skills:</strong> update memory leak debugging skill to use
native MCP tools (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2436">#2436</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/99bd90a7881bea5161d4e6b5ab6da26c2a9a3721">99bd90a</a>)</li>
<li>Update Chrome requirement for categoryExperimentalWebmcp (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2163">#2163</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/354458e23ffd2d1aaaaf1486abb6eb793394797d">354458e</a>)</li>
<li>update security.md (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2362">#2362</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5012b077997618edeb2291d39d17553280f5b2a6">5012b07</a>)</li>
</ul>
<h3>🏗️ Refactor</h3>
<ul>
<li>clean up McpResponse.handle (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2392">#2392</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/348975d808aa0bb1f8a7795df36aa3ff738d6d42">348975d</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/blob/main/CHANGELOG.md">chrome-devtools-mcp's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/compare/chrome-devtools-mcp-v1.6.0...chrome-devtools-mcp-v1.7.0">1.7.0</a>
(2026-08-10)</h2>
<h3>🎉 Features</h3>
<ul>
<li>add a utility function to check for localhost. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2454">#2454</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/c5ebf9e2023ec37c77d2ee355a345249ac91d192">c5ebf9e</a>)</li>
<li>Add get_heapsnapshot_object_details MCP tool (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2374">#2374</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/8432cb97a2a18f48afcb542f27dd88d7e5a11f36">8432cb9</a>)</li>
<li>Emit native contexts in snapshot summary (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2375">#2375</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/f78a911dc0ce843b08549560d0357712d3b18609">f78a911</a>)</li>
<li>Filter heap snapshot objects by native context (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2377">#2377</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/76fd2424984827802867672fcc8d0e0036f4a3af">76fd242</a>)</li>
<li><strong>telemetry:</strong> log devtools data. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2460">#2460</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/df2c753006ce77cdc8df8c7715d0b5c6675560d4">df2c753</a>)</li>
<li><strong>telemetry:</strong> log is_devtools_open with each tool
call. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2445">#2445</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/6f60eabf59dd197bcad244846ea5bbdd2e172286">6f60eab</a>)</li>
<li><strong>telemetry:</strong> report whether tool call is made on
localhost. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2455">#2455</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/6398b7e9a4ee91e50a1f1fd31aee45b0a80b14e4">6398b7e</a>)</li>
<li>update lighthouse to 13.4.1 (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2398">#2398</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/745ffe7132f8de97cba58b10e6501427fe254cfc">745ffe7</a>)</li>
</ul>
<h3>🛠️ Fixes</h3>
<ul>
<li>bound per-navigation network request retention (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2435">#2435</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/b08c73c8d8887813fdf358e81a43925b84ef10e4">b08c73c</a>)</li>
<li><strong>cli:</strong> validate session ids (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2475">#2475</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5ca9121d1805ba11215ddc36d6fb18d40403c1fc">5ca9121</a>)</li>
<li><strong>cli:</strong> warn about version mismatch between cli and
daemon (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2461">#2461</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/3afc44dac95757fcaa94e0e9296594bdf2ec97d1">3afc44d</a>)</li>
<li><strong>daemon:</strong> preserve hyphenated browser flags in arg
serialization and lazy daemon startup (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2405">#2405</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/d79f3ba24f3c38f7391ea7c9d886f9f7f404743c">d79f3ba</a>)</li>
<li>dispose heap snapshot workers on context teardown (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2428">#2428</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/f245c760570680fd808c8c034d138cf4a5c699e0">f245c76</a>)</li>
<li>do not throw synchronously when a CDP session is gone (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2466">#2466</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/ba4fe3eaa4c20e4e32ef6af3b78b4d9d9bbdc1d2">ba4fe3e</a>)</li>
<li>don't throw if Dialog was handled (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2437">#2437</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/574c3207ac5376f104960c5ba425dc4a2e0e3232">574c320</a>)</li>
<li>downscale viewport screenshots when no viewport is emulated (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2380">#2380</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/39c4140f119307bf9b4253ab368512a3aab6ebfc">39c4140</a>)</li>
<li>improve daemon lifecycle (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2360">#2360</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/3ee6a2710029f3718792da634c048bf4de90eaa6">3ee6a27</a>)</li>
<li>improve file writing (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2447">#2447</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/1da4bb06e2e598ec9cab9158e8d818aa8a344dc4">1da4bb0</a>)</li>
<li>include the tab id in <code>get_tab_id</code>'s text response (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2381">#2381</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/dcbaf495183a34d9bb0e3d9e8f3e566de6b425f8">dcbaf49</a>)</li>
<li><strong>memory:</strong> dispose the heap-snapshot worker when
loading fails (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2449">#2449</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/744738deaaa93e931628b8c42a38a317d0ae3c93">744738d</a>)</li>
<li><strong>performance:</strong> reset trace-running flag when
start_trace setup fails (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2420">#2420</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/40240c033f8ef91596b16e1b5b53974b385f8b5d">40240c0</a>)</li>
<li>regression after the <a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2443">#2443</a>
(<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2462">#2462</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/4c80ce46f3a456cbbc379a569506bcf44fc2bc48">4c80ce4</a>)</li>
<li>rename maxRetainedSize column (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2402">#2402</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/75c7048c80033d1826352f5f4464427e4235a526">75c7048</a>)</li>
<li><strong>screenshot:</strong> dispose element handle after
take_screenshot (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2422">#2422</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/fffb40e58bd5f7ff7e7110f07238b93d56f390ec">fffb40e</a>)</li>
<li>toggle lazy loading for source maps. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2486">#2486</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/8028bfe3abaecb67422530d05327c5ec72c53753">8028bfe</a>)</li>
<li><strong>wait:</strong> avoid 180s mutex stall when a dialog opens
during an action (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2427">#2427</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/b4e8f74ae5da327a5968c4836d9f5450a3bc2532">b4e8f74</a>)</li>
</ul>
<h3>📄 Documentation</h3>
<ul>
<li>Add devin cli install instruction to README (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2361">#2361</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/45262c0a5ca433e4d9d5700e3c1e006ac41f45f5">45262c0</a>)</li>
<li>correct the user data directory documentation (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2473">#2473</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5ddbffd0f364ecd073f4d42a56109950b1421a57">5ddbffd</a>)</li>
<li><strong>skills:</strong> update memory leak debugging skill to use
native MCP tools (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2436">#2436</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/99bd90a7881bea5161d4e6b5ab6da26c2a9a3721">99bd90a</a>)</li>
<li>Update Chrome requirement for categoryExperimentalWebmcp (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2163">#2163</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/354458e23ffd2d1aaaaf1486abb6eb793394797d">354458e</a>)</li>
<li>update security.md (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2362">#2362</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5012b077997618edeb2291d39d17553280f5b2a6">5012b07</a>)</li>
</ul>
<h3>🏗️ Refactor</h3>
<ul>
<li>clean up McpResponse.handle (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2392">#2392</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/348975d808aa0bb1f8a7795df36aa3ff738d6d42">348975d</a>)</li>
<li>introduce Explicit resouce managent (using) (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2443">#2443</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5b25370c9cd779032c3c9dc9880eca7031c73005">5b25370</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/774d78f5eef5e610407a0c92fa6ec5ed74b027e8"><code>774d78f</code></a>
chore(main): release chrome-devtools-mcp 1.7.0 (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2363">#2363</a>)</li>
<li><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5ddbffd0f364ecd073f4d42a56109950b1421a57"><code>5ddbffd</code></a>
docs: correct the user data directory documentation (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2473">#2473</a>)</li>
<li><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/8028bfe3abaecb67422530d05327c5ec72c53753"><code>8028bfe</code></a>
fix: toggle lazy loading for source maps. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2486">#2486</a>)</li>
<li><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/d1e4d711aa520c67df045a2f805380e9b3307abd"><code>d1e4d71</code></a>
chore(deps): bump sigstore/cosign-installer from 4.1.0 to 4.1.2 in the
all gr...</li>
<li><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/744738deaaa93e931628b8c42a38a317d0ae3c93"><code>744738d</code></a>
fix(memory): dispose the heap-snapshot worker when loading fails (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2449">#2449</a>)</li>
<li><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/ca66d0f321a57473ae400fa5e82842d4bbffe210"><code>ca66d0f</code></a>
chore(dev-deps): bump devtools-frontend (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2498">#2498</a>)</li>
<li><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/2f375c7e592d15ee9d0e1d665a4600a8b20879d0"><code>2f375c7</code></a>
chore: fix Explicit resource management polyfill (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2496">#2496</a>)</li>
<li><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/830f78b8ce19f8ee1e1d8c4d812bd9d6e4f48c2f"><code>830f78b</code></a>
chore: re-use connection adapter and dispose devtools unvierse (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2465">#2465</a>)</li>
<li><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/4c96dca1f19711a80308bd0d608fb8d40e29d152"><code>4c96dca</code></a>
ci: add main branch (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2497">#2497</a>)</li>
<li><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/71d897b27e7936c1a8911d053e19d92ec2c46655"><code>71d897b</code></a>
chore: add a new profiler scenario for get_console_messages. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2491">#2491</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/compare/chrome-devtools-mcp-v1.6.0...chrome-devtools-mcp-v1.7.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `@earendil-works/pi-coding-agent` from 0.83.0 to 0.84.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/earendil-works/pi/releases">@​earendil-works/pi-coding-agent's
releases</a>.</em></p>
<blockquote>
<h2>v0.84.1</h2>
<h3>New Features</h3>
<ul>
<li><strong>Qwen Token Plan Individual</strong> — Use the built-in
provider for models documented for Individual subscriptions. See <a
href="https://github.com/earendil-works/pi/blob/v0.84.1/packages/coding-agent/docs/providers.md#api-keys">API
Keys</a>.</li>
<li><strong>Authentication readiness checks</strong> — Use <code>pi auth
check</code> to verify provider or model credentials, optionally
emitting the resolved credential.</li>
<li><strong>Improved fullscreen interaction</strong> — Select words and
paragraphs with multiple clicks and configure half-page transcript
scrolling. See <a
href="https://github.com/earendil-works/pi/blob/v0.84.1/packages/coding-agent/docs/keybindings.md#tui-fullscreen-viewport">TUI
Fullscreen Viewport</a>.</li>
<li><strong>Terminating blocked tool calls</strong> — Extension
<code>tool_call</code> handlers can stop all-terminating batches without
another model call. See <a
href="https://github.com/earendil-works/pi/blob/v0.84.1/packages/coding-agent/docs/extensions.md#tool-events">Tool
Events</a>.</li>
</ul>
<h3>Added</h3>
<ul>
<li>Added Qwen Token Plan Individual as a built-in provider with its
documented subscription model catalog and the shared international
<code>QWEN_TOKEN_PLAN_API_KEY</code>. See <a
href="https://github.com/earendil-works/pi/blob/v0.84.1/packages/coding-agent/docs/providers.md#api-keys">API
Keys</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7659">#7659</a>
by <a
href="https://github.com/arasovic"><code>@​arasovic</code></a>).</li>
<li>Added <code>pi auth check</code> provider/model auth preflight with
optional credential output (<a
href="https://redirect.github.com/earendil-works/pi/issues/7152">#7152</a>).</li>
<li>Added <code>terminate</code> support to blocked extension
<code>tool_call</code> events so all-terminating batches can skip the
automatic follow-up model call. See <a
href="https://github.com/earendil-works/pi/blob/v0.84.1/packages/coding-agent/docs/extensions.md#tool-events">Tool
Events</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7715">#7715</a>
by <a href="https://github.com/muyiyr"><code>@​muyiyr</code></a>).</li>
<li>Added inherited double-click word and whitespace selection,
granularity-aware drag selection, and triple-click paragraph selection
in fullscreen mode (<a
href="https://redirect.github.com/earendil-works/pi/issues/7725">#7725</a>,
<a
href="https://redirect.github.com/earendil-works/pi/pull/7733">#7733</a>
by <a href="https://github.com/volsa"><code>@​volsa</code></a>).</li>
<li>Added inherited unbound half-page transcript scrolling actions for
fullscreen mode. See <a
href="https://github.com/earendil-works/pi/blob/v0.84.1/packages/coding-agent/docs/keybindings.md#tui-fullscreen-viewport">TUI
Fullscreen Viewport</a> (<a
href="https://redirect.github.com/earendil-works/pi/issues/7735">#7735</a>).</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Softened the bash tool's <code>PI_*</code> environment guideline in
an attempt to reduce unnecessary inspection commands (<a
href="https://redirect.github.com/earendil-works/pi/issues/7128">#7128</a>).</li>
<li>Reduced worst-case automatic terminal theme detection delay from 200
ms to 100 ms by probing color-scheme and background support
concurrently.</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fixed Bun standalone binaries crashing on startup when the cwd
contains a <code>bunfig.toml</code> with <code>preload</code> by
compiling with <code>--no-compile-autoload-bunfig</code> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7685">#7685</a>
by <a
href="https://github.com/geril07"><code>@​geril07</code></a>).</li>
<li>Fixed extension TUI method wrappers recursing indefinitely when
delegating to the original method (<a
href="https://redirect.github.com/earendil-works/pi/issues/7731">#7731</a>).</li>
<li>Fixed right-click not pasting clipboard text in fullscreen mode on
Windows.</li>
<li>Fixed inherited <code>Agent.reset()</code> clearing transcript and
runtime state during active runs; it now rejects until the agent is idle
(<a
href="https://redirect.github.com/earendil-works/pi/pull/7717">#7717</a>
by <a
href="https://github.com/wesleyzhangwq"><code>@​wesleyzhangwq</code></a>).</li>
<li>Fixed inherited LaTeX relation, multiplication, and named-operator
spacing, and matrix composition with stacked fractions, operator limits,
and adjacent matrices.</li>
<li>Reduced inherited fullscreen mouse event volume under tmux, Zellij,
and GNU Screen by using button-motion tracking instead of all-motion
tracking.</li>
</ul>
<h2>v0.84.0</h2>
<h3>New Features</h3>
<ul>
<li><strong>Fullscreen TUI mode</strong> — Switch between regular and
fullscreen modes at runtime, with a sticky editor and footer,
independently scrollable transcript, and draggable scrollbars. See <a
href="https://github.com/earendil-works/pi/blob/v0.84.0/packages/coding-agent/docs/settings.md#ui--display">UI
&amp; Display</a>.</li>
<li><strong>Mermaid and LaTeX rendering</strong> — Render Mermaid
diagrams and terminal-friendly Unicode math in interactive transcripts.
See <a
href="https://github.com/earendil-works/pi/blob/v0.84.0/packages/coding-agent/docs/settings.md#markdown">Markdown
settings</a> and <a
href="https://github.com/earendil-works/pi/blob/v0.84.0/packages/tui/README.md#markdown">TUI
Markdown</a>.</li>
<li><strong>Per-directory context overrides</strong> — Use
<code>AGENTS.override.md</code> to replace context files for a specific
directory. See <a
href="https://github.com/earendil-works/pi/blob/v0.84.0/packages/coding-agent/docs/usage.md#context-files">Context
Files</a>.</li>
<li><strong>Advanced custom model sampling</strong> — Configure
arbitrary OpenAI-compatible <code>samplingParams</code> and opt-in vLLM
<code>thinking_token_budget</code> values. See <a
href="https://github.com/earendil-works/pi/blob/v0.84.0/packages/coding-agent/docs/models.md#sampling-parameters">Sampling
Parameters</a>.</li>
<li><strong>Baseten provider</strong> — Use built-in Baseten
authentication and model support. See <a
href="https://github.com/earendil-works/pi/blob/v0.84.0/packages/coding-agent/docs/providers.md#api-keys">API
Keys</a>.</li>
</ul>
<h3>Breaking Changes</h3>
<ul>
<li>
<p>Renamed the inherited pi-ai <code>ModelsStreamTransforms</code>
interface to <code>ModelsRequestTransforms</code> because its header
transformation now applies to all authenticated provider requests.</p>
</li>
<li>
<p>Changed JSON and RPC <code>message_update</code> events to emit only
<code>assistantMessageEvent</code> deltas, removing the cumulative
<code>message</code> and <code>assistantMessageEvent.partial</code>
fields that caused quadratic output growth. Clients that need partial
messages must assemble deltas between <code>message_start</code> and
<code>message_end</code>; the latter remains authoritative (<a
href="https://redirect.github.com/earendil-works/pi/issues/7290">#7290</a>).</p>
</li>
<li>
<p><code>ModelRegistry.getApiKeyAndHeaders()</code> now returns
<code>ProviderHeaders</code> with <code>string | null</code> values and
preserves <code>null</code> header-deletion markers. Extensions that
inspect returned headers must handle <code>null</code>; extensions
forwarding them to pi-ai streams should pass them through unchanged.
This prevents placeholder OpenAI credentials from being sent through
Cloudflare AI Gateway (<a
href="https://redirect.github.com/earendil-works/pi/issues/7030">#7030</a>).</p>
</li>
<li>
<p>Changed <code>ModelRegistry.refresh()</code> to accept
<code>ModelsRefreshOptions</code> and return
<code>ModelsRefreshResult</code> instead of discarding cancellation and
provider errors.</p>
</li>
<li>
<p>Changed <code>ModelRuntime.setRuntimeApiKey()</code> to accept auth
cancellation options rather than catalog refresh options. Call
<code>refresh({ providers: [providerId], signal })</code> separately
when remote freshness is required.</p>
</li>
<li>
<p>Required config-form extension OAuth <code>refreshToken(credentials,
signal)</code> callbacks to accept and honor a concrete abort
signal.</p>
</li>
<li>
<p>Replaced dynamic provider refresh context store access with the
read-only <code>context.stored</code> snapshot and generation-checked
<code>context.publish()</code> transaction.</p>
<p><strong>Providers built with <code>createProvider({ fetchModels
})</code>:</strong> no catalog-publication migration is required. Before
and after, return the fetched models and register the resulting
provider; <code>createProvider()</code> owns restoration, persistence,
and in-memory publication.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/CHANGELOG.md">@​earendil-works/pi-coding-agent's
changelog</a>.</em></p>
<blockquote>
<h2>[0.84.1] - 2026-08-07</h2>
<h3>New Features</h3>
<ul>
<li><strong>Qwen Token Plan Individual</strong> — Use the built-in
provider for models documented for Individual subscriptions. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#api-keys">API
Keys</a>.</li>
<li><strong>Authentication readiness checks</strong> — Use <code>pi auth
check</code> to verify provider or model credentials, optionally
emitting the resolved credential.</li>
<li><strong>Improved fullscreen interaction</strong> — Select words and
paragraphs with multiple clicks and configure half-page transcript
scrolling. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/keybindings.md#tui-fullscreen-viewport">TUI
Fullscreen Viewport</a>.</li>
<li><strong>Terminating blocked tool calls</strong> — Extension
<code>tool_call</code> handlers can stop all-terminating batches without
another model call. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/extensions.md#tool-events">Tool
Events</a>.</li>
</ul>
<h3>Added</h3>
<ul>
<li>Added Qwen Token Plan Individual as a built-in provider with its
documented subscription model catalog and the shared international
<code>QWEN_TOKEN_PLAN_API_KEY</code>. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#api-keys">API
Keys</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7659">#7659</a>
by <a
href="https://github.com/arasovic"><code>@​arasovic</code></a>).</li>
<li>Added <code>pi auth check</code> provider/model auth preflight with
optional credential output (<a
href="https://redirect.github.com/earendil-works/pi/issues/7152">#7152</a>).</li>
<li>Added <code>terminate</code> support to blocked extension
<code>tool_call</code> events so all-terminating batches can skip the
automatic follow-up model call. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/extensions.md#tool-events">Tool
Events</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7715">#7715</a>
by <a href="https://github.com/muyiyr"><code>@​muyiyr</code></a>).</li>
<li>Added inherited double-click word and whitespace selection,
granularity-aware drag selection, and triple-click paragraph selection
in fullscreen mode (<a
href="https://redirect.github.com/earendil-works/pi/issues/7725">#7725</a>,
<a
href="https://redirect.github.com/earendil-works/pi/pull/7733">#7733</a>
by <a href="https://github.com/volsa"><code>@​volsa</code></a>).</li>
<li>Added inherited unbound half-page transcript scrolling actions for
fullscreen mode. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/keybindings.md#tui-fullscreen-viewport">TUI
Fullscreen Viewport</a> (<a
href="https://redirect.github.com/earendil-works/pi/issues/7735">#7735</a>).</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Softened the bash tool's <code>PI_*</code> environment guideline in
an attempt to reduce unnecessary inspection commands (<a
href="https://redirect.github.com/earendil-works/pi/issues/7128">#7128</a>).</li>
<li>Reduced worst-case automatic terminal theme detection delay from 200
ms to 100 ms by probing color-scheme and background support
concurrently.</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fixed Bun standalone binaries crashing on startup when the cwd
contains a <code>bunfig.toml</code> with <code>preload</code> by
compiling with <code>--no-compile-autoload-bunfig</code> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7685">#7685</a>
by <a
href="https://github.com/geril07"><code>@​geril07</code></a>).</li>
<li>Fixed extension TUI method wrappers recursing indefinitely when
delegating to the original method (<a
href="https://redirect.github.com/earendil-works/pi/issues/7731">#7731</a>).</li>
<li>Fixed right-click not pasting clipboard text in fullscreen mode on
Windows.</li>
<li>Fixed inherited <code>Agent.reset()</code> clearing transcript and
runtime state during active runs; it now rejects until the agent is idle
(<a
href="https://redirect.github.com/earendil-works/pi/pull/7717">#7717</a>
by <a
href="https://github.com/wesleyzhangwq"><code>@​wesleyzhangwq</code></a>).</li>
<li>Fixed inherited LaTeX relation, multiplication, and named-operator
spacing, and matrix composition with stacked fractions, operator limits,
and adjacent matrices.</li>
<li>Reduced inherited fullscreen mouse event volume under tmux, Zellij,
and GNU Screen by using button-motion tracking instead of all-motion
tracking.</li>
</ul>
<h2>[0.84.0] - 2026-08-06</h2>
<h3>New Features</h3>
<ul>
<li><strong>Fullscreen TUI mode</strong> — Switch between regular and
fullscreen modes at runtime, with a sticky editor and footer,
independently scrollable transcript, and draggable scrollbars. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/settings.md#ui-display">UI
&amp; Display</a>.</li>
<li><strong>Mermaid and LaTeX rendering</strong> — Render Mermaid
diagrams and terminal-friendly Unicode math in interactive transcripts.
See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/settings.md#markdown">Markdown
settings</a> and <a
href="https://github.com/earendil-works/pi/blob/main/packages/tui/README.md#markdown">TUI
Markdown</a>.</li>
<li><strong>Per-directory context overrides</strong> — Use
<code>AGENTS.override.md</code> to replace context files for a specific
directory. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/usage.md#context-files">Context
Files</a>.</li>
<li><strong>Advanced custom model sampling</strong> — Configure
arbitrary OpenAI-compatible <code>samplingParams</code> and opt-in vLLM
<code>thinking_token_budget</code> values. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/models.md#sampling-parameters">Sampling
Parameters</a>.</li>
<li><strong>Baseten provider</strong> — Use built-in Baseten
authentication and model support. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#api-keys">API
Keys</a>.</li>
</ul>
<h3>Breaking Changes</h3>
<ul>
<li>Renamed the inherited pi-ai <code>ModelsStreamTransforms</code>
interface to <code>ModelsRequestTransforms</code> because its header
transformation now applies to all authenticated provider requests.</li>
<li>Changed JSON and RPC <code>message_update</code> events to emit only
<code>assistantMessageEvent</code> deltas, removing the cumulative
<code>message</code> and <code>assistantMessageEvent.partial</code>
fields that caused quadratic output growth. Clients that need partial
messages must assemble deltas between <code>message_start</code> and
<code>message_end</code>; the latter remains authoritative (<a
href="https://redirect.github.com/earendil-works/pi/issues/7290">#7290</a>).</li>
<li><code>ModelRegistry.getApiKeyAndHeaders()</code> now returns
<code>ProviderHeaders</code> with <code>string | null</code> values and
preserves <code>null</code> header-deletion markers. Extensions that
inspect returned headers must handle <code>null</code>; extensions
forwarding them to pi-ai streams should pass them through unchanged.
This prevents placeholder OpenAI credentials from being sent through
Cloudflare AI Gateway (<a
href="https://redirect.github.com/earendil-works/pi/issues/7030">#7030</a>).</li>
<li>Changed <code>ModelRegistry.refresh()</code> to accept
<code>ModelsRefreshOptions</code> and return
<code>ModelsRefreshResult</code> instead of discarding cancellation and
provider errors.</li>
<li>Changed <code>ModelRuntime.setRuntimeApiKey()</code> to accept auth
cancellation options rather than catalog refresh options. Call
<code>refresh({ providers: [providerId], signal })</code> separately
when remote freshness is required.</li>
<li>Required config-form extension OAuth <code>refreshToken(credentials,
signal)</code> callbacks to accept and honor a concrete abort
signal.</li>
<li>Replaced dynamic provider refresh context store access with the
read-only <code>context.stored</code> snapshot and generation-checked
<code>context.publish()</code> transac...

_Description has been truncated_

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-17 18:57:12 +02:00
Alberto Schiabel a71b812db1 refactor(cli): rename LocalToolkitSlugs.match to longestPrefix (#4145) 
## Summary

Renames `LocalToolkitSlugs.match` to `longestPrefix` to clear CodeQL
code-scanning alert
[#113](https://github.com/ComposioHQ/composio/security/code-scanning/113)
(`js/regex-injection`, high).

## Why

The alert flagged `local.match(toolSlug)` in `toolkit-from-tool-slug.ts`
as a regular expression constructed from a command-line argument. It is
a false positive: `local` is a `LocalToolkitSlugs` object, and its
`match` member is a custom longest-prefix matcher
(`makeLongestPrefixMatcher`) that only does
`toolSlug.toLowerCase().split('_')` plus `Set` membership lookups — no
`RegExp` is ever constructed. CodeQL's `js/regex-injection` sink is
keyed on the `match` member name (matching `String.prototype.match`,
which coerces a string argument into a `RegExp`), so it could not tell
the custom method apart from the string sink.

The member name `match` on a non-string object invited exactly that
confusion — for the analyzer and for human readers. Renaming it to
`longestPrefix` (mirroring the underlying `makeLongestPrefixMatcher` /
`longestPrefix` helper) removes the false positive without suppressing
anything, and reads more clearly.

## Changes

- `services/toolkit-slug-catalog.ts`: interface member and object
literal `match` → `longestPrefix`
- `effects/toolkit-from-tool-slug.ts`: call site `local.match(...)` →
`local.longestPrefix(...)`

## Verification

- `pnpm typecheck` — 14/14 packages pass
- lint-staged (oxlint + prettier) clean on commit

The alert should clear on the next CodeQL scan of the merged commit.
 2026-08-16 18:33:25 +02:00
Alberto Schiabel b80808606a fix(cli): use staging dashboard URL (#4129) 
This PR:
- updates `constants.STAGING_WEB_URL` so `COMPOSIO_ENVIRONMENT=staging`
uses `https://staging-dashboard.composio.dev/`
- adds literal regression assertions for map-backed and
process-environment config loading
- records the user-facing CLI fix in the unreleased changelog

Verification:
- `pnpm --filter @composio/cli exec vitest run
test/src/services/config.test.ts` (23 passed)
- `pnpm typecheck`
- `pnpm lint:packages` (passes with pre-existing warnings)
 2026-08-13 20:20:42 +02:00
Azhar c3623cb898 fix(cli): nest custom credentials under auth_config.credentials in auth-configs create (#4063) 
## Summary

The `composio dev auth-configs create` command fails when custom OAuth
credentials are spread at the top level of `auth_config`. The API
expects those values under `auth_config.credentials`.

Fixes #4058

## Changes

- Nests custom credentials under `auth_config.credentials`.
- Merges parsed `--scopes` into the same credentials object.
- Preserves `credentials: undefined` when neither credentials nor scopes
are supplied.
- Captures the typed repository request in the CLI test layer and
asserts the exact custom OAuth payload.
- Records the user-visible fix in the CLI changelog.
- Merges the current `next` branch without conflicts.

## Verification

- Reproduced on the old implementation: 1 of 8 focused tests failed
because `client_id` remained at `auth_config.client_id`.
- Verified the fix: 8 of 8 focused auth-config create tests passed.
- Full CLI package suite: 120 test files passed; 1,188 tests passed; 1
skipped.
- `pnpm typecheck`: 14 tasks passed across the 19 TypeScript packages in
scope.
- `pnpm run lint:packages`: passed with existing warnings only.
- Prettier check on all four changed files: passed.

The fresh-worktree CLI suite currently needs a temporary local Vitest
alias for the pre-existing `#ssrf_guard` resolver drift. That alias was
used only to run the suite and is not part of this PR.

## Release notes

`@composio/cli` is excluded from Changesets, so this PR updates
`ts/packages/cli/CHANGELOG.md` directly.

---------

Co-authored-by: jkomyno <alberto@composio.dev>
 2026-08-12 23:18:17 +02:00
Alberto Schiabel 8086ef02cb fix(examples): align Python and TypeScript examples with current backend (#4107) 
## Summary

- Repairs runnable TypeScript and Python examples for current backend
requirements, including authenticated MCP endpoints, current transports,
valid tool identifiers, provider limits, and resource uniqueness.
- Replaces placeholder resource IDs with explicit `COMPOSIO_EXAMPLES_*`
configuration and makes failed examples exit loudly.
- Adds `scripts/examples-provision.mjs` as an idempotent provisioning
check for a disposable examples project.

## Scope

- This PR no longer changes the Python SDK runtime or generated-client
dependency.
- Python remains pinned to the published `composio-client==1.43.0` in
`pyproject.toml`, `setup.py`, and `uv.lock`.
- The owned 2.x client integration is deferred until that client
completes its release guarantees and is explicitly published.
- The scheduled live workflow and manifest remain deferred until their
runner is tracked.

## Verification

- `make chk`
- `make tst` (`927 passed, 33 skipped`)
- Hosted checks rerun against commit `12691aca7`.
 2026-08-11 19:45:58 +02:00
Alberto Schiabel 0e3b489f9f docs(cli): record 0.3.2 and 0.3.3 releases (#4118) 
This PR:

- records the pending CLI entries under `0.3.3`
- restores the missing `0.3.2` boundary from its published source tag
- keeps `Unreleased` available for changes after the stable promotion
- verifies the release metadata with `pnpm validate:changesets` and
`pnpm test:release-workflow`
 2026-08-11 16:09:54 +02:00
sdkrelease[bot] 02196de0b5 Release: update version (#4104) 
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to next, this PR will
be updated.


# Releases
## @composio/core@0.16.0

### Minor Changes

- 5e57815: Keep free-form object roots, `patternProperties`, and
`additionalProperties` when parsing a tool schema.

`ToolSchema.parse` used to reject a bare `{ "type": "object" }` root,
drop root `patternProperties` as an unknown key, and reject a root
`additionalProperties` written as a schema instead of a boolean.
Free-form roots now parse successfully, and both constraints survive
parsing exactly as written. The public `ToolSchema` type now makes
`properties` optional to reflect those valid property-less object
schemas.

This matters downstream. Every provider reads `inputParameters` after
parsing, so a tool that declares dynamic keys had those rules stripped
before the model ever saw them.

An omitted `additionalProperties` still stays omitted. The parser does
not invent a value, because each converter decides its own default.

  **What no longer works**

Parsing no longer fails on a schema-valued root `additionalProperties`.

  ```ts
  const tool = ToolSchema.parse({
    slug: 'MY_TOOL',
    inputParameters: {
      type: 'object',
      properties: { name: { type: 'string' } },
      additionalProperties: { type: 'number' },
    },
    // ...
  });

  // before: parsing failed, because only a boolean was accepted
// now: tool.inputParameters.additionalProperties is { type: 'number' }
  ```

  **What to do instead**

Nothing, if you only ever passed boolean values. That case is unchanged.

If your code assumed `inputParameters` never carries
`patternProperties`, or that `additionalProperties` is always a boolean,
widen that assumption. Both keywords can now appear, and
`additionalProperties` can be a boolean or a schema object.

### Patch Changes

- a2f6b96: Add `type: "object"` to nested JSON Schema nodes that carry
`properties` without an explicit type, so tool schemas work with strict
OpenAPI 3.0 consumers like Google Gemini.
- c625edc: Reuse fetched tool schemas when provider-wrapped tools
execute to avoid a redundant retrieval request.
- Updated dependencies [5e57815]
  - @composio/json-schema-to-zod@0.3.0
## @composio/json-schema-to-zod@0.3.0

### Minor Changes

- 5e57815: Keep the content of free-form object arguments, and apply
dynamic key rules only where they belong.

An object schema with no named properties, written as `{ "type":
"object" }` or `{ "properties": {} }`, used to become a strict empty
object. The only value that passed was `{}`. Any real payload was
rejected. Such an object is now open, so arbitrary content is accepted
and preserved. This works at the root, nested inside another object, and
inside array items.

Dynamic keys are now routed to the schemas that actually claim them.
Every matching `patternProperties` entry validates its key. A
schema-valued `additionalProperties` applies only to keys that no
declared property and no pattern matches. Before this change a key could
pass by satisfying an unrelated pattern instead of its own.

  **What no longer works**

Converting a property-less object no longer gives you a schema that
rejects everything.

  ```ts
  const schema = jsonSchemaToZod({ type: 'object' });

  schema.parse({ anything: 1 });
  // before: threw, because the result was z.object({}).strict()
  // now:    returns { anything: 1 }
  ```

  **What to do instead**

If you want a property-less object to stay closed, say so in the JSON
Schema:

  ```ts
const schema = jsonSchemaToZod({ type: 'object', additionalProperties:
false });

  schema.parse({ anything: 1 }); // throws, as before
  ```

Objects that name at least one property are unchanged. They still reject
unknown keys when `additionalProperties` is omitted.
## @composio/claude-agent-sdk@0.11.0

### Minor Changes

- ac6bbab: Register each tool with its complete schema, so root rules
reach the Claude Agent SDK.

The provider used to register a raw property shape. A raw shape is only
the map of named properties, so it cannot carry any root rule.
`additionalProperties` and `patternProperties` were dropped before the
SDK saw them.

Two things went wrong because of that. Free-form object arguments lost
their content. An argument the tool never declared was quietly removed,
and the tool ran anyway.

  Both are fixed. The provider now registers the whole object schema.

  **What no longer works**

  An undeclared argument no longer passes silently.

  ```ts
// The tool declares `to` and nothing else. The model also sends
`hallucinated`.
  { to: 'someone@example.com', hallucinated: 'value' }

// before: `hallucinated` was stripped, and the tool ran with { to:
'...' }
// now: the caller receives an error result, and the tool does not run
  ```

Tools with no input parameters behave the same way. They stay closed and
reject every argument.

  **What to do instead**

If the model should be allowed to send extra keys, say so in the tool
schema:

  ```json
  {
    "type": "object",
    "properties": { "to": { "type": "string" } },
    "additionalProperties": true
  }
  ```

If an argument is one the tool really accepts, declare it in
`properties`. Rejection is usually the better outcome, because the agent
sees the error and can correct itself instead of running with a silently
dropped argument.

This brings the provider in line with `@composio/vercel`,
`@composio/langchain`, and `@composio/llamaindex`, which already
registered complete schemas.
## @composio/google@0.10.2

### Patch Changes

- a2f6b96: Add missing object types to nested Google GenAI tool schemas
so Gemini accepts function declarations with property maps. This release
requires `@composio/core >=0.16.0 <1.0.0` for the shared schema
normalizer.
## @composio/slim@0.16.0

### Patch Changes

- Updated dependencies [5e57815]
  - @composio/json-schema-to-zod@0.3.0

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-08-11 10:54:21 +02:00
sergioperezcheco a2f6b9699b fix(json-schema): integrate Google object type normalization 
Co-authored-by: jkomyno <alberto@composio.dev>
 2026-08-10 22:01:09 +02:00
Alberto Schiabel 1af694baee Merge branch 'next' into fix/cross-sdk-json-schema-object-conversion 2026-08-10 21:23:10 +02:00
jkomyno 5350b00d90 perf(cli): resolve toolkits from local knowledge, not the catalog 
Every tool execution had to know which toolkit the tool belongs to, and
the only reliable source was the toolkit catalog — ~800 KB and ~2 s of
the wall time of a command that then does one small API call.

Match against what the CLI already knows instead: the slugs baked in at
build time, plus the ones this machine has learned since, kept in
`known-toolkit-slugs.json`. A slug that matches nothing known still
falls through to the catalog — that is what a toolkit released after the
binary looks like — and what it finds is remembered, so it costs a fetch
once rather than every run. Learned slugs older than a week trigger a
background refresh; that bounds how long a brand-new toolkit can be
mistaken for a shorter one sharing its prefix.

The file is derived data rather than saved API responses, so it is read
regardless of FORCE_USE_CACHE, which keeps its meaning. Nothing here can
fail a command: a missing, unreadable, or corrupt file means "nothing
learned yet", and an unreachable catalog still degrades to the
first-underscore guess.

Cache writes also move to a temp file and a rename, so an interrupted
run leaves the previous cache intact instead of a truncated file that
the next run reads back as a parse failure.
 2026-08-10 17:12:58 +02:00
jkomyno bf3efaa270 chore(cli): bake the toolkit slug catalog into the CLI 
Resolving a tool slug to its toolkit needs the catalog, but the catalog
is ~800 KB of metadata to learn ~11 KB of slugs. Check the slugs in as
generated source so the CLI starts out knowing them.

Adds the generator (paginates the production catalog, keeps native
toolkits, sorts and dedupes), the checked-in list, a guard test, and a
weekly workflow that opens a refresh PR when the catalog moves. The
generator refuses to write a list that is short, malformed, or missing
staple toolkits, so a bad or wrong-scoped credential aborts before
overwriting a good list. The binary build warns when the list is older
than two weeks, and never fails on it.

Nothing reads the list yet.
 2026-08-10 17:12:58 +02:00
jkomyno 4a764c100a perf(cli): fetch the toolkit catalog once per process 
A single command can ask for the full toolkit list several times —
toolkit resolution, validation, telemetry — and the file cache only
answers when FORCE_USE_CACHE is set, so the default path paid for the
same ~800 KB two-page download up to four times.

Memoize the lookup for the lifetime of the cached repository layer. The
first caller pays and the rest await the same result. Effect.cached
memoizes the outcome rather than only the success, so a failed fetch
stays failed for the process: the right trade for a one-shot CLI, where
retrying a broken network per call only multiplies the wait before the
same error surfaces.

That surfaced a second doubling underneath. The caching helper wrapped
its whole body — cache lookup and the underlying request alike — in one
catchAll that fell back to re-running the request, so a request that
failed on its own was immediately sent again and failed the same way.
Cache concerns now degrade to a miss on their own, and the request runs
exactly once with its failure passed straight through.
 2026-08-10 17:12:58 +02:00
jkomyno 5a74b4aade fix(cli): resolve multi-word toolkits from tool slugs 
Tool slugs carry no delimiter between the toolkit and the action, so
splitting on the first underscore resolved GOOGLE_ANALYTICS_RUN_REPORT to
`google` instead of `google_analytics` and picked the wrong connected
account.

Match the tool slug against the known toolkit list instead, longest
underscore-bounded prefix first, and keep the old split as the fallback
for when that list is unavailable. Routed through a new Effect resolver
so every call site (execute, listen, tools-executor, file uploads, error
overrides, telemetry) shares one answer.

Matching against the real catalog exposes a second miss the old split
hid: `COMPOSIO_SEARCH_TOOLS` is a session meta tool, but `composio_search`
is a real linkable toolkit, so a failed meta call told users to link an
app that had nothing to do with it. The meta tool slugs move out of
tools-executor into src/utils/meta-tool-slugs.ts, and resolution answers
'no toolkit' for them before any prefix matching.

Fixes https://github.com/ComposioHQ/composio/issues/4049
 2026-08-10 17:12:58 +02:00
Alberto Schiabel c625edc0f7 fix(core): reuse fetched schemas for provider execution (#4103) 
Reuse fetched raw tool schemas for provider-wrapped execution while preserving modifier isolation, runtime validation, and unknown-slug fallback behavior.

Refresh the Python 3.12.13 mise lock entries required by the Audit freshness gate.

Co-authored-by: breezeFur <voidexl@outlook.com>
 2026-08-10 13:34:20 +02:00
jkomyno 6c08f17637 test(json-schema): share one corpus loader across the SDK test suites 
The loader was copied into four packages, identical but for one path constant.
Core now owns it and the Zod, Effect, and CLI suites re-export it.

It also read its fixture with node:fs, which pulled @types/node into the Zod and
Effect test typechecks for the first time and broke them against the Node 26 line
the workspace was pinned to. That had been worked around by centralizing
@types/node on a Node 24 catalog entry across ten manifests. resolveJsonModule is
already enabled in every consumer, so a static JSON import removes the node:fs
dependency and the whole detour with it: the catalog entry, the pnpm override, the
per-package types fields, and 171 lines of lockfile churn are all reverted.
 2026-08-08 00:22:29 +05:30
jkomyno 8ccd0ceb4f docs(changelog): drop the per-call claim from the CLI compile failure 
compileToolInputSchema still runs inside validateToolInputArgumentsWithDefinition,
so the failure fires on every invocation. What changed is the diagnosis, not the
frequency. Line 153 already made only the diagnosis claim; this aligns line 88 and
the matching CLI changelog line with it.
 2026-08-08 00:22:22 +05:30
jkomyno 1ebdedd1cd docs(changelog): record the CLI schema compile failure 
The wrap-time paragraph named only Python. The CLI now fails the same way
on the two defects its validator can detect, so both the dynamic-keys
section and Backward Compatibility say which SDK does what, and note that
a reference outside a dynamic-key subschema is still left alone.
 2026-08-07 22:41:54 +05:30
jkomyno 26315ead21 fix(json-schema-to-effect-schema): reject dynamic-key schema defects at construction 
@cfworker/json-schema compiles patternProperties keys and resolves $ref
lazily, inside validate. A defect in the schema therefore surfaced once
per call through the same channel as a genuine input failure, telling the
caller their arguments were wrong when the tool's schema was broken.

Check both eagerly, scoped to what the Python SDK rejects while wrapping
a tool: patternProperties keys, and references inside a patternProperties
or schema-valued additionalProperties subschema, followed transitively
through the schemas they resolve to. References elsewhere stay with the
interpreter, so a dangling reference in a branch validation never visits
keeps working.

The filter keeps its catch for the one throw that depends on the instance
rather than the schema - a bigint, symbol, function, or undefined input.
Rethrowing from there would escape Schema.decodeUnknown as a defect
instead of a typed parse error.
 2026-08-07 22:41:50 +05:30
sdkrelease[bot] 13cba53b1d Release: update version (#4038) 
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to next, this PR will
be updated.


# Releases
## @composio/core@0.15.0

### Minor Changes

- 1503786: Replace the loose JSON Schema property type with a recursive,
type-safe definition.

`JSONSchemaProperty` (re-exported from `@composio/core` and reachable
through
`Tool.input_parameters` / `Tool.output_parameters`) is now a concrete
recursive
interface instead of effectively `any`. Runtime behavior is unchanged,
but
  consumer code that indexed into it without narrowing (for example
`schema.properties.foo.type` or `schema.default.someField`) may see new
type
errors: `properties` entries are now possibly `undefined` and `default`
/
`enum` values are `unknown`. Narrow with optional chaining or explicit
type
  guards when upgrading.

### Patch Changes

- 2ac6ad3: Bound the background npm version check so registry outages
cannot leave the request pending indefinitely.
- 5105612: Match sensitive upload path segments using the target
filesystem's actual case sensitivity so case-insensitive mounts cannot
bypass the denylist without over-blocking distinct paths on
case-sensitive mounts.
- 051c8c5: Redact secrets that appear inside JSON payloads in telemetry
error text. The key/value rule required the separator to follow the key
name directly, so a serialized body such as `{"api_key": "..."}` — the
shape error messages usually carry — was sent unredacted.
- e5c9ada: Refresh the OpenAI runtime dependency to version 7.
- ecd0861: Release unread response bodies on the paths the SDK knowingly
abandons: cancel every intermediate redirect body in `ssrfSafeFetch`,
and the response body before throwing on `!response.ok` in both
URL-upload call sites, instead of leaving them for the garbage collector
to reclaim.
- 2a6a051: Remove the unused internal `isNewerVersion` helper.
- Updated dependencies [1503786]
  - @composio/json-schema-to-zod@0.2.2
## @composio/openai@0.11.0

### Minor Changes

- e5c9ada: Add support for OpenAI versions 6 and 7.
## @composio/experimental@0.2.2

### Patch Changes

- 4ceaede: Refresh the TypeBox runtime dependency.
## @composio/json-schema-to-zod@0.2.2

### Patch Changes

- 1503786: Model the parser-supported `min`, `max`, and `example` JSON
Schema extensions in the exported recursive schema type.
## @composio/slim@0.15.0

### Patch Changes

- e5c9ada: Refresh the OpenAI runtime dependency to version 7.
- Updated dependencies [1503786]
  - @composio/json-schema-to-zod@0.2.2

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-08-07 22:16:46 +05:30
Alberto Schiabel b9a715e055 fix(e2e): pack core's workspace dependency in the openai-zod4 fixture (#4097) 
The `openai-zod4-compat` E2E fixture fails on every release branch that
bumps an internal workspace package. It is currently blocking the Python
0.18.2 / TypeScript 0.15.0 train
(https://github.com/ComposioHQ/composio/pull/4038).

## Root cause

The fixture packs `@composio/core` and `@composio/openai` and installs
the tarballs. `pnpm pack` rewrites `@composio/core`'s `workspace:*`
dependency on `@composio/json-schema-to-zod` to the exact workspace
version, so the tarball carries a hard pin:

```json
"@composio/json-schema-to-zod": "0.2.2"
```

On `next` that pin points at an already-published version, so the
install resolves from the registry and the fixture passes. On a release
branch it points at the version about to be published, which does not
exist yet:

```
npm error code ETARGET
npm error notarget No matching version found for @composio/json-schema-to-zod@0.2.2.
```

The setup step then exits non-zero and all 7 assertions fail with empty
output. That is exactly what
https://github.com/ComposioHQ/composio/pull/4038 shows:
`@composio/json-schema-to-zod` is bumped to `0.2.2` there, which is the
first release train to bump an internal dependency of `@composio/core`
since this fixture was added.

## Fix

Pack `@composio/json-schema-to-zod` alongside the other two and install
all three tarballs. npm satisfies core's pin from the top-level tarball,
so the fixture resolves entirely from local builds and no longer depends
on publication order. Behavior on `next` is unchanged — it just prefers
the local build over the identical published one.

## Verification

Reproduced and fixed against the release branch
(`changeset-release/next` @ `8068225d7`, core `0.15.0` /
json-schema-to-zod `0.2.2`) in a local worktree, since Docker was not
available to run the containerized suite here:

- packing core alone and running the fixture's install command
reproduces the ETARGET failure verbatim
- packing all three and installing them succeeds;
`node_modules/@composio/json-schema-to-zod` resolves to `0.2.2` and
`@composio/core`'s pin is satisfied locally
- `node ts/scripts/validate-changesets.mjs` passes; no changeset needed,
the fixture is a private package

CI runs the real containerized suite on this PR.
 2026-08-07 22:04:34 +05:30
jkomyno 191d919eef fix(python): harden dynamic schema validation 2026-08-07 21:56:39 +05:30
jkomyno 3fef432dc0 fix: fail closed on invalid dynamic schemas 2026-08-07 21:03:08 +05:30
LHMQ878 051c8c5357 fix(telemetry): redact secrets inside JSON payloads (#4043) 
## Summary

Telemetry error text is redacted before it leaves the process, but the
key/value rule only matches when the separator follows the key name
directly:

```
\b(authorization|api[-_]?key|...|pwd)\b(\s*[:=]+\s*)(["']?)([^\s"',}&]+)\3
```

In JSON — and in a Python `dict` repr — the key's own closing quote sits
between the name and the colon, so `{"api_key": "..."}` never matches
and the value is sent verbatim. That is the shape error messages usually
carry: an API error envelope, a rejected request body echoed back, or an
f-string interpolating a config dict. Both SDKs share the pattern and
both are affected.

The fix moves the optional quote into the separator group
(`(["']?\s*[:=]+\s*)`). The key name, separator, and quoting are all
preserved in the output; only the value is replaced.

Measured with `redact_sensitive_text` / `redactSensitiveText` directly,
before and after:

| input | before | after |
|---|---|---|
| `api_key=sk-1` | redacted | redacted |
| `api_key: "sk-1"` | redacted | redacted |
| `x-api-key: sk-live-hdr` | redacted | redacted |
| `{"api_key": "sk-live-abc"}` | **leaks** | `{"api_key": "[REDACTED]"}`
|
| `{"api_key":"sk-live-abc"}` | **leaks** | redacted |
| `{"api_key" : "sk-live-abc"}` | **leaks** | redacted |
| `{"refresh_token":"rt-abc.def-123"}` | **leaks** | redacted |
| `{"x-api-key":"sk-hdr","user":"bob"}` | **leaks** | redacted,
`"user":"bob"` kept |
| `{'client_secret': 'cs-live-abc'}` | **leaks** | redacted |
| `the password field is required` | untouched | untouched |
| `no separator here "api_key" and nothing else` | untouched | untouched
|

The end-to-end path in Python is `composio/core/models/base.py:60-61`,
which passes `str(e)` and `traceback.format_exc()` through the redactor
into the telemetry `error` field. A tool failure whose message
interpolates the rejected request body — `Error executing tool: request
body was rejected: {"toolkit": "GMAIL", "arguments": {"api_key": "...",
...}}` — leaked the customer's key today.

## Changes

- `python/composio/utils/redaction.py`,
`ts/packages/core/src/telemetry/redact.ts`: allow a quote between the
key name and the separator.
- Tests on both sides for JSON, minified JSON, spaced-colon JSON, dict
repr, the realistic serialized-payload shape, key/quote preservation,
and no-false-positive cases.
- Changeset for `@composio/core`.

## Type of change

- [x] Bug fix

## How Has This Been Tested?

Node 24.13.0 / pnpm 11.8.0 / Python 3.10.20 (uv), Windows.

- `uv run pytest tests/test_redaction.py` — 13 passed. With
`redaction.py` reverted and the new tests kept, 9 of them fail; the 4
that still pass are the pre-existing test plus the three
no-false-positive controls.
- `npx vitest run test/telemetry/redact.test.ts` in `ts/packages/core` —
10 passed. With `redact.ts` reverted, the 3 new cases fail.
- Full Python suite: 913 passed, same 4 failures as on `next` unchanged
(3 are `ModuleNotFoundError: composio_langchain` from providers not
installed in my env; 1 is `test_empty_name_safe_fails_at_write_time`,
which expects `IsADirectoryError` but Windows raises `PermissionError`
when opening a directory). Collection 944 → 956, exactly the 12 tests
added.
- Full `@composio/core` vitest: 798 passed / 2 failed, byte-identical to
the unchanged baseline (794 passed / same 2 failed — both Windows
path-and-symlink cases). 11 test files fail to load in both runs because
I installed with `--ignore-scripts`; the repo's `preinstall` hook
doesn't run in my shell.
- `ruff format --check` and `ruff check` clean on the two Python files;
`prettier --write` applied to the two TypeScript files.

## Checklist

- [x] I have read the Code of Conduct and this PR adheres to it
- [x] I ran linters/tests locally and they passed
- [ ] I updated documentation as needed — no user-facing behavior change
to document
- [x] I added tests or explain why not applicable
- [x] I added a changeset if this change affects published packages

## Additional context

This is defence-in-depth, so it stays deliberately narrow: same denylist
of key names, same value character class, no new rules. Bare-prefix
secrets (`sk-...`, `ghp_...`) and PEM blocks are still not matched by
either SDK — worth a separate look, but widening the pattern is a
different risk trade-off than closing a shape the rule already intends
to cover.
 2026-08-07 19:14:49 +05:30
jkomyno 5a8e0e358a fix(core): accept widened object schemas in strict helper 2026-08-07 19:06:27 +05:30
jkomyno 8d4bb3bf7e chore: merge next into json schema conversion fix 2026-08-07 18:44:34 +05:30
dependabot[bot] 0c4c5a360a chore(deps): bump the npm-production group across 1 directory with 17 updates (#4090) 
Bumps the npm-production group with 17 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
|
[@anthropic-ai/claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-typescript)
| `0.3.220` | `0.3.221` |
| [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai) | `6.0.235` |
`6.0.241` |
| [@google/genai](https://github.com/googleapis/js-genai) | `2.13.0` |
`2.15.0` |
| [@langchain/core](https://github.com/langchain-ai/langchainjs) |
`1.2.3` | `1.2.4` |
|
[@langchain/langgraph](https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core)
| `1.4.8` | `1.4.9` |
| [typebox](https://github.com/sinclairzx81/typebox) | `1.3.9` |
`1.3.10` |
| [@ai-sdk/mcp](https://github.com/vercel/ai/tree/HEAD/packages/mcp) |
`2.0.22` | `2.0.24` |
|
[@ai-sdk/openai](https://github.com/vercel/ai/tree/HEAD/packages/openai)
| `4.0.27` | `4.0.29` |
|
[@cloudflare/vitest-pool-workers](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers)
| `0.18.8` | `0.20.1` |
| [@cloudflare/workers-types](https://github.com/cloudflare/workerd) |
`5.20260801.1` | `5.20260804.1` |
|
[@mastra/core](https://github.com/mastra-ai/mastra/tree/HEAD/packages/core)
| `1.52.1` | `1.55.0` |
|
[@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk)
| `1.26.0` | `1.30.0` |
| [hono](https://github.com/honojs/hono) | `4.12.31` | `4.13.0` |
| [pnpm](https://github.com/pnpm/pnpm/tree/HEAD/pnpm11/pnpm) | `11.17.0`
| `11.20.0` |
|
[publint](https://github.com/publint/publint/tree/HEAD/packages/publint)
| `0.3.22` | `0.3.23` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.1` | `4.23.5` |
|
[wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler)
| `4.114.0` | `4.118.0` |


Updates `@anthropic-ai/claude-agent-sdk` from 0.3.220 to 0.3.221
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/releases">@​anthropic-ai/claude-agent-sdk's
releases</a>.</em></p>
<blockquote>
<h2>v0.3.221</h2>
<h2>What's changed</h2>
<ul>
<li>Improved <code>skills</code> option validation: malformed names
(delimiters or control characters) and wildcard-form names are rejected
with a clear error; use <code>skills: 'all'</code> to enable every
skill</li>
<li>Fixed external MCP servers passed via the <code>mcpServers</code>
option not being connected before the first turn, which caused the model
to emit tool calls as literal text</li>
</ul>
<h2>Update</h2>
<pre lang="sh"><code>npm install @anthropic-ai/claude-agent-sdk@0.3.221
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.221
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.221
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.221
</code></pre>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/blob/main/CHANGELOG.md">@​anthropic-ai/claude-agent-sdk's
changelog</a>.</em></p>
<blockquote>
<h2>0.3.221</h2>
<ul>
<li>Improved <code>skills</code> option validation: malformed names
(delimiters or control characters) and wildcard-form names are rejected
with a clear error; use <code>skills: 'all'</code> to enable every
skill</li>
<li>Fixed external MCP servers passed via the <code>mcpServers</code>
option not being connected before the first turn, which caused the model
to emit tool calls as literal text</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/31fbbfd403b3289933abc297e66cec775301e15e"><code>31fbbfd</code></a>
chore: Update CHANGELOG.md</li>
<li>See full diff in <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/compare/v0.3.220...v0.3.221">compare
view</a></li>
</ul>
</details>
<br />

Updates `ai` from 6.0.235 to 6.0.241
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/ai/blob/ai@6.0.241/packages/ai/CHANGELOG.md">ai's
changelog</a>.</em></p>
<blockquote>
<h2>6.0.241</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [7e50c52]
<ul>
<li><code>@​ai-sdk/gateway</code><a
href="https://github.com/3"><code>@​3</code></a>.0.163</li>
</ul>
</li>
</ul>
<h2>6.0.240</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [b28367e]
<ul>
<li><code>@​ai-sdk/gateway</code><a
href="https://github.com/3"><code>@​3</code></a>.0.162</li>
</ul>
</li>
</ul>
<h2>6.0.239</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [d3d9e0b]
<ul>
<li><code>@​ai-sdk/gateway</code><a
href="https://github.com/3"><code>@​3</code></a>.0.161</li>
</ul>
</li>
</ul>
<h2>6.0.238</h2>
<h3>Patch Changes</h3>
<ul>
<li>9ecdefe: Prevent validated downloads on Node.js from reaching
private or internal services through DNS aliases or DNS rebinding by
validating and pinning every resolved address at connection time.</li>
<li>26d10c0: support overriding model call settings for individual
<code>prepareStep</code> invocations</li>
<li>7767170: Preserve provider metadata from empty text deltas in
<code>streamText</code>.</li>
<li>Updated dependencies [9ecdefe]</li>
<li>Updated dependencies [87fb433]
<ul>
<li><code>@​ai-sdk/provider-utils</code><a
href="https://github.com/4"><code>@​4</code></a>.0.41</li>
<li><code>@​ai-sdk/gateway</code><a
href="https://github.com/3"><code>@​3</code></a>.0.160</li>
</ul>
</li>
</ul>
<h2>6.0.237</h2>
<h3>Patch Changes</h3>
<ul>
<li>f6020d7: Avoid synthesizing client tool errors for invalid
provider-executed tool calls.</li>
<li>Updated dependencies [de438f5]
<ul>
<li><code>@​ai-sdk/gateway</code><a
href="https://github.com/3"><code>@​3</code></a>.0.159</li>
</ul>
</li>
</ul>
<h2>6.0.236</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [8418710]
<ul>
<li><code>@​ai-sdk/gateway</code><a
href="https://github.com/3"><code>@​3</code></a>.0.158</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/ai/commit/5b4cf0ef925c6dfac12167e9e986e2e2e796e68e"><code>5b4cf0e</code></a>
Version Packages (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18345">#18345</a>)</li>
<li><a
href="https://github.com/vercel/ai/commit/b878ce998fbe53bb27d8124b59c94cb9c109899b"><code>b878ce9</code></a>
Version Packages (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18314">#18314</a>)</li>
<li><a
href="https://github.com/vercel/ai/commit/fbb507af0398516dc4db212a6dcdfff48744a4fd"><code>fbb507a</code></a>
Version Packages (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18280">#18280</a>)</li>
<li><a
href="https://github.com/vercel/ai/commit/6e37b23980716390f878881f0e39a878295d1dd4"><code>6e37b23</code></a>
v6.0: docs: document GenerateTextResult.output getter errors (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18252">#18252</a>)</li>
<li><a
href="https://github.com/vercel/ai/commit/006a2f87a3ca3409973d1a11ed21002b37d38c74"><code>006a2f8</code></a>
Version Packages (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18089">#18089</a>)</li>
<li><a
href="https://github.com/vercel/ai/commit/2deee5b27ec31ba38a2e2b20966fe1a868b5f117"><code>2deee5b</code></a>
v6.0: docs: clarify generateText text aggregation and empty-string
behavior (...</li>
<li><a
href="https://github.com/vercel/ai/commit/26d10c0b30ca68d5c7b618b8d54b06ae01930a68"><code>26d10c0</code></a>
[v6.0] feat: support per-step model call setting overrides in
prepareStep (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/1">#1</a>...</li>
<li><a
href="https://github.com/vercel/ai/commit/9ecdefe4eb4db14c76bcc7c04813663d2012fb8e"><code>9ecdefe</code></a>
[v6] fix(provider-utils): prevent DNS alias SSRF in validated downloads
(<a
href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18095">#18095</a>)</li>
<li><a
href="https://github.com/vercel/ai/commit/776717089720a00a29a7b72b86f7bdc54ea8c0bd"><code>7767170</code></a>
[v6.0] fix: preserve provider metadata from empty streamText text deltas
(<a
href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18">#18</a>...</li>
<li><a
href="https://github.com/vercel/ai/commit/98d8c433aa6a0d3ec05c201e0355f876c6349c47"><code>98d8c43</code></a>
Version Packages (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18028">#18028</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/ai/commits/ai@6.0.241/packages/ai">compare
view</a></li>
</ul>
</details>
<br />

Updates `@google/genai` from 2.13.0 to 2.15.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/js-genai/releases">@​google/genai's
releases</a>.</em></p>
<blockquote>
<h2>v2.15.0</h2>
<h2><a
href="https://github.com/googleapis/js-genai/compare/v2.14.0...v2.15.0">2.15.0</a>
(2026-07-30)</h2>
<h3>Features</h3>
<ul>
<li>add environment resource (<a
href="https://github.com/googleapis/js-genai/commit/2c911befbf839fc250a296783cbedbd3b668a9f7">2c911be</a>)</li>
<li>Support GoogleMaps Tool grounding_types places and routing (<a
href="https://github.com/googleapis/js-genai/commit/52655c192848942d2d866c3b256de27c94583f78">52655c1</a>)</li>
<li>Support per-request retryOptions in the JS GenAI SDK API Client (<a
href="https://github.com/googleapis/js-genai/commit/124b606bc5be0d5e70673dc28e16e739c9a25d7c">124b606</a>)</li>
<li>Wire environment service into genai sdk (<a
href="https://github.com/googleapis/js-genai/commit/70d79389536821f1323ae5016f63ee95afa6b48a">70d7938</a>)</li>
</ul>
<h2>v2.14.0</h2>
<h2><a
href="https://github.com/googleapis/js-genai/compare/v2.13.0...v2.14.0">2.14.0</a>
(2026-07-28)</h2>
<h3>Features</h3>
<ul>
<li>[GenerateContentConfig] Add
GenerationConfig.audio_transcription_config and
Part.audio_transcription. (<a
href="https://github.com/googleapis/js-genai/commit/4b2e67aebbb713321c095ccad34618f2a98fdd7d">4b2e67a</a>)</li>
<li>Add flat <code>language_codes</code> field to
<code>AudioTranscriptionConfig</code>. (<a
href="https://github.com/googleapis/js-genai/commit/cc808ebcbe76beb8e54fd5ca24ac358643104853">cc808eb</a>)</li>
<li>Allow api key + proj/location for enterprise mode (<a
href="https://github.com/googleapis/js-genai/commit/9c0540a26694e6a2896a433e43d1bac963af10e5">9c0540a</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>add deprecation warnings to Imagen generate_images, edit_images,
generate_videos (if using prompt/text/image args),
LiveConnectConfig.GenerationConfig which will be removed in the next
major version (<a
href="https://github.com/googleapis/js-genai/commit/bb6610199a76f7a99e28ed77974e6a3af21a52b1">bb66101</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/js-genai/blob/main/CHANGELOG.md">@​google/genai's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/googleapis/js-genai/compare/v2.14.0...v2.15.0">2.15.0</a>
(2026-07-30)</h2>
<h3>Features</h3>
<ul>
<li>add environment resource (<a
href="https://github.com/googleapis/js-genai/commit/2c911befbf839fc250a296783cbedbd3b668a9f7">2c911be</a>)</li>
<li>Support GoogleMaps Tool grounding_types places and routing (<a
href="https://github.com/googleapis/js-genai/commit/52655c192848942d2d866c3b256de27c94583f78">52655c1</a>)</li>
<li>Support per-request retryOptions in the JS GenAI SDK API Client (<a
href="https://github.com/googleapis/js-genai/commit/124b606bc5be0d5e70673dc28e16e739c9a25d7c">124b606</a>)</li>
<li>Wire environment service into genai sdk (<a
href="https://github.com/googleapis/js-genai/commit/70d79389536821f1323ae5016f63ee95afa6b48a">70d7938</a>)</li>
</ul>
<h2><a
href="https://github.com/googleapis/js-genai/compare/v2.13.0...v2.14.0">2.14.0</a>
(2026-07-28)</h2>
<h3>Features</h3>
<ul>
<li>[GenerateContentConfig] Add
GenerationConfig.audio_transcription_config and
Part.audio_transcription. (<a
href="https://github.com/googleapis/js-genai/commit/4b2e67aebbb713321c095ccad34618f2a98fdd7d">4b2e67a</a>)</li>
<li>Add flat <code>language_codes</code> field to
<code>AudioTranscriptionConfig</code>. (<a
href="https://github.com/googleapis/js-genai/commit/cc808ebcbe76beb8e54fd5ca24ac358643104853">cc808eb</a>)</li>
<li>Allow api key + proj/location for enterprise mode (<a
href="https://github.com/googleapis/js-genai/commit/9c0540a26694e6a2896a433e43d1bac963af10e5">9c0540a</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>add deprecation warnings to Imagen generate_images, edit_images,
generate_videos (if using prompt/text/image args),
LiveConnectConfig.GenerationConfig which will be removed in the next
major version (<a
href="https://github.com/googleapis/js-genai/commit/bb6610199a76f7a99e28ed77974e6a3af21a52b1">bb66101</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/googleapis/js-genai/commit/a76a3eab126e5b7c6a46f6c43795ec3cc65b5488"><code>a76a3ea</code></a>
chore(main): release 2.15.0 (<a
href="https://redirect.github.com/googleapis/js-genai/issues/1815">#1815</a>)</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/124b606bc5be0d5e70673dc28e16e739c9a25d7c"><code>124b606</code></a>
feat: Support per-request retryOptions in the JS GenAI SDK API
Client</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/52655c192848942d2d866c3b256de27c94583f78"><code>52655c1</code></a>
feat: Support GoogleMaps Tool grounding_types places and routing</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/70d79389536821f1323ae5016f63ee95afa6b48a"><code>70d7938</code></a>
feat: Wire environment service into genai sdk</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/2c911befbf839fc250a296783cbedbd3b668a9f7"><code>2c911be</code></a>
feat: add environment resource</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/1895d5793954cb62e3ab4d90aab2f636b4285497"><code>1895d57</code></a>
docs: Communicate on upcoming updates in the next major version</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/ebeba1cda039d43e821d519afb8ce1d0dc9d0f74"><code>ebeba1c</code></a>
chore(main): release 2.14.0 (<a
href="https://redirect.github.com/googleapis/js-genai/issues/1799">#1799</a>)</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/cc808ebcbe76beb8e54fd5ca24ac358643104853"><code>cc808eb</code></a>
feat: Add flat <code>language_codes</code> field to
<code>AudioTranscriptionConfig</code>.</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/9c0540a26694e6a2896a433e43d1bac963af10e5"><code>9c0540a</code></a>
feat: Allow api key + proj/location for enterprise mode</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/d221cf34c94ad558ab22d59e3163b60122d72948"><code>d221cf3</code></a>
chore: internal update</li>
<li>Additional commits viewable in <a
href="https://github.com/googleapis/js-genai/compare/v2.13.0...v2.15.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `@langchain/core` from 1.2.3 to 1.2.4
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchainjs/releases">@​langchain/core's
releases</a>.</em></p>
<blockquote>
<h2><code>@​langchain/core</code><a
href="https://github.com/1"><code>@​1</code></a>.2.4</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11190">#11190</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/9654bde694af4e78080a76a0b39d7edd35683449"><code>9654bde</code></a>
Thanks <a
href="https://github.com/pawel-twardziak"><code>@​pawel-twardziak</code></a>!
- Coalesce nested LangChain tracer callbacks that share run
bookkeeping.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11153">#11153</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/84ce6d65ef0ab2c556d5a5a3b5651b5cf3d73303"><code>84ce6d6</code></a>
Thanks <a
href="https://github.com/parveshsaini"><code>@​parveshsaini</code></a>!
- fix(core): bind splitText when trimMessages receives a TextSplitter
instance</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/f6dbb882d1d4a591d69020145b6a871fe7801b35"><code>f6dbb88</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11268">#11268</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/9654bde694af4e78080a76a0b39d7edd35683449"><code>9654bde</code></a>
fix(core): coalesce duplicate tracer copies sharing run state (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11190">#11190</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/84ce6d65ef0ab2c556d5a5a3b5651b5cf3d73303"><code>84ce6d6</code></a>
fix(core): bind splitText when trimMessages receives a TextSplitter
instance ...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/710d74f3fc0ff98d5088c8e0c86752829cfaaa2c"><code>710d74f</code></a>
fix: resolve open Dependabot alerts (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11259">#11259</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/5226cddb0d0b31d33bb78fc51230e4283cd6cc64"><code>5226cdd</code></a>
chore(deps-dev): bump <code>@​hono/node-server</code> from 2.0.4 to
2.0.10 in /libs/langcha...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/d829cb490112454b3cf8718a526f28450ff37062"><code>d829cb4</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11204">#11204</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/c8bd4c4a6dbde07fb24deb5870c02dc29c51ab53"><code>c8bd4c4</code></a>
feat(anthropic): add Claude Opus 5 support (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11255">#11255</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/741f380ae54afd2e920495b3042ea6346865836a"><code>741f380</code></a>
chore(deps): bump <code>@​hono/node-server</code> from 2.0.4 to 2.0.10
(<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11244">#11244</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/5103cee12ae0e3e56038f0c20edda5159b252daa"><code>5103cee</code></a>
chore(deps): bump js-yaml from 5.1.0 to 5.2.2 (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11256">#11256</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/db29a6a8060d9d8998f5fb566368e3bad5b32a5b"><code>db29a6a</code></a>
chore(deps): bump axios from 1.16.1 to 1.18.0 (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11228">#11228</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchainjs/compare/@langchain/core@1.2.3...@langchain/core@1.2.4">compare
view</a></li>
</ul>
</details>
<br />

Updates `@langchain/langgraph` from 1.4.8 to 1.4.9
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langgraphjs/releases">@​langchain/langgraph's
releases</a>.</em></p>
<blockquote>
<h2><code>@​langchain/langgraph</code><a
href="https://github.com/1"><code>@​1</code></a>.4.9</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2653">#2653</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/7880055ac7303483e424380cdd52f54cd094e311"><code>7880055</code></a>
Thanks <a
href="https://github.com/christian-bromann"><code>@​christian-bromann</code></a>!
- fix(langgraph): checkpoint Topic as a flat values list</p>
<p>Match Python Topic checkpoints so Host JS graphs no longer put
<code>__pregel_tasks: [[], []]</code> through the Python checkpointer.
Keep reading legacy <code>[seen, values]</code> checkpoints for restore
compatibility.</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langgraphjs/blob/main/libs/langgraph-core/CHANGELOG.md">@​langchain/langgraph's
changelog</a>.</em></p>
<blockquote>
<h2>1.4.9</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2653">#2653</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/7880055ac7303483e424380cdd52f54cd094e311"><code>7880055</code></a>
Thanks <a
href="https://github.com/christian-bromann"><code>@​christian-bromann</code></a>!
- fix(langgraph): checkpoint Topic as a flat values list</p>
<p>Match Python Topic checkpoints so Host JS graphs no longer put
<code>__pregel_tasks: [[], []]</code> through the Python checkpointer.
Keep reading legacy <code>[seen, values]</code> checkpoints for restore
compatibility.</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/5f9915234a5dca861ef01180fde28e52f42c6e15"><code>5f99152</code></a>
chore: version packages (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2655">#2655</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/7880055ac7303483e424380cdd52f54cd094e311"><code>7880055</code></a>
fix(langgraph): checkpoint Topic as a flat values list (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2653">#2653</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/cac6d3106599b5c9ecff8c00d99a7e78571c5202"><code>cac6d31</code></a>
chore(deps): bump the vite-vitest group across 1 directory with 6
updates (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2">#2</a>...</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/fa9892117d56398ce0f02f1a73bafb807a61ce2e"><code>fa98921</code></a>
chore(deps-dev): bump <code>@​vitest/browser</code> from 4.1.9 to 4.1.10
(<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2624">#2624</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/cdffd18d192eaa87375bc2d45b343418af8bd024"><code>cdffd18</code></a>
chore(deps): bump the langchain group across 1 directory with 6 updates
(<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2616">#2616</a>)</li>
<li>See full diff in <a
href="https://github.com/langchain-ai/langgraphjs/commits/@langchain/langgraph@1.4.9/libs/langgraph-core">compare
view</a></li>
</ul>
</details>
<br />

Updates `typebox` from 1.3.9 to 1.3.10
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/sinclairzx81/typebox/commit/221a1de804f08471600ebd4dc8a4460340797d56"><code>221a1de</code></a>
Version 1.3.10 (<a
href="https://redirect.github.com/sinclairzx81/typebox/issues/1662">#1662</a>)</li>
<li><a
href="https://github.com/sinclairzx81/typebox/commit/4992c53f930a675d78acdf5d61a1a12e64e8037a"><code>4992c53</code></a>
Specification</li>
<li>See full diff in <a
href="https://github.com/sinclairzx81/typebox/compare/1.3.9...1.3.10">compare
view</a></li>
</ul>
</details>
<br />

Updates `@ai-sdk/mcp` from 2.0.22 to 2.0.24
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/ai/blob/main/packages/mcp/CHANGELOG.md">@​ai-sdk/mcp's
changelog</a>.</em></p>
<blockquote>
<h2>2.0.24</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [160ccdb]
<ul>
<li><code>@​ai-sdk/provider-utils</code><a
href="https://github.com/5"><code>@​5</code></a>.0.20</li>
</ul>
</li>
</ul>
<h2>2.0.23</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [79e133c]
<ul>
<li><code>@​ai-sdk/provider</code><a
href="https://github.com/4"><code>@​4</code></a>.0.5</li>
<li><code>@​ai-sdk/provider-utils</code><a
href="https://github.com/5"><code>@​5</code></a>.0.19</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/ai/commit/22095f409fdf70dc858546fe26b1cf92f12f87f1"><code>22095f4</code></a>
Version Packages (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/mcp/issues/18381">#18381</a>)</li>
<li><a
href="https://github.com/vercel/ai/commit/9df82a8bc70f569ae0fbb701a81fd6209ec2a2b7"><code>9df82a8</code></a>
Version Packages (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/mcp/issues/18368">#18368</a>)</li>
<li>See full diff in <a
href="https://github.com/vercel/ai/commits/@ai-sdk/mcp@2.0.24/packages/mcp">compare
view</a></li>
</ul>
</details>
<br />

Updates `@ai-sdk/openai` from 4.0.27 to 4.0.29
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/ai/blob/main/packages/openai/CHANGELOG.md">@​ai-sdk/openai's
changelog</a>.</em></p>
<blockquote>
<h2>4.0.29</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [160ccdb]
<ul>
<li><code>@​ai-sdk/provider-utils</code><a
href="https://github.com/5"><code>@​5</code></a>.0.20</li>
</ul>
</li>
</ul>
<h2>4.0.28</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [79e133c]
<ul>
<li><code>@​ai-sdk/provider</code><a
href="https://github.com/4"><code>@​4</code></a>.0.5</li>
<li><code>@​ai-sdk/provider-utils</code><a
href="https://github.com/5"><code>@​5</code></a>.0.19</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/ai/commit/22095f409fdf70dc858546fe26b1cf92f12f87f1"><code>22095f4</code></a>
Version Packages (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/openai/issues/18381">#18381</a>)</li>
<li><a
href="https://github.com/vercel/ai/commit/9df82a8bc70f569ae0fbb701a81fd6209ec2a2b7"><code>9df82a8</code></a>
Version Packages (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/openai/issues/18368">#18368</a>)</li>
<li>See full diff in <a
href="https://github.com/vercel/ai/commits/@ai-sdk/openai@4.0.29/packages/openai">compare
view</a></li>
</ul>
</details>
<br />

Updates `@cloudflare/vitest-pool-workers` from 0.18.8 to 0.20.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/cloudflare/workers-sdk/releases">@​cloudflare/vitest-pool-workers's
releases</a>.</em></p>
<blockquote>
<h2><code>@​cloudflare/vitest-pool-workers</code><a
href="https://github.com/0"><code>@​0</code></a>.20.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/cloudflare/workers-sdk/commit/cc63aae658c39ae33169c6dc89f2e6ec1071fc53"><code>cc63aae</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/f92d1fc1316ba4e5f7e308c79943cb9e34b308c2"><code>f92d1fc</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/a249591473321cc2fb88a7b62a8c2b8663ebd4ef"><code>a249591</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/f92d1fc1316ba4e5f7e308c79943cb9e34b308c2"><code>f92d1fc</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/f92d1fc1316ba4e5f7e308c79943cb9e34b308c2"><code>f92d1fc</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/cec9d8875d3f103acc813724ded980867bd25ed7"><code>cec9d88</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/e0bbf55fdce5239a88c78a4350d3287f52d77964"><code>e0bbf55</code></a>]:
<ul>
<li>wrangler@4.118.0</li>
</ul>
</li>
</ul>
<h2><code>@​cloudflare/vitest-pool-workers</code><a
href="https://github.com/0"><code>@​0</code></a>.20.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/cloudflare/workers-sdk/pull/14586">#14586</a>
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>
Thanks <a
href="https://github.com/emily-shen"><code>@​emily-shen</code></a>! -
Breaking change: Remove several options from the <code>miniflare</code>
override options</p>
<p>The following options have been removed from the
<code>miniflare</code> override options, as they were not intended to be
exposed, were not functional, or have been superseded by other
options:</p>
<ul>
<li><code>wrappedBindings</code></li>
<li><code>cacheWarnUsage</code></li>
<li><code>fetchMock</code>: you should use <code>outboundService</code>
instead</li>
<li><code>containerEngine</code>: containers were not supported in
vitest-pool-workers. Consider using <a
href="https://developers.cloudflare.com/workers/testing/test-harness/"><code>createTestHarness()</code></a>
instead if you want to test against actual containers.</li>
</ul>
<p>Additionally, <code>cache</code> has been deprecated and renamed to
<code>cacheAPI</code>, but <code>cache</code> remains functional.</p>
</li>
</ul>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/cloudflare/workers-sdk/pull/14586">#14586</a>
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>
Thanks <a
href="https://github.com/emily-shen"><code>@​emily-shen</code></a>! -
Preserve the deprecated Miniflare <code>cache</code> option</p>
<p>Vitest configurations using <code>cache</code> continue to work after
the internal Miniflare v5 upgrade. The option is translated to
<code>cacheAPI</code>; new configurations should use
<code>cacheAPI</code> directly.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/cloudflare/workers-sdk/pull/14586">#14586</a>
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>
Thanks <a
href="https://github.com/emily-shen"><code>@​emily-shen</code></a>! -
Stop enabling Miniflare's removed <code>unsafeStickyBlobs</code>
option</p>
<p>The pool no longer sets the <code>unsafeStickyBlobs</code> Miniflare
option, which has been removed. This option was only needed for the
Durable Object isolated storage feature that was dropped in 0.13.0, so
there is no change in behaviour.</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>]:</p>
<ul>
<li><a
href="mailto:miniflare@5.20260730.0-alpha">miniflare@5.20260730.0-alpha</a></li>
<li>wrangler@4.117.0</li>
</ul>
</li>
</ul>
<h2><code>@​cloudflare/vitest-pool-workers</code><a
href="https://github.com/0"><code>@​0</code></a>.19.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/cloudflare/workers-sdk/commit/01d7020806dd523158cf9f26a4575365117f5381"><code>01d7020</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/beec0fbc9d3adec24bc42e31a21fe7f82badb543"><code>beec0fb</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/48f0c6cbbc50dfac02e2d76554c181ced233a792"><code>48f0c6c</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/8049ca451c9561e8b72f3eeeb7916a8712f06133"><code>8049ca4</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/d7f38c311e8cd0f29f56a25250da45f62b20f8ca"><code>d7f38c3</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/1394867d1dc357d9bddabf8c16aede47d052fb18"><code>1394867</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/cc5447865022ebc602258cfbeb79953181a62ae0"><code>cc54478</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5c25cfe4e03e0d3d42ddab57adc3274d6f6a1a30"><code>5c25cfe</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/b21eac24878f060296915f198fae910268c465ef"><code>b21eac2</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/bb09f1bd77a194520db3e61d733996f4bbe4bad8"><code>bb09f1b</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/1f61001e5f7a807db7856f5d89e0b26e12a0d0a0"><code>1f61001</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/01d7020806dd523158cf9f26a4575365117f5381"><code>01d7020</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/e31ab0f40c5310babd8b493490c0e1ca677e9a8c"><code>e31ab0f</code></a>]:
<ul>
<li>miniflare@4.20260730.0</li>
<li>wrangler@4.116.0</li>
</ul>
</li>
</ul>
<h2><code>@​cloudflare/vitest-pool-workers</code><a
href="https://github.com/0"><code>@​0</code></a>.19.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/cloudflare/workers-sdk/pull/14879">#14879</a>
<a
href="https://github.com/cloudflare/workers-sdk/commit/e6480e3c26e849034e9e511a2fd1216257975656"><code>e6480e3</code></a>
Thanks <a
href="https://github.com/dmmulroy"><code>@​dmmulroy</code></a>! - Add a
<code>verbose</code> option to <code>cloudflareTest()</code> and
<code>cloudflarePool()</code> configuration</p>
<p>Set <code>verbose: false</code> to suppress verbose workerd runtime
logs, such as caught Durable Object RPC errors. The option defaults to
<code>true</code> to preserve existing output.</p>
</li>
</ul>
<h3>Patch Changes</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/cloudflare/workers-sdk/blob/main/packages/vitest-pool-workers/CHANGELOG.md">@​cloudflare/vitest-pool-workers's
changelog</a>.</em></p>
<blockquote>
<h2>0.20.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/cloudflare/workers-sdk/commit/cc63aae658c39ae33169c6dc89f2e6ec1071fc53"><code>cc63aae</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/f92d1fc1316ba4e5f7e308c79943cb9e34b308c2"><code>f92d1fc</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/a249591473321cc2fb88a7b62a8c2b8663ebd4ef"><code>a249591</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/f92d1fc1316ba4e5f7e308c79943cb9e34b308c2"><code>f92d1fc</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/f92d1fc1316ba4e5f7e308c79943cb9e34b308c2"><code>f92d1fc</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/cec9d8875d3f103acc813724ded980867bd25ed7"><code>cec9d88</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/e0bbf55fdce5239a88c78a4350d3287f52d77964"><code>e0bbf55</code></a>]:
<ul>
<li>wrangler@4.118.0</li>
</ul>
</li>
</ul>
<h2>0.20.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/cloudflare/workers-sdk/pull/14586">#14586</a>
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>
Thanks <a
href="https://github.com/emily-shen"><code>@​emily-shen</code></a>! -
Breaking change: Remove several options from the <code>miniflare</code>
override options</p>
<p>The following options have been removed from the
<code>miniflare</code> override options, as they were not intended to be
exposed, were not functional, or have been superseded by other
options:</p>
<ul>
<li><code>wrappedBindings</code></li>
<li><code>cacheWarnUsage</code></li>
<li><code>fetchMock</code>: you should use <code>outboundService</code>
instead</li>
<li><code>containerEngine</code>: containers were not supported in
vitest-pool-workers. Consider using <a
href="https://developers.cloudflare.com/workers/testing/test-harness/"><code>createTestHarness()</code></a>
instead if you want to test against actual containers.</li>
</ul>
<p>Additionally, <code>cache</code> has been deprecated and renamed to
<code>cacheAPI</code>, but <code>cache</code> remains functional.</p>
</li>
</ul>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/cloudflare/workers-sdk/pull/14586">#14586</a>
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>
Thanks <a
href="https://github.com/emily-shen"><code>@​emily-shen</code></a>! -
Preserve the deprecated Miniflare <code>cache</code> option</p>
<p>Vitest configurations using <code>cache</code> continue to work after
the internal Miniflare v5 upgrade. The option is translated to
<code>cacheAPI</code>; new configurations should use
<code>cacheAPI</code> directly.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/cloudflare/workers-sdk/pull/14586">#14586</a>
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>
Thanks <a
href="https://github.com/emily-shen"><code>@​emily-shen</code></a>! -
Stop enabling Miniflare's removed <code>unsafeStickyBlobs</code>
option</p>
<p>The pool no longer sets the <code>unsafeStickyBlobs</code> Miniflare
option, which has been removed. This option was only needed for the
Durable Object isolated storage feature that was dropped in 0.13.0, so
there is no change in behaviour.</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>]:</p>
<ul>
<li><a
href="mailto:miniflare@5.20260730.0-alpha">miniflare@5.20260730.0-alpha</a></li>
<li>wrangler@4.117.0</li>
</ul>
</li>
</ul>
<h2>0.19.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/cloudflare/workers-sdk/commit/01d7020806dd523158cf9f26a4575365117f5381"><code>01d7020</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/beec0fbc9d3adec24bc42e31a21fe7f82badb543"><code>beec0fb</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/48f0c6cbbc50dfac02e2d76554c181ced233a792"><code>48f0c6c</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/8049ca451c9561e8b72f3eeeb7916a8712f06133"><code>8049ca4</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/d7f38c311e8cd0f29f56a25250da45f62b20f8ca"><code>d7f38c3</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/1394867d1dc357d9bddabf8c16aede47d052fb18"><code>1394867</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/cc5447865022ebc602258cfbeb79953181a62ae0"><code>cc54478</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5c25cfe4e03e0d3d42ddab57adc3274d6f6a1a30"><code>5c25cfe</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/b21eac24878f060296915f198fae910268c465ef"><code>b21eac2</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/bb09f1bd77a194520db3e61d733996f4bbe4bad8"><code>bb09f1b</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/1f61001e5f7a807db7856f5d89e0b26e12a0d0a0"><code>1f61001</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/01d7020806dd523158cf9f26a4575365117f5381"><code>01d7020</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/e31ab0f40c5310babd8b493490c0e1ca677e9a8c"><code>e31ab0f</code></a>]:
<ul>
<li>miniflare@4.20260730.0</li>
<li>wrangler@4.116.0</li>
</ul>
</li>
</ul>
<h2>0.19.0</h2>
<h3>Minor Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/cloudflare/workers-sdk/pull/14879">#14879</a>
<a
href="https://github.com/cloudflare/workers-sdk/commit/e6480e3c26e849034e9e511a2fd1216257975656"><code>e6480e3</code></a>
Thanks <a
href="https://github.com/dmmulroy"><code>@​dmmulroy</code></a>! - Add a
<code>verbose</code> option to <code>cloudflareTest()</code> and
<code>cloudflarePool()</code> configuration</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/cloudflare/workers-sdk/commit/95d9b12f2c707f254b66b446e0bd9fd6b8b7d96d"><code>95d9b12</code></a>
Version Packages (<a
href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers/issues/14946">#14946</a>)</li>
<li><a
href="https://github.com/cloudflare/workers-sdk/commit/83a37e3ef05d6930f29df904978e7f6eacde2203"><code>83a37e3</code></a>
docs: point vitest-pool-workers BUILD section at the tsdown config (<a
href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers/issues/14940">#14940</a>)</li>
<li><a
href="https://github.com/cloudflare/workers-sdk/commit/fcb5402346b2424008c7a0d0612ee8ba2f65bf3e"><code>fcb5402</code></a>
Version Packages (<a
href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers/issues/14939">#14939</a>)</li>
<li><a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>
Miniflare v5 alpha (<a
href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers/issues/14586">#14586</a>)</li>
<li><a
href="https://github.com/cloudflare/workers-sdk/commit/96fd16f0e06e82eb99001c70e4935e992e69cb87"><code>96fd16f</code></a>
Version Packages (<a
href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers/issues/14898">#14898</a>)</li>
<li><a
href="https://github.com/cloudflare/workers-sdk/commit/760a85b6fac60b0a73298c99df54ae0058653c76"><code>760a85b</code></a>
Version Packages (<a
href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers/issues/14824">#14824</a>)</li>
<li><a
href="https://github.com/cloudflare/workers-sdk/commit/e6480e3c26e849034e9e511a2fd1216257975656"><code>e6480e3</code></a>
[vitest-pool-workers] Make workerd verbose logging configurable (<a
href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers/issues/14879">#14879</a>)</li>
<li><a
href="https://github.com/cloudflare/workers-sdk/commit/edc203e42a10a52f8d2af305fecd2fed4807274e"><code>edc203e</code></a>
[vitest-pool-workers] Ignore workerd's ungraceful TLS disconnect
exception lo...</li>
<li>See full diff in <a
href="https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vitest-pool-workers@0.20.1/packages/vitest-pool-workers">compare
view</a></li>
</ul>
</details>
<br />

Updates `@cloudflare/workers-types` from 5.20260801.1 to 5.20260804.1
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/cloudflare/workerd/commits">compare
view</a></li>
</ul>
</details>
<br />

Updates `@mastra/core` from 1.52.1 to 1.55.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/mastra-ai/mastra/releases">@​mastra/core's
releases</a>.</em></p>
<blockquote>
<h2>July 30, 2026</h2>
<h2>Highlights</h2>
<h3>In-process Code Mode execution (no workspace sandbox required)</h3>
<p>Code Mode transports can now declare <code>requiresSandbox:
false</code>, letting <code>createCodeMode()</code> run without a
workspace sandbox for in-process execution boundaries. This enables
secure in-process runtimes like V8 isolates and exports
<code>sanitizeToolId</code> so transports can share consistent
<code>external_*</code> naming.</p>
<h3>New <code>@mastra/isolated-vm</code> package for V8-isolated Code
Mode</h3>
<p>Introduces <code>@mastra/isolated-vm</code> with
<code>IsolatedVmCodeModeTransport</code>, running model-authored
programs inside an in-process V8 isolate with no
filesystem/network/process access (only bridged <code>external_*</code>
tools). Note: requires <code>isolated-vm</code> native addon and Node
20+ hosts must start with <code>--no-node-snapshot</code>.</p>
<h3>Built-in provider-native Web Search tool</h3>
<p><code>@mastra/core</code> adds <code>webSearchTool</code>, a
first-party web search tool that resolves to provider-native search when
supported by the configured model/provider, simplifying “current info”
agent setups.</p>
<h3>Stored agent drafts via <code>autoPublish</code> (Server + JS
SDK)</h3>
<p>Both <code>@mastra/server</code> and <code>@mastra/client-js</code>
add <code>autoPublish</code> to stored agent creation so you can create
an initial unpublished draft for review before publishing (existing
calls still publish immediately by default).</p>
<h3>New Factory channel identity domain + channels integration slot</h3>
<p><code>@mastra/factory</code> adds a <code>channel-identity</code>
storage domain to link chat-platform senders to Factory users, plus a
<code>channels()</code> integration slot to attach an
<code>AgentControllerChannels</code> during <code>prepare()</code> so
inbound platform messages can drive the same agents as the web UI.</p>
<h3>Breaking Changes</h3>
<ul>
<li><code>ChannelHandler</code> context parameter is now required: the
4th parameter is <code>ctx: ChannelHandlerContext</code> (non-optional).
Code that <em>calls</em> a <code>ChannelHandler</code>-typed function
with only three args must be updated to pass <code>ctx</code>.</li>
</ul>
<h2>Changelog</h2>
<h3><a
href="https://github.com/mastra-ai/mastra/blob/@mastra/core@1.55.0/packages/core/CHANGELOG.md">@​mastra/core@1.55.0</a></h3>
<h4>Minor Changes</h4>
<ul>
<li>
<p>Added support for Code Mode transports that provide their own
execution boundary. A transport can now declare <code>requiresSandbox:
false</code> and <code>createCodeMode()</code> will run it without a
workspace sandbox, which enables in-process transports such as
<code>IsolatedVmCodeModeTransport</code> from
<code>@mastra/isolated-vm</code>: (<a
href="https://redirect.github.com/mastra-ai/mastra/pull/20359">#20359</a>)</p>
<pre lang="typescript"><code>import { createCodeMode } from
'@mastra/core/tools';
import { IsolatedVmCodeModeTransport } from '@mastra/isolated-vm';
<p>// No sandbox needed — the V8 isolate is the execution boundary
const { tool, instructions } = createCodeMode({ tools }, new
IsolatedVmCodeModeTransport());
</code></pre></p>
<p>Also fixed the generated Code Mode instructions to describe isolation
accurately instead of always claiming the program runs fully sandboxed,
since the actual boundary depends on the configured sandbox and
transport. The <code>sanitizeToolId</code> helper used for
<code>external_*</code> naming is now exported from
<code>@mastra/core/tools</code> so transports can reuse it instead of
duplicating it.</p>
</li>
<li>
<p>Added retry callbacks for stream error policies and ensured explicit
matcher policies override provider retry metadata. (<a
href="https://redirect.github.com/mastra-ai/mastra/pull/19724">#19724</a>)</p>
</li>
<li>
<p>Channel handlers can now contribute to the request context of the run
they start. (<a
href="https://redirect.github.com/mastra-ai/mastra/pull/20060">#20060</a>)</p>
<p><code>ChannelHandlerContext</code> gains a
<code>requestContext</code> field holding the
<code>RequestContext</code> for the run the inbound message is about to
start. It is constructed fresh for every message, and a handler may
write to it before calling <code>defaultHandler</code>. Core then adds
its own channel and render-context entries and dispatches with the same
instance, so anything the handler wrote reaches the run.</p>
<pre lang="ts"><code>import { AgentControllerChannels } from
'@mastra/core/channels';
<p>const channels = new AgentControllerChannels({
adapters,
handlers: {
</code></pre></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/mastra-ai/mastra/commit/bccb45d579ae7a914b9c03733f919127952c2300"><code>bccb45d</code></a>
chore: version - exit prerelease mode</li>
<li><a
href="https://github.com/mastra-ai/mastra/commit/469696312ac4c618bc8475b0c5ed7949b8a3455e"><code>4696963</code></a>
fix(core): persist delegation prompt exactly once in sub-agent threads
(<a
href="https://github.com/mastra-ai/mastra/tree/HEAD/packages/core/issues/20174">#20174</a>)</li>
<li><a
href="https://github.com/mastra-ai/mastra/commit/6b861234d6728e50c7b424d504024b468d6db2b8"><code>6b86123</code></a>
chore: version packages (alpha) (<a
href="https://github.com/mastra-ai/mastra/tree/HEAD/packages/core/issues/20419">#20419</a>)</li>
<li><a
href="https://github.com/mastra-ai/mastra/commit/723aa5437106bdb708ae03c0ef6b77aa11291e73"><code>723aa54</code></a>
feat(factory): stricter review agent — weigh existing comments,
calibrated ve...</li>
<li><a
href="https://github.com/mastra-ai/mastra/commit/ef8a7ceb6d663723e5e09aa6ebabc716665325af"><code>ef8a7ce</code></a>
chore: version packages (alpha) (<a
href="https://github.com/mastra-ai/mastra/tree/HEAD/packages/core/issues/20358">#20358</a>)</li>
<li><a
href="https://github.com/mastra-ai/mastra/commit/07f5b4ba9d608d88865030732e580298296adf99"><code>07f5b4b</code></a>
fix(core): avoid serializing result comparisons (<a
href="https://github.com/mastra-ai/mastra/tree/HEAD/packages/core/issues/20340">#20340</a>)</li>
<li><a
href="https://github.com/mastra-ai/mastra/commit/9c16d7b20f02b5bfd1152861a69fd6694c26f4b3"><code>9c16d7b</code></a>
chore: regenerate providers and docs [skip ci]</li>
<li><a
href="https://github.com/mastra-ai/mastra/commit/55c9e248c27c1d72b5bb7e94ea6b8a3999eee49f"><code>55c9e24</code></a>
Run Slack messages as the sender's Mastra tenant (<a
href="https://github.com/mastra-ai/mastra/tree/HEAD/packages/core/issues/20060">#20060</a>)</li>
<li><a
href="https://github.com/mastra-ai/mastra/commit/cfb2899d510252f39ddf46fb75c35c11fb4a36f4"><code>cfb2899</code></a>
chore: version packages</li>
<li><a
href="https://github.com/mastra-ai/mastra/commit/ba369f2a0aaf998da0d6aa033d26f64f96bef8ac"><code>ba369f2</code></a>
feat(isolated-vm): add IsolatedVmCodeModeTransport for in-process Code
Mode i...</li>
<li>Additional commits viewable in <a
href="https://github.com/mastra-ai/mastra/commits/@mastra/core@1.55.0/packages/core">compare
view</a></li>
</ul>
</details>
<br />

Updates `@modelcontextprotocol/sdk` from 1.26.0 to 1.30.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/modelcontextprotocol/typescript-sdk/releases">@​modelcontextprotocol/sdk's
releases</a>.</em></p>
<blockquote>
<h2>1.30.0</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(server): prioritize zod issues and format them by <a
href="https://github.com/mozmo15"><code>@​mozmo15</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1503">modelcontextprotocol/typescript-sdk#1503</a></li>
<li>chore(ci): switch publish to OIDC trusted publishing by <a
href="https://github.com/felixweinberger"><code>@​felixweinberger</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1839">modelcontextprotocol/typescript-sdk#1839</a></li>
<li>Add end-to-end test suite by <a
href="https://github.com/felixweinberger"><code>@​felixweinberger</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2167">modelcontextprotocol/typescript-sdk#2167</a></li>
<li>v1 stdio buffer limit by <a
href="https://github.com/KKonstantinov"><code>@​KKonstantinov</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2239">modelcontextprotocol/typescript-sdk#2239</a></li>
<li>fix: support Zod 3.25 method literals by <a
href="https://github.com/mattzcarey"><code>@​mattzcarey</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2368">modelcontextprotocol/typescript-sdk#2368</a></li>
<li>Validate Content-Type by parsed media type instead of substring
match (v1.x) by <a
href="https://github.com/felixweinberger"><code>@​felixweinberger</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2444">modelcontextprotocol/typescript-sdk#2444</a></li>
<li>fix: send SSE keep-alive comment frames from Streamable HTTP server
transport (v1.x) by <a
href="https://github.com/mattzcarey"><code>@​mattzcarey</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2538">modelcontextprotocol/typescript-sdk#2538</a></li>
<li>fix(deps): widen <code>@​hono/node-server</code> past
GHSA-frvp-7c67-39w9 by <a
href="https://github.com/arimu1"><code>@​arimu1</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2549">modelcontextprotocol/typescript-sdk#2549</a></li>
<li>Fix SSE keep-alive timer lifecycle in Streamable HTTP server
transport (v1.x) by <a
href="https://github.com/felixweinberger"><code>@​felixweinberger</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2547">modelcontextprotocol/typescript-sdk#2547</a></li>
<li>chore: bump version to 1.30.0 by <a
href="https://github.com/felixweinberger"><code>@​felixweinberger</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2563">modelcontextprotocol/typescript-sdk#2563</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/mozmo15"><code>@​mozmo15</code></a> made
their first contribution in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1503">modelcontextprotocol/typescript-sdk#1503</a></li>
<li><a href="https://github.com/arimu1"><code>@​arimu1</code></a> made
their first contribution in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2549">modelcontextprotocol/typescript-sdk#2549</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/modelcontextprotocol/typescript-sdk/compare/v1.29.0...1.30.0">https://github.com/modelcontextprotocol/typescript-sdk/compare/v1.29.0...1.30.0</a></p>
<h2>v1.29.0</h2>
<h2>What's Changed</h2>
<ul>
<li>fix: treat v1.x as primary branch for npm latest tag (backport <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/1577">#1577</a>)
by <a
href="https://github.com/felixweinberger"><code>@​felixweinberger</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1749">modelcontextprotocol/typescript-sdk#1749</a></li>
<li>[v1.x] fix: disallow null (infinite) requested TTL by <a
href="https://github.com/LucaButBoring"><code>@​LucaButBoring</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1339">modelcontextprotocol/typescript-sdk#1339</a></li>
<li>[v1.x] fix: add missing size field to ResourceSchema by <a
href="https://github.com/olaservo"><code>@​olaservo</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1575">modelcontextprotocol/typescript-sdk#1575</a></li>
<li>Add typings exports by <a
href="https://github.com/tdraier"><code>@​tdraier</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1623">modelcontextprotocol/typescript-sdk#1623</a></li>
<li>v1.x npm audit fix by <a
href="https://github.com/KKonstantinov"><code>@​KKonstantinov</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1780">modelcontextprotocol/typescript-sdk#1780</a></li>
<li>v1.x <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/1623">#1623</a>
follow up -add missing types to package.json by <a
href="https://github.com/KKonstantinov"><code>@​KKonstantinov</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1773">modelcontextprotocol/typescript-sdk#1773</a></li>
<li>[v1.x backport] Allow servers / clients to advertise extensions in
the capability object by <a
href="https://github.com/localden"><code>@​localden</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1811">modelcontextprotocol/typescript-sdk#1811</a></li>
<li>fix(stdio): always set windowsHide on Windows, not just in Electron
by <a href="https://github.com/jnMetaCode"><code>@​jnMetaCode</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1640">modelcontextprotocol/typescript-sdk#1640</a></li>
<li>chore: bump version to 1.29.0 by <a
href="https://github.com/felixweinberger"><code>@​felixweinberger</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1820">modelcontextprotocol/typescript-sdk#1820</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/tdraier"><code>@​tdraier</code></a> made
their first contribution in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1623">modelcontextprotocol/typescript-sdk#1623</a></li>
<li><a
href="https://github.com/jnMetaCode"><code>@​jnMetaCode</code></a> made
their first contribution in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1640">modelcontextprotocol/typescript-sdk#1640</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/modelcontextprotocol/typescript-sdk/compare/v1.28.0...v1.29.0">https://github.com/modelcontextprotocol/typescript-sdk/compare/v1.28.0...v1.29.0</a></p>
<h2>v1.28.0</h2>
<h2>What's Changed</h2>
<ul>
<li>feat: use scopes_supported from resource metadata by default (fixes
<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/580">#580</a>)
by <a href="https://github.com/antogyn"><code>@​antogyn</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/757">modelcontextprotocol/typescript-sdk#757</a></li>
<li>[v1.x backport] Default to client_secret_basic when server omits
token_endpoint_auth_methods_supported by <a
href="https://github.com/pcarleton"><code>@​pcarleton</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1611">modelcontextprotocol/typescript-sdk#1611</a></li>
<li>fix: reject plain JSON Schema objects passed as inputSchema by <a
href="https://github.com/tiluckdave"><code>@​tiluckdave</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1596">modelcontextprotocol/typescript-sdk#1596</a></li>
<li>fix: clear _timeoutInfo in _onclose() and scope .finally() abort
controller cleanup by <a
href="https://github.com/pcarleton"><code>@​pcarleton</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1462">modelcontextprotocol/typescript-sdk#1462</a></li>
<li>fix(server/auth): RFC 8252 loopback port relaxation by <a
href="https://github.com/poteat"><code>@​poteat</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1738">modelcontextprotocol/typescript-sdk#1738</a></li>
<li>chore: bump version to 1.28.0 by <a
href="https://github.com/felixweinberger"><code>@​felixweinberger</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1746">modelcontextprotocol/typescript-sdk#1746</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/antogyn"><code>@​antogyn</code></a> made
their first contribution in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/757">modelcontextprotocol/typescript-sdk#757</a></li>
<li><a
href="https://github.com/tiluckdave"><code>@​tiluckdave</code></a> made
their first contribution in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1596">modelcontextprotocol/typescript-sdk#1596</a></li>
<li><a href="https://github.com/poteat"><code>@​poteat</code></a> made
their first contribution in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1738">modelcontextprotocol/typescript-sdk#1738</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/2d889f2b329e46680ec9bdd565de4616c497825a"><code>2d889f2</code></a>
chore: bump version to 1.30.0 (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2563">#2563</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/e3f3daa12cc2603919939b72136ce9d9e800b868"><code>e3f3daa</code></a>
Fix SSE keep-alive timer lifecycle in Streamable HTTP server transport
(v1.x)...</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/bb5a718cbf90796bacbf62218b359196d210426b"><code>bb5a718</code></a>
fix(deps): widen <code>@​hono/node-server</code> past
GHSA-frvp-7c67-39w9 (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2549">#2549</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/1dad2634ce5799fb386283d14291d1b4935a9a52"><code>1dad263</code></a>
fix: send SSE keep-alive comment frames from Streamable HTTP server
transport...</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/69749aa5081ddfe675d36da8d96c7e27d83742b8"><code>69749aa</code></a>
Validate Content-Type by parsed media type instead of substring match
(v1.x) ...</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/369513df7b0e9d8a979c86f68ba1930e0d5f27f0"><code>369513d</code></a>
fix: support Zod 3.25 method literals (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2368">#2368</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/e7ee57c2f33b8290a78a3cefa27ab635fe67fbff"><code>e7ee57c</code></a>
v1 stdio buffer limit (<a
href="https://redirect.github.com/modelcontextprotocol...

_Description has been truncated_

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: jkomyno <12381818+jkomyno@users.noreply.github.com>
 2026-08-07 18:41:15 +05:30
dependabot[bot] 2cab683f0e chore(deps-dev): bump the npm-development group with 6 updates (#4091) 
Bumps the npm-development group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [lint-staged](https://github.com/lint-staged/lint-staged) | `17.2.0` |
`17.3.0` |
| [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) |
`1.76.0` | `1.77.0` |
|
[oxlint-plugin-eslint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint)
| `1.76.0` | `1.77.0` |
|
[@types/semver](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/semver)
| `7.7.1` | `7.8.0` |
|
[@earendil-works/pi-coding-agent](https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent)
| `0.82.1` | `0.83.0` |
| [eve](https://github.com/vercel/eve/tree/HEAD/packages/eve) |
`0.27.13` | `0.29.5` |

Updates `lint-staged` from 17.2.0 to 17.3.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/lint-staged/lint-staged/releases">lint-staged's
releases</a>.</em></p>
<blockquote>
<h2>v17.3.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/lint-staged/lint-staged/pull/1825">#1825</a>
<a
href="https://github.com/lint-staged/lint-staged/commit/16b3f74850e5d2811b5fbaea6c136733a71ad3e4"><code>16b3f74</code></a>
- It is now possible to run multiple tasks in parallel for a single glob
by configuring it with an array of tasks (which run sequentially), and
then placing another array inside it (where the tasks will run in
parallel). The following demonstrates the order tasks will start in:</p>
<pre lang="json"><code>{
&quot;*.ts&quot;: [&quot;first&quot;, &quot;second&quot;,
[&quot;third&quot;, &quot;third&quot;], &quot;fourth&quot;]
}
</code></pre>
<p>As a concrete example, <em>lint-staged</em>'s own configuration
is:</p>
<pre lang="js"><code>/** @type {import('./lib/index.js').Configuration}
*/
export default {
  &quot;*&quot;: [
    [
      &quot;oxfmt --check --no-error-on-unmatched-pattern&quot;,
      &quot;oxlint --no-error-on-unmatched-pattern&quot;,
    ],
  ],
  &quot;*.ts&quot;: () =&gt; &quot;tsc&quot;,
};
</code></pre>
<p>which means:</p>
<ol>
<li>for all staged files, run the two commands in parallel with staged
filenames appended, for example:
<ul>
<li><code>oxfmt --check --no-error-on-unmatched-pattern
lib/index.js</code></li>
<li><code>oxlint --no-error-on-unmatched-pattern
lib/index.js</code></li>
</ul>
</li>
<li>additionally, if any <code>*.ts</code> files are staged, run
<code>tsc</code> without appending any arguments</li>
<li>The two sets of commands also run in parallel</li>
</ol>
</li>
</ul>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/lint-staged/lint-staged/pull/1829">#1829</a>
<a
href="https://github.com/lint-staged/lint-staged/commit/15f7e5314b4afe4702808d978758b22d42437f43"><code>15f7e53</code></a>
- During an in-progress merge, files that are unchanged from the branch
being merged are now skipped. Technically, files are only included if
there are staged changes against both <code>HEAD</code> and
<code>MERGE_HEAD</code>.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md">lint-staged's
changelog</a>.</em></p>
<blockquote>
<h2>17.3.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/lint-staged/lint-staged/pull/1825">#1825</a>
<a
href="https://github.com/lint-staged/lint-staged/commit/16b3f74850e5d2811b5fbaea6c136733a71ad3e4"><code>16b3f74</code></a>
- It is now possible to run multiple tasks in parallel for a single glob
by configuring it with an array of tasks (which run sequentially), and
then placing another array inside it (where the tasks will run in
parallel). The following demonstrates the order tasks will start in:</p>
<pre lang="json"><code>{
&quot;*.ts&quot;: [&quot;first&quot;, &quot;second&quot;,
[&quot;third&quot;, &quot;third&quot;], &quot;fourth&quot;]
}
</code></pre>
<p>As a concrete example, <em>lint-staged</em>'s own configuration
is:</p>
<pre lang="js"><code>/** @type {import('./lib/index.js').Configuration}
*/
export default {
  &quot;*&quot;: [
    [
      &quot;oxfmt --check --no-error-on-unmatched-pattern&quot;,
      &quot;oxlint --no-error-on-unmatched-pattern&quot;,
    ],
  ],
  &quot;*.ts&quot;: () =&gt; &quot;tsc&quot;,
};
</code></pre>
<p>which means:</p>
<ol>
<li>for all staged files, run the two commands in parallel with staged
filenames appended, for example:
<ul>
<li><code>oxfmt --check --no-error-on-unmatched-pattern
lib/index.js</code></li>
<li><code>oxlint --no-error-on-unmatched-pattern
lib/index.js</code></li>
</ul>
</li>
<li>additionally, if any <code>*.ts</code> files are staged, run
<code>tsc</code> without appending any arguments</li>
<li>The two sets of commands also run in parallel</li>
</ol>
</li>
</ul>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/lint-staged/lint-staged/pull/1829">#1829</a>
<a
href="https://github.com/lint-staged/lint-staged/commit/15f7e5314b4afe4702808d978758b22d42437f43"><code>15f7e53</code></a>
- During an in-progress merge, files that are unchanged from the branch
being merged are now skipped. Technically, files are only included if
there are staged changes against both <code>HEAD</code> and
<code>MERGE_HEAD</code>.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/d15344350d914f5ce24df2c85f3ffebb9b387f3b"><code>d153443</code></a>
Merge pull request <a
href="https://redirect.github.com/lint-staged/lint-staged/issues/1828">#1828</a>
from lint-staged/changeset-release/main</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/5162c149bbfa09b8a5ad4d37c647d63946568ca8"><code>5162c14</code></a>
chore(changeset): release</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/a4db9a4c32f108d1397436752be7e9dda956baa2"><code>a4db9a4</code></a>
Merge pull request <a
href="https://redirect.github.com/lint-staged/lint-staged/issues/1831">#1831</a>
from lint-staged/linter-updates</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/ea96cab0109ab44a5b2562927b890648ee32b4cc"><code>ea96cab</code></a>
style: enable oxlint &quot;suspicious&quot; category</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/2fae00778cea0c99da9bcb8bad4718dce08ea04e"><code>2fae007</code></a>
style: add <code>@e18e/eslint-plugin</code></li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/2280c38a09ff4ca4db60320b5879e0029527afaa"><code>2280c38</code></a>
Merge pull request <a
href="https://redirect.github.com/lint-staged/lint-staged/issues/1829">#1829</a>
from lint-staged/fix-merge-conflict-files</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/1453ae6ae0e05275d714ad0cad7cd090885f504d"><code>1453ae6</code></a>
test: relax assertion so that it passes in worktree</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/15f7e5314b4afe4702808d978758b22d42437f43"><code>15f7e53</code></a>
fix: lint only files changed against HEAD and MERGE_HEAD, during a
merge</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/dedfc31007aed50e1c9c5591a11085cb485ba41c"><code>dedfc31</code></a>
Merge pull request <a
href="https://redirect.github.com/lint-staged/lint-staged/issues/1825">#1825</a>
from lint-staged/parallel-tasks-inside-sequence</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/286e25cef9fde2fb6e77d2312fd91ac99020d69d"><code>286e25c</code></a>
feat: allow running parallel tasks by nesting arrays</li>
<li>Additional commits viewable in <a
href="https://github.com/lint-staged/lint-staged/compare/v17.2.0...v17.3.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `oxlint` from 1.76.0 to 1.77.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/oxc-project/oxc/releases">oxlint's
releases</a>.</em></p>
<blockquote>
<h2>oxlint v1.27.0 &amp;&amp; oxfmt v0.12.0</h2>
<h1>Oxlint v1.27.0</h1>
<h3>🚀 Features</h3>
<ul>
<li>222a8f0 linter/plugins: Implement
<code>SourceCode#isSpaceBetween</code> (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15498">#15498</a>)
(overlookmotel)</li>
<li>2f9735d linter/plugins: Implement
<code>context.languageOptions</code> (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15486">#15486</a>)
(overlookmotel)</li>
<li>bc731ff linter/plugins: Stub out all <code>Context</code> APIs (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15479">#15479</a>)
(overlookmotel)</li>
<li>5822cb4 linter/plugins: Add <code>extend</code> method to
<code>FILE_CONTEXT</code> (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15477">#15477</a>)
(overlookmotel)</li>
<li>7b1e6f3 apps: Add pure rust binaries and release to github (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15469">#15469</a>)
(Boshen)</li>
<li>2a89b43 linter: Introduce debug assertions after fixes to assert
validity (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15389">#15389</a>)
(camc314)</li>
<li>ad3c45a editor: Add <code>oxc.path.node</code> option (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15040">#15040</a>)
(Sysix)</li>
</ul>
<h3>🐛 Bug Fixes</h3>
<ul>
<li>6f3cd77 linter/no-var: Incorrect warning for blocks (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15504">#15504</a>)
(Hamir Mahal)</li>
<li>6957fb9 linter/plugins: Do not allow access to
<code>Context#id</code> in <code>createOnce</code> (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15489">#15489</a>)
(overlookmotel)</li>
<li>7409630 linter/plugins: Allow access to <code>cwd</code> in
<code>createOnce</code> in ESLint interop mode (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15488">#15488</a>)
(overlookmotel)</li>
<li>732205e parser: Reject <code>using</code> / <code>await using</code>
in a switch <code>case</code> / <code>default</code> clause (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15225">#15225</a>)
(sapphi-red)</li>
<li>a17ca32 linter/plugins: Replace <code>Context</code> class (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15448">#15448</a>)
(overlookmotel)</li>
<li>ecf2f7b language_server: Fail gracefully when tsgolint executable
not found (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15436">#15436</a>)
(camc314)</li>
<li>3c8d3a7 lang-server: Improve logging in failure case for tsgolint
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15299">#15299</a>)
(camc314)</li>
<li>ef71410 linter: Use jsx if source type is JS in fix debug assertion
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15434">#15434</a>)
(camc314)</li>
<li>e32bbf6 linter/no-var: Handle TypeScript declare keyword in fixer
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15426">#15426</a>)
(camc314)</li>
<li>6565dbe linter/switch-case-braces: Skip comments when searching for
<code>:</code> token (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15425">#15425</a>)
(camc314)</li>
<li>85bd19a linter/prefer-class-fields: Insert value after type
annotation in fixer (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15423">#15423</a>)
(camc314)</li>
<li>fde753e linter/plugins: Block access to
<code>context.settings</code> in <code>createOnce</code> (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15394">#15394</a>)
(overlookmotel)</li>
<li>ddd9f9f linter/forward-ref-uses-ref: Dont suggest removing wrapper
in invalid positions (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15388">#15388</a>)
(camc314)</li>
<li>dac2a9c linter/no-template-curly-in-string: Remove fixer (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15387">#15387</a>)
(camc314)</li>
<li>989b8e3 linter/no-var: Only fix to <code>const</code> if the var has
an initializer (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15385">#15385</a>)
(camc314)</li>
<li>cc403f5 linter/plugins: Return empty object for unimplemented
parserServices (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15364">#15364</a>)
(magic-akari)</li>
</ul>
<h3>⚡ Performance</h3>
<ul>
<li>25d577e language_server: Start tools in parallel (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15500">#15500</a>)
(Sysix)</li>
<li>3c57291 linter/plugins: Optimize loops (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15449">#15449</a>)
(overlookmotel)</li>
<li>3166233 linter/plugins: Remove <code>Arc</code>s (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15431">#15431</a>)
(overlookmotel)</li>
<li>9de1322 linter/plugins: Lazily deserialize settings JSON (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15395">#15395</a>)
(overlookmotel)</li>
<li>3049ec2 linter/plugins: Optimize <code>deepFreezeSettings</code> (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15392">#15392</a>)
(overlookmotel)</li>
<li>444ebfd linter/plugins: Use single object for
<code>parserServices</code> (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15378">#15378</a>)
(overlookmotel)</li>
</ul>
<h3>📚 Documentation</h3>
<ul>
<li>97d2104 linter: Update comment in lint.rs about default value for
tsconfig path (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15530">#15530</a>)
(Connor Shea)</li>
<li>2c6bd9e linter: Always refer as &quot;ES2015&quot; instead of
&quot;ES6&quot; (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15411">#15411</a>)
(sapphi-red)</li>
<li>a0c5203 linter/import/named: Update &quot;ES7&quot; comment in
examples (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15410">#15410</a>)
(sapphi-red)</li>
<li>3dc24b5 linter,minifier: Always refer as &quot;ES Modules&quot;
instead of &quot;ES6 Modules&quot; (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15409">#15409</a>)
(sapphi-red)</li>
<li>2ad77fb linter/no-this-before-super: Correct &quot;Why is this
bad?&quot; section (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15408">#15408</a>)
(sapphi-red)</li>
<li>57f0ce1 linter: Add backquotes where appropriate (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15407">#15407</a>)
(sapphi-red)</li>
</ul>
<h1>Oxfmt v0.12.0</h1>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md">oxlint's
changelog</a>.</em></p>
<blockquote>
<h2>[1.77.0] - 2026-08-03</h2>
<h3>🐛 Bug Fixes</h3>
<ul>
<li>5c0fa61 linter/eslint/no-warning-comments: Unify config structs and
remove manual options docs (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25151">#25151</a>)
(Mikhail Baev)</li>
</ul>
<h3>📚 Documentation</h3>
<ul>
<li>9dc7756 linter/typescript/no-unnecessary-condition: Clarify options
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25110">#25110</a>)
(camc314)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/oxc-project/oxc/commit/9a423f2f485b79c2353c49442c0c7f60f900261d"><code>9a423f2</code></a>
release(apps): oxlint v1.77.0 &amp;&amp; oxfmt v0.62.0 (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25251">#25251</a>)</li>
<li><a
href="https://github.com/oxc-project/oxc/commit/5c0fa61ddbd098fea5101dff356dc9b67adbee95"><code>5c0fa61</code></a>
fix(linter/eslint/no-warning-comments): unify config structs and remove
manua...</li>
<li><a
href="https://github.com/oxc-project/oxc/commit/9dc77567291db6ebd0641284f80bf50163c6a257"><code>9dc7756</code></a>
docs(linter/typescript/no-unnecessary-condition): clarify options (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25110">#25110</a>)</li>
<li>See full diff in <a
href="https://github.com/oxc-project/oxc/commits/oxlint_v1.77.0/npm/oxlint">compare
view</a></li>
</ul>
</details>
<br />

Updates `oxlint-plugin-eslint` from 1.76.0 to 1.77.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/oxc-project/oxc/commit/9a423f2f485b79c2353c49442c0c7f60f900261d"><code>9a423f2</code></a>
release(apps): oxlint v1.77.0 &amp;&amp; oxfmt v0.62.0 (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25251">#25251</a>)</li>
<li>See full diff in <a
href="https://github.com/oxc-project/oxc/commits/apps_v1.77.0/npm/oxlint-plugin-eslint">compare
view</a></li>
</ul>
</details>
<br />

Updates `@types/semver` from 7.7.1 to 7.8.0
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/semver">compare
view</a></li>
</ul>
</details>
<br />

Updates `@earendil-works/pi-coding-agent` from 0.82.1 to 0.83.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/earendil-works/pi/releases">@​earendil-works/pi-coding-agent's
releases</a>.</em></p>
<blockquote>
<h2>v0.83.0</h2>
<h3>New Features</h3>
<ul>
<li><strong>Credential export for external clients</strong> — <code>pi
auth print-api-key</code> and <code>pi auth print-bearer-token</code>
export configured credentials with automatic OAuth refresh and
minimum-validity enforcement.</li>
<li><strong>Headless OpenRouter sign-in</strong> — Complete
<code>/login</code> over SSH by pasting the redirect URL or
authorization code when the loopback callback is unavailable. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/providers.md#openrouter">OpenRouter</a>.</li>
<li><strong>Claude Opus 5 on GitHub Copilot</strong> — Use Claude Opus 5
through GitHub Copilot with adaptive thinking and a 1M context window.
See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/providers.md#github-copilot">GitHub
Copilot</a>.</li>
</ul>
<h3>Breaking Changes</h3>
<ul>
<li>Upgraded bundled TypeBox aliases to 1.3.7, removing deprecated APIs
including <code>Type.Base</code>, <code>Type.Awaited</code>,
<code>Type.Promise</code>, <code>Type.AsyncIterator</code>,
<code>Type.Iterator</code>, <code>Type.Options</code>, and
<code>Value.Mutate</code>, while fixing compiled validation of nullable
array tool arguments. Extensions using removed APIs must migrate to
supported TypeBox APIs. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/packages.md#dependencies">Package
Dependencies</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7243">#7243</a>
by <a
href="https://github.com/petrroll"><code>@​petrroll</code></a>).</li>
</ul>
<h3>Added</h3>
<ul>
<li>Added <code>pi auth print-api-key</code> and <code>pi auth
print-bearer-token</code> commands for exporting configured credentials
to external clients, including automatic OAuth refresh and configurable
minimum token validity (<a
href="https://redirect.github.com/earendil-works/pi/pull/7168">#7168</a>).</li>
<li>Exposed the session's resolved model scope as
<code>ctx.scopedModels</code> to extensions. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/extensions.md#ctxmodelregistry--ctxmodel--ctxthinkinglevel--ctxscopedmodels">Extension
Context</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7191">#7191</a>
by <a href="https://github.com/pungggi"><code>@​pungggi</code></a>, <a
href="https://redirect.github.com/earendil-works/pi/pull/7215">#7215</a>).</li>
<li>Added inherited per-request <code>fetch</code> injection for
supported text and image provider transports.</li>
<li>Added the inherited <code>&quot;pending&quot;</code> stop reason for
partial streaming messages. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/custom-provider.md#stream-pattern">Custom
Provider Stream Pattern</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7151">#7151</a>
by <a
href="https://github.com/lucasmeijer"><code>@​lucasmeijer</code></a>).</li>
<li>Added inherited raw provider stop reasons across Google, Anthropic,
Amazon Bedrock, Mistral, and OpenAI streams; unmapped terminal reasons
now surface as provider errors instead of successful stops (<a
href="https://redirect.github.com/earendil-works/pi/pull/7272">#7272</a>).</li>
<li>Added manual redirect URL and authorization-code entry to OpenRouter
login for remote and headless environments. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/providers.md#openrouter">OpenRouter</a>
(<a
href="https://redirect.github.com/earendil-works/pi/pull/7114">#7114</a>
by <a
href="https://github.com/rgarcia"><code>@​rgarcia</code></a>).</li>
<li>Added inherited Claude Opus 5 support for GitHub Copilot with
adaptive thinking and a 1M context window. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/providers.md#github-copilot">GitHub
Copilot</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7158">#7158</a>
by <a
href="https://github.com/jay-aye-see-kay"><code>@​jay-aye-see-kay</code></a>).</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Changed inherited OAuth credential resolution to refresh tokens with
less than five minutes of validity remaining instead of waiting until
expiration (<a
href="https://redirect.github.com/earendil-works/pi/pull/7168">#7168</a>).</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Added a status line when the tool output expansion is toggled (<a
href="https://redirect.github.com/earendil-works/pi/issues/7180">#7180</a>).</li>
<li>Fixed file-backed <code>SYSTEM.md</code> and
<code>APPEND_SYSTEM.md</code> prompts being omitted from the interactive
startup context listing. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/usage.md#system-prompt-files">System
Prompt Files</a> (<a
href="https://redirect.github.com/earendil-works/pi/issues/7096">#7096</a>).</li>
<li>Fixed context files loading twice when a linked Git worktree is
nested under its main repository. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/usage.md#context-files">Context
Files</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7221">#7221</a>
by <a
href="https://github.com/arajkumar"><code>@​arajkumar</code></a>).</li>
<li>Fixed llama.cpp streamed responses reporting zero token usage and
leaving session context accounting empty. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/llama-cpp.md">llama.cpp</a>
(<a
href="https://redirect.github.com/earendil-works/pi/pull/7258">#7258</a>
by <a
href="https://github.com/SteveImmanuel"><code>@​SteveImmanuel</code></a>).</li>
<li>Fixed session replacement and committed tree navigation during an
active response to abort and persist the outgoing turn instead of
leaving dangling tool calls. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/usage.md#sessions">Sessions</a>
(<a
href="https://redirect.github.com/earendil-works/pi/pull/7022">#7022</a>
by <a
href="https://github.com/tmustier"><code>@​tmustier</code></a>).</li>
<li>Fixed failed Git package installs leaving partial directories that
blocked clean retries. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/packages.md#install-and-manage">Install
and Manage</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7210">#7210</a>
by <a
href="https://github.com/haoqixu"><code>@​haoqixu</code></a>).</li>
<li>Fixed the <code>/model</code> selector retaining a stale selection
while filtering instead of highlighting the top match (<a
href="https://redirect.github.com/earendil-works/pi/pull/7211">#7211</a>
by <a
href="https://github.com/christianbasch"><code>@​christianbasch</code></a>).</li>
<li>Fixed direct RPC bash commands bypassing extension
<code>user_bash</code> handlers. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/extensions.md#user-bash-events">User
Bash Events</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7214">#7214</a>).</li>
<li>Fixed skills, prompts, and themes losing package source metadata
after extensions reload resources. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/extensions.md#resource-events">Resource
Events</a> (<a
href="https://redirect.github.com/earendil-works/pi/issues/6968">#6968</a>).</li>
<li>Fixed cancellation of concurrently running user bash commands so
every active command is aborted (<a
href="https://redirect.github.com/earendil-works/pi/pull/7103">#7103</a>
by <a
href="https://github.com/yzhg1983"><code>@​yzhg1983</code></a>).</li>
<li>Fixed duplicate messages appearing when extensions switch sessions
during interactive startup (<a
href="https://redirect.github.com/earendil-works/pi/pull/7110">#7110</a>
by <a
href="https://github.com/yzhg1983"><code>@​yzhg1983</code></a>).</li>
<li>Fixed inherited Qwen Token Plan reasoning models to send their
service-specific thinking controls and supported reasoning-effort levels
(<a
href="https://redirect.github.com/earendil-works/pi/issues/6951">#6951</a>,
<a
href="https://redirect.github.com/earendil-works/pi/issues/6998">#6998</a>).</li>
<li>Fixed inherited Z.AI output limits being sent through an unsupported
parameter. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/providers.md">Providers</a>
(<a
href="https://redirect.github.com/earendil-works/pi/pull/7174">#7174</a>
by <a
href="https://github.com/HyeokjaeLee"><code>@​HyeokjaeLee</code></a>).</li>
<li>Fixed explicitly configured Amazon Bedrock profiles being overridden
by ambient AWS access keys. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/providers.md#amazon-bedrock">Amazon
Bedrock</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7176">#7176</a>
by <a
href="https://github.com/christianbasch"><code>@​christianbasch</code></a>).</li>
<li>Fixed inherited image fallback paths overflowing narrow terminals,
shortened home-directory paths, and made absolute paths clickable when
terminal hyperlinks are available (<a
href="https://redirect.github.com/earendil-works/pi/pull/7262">#7262</a>).</li>
<li>Fixed inherited OpenAI-compatible tool calls losing their function
arguments when malformed deltas also contain an empty
<code>custom</code> object (<a
href="https://redirect.github.com/earendil-works/pi/pull/7288">#7288</a>
by <a
href="https://github.com/sunnyyoung"><code>@​sunnyyoung</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/CHANGELOG.md">@​earendil-works/pi-coding-agent's
changelog</a>.</em></p>
<blockquote>
<h2>[0.83.0] - 2026-07-29</h2>
<h3>New Features</h3>
<ul>
<li><strong>Credential export for external clients</strong> — <code>pi
auth print-api-key</code> and <code>pi auth print-bearer-token</code>
export configured credentials with automatic OAuth refresh and
minimum-validity enforcement.</li>
<li><strong>Headless OpenRouter sign-in</strong> — Complete
<code>/login</code> over SSH by pasting the redirect URL or
authorization code when the loopback callback is unavailable. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#openrouter">OpenRouter</a>.</li>
<li><strong>Claude Opus 5 on GitHub Copilot</strong> — Use Claude Opus 5
through GitHub Copilot with adaptive thinking and a 1M context window.
See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#github-copilot">GitHub
Copilot</a>.</li>
</ul>
<h3>Breaking Changes</h3>
<ul>
<li>Upgraded bundled TypeBox aliases to 1.3.7, removing deprecated APIs
including <code>Type.Base</code>, <code>Type.Awaited</code>,
<code>Type.Promise</code>, <code>Type.AsyncIterator</code>,
<code>Type.Iterator</code>, <code>Type.Options</code>, and
<code>Value.Mutate</code>, while fixing compiled validation of nullable
array tool arguments. Extensions using removed APIs must migrate to
supported TypeBox APIs. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/packages.md#dependencies">Package
Dependencies</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7243">#7243</a>
by <a
href="https://github.com/petrroll"><code>@​petrroll</code></a>).</li>
</ul>
<h3>Added</h3>
<ul>
<li>Added <code>pi auth print-api-key</code> and <code>pi auth
print-bearer-token</code> commands for exporting configured credentials
to external clients, including automatic OAuth refresh and configurable
minimum token validity (<a
href="https://redirect.github.com/earendil-works/pi/pull/7168">#7168</a>).</li>
<li>Exposed the session's resolved model scope as
<code>ctx.scopedModels</code> to extensions. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/extensions.md#ctxmodelregistry--ctxmodel--ctxthinkinglevel--ctxscopedmodels">Extension
Context</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7191">#7191</a>
by <a href="https://github.com/pungggi"><code>@​pungggi</code></a>, <a
href="https://redirect.github.com/earendil-works/pi/pull/7215">#7215</a>).</li>
<li>Added inherited per-request <code>fetch</code> injection for
supported text and image provider transports.</li>
<li>Added the inherited <code>&quot;pending&quot;</code> stop reason for
partial streaming messages. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/custom-provider.md#stream-pattern">Custom
Provider Stream Pattern</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7151">#7151</a>
by <a
href="https://github.com/lucasmeijer"><code>@​lucasmeijer</code></a>).</li>
<li>Added inherited raw provider stop reasons across Google, Anthropic,
Amazon Bedrock, Mistral, and OpenAI streams; unmapped terminal reasons
now surface as provider errors instead of successful stops (<a
href="https://redirect.github.com/earendil-works/pi/pull/7272">#7272</a>).</li>
<li>Added manual redirect URL and authorization-code entry to OpenRouter
login for remote and headless environments. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#openrouter">OpenRouter</a>
(<a
href="https://redirect.github.com/earendil-works/pi/pull/7114">#7114</a>
by <a
href="https://github.com/rgarcia"><code>@​rgarcia</code></a>).</li>
<li>Added inherited Claude Opus 5 support for GitHub Copilot with
adaptive thinking and a 1M context window. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#github-copilot">GitHub
Copilot</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7158">#7158</a>
by <a
href="https://github.com/jay-aye-see-kay"><code>@​jay-aye-see-kay</code></a>).</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Changed inherited OAuth credential resolution to refresh tokens with
less than five minutes of validity remaining instead of waiting until
expiration (<a
href="https://redirect.github.com/earendil-works/pi/pull/7168">#7168</a>).</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Added a status line when the tool output expansion is toggled (<a
href="https://redirect.github.com/earendil-works/pi/issues/7180">#7180</a>).</li>
<li>Fixed file-backed <code>SYSTEM.md</code> and
<code>APPEND_SYSTEM.md</code> prompts being omitted from the interactive
startup context listing. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/usage.md#system-prompt-files">System
Prompt Files</a> (<a
href="https://redirect.github.com/earendil-works/pi/issues/7096">#7096</a>).</li>
<li>Fixed context files loading twice when a linked Git worktree is
nested under its main repository. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/usage.md#context-files">Context
Files</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7221">#7221</a>
by <a
href="https://github.com/arajkumar"><code>@​arajkumar</code></a>).</li>
<li>Fixed llama.cpp streamed responses reporting zero token usage and
leaving session context accounting empty. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/llama-cpp.md">llama.cpp</a>
(<a
href="https://redirect.github.com/earendil-works/pi/pull/7258">#7258</a>
by <a
href="https://github.com/SteveImmanuel"><code>@​SteveImmanuel</code></a>).</li>
<li>Fixed session replacement and committed tree navigation during an
active response to abort and persist the outgoing turn instead of
leaving dangling tool calls. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/usage.md#sessions">Sessions</a>
(<a
href="https://redirect.github.com/earendil-works/pi/pull/7022">#7022</a>
by <a
href="https://github.com/tmustier"><code>@​tmustier</code></a>).</li>
<li>Fixed failed Git package installs leaving partial directories that
blocked clean retries. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/packages.md#install-and-manage">Install
and Manage</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7210">#7210</a>
by <a
href="https://github.com/haoqixu"><code>@​haoqixu</code></a>).</li>
<li>Fixed the <code>/model</code> selector retaining a stale selection
while filtering instead of highlighting the top match (<a
href="https://redirect.github.com/earendil-works/pi/pull/7211">#7211</a>
by <a
href="https://github.com/christianbasch"><code>@​christianbasch</code></a>).</li>
<li>Fixed direct RPC bash commands bypassing extension
<code>user_bash</code> handlers. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/extensions.md#user-bash-events">User
Bash Events</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7214">#7214</a>).</li>
<li>Fixed skills, prompts, and themes losing package source metadata
after extensions reload resources. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/extensions.md#resource-events">Resource
Events</a> (<a
href="https://redirect.github.com/earendil-works/pi/issues/6968">#6968</a>).</li>
<li>Fixed cancellation of concurrently running user bash commands so
every active command is aborted (<a
href="https://redirect.github.com/earendil-works/pi/pull/7103">#7103</a>
by <a
href="https://github.com/yzhg1983"><code>@​yzhg1983</code></a>).</li>
<li>Fixed duplicate messages appearing when extensions switch sessions
during interactive startup (<a
href="https://redirect.github.com/earendil-works/pi/pull/7110">#7110</a>
by <a
href="https://github.com/yzhg1983"><code>@​yzhg1983</code></a>).</li>
<li>Fixed inherited Qwen Token Plan reasoning models to send their
service-specific thinking controls and supported reasoning-effort levels
(<a
href="https://redirect.github.com/earendil-works/pi/issues/6951">#6951</a>,
<a
href="https://redirect.github.com/earendil-works/pi/issues/6998">#6998</a>).</li>
<li>Fixed inherited Z.AI output limits being sent through an unsupported
parameter. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md">Providers</a>
(<a
href="https://redirect.github.com/earendil-works/pi/pull/7174">#7174</a>
by <a
href="https://github.com/HyeokjaeLee"><code>@​HyeokjaeLee</code></a>).</li>
<li>Fixed explicitly configured Amazon Bedrock profiles being overridden
by ambient AWS access keys. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#amazon-bedrock">Amazon
Bedrock</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7176">#7176</a>
by <a
href="https://github.com/christianbasch"><code>@​christianbasch</code></a>).</li>
<li>Fixed inherited image fallback paths overflowing narrow terminals,
shortened home-directory paths, and made absolute paths clickable when
terminal hyperlinks are available (<a
href="https://redirect.github.com/earendil-works/pi/pull/7262">#7262</a>).</li>
<li>Fixed inherited OpenAI-compatible tool calls losing their function
arguments when malformed deltas also contain an empty
<code>custom</code> object (<a
href="https://redirect.github.com/earendil-works/pi/pull/7288">#7288</a>
by <a
href="https://github.com/sunnyyoung"><code>@​sunnyyoung</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/earendil-works/pi/commit/845d6ff1f6643aba440341cce877ce1c43ebbc39"><code>845d6ff</code></a>
Release v0.83.0</li>
<li><a
href="https://github.com/earendil-works/pi/commit/f0499a63ff5563ff041c689f680ecbf01436a5e2"><code>f0499a6</code></a>
docs: audit changelogs since v0.82.1</li>
<li><a
href="https://github.com/earendil-works/pi/commit/bff5ab71743b442efa234dbed369e0a96da791f3"><code>bff5ab7</code></a>
fix(coding-agent): show system prompt files in startup context (<a
href="https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent/issues/7266">#7266</a>)</li>
<li><a
href="https://github.com/earendil-works/pi/commit/cced6a21da273b26ee4a23a803680614bbe8dd1e"><code>cced6a2</code></a>
fix(coding-agent): stop loading AGENTS.md twice in nested git worktrees
(<a
href="https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent/issues/7221">#7221</a>)</li>
<li><a
href="https://github.com/earendil-works/pi/commit/f9476a61e557bfdce2fbf3ffeaad0988fe47c184"><code>f9476a6</code></a>
fix(ai): update TypeBox nullable array validation (<a
href="https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent/issues/7243">#7243</a>)</li>
<li><a
href="https://github.com/earendil-works/pi/commit/0c32e83a352a4284133b2544f730a23814948ac3"><code>0c32e83</code></a>
fix(coding-agent): enable streaming usage for llama.cpp provider (<a
href="https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent/issues/7258">#7258</a>)</li>
<li><a
href="https://github.com/earendil-works/pi/commit/47ca25fcd8535b80710fad5be758f1f2cf81443c"><code>47ca25f</code></a>
Revert &quot;fix(coding-agent): build-check-test (<a
href="https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent/issues/7206">#7206</a>)&quot;</li>
<li><a
href="https://github.com/earendil-works/pi/commit/0d008b746892ad33d3fe15c0c4bc86a14369e0e8"><code>0d008b7</code></a>
fix(coding-agent): show tool expansion status</li>
<li><a
href="https://github.com/earendil-works/pi/commit/f14519551682cd0fddac2e4b4e8b1f333667e94c"><code>f145195</code></a>
fix(coding-agent): build-check-test (<a
href="https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent/issues/7206">#7206</a>)</li>
<li><a
href="https://github.com/earendil-works/pi/commit/cefa40ed8f8dbcd6ffd67b5e7a0eaa75a5050d1a"><code>cefa40e</code></a>
***WIP it's a PoC *** fix(coding-agent): guard tree navigation during
respons...</li>
<li>Additional commits viewable in <a
href="https://github.com/earendil-works/pi/commits/v0.83.0/packages/coding-agent">compare
view</a></li>
</ul>
</details>
<br />

Updates `eve` from 0.27.13 to 0.29.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/eve/releases">eve's
releases</a>.</em></p>
<blockquote>
<h2>eve@0.29.5</h2>
<h3>Patch Changes</h3>
<ul>
<li>c0dc572: Rename the TUI <code>/new</code> command to
<code>/reset</code> so session reset uses the same name across the
client, HTTP, channel, and TUI APIs.</li>
<li>3dce30a: Add manual session compaction through custom-channel
helpers, the eve HTTP client, and the <code>eve dev</code> TUI's
<code>/compact</code> command. Compaction preserves the session, queues
behind an active turn, and does not send synthetic model input.</li>
<li>910805e: Make a single <code>Esc</code> cancel the running turn in
the eve dev TUI when no message is queued. Queued messages still use
<code>Esc</code> to steer the oldest message into the next turn.</li>
<li>9c51755: Connection search and discovered connection tools now use
the same <code>defineDynamic</code> and <code>defineTool</code> pipeline
as authored tools. Dynamic tool maps now reject entries that omit
<code>defineTool</code> instead of accepting unsupported raw
objects.</li>
<li>84aa671: Clarify the dev TUI’s <code>/add</code> flow with
consistent integration categories and category-specific browsing labels.
MCP connections are now named explicitly, and the flow more clearly
explains channels, extensions, and observability integrations.</li>
<li>0c28eb7: Allow declared subagents to export
<code>defineDynamic</code> from <code>agent.ts</code>. Session and turn
resolvers can now return an agent configuration to expose it or nil to
omit it from direct and Workflow delegation.</li>
<li>f3bb60d: Add manual session-context clearing through custom-channel
helpers, the eve HTTP client, and the <code>eve dev</code> TUI's
<code>/clear</code> command. Clearing removes model-message history
while preserving the session, agent configuration, durable state,
limits, and sandbox.</li>
<li>ac7d3c6: Add <code>/cancel</code> to the eve dev TUI. The command
cooperatively cancels a running turn from either the live streaming
input or the idle prompt while preserving the session and settled
context.</li>
</ul>
<h2>eve@0.29.4</h2>
<h3>Patch Changes</h3>
<ul>
<li>e90a8c2: Launch local or deployed eve applications as stable ACP v1
agents with <code>eve acp [url]</code>, including streamed messages,
tool activity, human input, cancellation, concurrent sessions, and
verified Vercel authentication.</li>
<li>cec672d: Add guided Discord setup through <code>eve add
channel/discord</code>, including Vercel Connect provisioning, trigger
attachment, interactions endpoint configuration, slash-command
registration, and channel scaffolding.</li>
<li>ed328e7: Render registry item titles with their exact
registry-provided casing by loading manifests for each page of catalog
results.</li>
<li>c875a67: Update the generated <code>AGENTS.md</code> to direct
coding agents to the eve registry for discovering and installing
integrations.</li>
<li>5153b13: Add JSON output to <code>eve registry list</code> and
<code>eve registry search</code> for scripts that inspect registry
catalogs.</li>
<li>155d46a: Connection registry items now configure their Vercel
Connect connector during <code>eve add</code>, and registry setup
commands close their IPC channel after reporting an outcome so
<code>/add</code> returns instead of remaining stuck.</li>
<li>6f3daca: Add <code>ClientSession.snapshot()</code> for reading a
finite, cursor-consistent session event prefix that can hydrate
server-rendered applications.</li>
<li>67bfc76: Resolve sandbox skill roots and seed-file paths through the
same <code>$HOME</code> resolver the file tools use, so the skills
location is spelled once instead of twice.</li>
<li>a5acde8: Ensure exiting the dev TUI shuts down its owned server and
any surviving workflow processes before the CLI exits. Persisted
workflow messages now reach the ready worker during restart instead of
being rejected while the file watcher starts.</li>
<li>731464f: Give the local trace spool's on-disk layout a single owner:
the shared trace reader now exposes the listing and segment-read
primitives that <code>eve traces</code> and the <code>/traces</code>
viewer both use, and payload formatting is shared between the detail
panel and the conversation view.</li>
<li>f7ba3b3: Derive the <code>/traces</code> conversation viewer's line
geometry from one prefix-sum helper so scroll, click, and wheel math
cannot disagree, and reset the view through a single factory when the
viewed trace changes.</li>
<li>3f4bb9c: The <code>/traces</code> viewer now follows your terminal's
colors instead of forcing a hardcoded black/grey truecolor palette. It
probes the terminal's default background (OSC 11) and derives its card
surfaces from your own theme — subtly elevated bands on dark and light
backgrounds alike, with red bands for failures, and card titles that
invert to black on light backgrounds so they stay legible. Terminals
that don't answer the probe get a clean gutter-rail rendering drawn
entirely with the shared TUI theme.</li>
<li>f5d0533: Derive the dev TUI's slash-command suggestion window from
the command registry instead of a hand-maintained constant, and collapse
the duplicated cursor step in the terminal line-wrap loop.</li>
</ul>
<h2>eve@0.29.3</h2>
<h3>Patch Changes</h3>
<ul>
<li>22bfa02: Add guided Photon setup through <code>eve add
channel/photon-imessage</code>, including project creation, phone
registration, Vercel Connect or portable credentials, and channel
scaffolding.</li>
<li>0c0de19: Add an opt-in experimental steering policy to Chat SDK
sends that cancels an active turn before delivering its replacement
message.</li>
<li>b00a79d: Add <code>photonIMessageChannel</code>, a first-class
Photon iMessage channel with lazy credentials, Vercel OIDC webhook
verification, and automatic eve session routing.</li>
<li>495e93b: Resolve leading <code>$HOME</code> paths in the built-in
<code>read_file</code>, <code>write_file</code>, <code>glob</code>, and
<code>grep</code> tools so agents can directly access packaged skill
references advertised in their prompt.</li>
<li>bf01952: Local trace spans now capture model and tool payloads: the
system prompt, prompt messages, and response text/reasoning/tool calls
on model spans, and call arguments/results on tool spans, each capped at
32 KB with provider transport metadata stripped. Set
<code>EVE_TRACES_CONTENT=off</code> to keep payloads out of the
spool.</li>
<li>680db59: Provider-executed tool calls (like a gateway's
<code>web_search</code>) now show up in local traces: their calls and
results are captured on the model span and the <code>/traces</code>
viewer renders them as tool cards, with oversized outputs truncated to
stay valid JSON.</li>
<li>7ab6d8a: Terminal text wrapping in the dev TUI is now linear-time,
so views rendering large single-line payloads (long tool results, big
JSON) no longer stall on every repaint.</li>
<li>52cee9c: Consolidate the three Vercel CLI subprocess runners onto
one shared lifecycle. A <code>vercel</code> lookup killed by a signal
(for example Ctrl-C during setup) now reports a cancellation failure
instead of resolving as a success with truncated output.</li>
<li>7703448: The local trace spool reader behind <code>eve traces</code>
moved into a shared internal module; command behavior is unchanged.</li>
<li>2d87acb: Subagent turn spans now record the dispatch that created
them —
<code>agent.parent.session.id</code>, <code>agent.parent.turn.id</code>,
<code>agent.parent.call_id</code>, and
<code>agent.subagent.name</code> — so a parent turn that fans out to
several children can
be attributed to the exact tool call behind each one.</li>
<li>3c846bc: The <code>/traces</code> viewer supports drag-to-select:
dragging with the mouse highlights text and releasing copies it to the
clipboard (OSC 52 with tmux passthrough, plus the platform clipboard
command) with a confirmation toast. Clicks now act on release so drags
never toggle cards, and Esc cancels an in-flight selection.</li>
<li>3645c6e: The <code>/traces</code> viewer frame breathes: padding
rows around the title and above the footer hints, the copy toast floats
top-right as a small surface with a left edge bar, and the scroll wheel
scrolls the attributes drawer when the pointer is over it.</li>
<li>8858403: The local tracing subsystem (spool writer/reader,
retention, the zero-config local OTel runtime, and agent span capture)
moved from <code>src/harness</code> into its own
<code>src/tracing</code> module; no behavior change.</li>
<li>9adb455: Adds a <code>/traces</code> command to the dev TUI: a
full-screen live viewer over the local trace spool that re-tells each
trace as a chat-style conversation — system prompt, user and assistant
messages, and tool calls render as expandable cards (arrow keys or mouse
click to expand/collapse), with a right-side metadata drawer. Subagent
turns are badged with their dispatch lineage
(<code>subagent:&lt;name&gt;</code>), and the viewer opens on the trace
containing the current session — including windowed sessions and
subagent children recorded into a parent's trace. Expanded cards scroll
line-by-line so content taller than the viewport is fully readable.
Model spans with errors, token usage, or tool calls (but no text) now
appear as cards instead of disappearing. Terminal escape sequences in
trace payloads are stripped at render time. Tool-call arguments and
results are captured without stripping domain-level
<code>providerOptions</code>/<code>providerMetadata</code> keys. A
single prompt message over 32 KiB is truncated at the text level so the
serialized JSON stays parseable. Local spans capture system prompt,
prompt messages, responses, reasoning, and tool arguments/results
(<code>EVE_TRACES_CONTENT=off</code> to disable); long conversations
truncate oldest messages first with an omission marker.</li>
<li>275271d: Subagent runs now record into the trace of the session that
dispatched them instead of a disconnected trace of their own, and
<code>eve traces</code> resolves either session id to it. Local traces
also open a real <code>agent.session</code> root span rather than a
synthesized parent, so an authored OTel sampler's root rule decides
whether a session is sampled, and a session long enough to outgrow one
trace rolls into numbered windows that <code>eve traces
&lt;session-id&gt;</code> lists oldest first. Rows whose lifetime
outlives the worker that opened them — <code>agent.session</code> and
<code>agent.turn</code> — now show the extent of their descendants
instead of <code>0ms</code>.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/eve/blob/main/packages/eve/CHANGELOG.md">eve's
changelog</a>.</em></p>
<blockquote>
<h2>0.29.5</h2>
<h3>Patch Changes</h3>
<ul>
<li>c0dc572: Rename the TUI <code>/new</code> command to
<code>/reset</code> so session reset uses the same name across the
client, HTTP, channel, and TUI APIs.</li>
<li>3dce30a: Add manual session compaction through custom-channel
helpers, the eve HTTP client, and the <code>eve dev</code> TUI's
<code>/compact</code> command. Compaction preserves the session, queues
behind an active turn, and does not send synthetic model input.</li>
<li>910805e: Make a single <code>Esc</code> cancel the running turn in
the eve dev TUI when no message is queued. Queued messages still use
<code>Esc</code> to steer the oldest message into the next turn.</li>
<li>9c51755: Connection search and discovered connection tools now use
the same <code>defineDynamic</code> and <code>defineTool</code> pipeline
as authored tools. Dynamic tool maps now reject entries that omit
<code>defineTool</code> instead of accepting unsupported raw
objects.</li>
<li>84aa671: Clarify the dev TUI’s <code>/add</code> flow with
consistent integration categories and category-specific browsing labels.
MCP connections are now named explicitly, and the flow more clearly
explains channels, extensions, and observability integrations.</li>
<li>0c28eb7: Allow declared subagents to export
<code>defineDynamic</code> from <code>agent.ts</code>. Session and turn
resolvers can now return an agent configuration to expose it or nil to
omit it from direct and Workflow delegation.</li>
<li>f3bb60d: Add manual session-context clearing through custom-channel
helpers, the eve HTTP client, and the <code>eve dev</code> TUI's
<code>/clear</code> command. Clearing removes model-message history
while preserving the session, agent configuration, durable state,
limits, and sandbox.</li>
<li>ac7d3c6: Add <code>/cancel</code> to the eve dev TUI. The command
cooperatively cancels a running turn from either the live streaming
input or the idle prompt while preserving the session and settled
context.</li>
</ul>
<h2>0.29.4</h2>
<h3>Patch Changes</h3>
<ul>
<li>e90a8c2: Launch local or deployed eve applications as stable ACP v1
agents with <code>eve acp [url]</code>, including streamed messages,
tool activity, human input, cancellation, concurrent sessions, and
verified Vercel authentication.</li>
<li>cec672d: Add guided Discord setup through <code>eve add
channel/discord</code>, including Vercel Connect provisioning, trigger
attachment, interactions endpoint configuration, slash-command
registration, and channel scaffolding.</li>
<li>ed328e7: Render registry item titles with their exact
registry-provided casing by loading manifests for each page of catalog
results.</li>
<li>c875a67: Update the generated <code>AGENTS.md</code> to direct
coding agents to the eve registry for discovering and installing
integrations.</li>
<li>5153b13: Add JSON output to <code>eve registry list</code> and
<code>eve registry search</code> for scripts that inspect registry
catalogs.</li>
<li>155d46a: Connection registry items now configure their Vercel
Connect connector during <code>eve add</code>, and registry setup
commands close their IPC channel after reporting an outcome so
<code>/add</code> returns instead of remaining stuck.</li>
<li>6f3daca: Add <code>ClientSession.snapshot()</code> for reading a
finite, cursor-consistent session event prefix that can hydrate
server-rendered applications.</li>
<li>67bfc76: Resolve sandbox skill roots and seed-file paths through the
same <code>$HOME</code> resolver the file tools use, so the skills
location is spelled once instead of twice.</li>
<li>a5acde8: Ensure exiting the dev TUI shuts down its owned server and
any surviving workflow processes before the CLI exits. Persisted
workflow messages now reach the ready worker during restart instead of
being rejected while the file watcher starts.</li>
<li>731464f: Give the local trace spool's on-disk layout a single owner:
the shared trace reader now exposes the listing and segment-read
primitives that <code>eve traces</code> and the <code>/traces</code>
viewer both use, and payload formatting is shared between the detail
panel and the conversation view.</li>
<li>f7ba3b3: Derive the <code>/traces</code> conversation viewer's line
geometry from one prefix-sum helper so scroll, click, and wheel math
cannot disagree, and reset the view through a single factory when the
viewed trace changes.</li>
<li>3f4bb9c: The <code>/traces</code> viewer now follows your terminal's
colors instead of forcing a hardcoded black/grey truecolor palette. It
probes the terminal's default background (OSC 11) and derives its card
surfaces from your own theme — subtly elevated bands on dark and light
backgrounds alike, with red bands for failures, and card titles that
invert to black on light backgrounds so they stay legible. Terminals
that don't answer the probe get a clean gutter-rail rendering drawn
entirely with the shared TUI theme.</li>
<li>f5d0533: Derive the dev TUI's slash-command suggestion window from
the command registry instead of a hand-maintained constant, and collapse
the duplicated cursor step in the terminal line-wrap loop.</li>
</ul>
<h2>0.29.3</h2>
<h3>Patch Changes</h3>
<ul>
<li>22bfa02: Add guided Photon setup through <code>eve add
channel/photon-imessage</code>, including project creation, phone
registration, Vercel Connect or portable credentials, and channel
scaffolding.</li>
<li>0c0de19: Add an opt-in experimental steering policy to Chat SDK
sends that cancels an active turn before delivering its replacement
message.</li>
<li>b00a79d: Add <code>photonIMessageChannel</code>, a first-class
Photon iMessage channel with lazy credentials, Vercel OIDC webhook
verification, and automatic eve session routing.</li>
<li>495e93b: Resolve leading <code>$HOME</code> paths in the built-in
<code>read_file</code>, <code>write_file</code>, <code>glob</code>, and
<code>grep</code> tools so agents can directly access packaged skill
references advertised in their prompt.</li>
<li>bf01952: Local trace spans now capture model and tool payloads: the
system prompt, prompt messages, and response text/reasoning/tool calls
on model spans, and call arguments/results on tool spans, each capped at
32 KB with provider transport metadata stripped. Set
<code>EVE_TRACES_CONTENT=off</code> to keep payloads out of the
spool.</li>
<li>680db59: Provider-executed tool calls (like a gateway's
<code>web_search</code>) now show up in local traces: their calls and
results are captured on the model span and the <code>/traces</code>
viewer renders them as tool cards, with oversized outputs truncated to
stay valid JSON.</li>
<li>7ab6d8a: Terminal text wrapping in the dev TUI is now linear-time,
so views rendering large single-line payloads (long tool results, big
JSON) no longer stall on every repaint.</li>
<li>52cee9c: Consolidate the three Vercel CLI subprocess runners onto
one shared lifecycle. A <code>vercel</code> lookup killed by a signal
(for example Ctrl-C during setup) now reports a cancellation failure
instead of resolving as a success with truncated output.</li>
<li>7703448: The local trace spool reader behind <code>eve traces</code>
moved into a shared internal module; command behavior is unchanged.</li>
<li>2d87acb: Subagent turn spans now record the dispatch that created
them —
<code>agent.parent.session.id</code>, <code>agent.parent.turn.id</code>,
<code>agent.parent.call_id</code>, and
<code>agent.subagent.name</code> — so a parent turn that fans out to
several children can
be attributed to the exact tool call behind each one.</li>
<li>3c846bc: The <code>/traces</code> viewer supports drag-to-select:
dragging with the mouse highlights text and releasing copies it to the
clipboard (OSC 52 with tmux passthrough, plus the platform clipboard
command) with a confirmation toast. Clicks now act on release so drags
never toggle cards, and Esc cancels an in-flight selection.</li>
<li>3645c6e: The <code>/traces</code> viewer frame breathes: padding
rows around the title and above the footer hints, the copy toast floats
top-right as a small surface with a left edge bar, and the scroll wheel
scrolls the attributes drawer when the pointer is over it.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/eve/commit/8988139097d1e1a1f1aca9b2828e63408848fccf"><code>8988139</code></a>
Version Packages (<a
href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1497">#1497</a>)</li>
<li><a
href="https://github.com/vercel/eve/commit/c0dc57240ec850b0f73075f0e3cc900c6e07640a"><code>c0dc572</code></a>
feat(tui): rename /new command to /reset (<a
href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1513">#1513</a>)</li>
<li><a
href="https://github.com/vercel/eve/commit/910805e8a825a34ba90c0a22a59dc1d787967976"><code>910805e</code></a>
feat(tui): cancel with one Esc press (<a
href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1514">#1514</a>)</li>
<li><a
href="https://github.com/vercel/eve/commit/ac7d3c66f8c43ce1008d88cedd5254bfec1301e1"><code>ac7d3c6</code></a>
feat(tui): add /cancel command (<a
href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1512">#1512</a>)</li>
<li><a
href="https://github.com/vercel/eve/commit/f3bb60dd53fa56e955c6ea71cbf72533cfe618e1"><code>f3bb60d</code></a>
feat: add manual session context clearing (<a
href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1511">#1511</a>)</li>
<li><a
href="https://github.com/vercel/eve/commit/3dce30a18d24644d85b6120d79eaf4d304beaf4b"><code>3dce30a</code></a>
feat: add manual session compaction (<a
href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1508">#1508</a>)</li>
<li><a
href="https://github.com/vercel/eve/commit/9c517555e870231af00df799523bffd9fc00df71"><code>9c51755</code></a>
refactor(eve): use public dynamic definitions for connection tools (<a
href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1505">#1505</a>)</li>
<li><a
href="https://github.com/vercel/eve/commit/0c28eb7e886c1a69ee20a5229682509d5413e140"><code>0c28eb7</code></a>
feat(eve): support dynamic subagents (<a
href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1485">#1485</a>)</li>
<li><a
href="https://github.com/vercel/eve/commit/84aa6715dbf6b6d696b7f567744711f4526b183f"><code>84aa671</code></a>
fix(eve): clarify add flow categories (<a
href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1494">#1494</a>)</li>
<li><a
href="https://github.com/vercel/eve/commit/ab86523b3e07f05f415c9c784232b3875b17b16f"><code>ab86523</code></a>
feat(eve): agent-handle lifecycle contracts (three-phase handles, turn
outcom...</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/eve/commits/eve@0.29.5/packages/eve">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-07 16:53:51 +05:30
jkomyno 3639ad29a6 docs(changelog): align free-form object release notes 2026-08-07 00:07:04 +05:30
jkomyno 4a89ff112c fix(json-schema): enforce dynamic object contracts 2026-08-07 00:06:55 +05:30
jkomyno ac6bbabd31 fix(claude-agent-sdk): register complete tool schemas 
The provider registered tools through jsonSchemaToZodShape, which returns only
the per-property map. Root-level constraints -- `additionalProperties`, boolean
or schema-valued, and `patternProperties` -- are structurally unrepresentable in
a raw shape, so they were dropped before the Claude Agent SDK ever saw them:
free-form object arguments lost their content, and an unknown key was silently
stripped from tool input rather than rejected.

Registering the complete object schema fixes both. A tool with no input
parameters keeps its closed root explicitly, since a bare `properties: {}` is
now an open object.

Proven at the real SDK boundary rather than against a mocked `tool()`: the new
suite drives createSdkMcpServer over an in-memory MCP transport and asserts on
the advertised inputSchema and on real tools/call results.
 2026-08-06 21:59:12 +05:30
jkomyno 46ee10eb78 chore(deps): catalog @types/node on the Node 24 line 
Every workspace package now takes @types/node from the catalog instead of
pinning its own major, and an override pulls the transitive copies onto the
same line -- @types/ws and @types/yauzl depend on `@types/node: *`, so
vite/vitest peer-resolved 26 for packages that declare nothing themselves.

Node 26 is not a safe target yet. This also removes the one-off ^24.13.3
devDependency the schema-conversion corpus loaders had added to
@composio/json-schema-to-effect-schema, which was the only package in the
repository typing against a different major.
 2026-08-06 21:44:41 +05:30
jkomyno b7592585dd refactor(json-schema-to-effect-schema): validate through a filter instead of a declaration 
`Schema.declare`, `ParseResult`, and `Either` are all removed or reshaped in
Effect 4, so the converter compiled against three APIs that do not survive the
next major.

Express validation as a filter over `Schema.Unknown` instead: the filter returns
the formatted messages and Effect builds the issue tree, which drops the
hand-constructed `ParseResult.Composite`/`Type` values and the identity encode
half that declarations no longer carry. `Either.try` has no `Result` counterpart
in Effect 4 and both uses were local try/catch in disguise, so they become that.

Reported messages are unchanged: the location stays inside the message, because
`formatIssues` may fan one issue out into several. Tests move to
`decodeUnknownOption`, which keeps its name across both majors.

The CLI keeps `ParseResult.ArrayFormatter` while the repo is on Effect 3.x.
 2026-08-06 21:25:48 +05:30
jkomyno 2e2e71f2b1 chore(json-schema-to-effect-schema): type the corpus loaders against Node 24 
The corpus loaders read their fixture copy with `node:fs`, so both test
tsconfigs now declare `types: ["node"]` — the dependency alone was not enough,
as `@composio/json-schema-to-zod` already had it and still failed to resolve the
builtins. `@types/node` is pinned to the 24.x line that `mise.toml` pins the
runtime to.
 2026-08-06 20:47:23 +05:30
jkomyno 5e57815af1 fix(json-schema): accept and preserve dynamic object content across converters 
Property-less objects (`{ type: "object" }`, `properties: {}`) were being
collapsed to a strict empty object by the Zod converter and given an implicit
`additionalProperties: false` by the Effect converter, so valid free-form
payloads such as METABASE_POST_API_CARD.dataset_query were rejected at the CLI
boundary. `ToolSchema.parse` separately dropped root `patternProperties` and
rejected a schema-valued root `additionalProperties`.

Dynamic keys are now routed to exactly the schemas that apply to them, and the
shared acceptance contract lives in one checked-in corpus with byte-identical
TypeScript and Python copies.
 2026-08-06 20:33:53 +05:30
Alberto Schiabel ecd0861741 fix(core): release unread response bodies (#4078) 
This PR:
- follows [Undici's
recommendation](https://github.com/nodejs/undici#garbage-collection) to
consume or cancel unread response bodies instead of leaving
connection-resource cleanup to the garbage collector, which can increase
connection pressure and reduce reuse
- cancels every intermediate redirect body in `ssrfSafeFetch` before
validating and following the next hop
- cancels non-success response bodies in both URL-upload callers before
preserving their existing errors
- adds regression coverage for redirect ordering, redirect-budget
exhaustion, and both caller error paths
- adds a patch changeset for `@composio/core`
- supersedes https://github.com/ComposioHQ/composio/pull/4018 and
credits @pacocartones as co-author

## Verification

- `pnpm --filter @composio/core test ssrfGuard fileUtils
ToolRouterSessionFilesMount` (4 files, 58 tests passed)
- `pnpm --filter @composio/core test` (47 files, 1,049 tests passed)
- `pnpm --filter @composio/core typecheck`
- `pnpm lint:packages` (0 errors; existing warnings only)
- Prettier check on all touched files
- `pnpm validate:changesets`

Co-authored-by: pacocartones <pacocartones@users.noreply.github.com>
 2026-08-06 17:52:02 +05:30
Rajarshi Datta 2a6a051bc3 refactor(core): remove unused isNewerVersion helper (#4029) 
This PR:

- closes #4028
- removes the unused `isNewerVersion` helper from the internal version
utility
- avoids defining malformed-version behavior for a helper with no
callers or package export
- retains `next`'s tested npm version-check timeout implementation
- adds a patch changeset for `@composio/core`
- refreshes Python 3.12.13 artifact metadata in `mise.lock` after the
upstream build was republished

## Verification

- version utility tests: 2 passed
- core typecheck: passed
- changeset validation: passed
- `mise 2026.5.18 lock --platform
linux-x64,linux-arm64,macos-arm64,macos-x64`: clean

---------

Co-authored-by: jkomyno <alberto@composio.dev>
 2026-08-06 09:32:53 +05:30
jkomyno 86cc3cc399 chore: merge next into dependabot remediation 2026-08-05 21:29:53 +05:30
Alberto Schiabel 1221c15783 fix(core): bound the npm version-check fetch with an AbortSignal timeout (#4027) 
Fixes #4026

## Problem

The `Composio` constructor fires a background npm version check unless
`disableVersionCheck` is set — and `disableVersionCheck` has no default,
so this is on for every user:

```ts
// ts/packages/core/src/composio.ts:399-402
if (!this.config.disableVersionCheck) {
  checkForLatestVersionFromNPM(version);
}
```

That check performed a bare fetch with no timeout and no AbortSignal:

```ts
// ts/packages/core/src/utils/version.ts:46
const response = await fetch(`https://registry.npmjs.org/${packageName}/latest`);
```

An in-flight fetch keeps its socket referenced on the Node event loop.
When registry.npmjs.org is slow, black-holed, or
unreachable-but-accepting (corporate proxy, egress firewall that drops
rather than rejects, captive network, npm incident), the process cannot
exit — all the user's work is done and it just sits there. It's also
called without await, so a caller has nowhere to attach a bound of their
own.

Reproducing with a local server that accepts the socket and never
responds: the process was still alive at 90s and had to be killed.

## Fix

```diff
-    // @TODO: Check if fetch is available, if not use node-fetch
-    const response = await fetch(`https://registry.npmjs.org/${packageName}/latest`);
+    const response = await fetch(`https://registry.npmjs.org/${packageName}/latest`, {
+      signal: AbortSignal.timeout(VERSION_CHECK_TIMEOUT_MS),
+    });
```

`VERSION_CHECK_TIMEOUT_MS = 2000`. The existing `catch (_error) { /*
Ignore and do nothing */ }` already swallows the resulting
`TimeoutError`, so failure stays silent — which is right for a
best-effort nicety nobody awaits. A comment records why the signal is
there so a later cleanup doesn't drop it.

Also removed the stale `@TODO: Check if fetch is available, if not use
node-fetch` on the line above: the code already calls global `fetch`
unconditionally, and `toolchain-versions.json` pins the tested Node
versions to 22/24/25, where both `fetch` and `AbortSignal.timeout` (Node
17.3+) are available.

## Results, and one honest caveat

End-to-end with the issue's reproduction: 91s, exit 124 (killed) →
exited on its own after 6.0s, exit 0.

That 6.0s deserves explanation, because the timeout is 2s and I did not
want to overclaim. Measured in isolation:

```text
fetch rejected at 2.01s with TimeoutError     <- the signal works as intended
handler done at 2.01s
process exited at 6.03s                       <- undici's default 4s keepAliveTimeout
```

So the SDK's wait is bounded at 2s, which is what this change controls.
The trailing ~4s is Node's global undici agent releasing the pooled
socket, outside this code's reach — I tested `connection: 'close'` to
see if it could be shortened and got an identical 6.03s. Eliminating it
would require a custom dispatcher, which isn't worth the complexity for
a background version check. Net: unbounded becomes bounded, worst-case
exit ~6s instead of never.

## Tests

Added `ts/packages/core/test/utils/version.test.ts` with two focused
regressions:

- asserts `AbortSignal.timeout` receives `2_000` and its exact signal is
passed to the registry request
- proves that aborting a registry request that never responds is
swallowed by the best-effort check

The timeout path uses a controlled `AbortController`, so the test is
deterministic and does not wait two seconds of wall-clock time.

## Verification

| Check | Result |
|---|---|
| Focused version-check tests | 2 passed |
| Full core suite | 1046 passed |
| Core typecheck | exit 0 |
| Core build | passed, including ATTW and publint |
| Package lint | exit 0 with existing repository warnings |
| Changeset validation | passed |

## Out of scope — follow-up worth filing

`TelemetryService.sendMetric` / `sendErrorLog`
(`services/telemetry/TelemetryService.ts:14,35`) have the identical
unbounded-fetch shape. Black-holing `telemetry.composio.dev` still hangs
the process indefinitely with this fix applied:

```text
blackhole=[registry]   -> exited after 6.0s
blackhole=[telemetry]  -> HUNG (killed at 45s)
```

I deliberately left it alone: telemetry has its own
`registerExitHandlers`/`flush` machinery that intends to block on exit,
so bounding it is a real design decision rather than a one-liner, and
it's outside what this issue covers. Happy to open a separate issue for
it.

## Notes

- Changeset included (`@composio/core: patch`).
- The Python SDK has no equivalent version check, so no parity change is
needed.
 2026-08-05 21:07:04 +05:30
Rajarshi Datta e0f4a3463c Merge branch 'next' into fix/version-check-fetch-timeout 2026-08-05 19:27:36 +05:30
jkomyno 9a6d59326f Merge branch 'next' into feat/installer-auto-shell-default 
Keeps this branch's fixture-driven managed-block reconciler
(reconcileManagedPathBlock, pinned byte-for-byte against install.sh's awk
rewrite by test/managed-block-fixtures) and drops next's narrower
replaceManagedPathBlock/applyFileChanges pair, which it supersedes.

Adopts from next: the narrowed unsafe-path character set on both the TS and
sh sides, the removal of the $PATH-reachability write skip, the hedged
no-shell PATH message, and the COMPOSIO_BIN_DIR command documentation.
 2026-08-05 19:12:05 +05:30
jkomyno fdb366d090 Merge branch 'feat/cli-install-shell-flag' into feat/mise-style-installer-rollout 
# Conflicts:
#	install.sh
#	test/install-sh-release-resolution.test.sh
#	ts/packages/cli/test/__utils__/services/test-layer.ts
#	ts/packages/cli/test/src/commands/install.cmd.test.ts
 2026-08-04 20:02:22 +05:30
jkomyno 16b167c94a docs(cli): document COMPOSIO_BIN_DIR and the install abort contract 
COMPOSIO_BIN_DIR was discoverable only by reading the changelog: it is
read through a raw ConfigProvider and appeared in no help text. Add it to
the README env-var table with its resolution order, and name it in the
install command description so `composio install --help` mentions it.
No --bin-dir flag: the env var is the right shape for an installer
handoff.

The changelog entry also picks up the behavior changes it was missing —
the non-zero exit on abort and what it means for install.sh's fallback,
both abort conditions, the narrowed character set, legacy-block
migration, and a note for custom-install-dir users reinstalling without
re-specifying COMPOSIO_INSTALL_DIR.
 2026-08-04 19:17:14 +05:30
jkomyno 745bd67cef fix(cli): make composio install reconcile stale managed blocks 
Three changes to the PATH writer, all around the same failure mode: the
command reporting success while leaving a shell unable to find composio.

- The unsafe-path denylist rejected characters that are literal inside
  the double quotes the bin dir is always written in. Keep only what
  bash, zsh, and fish still expand there, plus newline and the PATH
  separator, which are structural. /Users/o'brien/.composio now works.
- A file carrying the marker was treated as configured forever, so the
  legacy three-line block written by install.sh's fallback or by an
  older CLI was never migrated. Skip only on the exact rendered PATH
  line for the resolved bin dir; otherwise splice the current block over
  the stale one in place.
- The reachability skip used the invoking process's $PATH as evidence
  about future shells, so an ad-hoc export or a mise/direnv shim made
  the command persist nothing and exit 0. A redundant PATH line is
  harmless, and the content check already prevents duplicates.

installShellIntegration no longer takes an execPath override; it always
reads NodeProcess, and tests thread their exec path through the test
layer instead.
 2026-08-04 19:16:09 +05:30
Alberto Schiabel 331a1373de Merge branch 'next' into feat/cli-install-shell-flag 2026-08-04 18:25:57 +05:30
jkomyno 4a179f8fdc ci(cli): avoid unavailable installer routes 2026-08-04 18:17:00 +05:30