skills/composiohq__composio
1
0
Fork 0
mirror of https://github.com/ComposioHQ/composio.git synced 2026-09-22 11:46:35 +08:00
Code Issues Packages Projects Releases Wiki Activity
5,039 Commits 338 Branches 1,550 Tags
toolkits-example@0.1.10
Commit Graph

5039 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
jkomyno 1a6ced0220 docs(kb): refresh public support knowledge 2026-08-26 11:20:34 +00:00
Alberto Schiabel 1a059f7c80 ci(docs): degrade KB refresh to artifact-only when upstream token fails (#4250) 
This PR:

- continues past a failed `support-knowledge` token mint instead of
failing the whole KB refresh job
- skips the upstream checkout and sync check when no token could be
minted (treats upstream as unchanged)
- unblocks the staleness-based semantic-artifact rebuild from #4249,
which needs only this repository

## Context

Every scheduled run of `Docs - Update Support Knowledge` since at least
Aug 25 dies at step 1: the release-bot app has no installation on the
internal `ComposioHQ/support-knowledge` repo, so
`create-github-app-token` 404s. The upstream import genuinely needs that
token, but the artifact rebuild does not. Until a human installs the app
on `support-knowledge`, upstream sync stays degraded and this keeps the
artifact-refresh half of the job functional.
 2026-08-26 13:18:32 +02:00
jkomyno f39d37be77 ci(docs): degrade KB refresh to artifact-only when upstream token fails 
Every scheduled run of the KB refresh workflow has failed at the first
step: the release-bot app has no installation on the internal
support-knowledge repository, so the token request 404s and the whole
job dies before anything runs.

The upstream import needs that token, but the stale-artifact rebuild
needs only this repository. Continue past a token failure, skip the
support-knowledge checkout and sync check, and let the staleness-based
rebuild proceed. Upstream sync stays degraded until the app is installed
on support-knowledge.
 2026-08-26 13:18:08 +02:00
Alberto Schiabel 9a60a91874 fix(docs): render KB identifier URLs as code spans, not dead links (#4249) 
This PR:

- Closes #4205 (nightly docs external-link check failing)
- demotes bare identifier URLs — Google OAuth scope URIs
(`googleapis.com/auth/*`) and version-only API roots like
`https://api.ahrefs.com/v3` — to inline code spans in the KB generation
layer (`markdownForMdx`), so they stop publishing as links that 404 by
design
- regenerates the two affected guides (`toolkits-ahrefs`,
`toolkits-googlemeet`); explicit markdown links keep their authored form
- adds a regression test covering the exact URLs from #4205 plus
link/autolink/code-span edge cases
- records the rule in `docs/decisions/public-knowledge-base.md`
- makes the scheduled KB workflow rebuild `docs/kb/semantic-index.json`
when it is stale against the checked-in corpus, not only when the
upstream `support-knowledge` commit moves

## Context

The failing URLs are machine identifiers, not documents — fetching them
404s by design, so no link target could ever satisfy the nightly sweep.
Upstream support prose cites them bare, the generator copied them
verbatim, and GFM autolinks published them as clickable links. Sibling
KB articles already used the backtick convention, confirming the
intended presentation.

`check:kb-semantic` is expected to fail on this PR: 4 embedded record
chunks change, and the artifact rebuild needs `OPENAI_API_KEY`
(CI-owned). After merge, the scheduled job (now staleness-aware)
proposes the artifact refresh PR on `docs/auto-update-kb`; until it
merges, that gate stays red for docs PRs.

Verified locally: `bun run lint:links:external` (the failing nightly
command) — 0 errors; `bun test tests/static/` — 506 pass; `lint:links`,
`generate:kb --check`, `types:check`, `lint` — pass.
 2026-08-26 13:15:34 +02:00
jkomyno b42d3451a7 ci(docs): rebuild stale KB semantic artifact from the scheduled job 
The KB refresh workflow only rebuilt docs/kb/semantic-index.json when the
upstream support-knowledge commit moved, but any docs-side text change
(guide edits, generator updates) invalidates the artifact record hashes
too. The PR-path check:kb-semantic gate then stays red until someone
with OPENAI_API_KEY refreshes the artifact by hand, as 0fb5438c3 did.

The scheduled job now also detects artifact staleness against the
checked-in corpus and rebuilds plus proposes the refresh PR in that case,
reusing cached vectors for unchanged records. Setup and install now run
unconditionally; the upstream import still runs only when the upstream
commit changes.
 2026-08-26 10:48:52 +02:00
Tri 230c7932bc docs: replace hardcoded "1,000+" toolkit counts with the live catalog count (#4247) 
## Problem

The docs hero, feature cards, site metadata, and `llms.txt` /
`llms-full.txt` all hardcoded **"1,000+"** (variously written `1,000+`
and `1000+`) apps. The actual published catalog is **1,327 toolkits** —
the length of the committed `docs/public/data/toolkits-list.json`, which
the `/toolkits` page already renders. The copy was stale and
understated.

## Approach

Reuse the same `toolkits-list.json` the `/toolkits` page reads. A new
server-only helper `docs/lib/toolkit-count.ts` imports it and derives a
rounded-down, human-friendly label:

```ts
const roundedToolkitCount = Math.floor(toolkitsData.length / 100) * 100; // 1327 -> 1300
export const TOOLKIT_COUNT_LABEL = `${roundedToolkitCount.toLocaleString('en-US')}+`; // "1,300+"
```

The count stays correct as the catalog grows, and the locale is pinned
to `en-US` so the grouping separator is always a comma regardless of the
build host's locale (never `1.300+` or `1 300+`).

## Files

Helper (new):
- `docs/lib/toolkit-count.ts`

Six consumers, all server-side (none is a `"use client"` module):
- `docs/components/docs-hero-v2.tsx`
- `docs/components/home-features.tsx`
- `docs/components/home-resources.tsx`
- `docs/app/layout.tsx` (metadata description, OpenGraph, Twitter,
JSON-LD)
- `docs/app/llms.txt/route.ts`
- `docs/app/llms-full.txt/route.ts`

## No client bundle cost

Every importer resolves in a server graph, so the ~1,300-row JSON array
is read at build time only and never ships to the browser.

## Scope / deferred follow-up

Deliberately narrow: no MDX content and no generator scripts are
touched. The remaining ~15 hardcoded literals in MDX frontmatter/prose,
and the meta-tools generator's `"500+"`, are a **deferred follow-up**
and are **not** in this PR.

## Verification

Cross-model (Codex / GPT-5.6) adversarial review: GREEN. Codex ran `bun
run types:check` and a production `next build` in the working tree —
both pass. Locally I confirmed the count (1327 -> "1,300+"), that no
importer is `"use client"`, and that no stray `1000+` / `1,000+` /
`500+` remains in the six files. CI should re-verify typecheck/build.

🤖 Generated with [Claude Code](https://claude.com/claude-code)
 2026-08-25 20:49:52 -04:00
Tridhatri Vallamkondu 4352f210dc docs: replace hardcoded "1,000+" toolkit counts with the live catalog count 
The docs hero, feature cards, site metadata, and llms.txt all hardcoded
"1,000+" apps, while the published catalog is 1,327 toolkits (the length of
docs/public/data/toolkits-list.json, already rendered by the /toolkits page).

Add a server-only helper docs/lib/toolkit-count.ts that imports that same
JSON and exports TOOLKIT_COUNT_LABEL = Math.floor(len/100)*100 -> "1,300+",
with the locale pinned (toLocaleString('en-US')) so the separator is a comma
on any build host. Six server-side files now consume it. No client bundle
cost: none of the importers is a "use client" module, so the JSON never
reaches the browser.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-08-25 20:40:40 -04:00
jkomyno 3fb74d5c98 fix(docs): render KB identifier URLs as code spans, not dead links 
Nightly external-link sweeps (#4205) failed on four KB URLs that are
machine identifiers, not documents: Google OAuth scope URIs
(googleapis.com/auth/meetings.space.*) and Ahrefs API surface roots
(api.ahrefs.com/v3, the wrong-host ahrefs.com/v3). Support prose cites
them bare, the KB generator copied them verbatim, and GFM autolinks
published them as links that 404 by design — unfixable by pointing them
anywhere.

The generation layer now demotes bare citations and <url> autolinks of
these identifier shapes to inline code spans, matching the convention
sibling KB articles already use. Explicit markdown links keep their
authored form. Regenerated the two affected guides.

Verified: bun run test (506 pass), bun run lint:links,
bun run lint:links:external (0 errors — the failing nightly command),
bun run types:check, bun run generate:kb --check.

Follow-up: docs/kb/semantic-index.json needs a rebuild with
OPENAI_API_KEY (bun run build:kb-semantic) because four embedded record
chunks changed.
 2026-08-26 01:22:52 +02:00
sdkrelease[bot] 1fe2fe30cc docs: update guides for SDK changes (#4105) 
## Summary
Automated docs update triggered by SDK source changes on `next`.

- Claude reviewed the SDK diff and updated guides, FAQs, or examples
  that reference changed APIs or features.
- The docs `@composio/*` dependencies were realigned to their latest
  published releases so Twoslash snippets and example apps validate
  against versions users can actually install.

## Review checklist
- [ ] Changes accurately reflect the new SDK behavior
- [ ] No unrelated docs were modified
- [ ] Code examples are correct and complete
- [ ] If a documented feature is not published yet, the Twoslash build
      will fail — wait for the release instead of working around it

Generated by Claude Code via GitHub Actions.

---------

Co-authored-by: jkomyno <12381818+jkomyno@users.noreply.github.com>
Co-authored-by: jkomyno <alberto@composio.dev>
 2026-08-26 00:23:02 +02:00
Alberto Schiabel 18944df9eb fix(cli): verify codex-acp tarballs against the lockfile before packaging them (#4217) 
# Description

Found by the scheduled security audit while reviewing the CLI release
pipeline.

`ts/packages/cli/scripts/_acp-adapters.ts` downloads four
`@zed-industries/codex-acp-<platform>` tarballs directly from the
registry at release-build time — it has to, because `pnpm` only installs
the optional dependency matching the runner's own platform while the
archive must name all four. Those bytes were then extracted, `chmod
0755`'d, and packaged inside the published `composio` CLI archive
**without being checked against any known hash**.

That made the codex-acp binaries the one dependency in the release that
received none of the integrity verification `pnpm install
--frozen-lockfile` applies to everything else, despite `pnpm-lock.yaml`
already pinning a `sha512` for each of them:

```
'@zed-industries/codex-acp-linux-x64@0.16.0':
  resolution: {integrity: sha512-xs5zZBLpJuciEbZNx6ZSNL0qCa9h3i/zWpj40sp6QtF+L4Ow/7qzHdBzboGhHdcz1jrLedfZeRFDA2Elj8TLMA==}
```

Distribution is `curl -fsSL https://composio.dev/install | sh`, so
anything that reached those bytes between the registry and the archive
would ship executable to every CLI user inside an otherwise-signed
release.

## What changed

New `scripts/_tarball-integrity.ts`:

- `parseLockfileIntegrity` — maps every `name@version` in
`pnpm-lock.yaml` to its recorded hash. Line-based rather than a YAML
parse: the shape being read is two adjacent lines, and this keeps a
build script free of a YAML dependency.
- `expectedIntegrityFor` — returns the pinned hash, and **throws** for a
package the lockfile never resolved.
- `assertBytesMatchIntegrity` — Web Crypto digest compared against the
pinned value; the algorithm is read from the expected string so a
lockfile that moves off sha512 keeps working.
- `findLockfilePath` / `loadLockfileIntegrity` — walk up from the script
rather than resolving a fixed `../../..`.

`_acp-adapters.ts` now looks the hash up *before* the download and
verifies the archive bytes before extracting them.

Two deliberate choices:

- **Checked against the lockfile, not the registry's `dist.integrity`**
— whoever can serve the tarball can serve the metadata that vouches for
it.
- **Fail-closed throughout** — a missing lockfile, or a package absent
from it, aborts the build rather than packaging unverified bytes.

Scope is limited to the integrity gap. The `@zed-industries/codex-acp*`
family is deprecated upstream ("replaced by
`@agentclientprotocol/codex-acp`") and pinned at `0.16.0`; migrating it
is a separate call for whoever owns the ACP integration.

# How did I test this PR

**Unit — 16 new tests, all passing:**

```
$ vitest run test/src/scripts/tarball-integrity.test.ts
 Test Files  1 passed (1)
      Tests  16 passed (16)
```

Covers quoted scoped keys and unquoted bare keys, resolutions carrying
no integrity, `snapshots:` repeats, a package absent from the lockfile,
a version pinned under a different number, tampered bytes, a single
flipped byte, an uncomputable algorithm, sha256 as well as sha512, and
the upward lockfile walk (including the no-lockfile-anywhere case). One
test asserts this repository actually pins a hash for all four packaged
codex-acp binaries.

**Live end-to-end against the real registry** — the real 74,914,872-byte
`@zed-industries/codex-acp-linux-x64@0.16.0` tarball, downloaded and run
through the same code path the build uses:

```
downloaded 74914872 bytes from https://registry.npmjs.org/@zed-industries/codex-acp-linux-x64/-/codex-acp-linux-x64-0.16.0.tgz
PASS: real tarball matches the lockfile pin
PASS: tampered rejected — TarballIntegrityError: Integrity mismatch for @zed-industries/codex-acp-linux-x64@0.16.0.
PASS: unpinned version refused — TarballIntegrityError: @zed-industries/codex-acp-linux-x64@0.99.0 has no integrity hash in pnpm-lock.yaml; refusing to package unverified bytes.
```

So the check passes on genuine bytes, rejects a single flipped byte in a
75 MB archive, and refuses a version the lockfile does not pin.

**Lint / types / boundaries:**

- `oxlint` on all three files — clean. (First draft used `node:crypto`;
`no-restricted-imports` bans it, so the digest went to Web Crypto.)
- `prettier --check` — clean.
- `tsc --noEmit` — no errors in any of the three changed files. This
sandbox has 820 pre-existing errors from an unbuilt workspace (only 7 of
70 projects installed); `test/src/scripts/release-artifacts.test.ts`
fails to import here for the same reason, on `next` as well as on this
branch.
- `pnpm run validate:boundaries` — `lint boundaries OK: 4 registered
disables across 4 files` (unchanged; `scripts/` and `test/` sit outside
the `src/` Effect boundary policy).

# Security

- **Grype** — `grype dir:ts/packages/cli/scripts --only-fixed --fail-on
medium` → `No vulnerabilities found`.
- **Socket** — could not run. `doppler secrets get SOCKET_API_TOKEN
--plain --project hermes --config dev_zen` returns empty in this cron
sandbox, so `socket ci` exits with `Auth Error`. Reporting rather than
skipping silently; this change adds no dependency, so the
dependency-alert surface is unchanged.
- No new dependencies, no new network destinations. The one behavioural
change is a fail-closed integrity check on bytes that were previously
trusted unverified.

Origin: cron-48e51eab745f /
[zen-cron-44e260352d1a](https://zen.corp.composio.io/dashboard/#/chat/zen-cron-44e260352d1a)

Triggered by: saransh@composio.dev | Source: unknown
Session:
https://zen.corp.composio.io/dashboard/#/chat/zen-cron-44e260352d1a
@composio/cli@0.4.1-beta.369 		2026-08-25 23:57:49 +02:00
Soham Basu 23ae2cdf19 fix(docs): stabilize toolkit knowledge and refresh KB 2026-08-25 12:55:03 -07:00
jkomyno 121edf4e65 docs: auto-generate Python SDK reference 2026-08-25 19:49:24 +00:00
Alberto Schiabel 9e958948c5 fix(core): block sensitive upload paths hidden behind a symlinked directory (#4218) 
# Description

Found by the scheduled security audit, while checking whether a test
failure on my other PR was pre-existing. It was — and the reason it
fails is a real gap in a shipped security control.

`isBlockedSensitiveFileUploadPath` (the GHSA-hp3h-89pf-5q58 denylist)
matched deny segments **only against the symlink-resolved path**. That
catches a benign name pointing at a secret — `~/innocent-name ->
~/nested/.aws/creds`, which the existing test covers — but misses the
inverse:

| Layout | Written path | Resolved path | Blocked before? |
|---|---|---|---|
| `~/innocent -> ~/.aws/creds` | no `.aws` | **`.aws`** | yes |
| `~/.claude -> /state/claude` | **`.claude`** | no `.claude` | **no** |

`~/.claude/settings.json` resolves to `/state/claude/settings.json`,
which has no `.claude` segment, so it sailed through — and `.claude` is
on the denylist precisely because it *"may contain API keys and project
context read by assistants"*.

This layout is not exotic. Dotfile managers (chezmoi, stow, yadm) and
containerised home directories produce it routinely — Composio's own
agent sandbox image has `/home/zen/.claude -> /state/claude`. For every
user in that shape the control was silently inactive, which is the worst
failure mode for a denylist: no error, no warning, upload proceeds.

The same hiding trick applies to the basename check (`~/.env ->
/state/plain-config`), so that path is fixed too.

## Why CI never caught this

`ts/packages/core/test/utils/sensitiveFileUploadPaths.test.ts` **already
asserts** the blocked behaviour:

```ts
expect(isBlockedSensitiveFileUploadPath(path.join(os.homedir(), '.claude', 'settings.json'))).toBe(true);
```

That assertion has been failing on `next` on any machine where
`~/.claude` is a symlink. It passes in CI only because `~/.claude` does
not exist on the runners: `existsSync` is false, no `realpath` runs, and
the written path keeps its `.claude` segment. The test is
environment-dependent, so green CI was never evidence the control
worked.

## The fix

The TypeScript `normalizePath` helper now returns both the written and
resolved segments, and the segment scan and basename check each consider
both. The Python guard now applies the same rule. Either path can carry
the denied name, so both SDKs inspect both forms.

# How did I test this PR

**The TypeScript fix is gated by tests — 3 fail without it, 13/13 pass
with it.**

Without the `src` change (test file only):

```
× blocks common credential directory segments
× blocks a sensitive directory that is itself a symlink to a plain path
× blocks a denied basename whose symlink target is named innocuously
  Tests  3 failed | 10 passed (13)
```

With the fix:

```
  Test Files  1 passed (1)
        Tests  13 passed (13)
```

Note the first of those three is the **pre-existing** assertion quoted
above — this PR turns it green rather than adding it.

Three tests added, each building a real symlink in a temp dir:
- sensitive directory that is itself a symlink to a plain path (the
`~/.claude -> /state/claude` case), asserting both
`isBlockedSensitiveFileUploadPath` and that `assertSafeFileUploadPath`
throws
- denied basename whose symlink target is named innocuously (`.env ->
plain-config`)
- **negative case**: an ordinary file reached through a symlinked
directory (`docs/document.pdf`) is still allowed, so the fix does not
over-block

The Python parity change adds the same three cases. Before the Python
source change, the sensitive written directory and basename both
returned `False`; with the fix, all 11 focused Python tests pass.

**Full verification:**

| Command | Result |
|---|---|
| `vitest run` in `ts/packages/core` | **48 files, 1114 tests passed** |
| `pnpm typecheck` (workspace) | **14/14 tasks successful**, exit 0 |
| `oxlint` on both changed files | exit 0, clean |
| `prettier --check` on both changed files | "All matched files use
Prettier code style!" |
| `nox -s chk` in `python/` | Ruff and mypy passed |
| `nox -s tst` in `python/` | **1339 passed, 33 skipped**, exit 0 |

# Security

- No dependency changes, no new network calls, no new imports. The diff
is limited to the equivalent TypeScript and Python guards, their tests,
and the required `@composio/core` patch changeset.
- This **strengthens** an existing control and cannot weaken it: the
previous match set is a strict subset of the new one, so nothing that
was blocked before is allowed now. The added negative test pins that the
widening does not over-block ordinary files.
- **Grype** — `grype dir:ts/packages/core --only-fixed --fail-on medium`
→ reported below.
- **Socket** — could not run; `doppler secrets get SOCKET_API_TOKEN
--plain --project hermes --config dev_zen` returns empty in this cron
sandbox, so `socket ci` exits `Auth Error`. Reporting rather than
skipping silently.
- Unrelated pre-existing note: the repo's `pnpm audit --prod` comment
flags `extract-zip <=2.0.1` with `Patched versions >=2.0.2`, a version
that does not exist on npm. Details in #4217.

Origin: cron-48e51eab745f /
[zen-cron-44e260352d1a](https://zen.corp.composio.io/dashboard/#/chat/zen-cron-44e260352d1a)

Triggered by: saransh@composio.dev | Source: unknown
Session:
https://zen.corp.composio.io/dashboard/#/chat/zen-cron-44e260352d1a
 2026-08-25 21:48:55 +02:00
jkomyno 449f4e128a chore: add changeset for symlink path protection 2026-08-25 21:02:36 +02:00
jkomyno 43545ec889 fix(python): block sensitive paths hidden by symlinks 2026-08-25 20:49:04 +02:00
Alberto Schiabel 52f8861c95 docs(gemini): update to use gemini 3.7 and new models (#4244) 
## Summary

Updates docs and sample scripts to use latest Gemini models.

## Changes
- Vertex & Gemini sample scripts updated
- Plus accompanying markdown

## Type of change
- [ ] Bug fix
- [ ] New feature
- [ ] Refactor/Chore
- [x] Documentation
- [ ] Breaking change

## How Has This Been Tested?

Visual inspection

## Checklist
- [x] I have read the Code of Conduct and this PR adheres to it
- [x] I ran linters/tests locally and they passed
- [x] I updated documentation as needed
- [ ] I added tests or explain why not applicable
- [ ] I added a changeset if this change affects published packages

## Additional context
 2026-08-25 16:08:11 +02:00
Alberto Schiabel 3353374105 fix(deps): bump the github-actions group across 1 directory with 7 updates (#4239) 
Bumps the github-actions group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4.4.0` |
`7.0.1` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact)
| `4.6.2` | `7.0.1` |
|
[anthropics/claude-code-action](https://github.com/anthropics/claude-code-action)
| `1.0.185` | `1.0.199` |
| [actions/setup-python](https://github.com/actions/setup-python) |
`5.6.0` | `7.0.0` |
| [actions/cache](https://github.com/actions/cache) | `4.3.0` | `6.1.0`
|
| [openai/codex-action](https://github.com/openai/codex-action) | `1.11`
| `1.12` |
|
[anthropics/claude-code-action/base-action](https://github.com/anthropics/claude-code-action)
| `1.0.185` | `1.0.199` |


Updates `actions/checkout` from 4.4.0 to 7.0.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/releases">actions/checkout's
releases</a>.</em></p>
<blockquote>
<h2>v7.0.1</h2>
<h2>What's Changed</h2>
<ul>
<li>skip running unsafe pr check if input is default by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li>
<li>trim only ascii whitespace for branch by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li>
<li>escape values passed to --unset by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li>
<li>Various dependency updates</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v7...v7.0.1">https://github.com/actions/checkout/compare/v7...v7.0.1</a></p>
<h2>v7.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>block checking out fork pr for pull_request_target and workflow_run
by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
<li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the
minor-actions-dependencies group across 1 directory by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li>
<li>Bump flatted from 3.3.1 to 3.4.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li>
<li>Bump js-yaml from 4.1.0 to 4.2.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li>
<li>Bump <code>@​actions/core</code> and
<code>@​actions/tool-cache</code> and Remove uuid by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li>
<li>upgrade module to esm and update dependencies by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li>
<li>Bump the minor-npm-dependencies group across 1 directory with 3
updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li>
<li>getting ready for checkout v7 release by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2464">actions/checkout#2464</a></li>
<li>update error wording by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2467">actions/checkout#2467</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v6.0.3...v7.0.0">https://github.com/actions/checkout/compare/v6.0.3...v7.0.0</a></p>
<h2>v6.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li><strong>[BREAKING]</strong> backport
<code>allow-unsafe-pr-checkout</code> to v6 by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2500">actions/checkout#2500</a></li>
<li>backport fixes to releases-v6 by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2527">actions/checkout#2527</a></li>
</ul>
<p><a
href="https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/">https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/</a>
for more details about this breaking change</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v6.0.3...v6.1.0">https://github.com/actions/checkout/compare/v6.0.3...v6.1.0</a></p>
<h2>v6.0.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Update changelog by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2357">actions/checkout#2357</a></li>
<li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
<li>Fix checkout init for SHA-256 repositories by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li>
<li>Update changelog for v6.0.3 by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2446">actions/checkout#2446</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/yaananth"><code>@​yaananth</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v6...v6.0.3">https://github.com/actions/checkout/compare/v6...v6.0.3</a></p>
<h2>v6.0.2</h2>
<h2>What's Changed</h2>
<ul>
<li>Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID
is set by <a
href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2355">actions/checkout#2355</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>v7.0.1</h2>
<ul>
<li>Skip running unsafe pr check if input is default by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li>
<li>Trim only ascii whitespace for branch by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li>
<li>Escape values passed to --unset by <a
href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li>
<li>Various dependency updates</li>
</ul>
<h2>v7.0.0</h2>
<ul>
<li>Block checking out fork PR for pull_request_target and workflow_run
by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li>
<li>Various dependency updates</li>
</ul>
<h2>v6.0.3</h2>
<ul>
<li>Fix checkout init for SHA-256 repositories by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li>
<li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
</ul>
<h2>v6.0.2</h2>
<ul>
<li>Fix tag handling: preserve annotations and explicit fetch-tags by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li>
</ul>
<h2>v6.0.1</h2>
<ul>
<li>Add worktree support for persist-credentials includeIf by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li>
</ul>
<h2>v6.0.0</h2>
<ul>
<li>Persist creds to a separate file by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li>
<li>Update README to include Node.js 24 support details and requirements
by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li>
</ul>
<h2>v5.0.1</h2>
<ul>
<li>Port v6 cleanup to v5 by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li>
</ul>
<h2>v5.0.0</h2>
<ul>
<li>Update actions checkout to use node 24 by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li>
</ul>
<h2>v4.3.1</h2>
<ul>
<li>Port v6 cleanup to v4 by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li>
</ul>
<h2>v4.3.0</h2>
<ul>
<li>docs: update README.md by <a
href="https://github.com/motss"><code>@​motss</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li>
<li>Add internal repos for checking out multiple repositories by <a
href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li>
<li>Documentation update - add recommended permissions to Readme by <a
href="https://github.com/benwells"><code>@​benwells</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li>
<li>Adjust positioning of user email note and permissions heading by <a
href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li>
<li>Update README.md by <a
href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li>
<li>Update CODEOWNERS for actions by <a
href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li>
<li>Update package dependencies by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li>
</ul>
<h2>v4.2.2</h2>
<ul>
<li><code>url-helper.ts</code> now leverages well-known environment
variables by <a href="https://github.com/jww3"><code>@​jww3</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li>
<li>Expand unit test coverage for <code>isGhes</code> by <a
href="https://github.com/jww3"><code>@​jww3</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li>
</ul>
<h2>v4.2.1</h2>
<ul>
<li>Check out other refs/* by commit if provided, fall back to ref by <a
href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/checkout/commit/3d3c42e5aac5ba805825da76410c181273ba90b1"><code>3d3c42e</code></a>
prep v7.0.1 release (<a
href="https://redirect.github.com/actions/checkout/issues/2531">#2531</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/28802689a136bfcdb721715abd713740beecbe07"><code>2880268</code></a>
escape values passed to --unset (<a
href="https://redirect.github.com/actions/checkout/issues/2530">#2530</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/12cd2235efa0937479335606d7c3ac9f6c0973b1"><code>12cd223</code></a>
trim only ascii whitespace for branch (<a
href="https://redirect.github.com/actions/checkout/issues/2521">#2521</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/62661c4e71a304b2823ed026347b8d34c3eac541"><code>62661c4</code></a>
skip running unsafe pr check if input is default (<a
href="https://redirect.github.com/actions/checkout/issues/2518">#2518</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/e8d4307400f9427dba7cb98e488d6ab85f1cec5f"><code>e8d4307</code></a>
Bump the minor-actions-dependencies group with 2 updates (<a
href="https://redirect.github.com/actions/checkout/issues/2499">#2499</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/631c942040754b6e095e929c1677c07e10ed4f87"><code>631c942</code></a>
eslint 9 (<a
href="https://redirect.github.com/actions/checkout/issues/2474">#2474</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/4f1f4aec02e41874fa0262ea8ff5172d7978ad1e"><code>4f1f4ae</code></a>
Bump actions/upload-artifact from 4 to 7 (<a
href="https://redirect.github.com/actions/checkout/issues/2476">#2476</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/ba097532fb203f7e88c9c3c0b899b49469908a92"><code>ba09753</code></a>
Bump actions/checkout from 6 to 7 (<a
href="https://redirect.github.com/actions/checkout/issues/2488">#2488</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/b9e0990d219a03df7633c93f6f005a8fecbcab22"><code>b9e0990</code></a>
Bump docker/login-action from 3.3.0 to 4.2.0 (<a
href="https://redirect.github.com/actions/checkout/issues/2479">#2479</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/e8cb398be4a550817e382abf69e4c12c76fce1f2"><code>e8cb398</code></a>
Bump docker/build-push-action from 6.5.0 to 7.2.0 (<a
href="https://redirect.github.com/actions/checkout/issues/2478">#2478</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/checkout/compare/v4.4.0...3d3c42e5aac5ba805825da76410c181273ba90b1">compare
view</a></li>
</ul>
</details>
<br />

Updates `actions/upload-artifact` from 4.6.2 to 7.0.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/upload-artifact/releases">actions/upload-artifact's
releases</a>.</em></p>
<blockquote>
<h2>v7.0.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Update the readme with direct upload details by <a
href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in
<a
href="https://redirect.github.com/actions/upload-artifact/pull/795">actions/upload-artifact#795</a></li>
<li>Readme: bump all the example versions to v7 by <a
href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in
<a
href="https://redirect.github.com/actions/upload-artifact/pull/796">actions/upload-artifact#796</a></li>
<li>Include changes in typespec/ts-http-runtime 0.3.5 by <a
href="https://github.com/yacaovsnc"><code>@​yacaovsnc</code></a> in <a
href="https://redirect.github.com/actions/upload-artifact/pull/797">actions/upload-artifact#797</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/upload-artifact/compare/v7...v7.0.1">https://github.com/actions/upload-artifact/compare/v7...v7.0.1</a></p>
<h2>v7.0.0</h2>
<h2>v7 What's new</h2>
<h3>Direct Uploads</h3>
<p>Adds support for uploading single files directly (unzipped). Callers
can set the new <code>archive</code> parameter to <code>false</code> to
skip zipping the file during upload. Right now, we only support single
files. The action will fail if the glob passed resolves to multiple
files. The <code>name</code> parameter is also ignored with this
setting. Instead, the name of the artifact will be the name of the
uploaded file.</p>
<h3>ESM</h3>
<p>To support new versions of the <code>@actions/*</code> packages,
we've upgraded the package to ESM.</p>
<h2>What's Changed</h2>
<ul>
<li>Add proxy integration test by <a
href="https://github.com/Link"><code>@​Link</code></a>- in <a
href="https://redirect.github.com/actions/upload-artifact/pull/754">actions/upload-artifact#754</a></li>
<li>Upgrade the module to ESM and bump dependencies by <a
href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in
<a
href="https://redirect.github.com/actions/upload-artifact/pull/762">actions/upload-artifact#762</a></li>
<li>Support direct file uploads by <a
href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in
<a
href="https://redirect.github.com/actions/upload-artifact/pull/764">actions/upload-artifact#764</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/Link"><code>@​Link</code></a>- made
their first contribution in <a
href="https://redirect.github.com/actions/upload-artifact/pull/754">actions/upload-artifact#754</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/upload-artifact/compare/v6...v7.0.0">https://github.com/actions/upload-artifact/compare/v6...v7.0.0</a></p>
<h2>v6.0.0</h2>
<h2>v6 - What's new</h2>
<blockquote>
<p>[!IMPORTANT]
actions/upload-artifact@v6 now runs on Node.js 24 (<code>runs.using:
node24</code>) and requires a minimum Actions Runner version of 2.327.1.
If you are using self-hosted runners, ensure they are updated before
upgrading.</p>
</blockquote>
<h3>Node.js 24</h3>
<p>This release updates the runtime to Node.js 24. v5 had preliminary
support for Node.js 24, however this action was by default still running
on Node.js 20. Now this action by default will run on Node.js 24.</p>
<h2>What's Changed</h2>
<ul>
<li>Upload Artifact Node 24 support by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/upload-artifact/pull/719">actions/upload-artifact#719</a></li>
<li>fix: update <code>@​actions/artifact</code> for Node.js 24 punycode
deprecation by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/upload-artifact/pull/744">actions/upload-artifact#744</a></li>
<li>prepare release v6.0.0 for Node.js 24 support by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/upload-artifact/pull/745">actions/upload-artifact#745</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/upload-artifact/compare/v5.0.0...v6.0.0">https://github.com/actions/upload-artifact/compare/v5.0.0...v6.0.0</a></p>
<h2>v5.0.0</h2>
<h2>What's Changed</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/upload-artifact/commit/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"><code>043fb46</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/upload-artifact/issues/797">#797</a>
from actions/yacaovsnc/update-dependency</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/634250c1388765ea7ed0f053e636f1f399000b94"><code>634250c</code></a>
Include changes in typespec/ts-http-runtime 0.3.5</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/e454baaac2be505c9450e11b8f3215c6fc023ce8"><code>e454baa</code></a>
Readme: bump all the example versions to v7 (<a
href="https://redirect.github.com/actions/upload-artifact/issues/796">#796</a>)</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/74fad66b98a6d799dc004d3353ccd0e6f6b2530e"><code>74fad66</code></a>
Update the readme with direct upload details (<a
href="https://redirect.github.com/actions/upload-artifact/issues/795">#795</a>)</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/bbbca2ddaa5d8feaa63e36b76fdaad77386f024f"><code>bbbca2d</code></a>
Support direct file uploads (<a
href="https://redirect.github.com/actions/upload-artifact/issues/764">#764</a>)</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/589182c5a4cec8920b8c1bce3e2fab1c97a02296"><code>589182c</code></a>
Upgrade the module to ESM and bump dependencies (<a
href="https://redirect.github.com/actions/upload-artifact/issues/762">#762</a>)</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/47309c993abb98030a35d55ef7ff34b7fa1074b5"><code>47309c9</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/upload-artifact/issues/754">#754</a>
from actions/Link-/add-proxy-integration-tests</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/02a8460834e70dab0ce194c64360c59dc1475ef0"><code>02a8460</code></a>
Add proxy integration test</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/b7c566a772e6b6bfb58ed0dc250532a479d7789f"><code>b7c566a</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/upload-artifact/issues/745">#745</a>
from actions/upload-artifact-v6-release</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/e516bc8500aaf3d07d591fcd4ae6ab5f9c391d5b"><code>e516bc8</code></a>
docs: correct description of Node.js 24 support in README</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/upload-artifact/compare/v4.6.2...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a">compare
view</a></li>
</ul>
</details>
<br />

Updates `anthropics/claude-code-action` from 1.0.185 to 1.0.199
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-code-action/releases">anthropics/claude-code-action's
releases</a>.</em></p>
<blockquote>
<h2>v1.0.199</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(github): honor GITHUB_GRAPHQL_URL for the GraphQL client by <a
href="https://github.com/rover0811"><code>@​rover0811</code></a> in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1575">anthropics/claude-code-action#1575</a></li>
<li>fix(cleanup): keep the base-branch config revert out of the
auto-commit by <a
href="https://github.com/GautamSharma99"><code>@​GautamSharma99</code></a>
in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1677">anthropics/claude-code-action#1677</a></li>
<li>fix(mcp): recognize mcp__github aggregate selector for GitHub MCP
server initialization by <a
href="https://github.com/anishesg"><code>@​anishesg</code></a> in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1657">anthropics/claude-code-action#1657</a></li>
<li>Document 1M gateway models and surface resolved limits by <a
href="https://github.com/ulofiai"><code>@​ulofiai</code></a> in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1608">anthropics/claude-code-action#1608</a></li>
<li>fix: teach claude_args --allowedTools in the signed prompt by <a
href="https://github.com/WeAreResilience"><code>@​WeAreResilience</code></a>
in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1704">anthropics/claude-code-action#1704</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/rover0811"><code>@​rover0811</code></a>
made their first contribution in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1575">anthropics/claude-code-action#1575</a></li>
<li><a
href="https://github.com/GautamSharma99"><code>@​GautamSharma99</code></a>
made their first contribution in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1677">anthropics/claude-code-action#1677</a></li>
<li><a
href="https://github.com/WeAreResilience"><code>@​WeAreResilience</code></a>
made their first contribution in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1704">anthropics/claude-code-action#1704</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/anthropics/claude-code-action/compare/v1.0.198...v1.0.199">https://github.com/anthropics/claude-code-action/compare/v1.0.198...v1.0.199</a></p>
<h2>v1.0.198</h2>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/anthropics/claude-code-action/compare/v1.0.197...v1.0.198">https://github.com/anthropics/claude-code-action/compare/v1.0.197...v1.0.198</a></p>
<h2>v1.0.197</h2>
<h2>What's Changed</h2>
<ul>
<li>fix: neutralize the checkout credential under actions/checkout v6+
include layout (<a
href="https://redirect.github.com/anthropics/claude-code-action/issues/1510">#1510</a>)
by <a href="https://github.com/TemRevil"><code>@​TemRevil</code></a> in
<a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1526">anthropics/claude-code-action#1526</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/TemRevil"><code>@​TemRevil</code></a>
made their first contribution in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1526">anthropics/claude-code-action#1526</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/anthropics/claude-code-action/compare/v1.0.196...v1.0.197">https://github.com/anthropics/claude-code-action/compare/v1.0.196...v1.0.197</a></p>
<h2>v1.0.196</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(security): unify secret redaction in public comment outputs by
<a href="https://github.com/Juwan-Hwang"><code>@​Juwan-Hwang</code></a>
in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1693">anthropics/claude-code-action#1693</a></li>
<li>fix: strip unused ALL_INPUTS environment variable from Claude
subprocess env by <a
href="https://github.com/Juwan-Hwang"><code>@​Juwan-Hwang</code></a> in
<a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1692">anthropics/claude-code-action#1692</a></li>
<li>fix(github): match bot actors in comment filters using GraphQL
__typename by <a
href="https://github.com/Neal006"><code>@​Neal006</code></a> in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1616">anthropics/claude-code-action#1616</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/Juwan-Hwang"><code>@​Juwan-Hwang</code></a>
made their first contribution in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1693">anthropics/claude-code-action#1693</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/anthropics/claude-code-action/compare/v1.0.195...v1.0.196">https://github.com/anthropics/claude-code-action/compare/v1.0.195...v1.0.196</a></p>
<h2>v1.0.195</h2>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/anthropics/claude-code-action/compare/v1.0.194...v1.0.195">https://github.com/anthropics/claude-code-action/compare/v1.0.194...v1.0.195</a></p>
<h2>v1.0.194</h2>
<h2>What's Changed</h2>
<ul>
<li>Harden delete_files MCP tool: validate paths within repo root
(consistency with commit_files) by <a
href="https://github.com/GabrielOnRails"><code>@​GabrielOnRails</code></a>
in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1636">anthropics/claude-code-action#1636</a></li>
<li>Only limit fetch depth when the checkout is already shallow by <a
href="https://github.com/winklemad"><code>@​winklemad</code></a> in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1647">anthropics/claude-code-action#1647</a></li>
<li>fix(base-action): add ~/.local/bin to $GITHUB_PATH after
auto-install by <a
href="https://github.com/anishesg"><code>@​anishesg</code></a> in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1643">anthropics/claude-code-action#1643</a></li>
<li>feat(context): include diffHunk in PR review comment context by <a
href="https://github.com/rishavnaskar"><code>@​rishavnaskar</code></a>
in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1584">anthropics/claude-code-action#1584</a></li>
<li>ci: skip Claude-backed test jobs on fork PRs by <a
href="https://github.com/ashwin-ant"><code>@​ashwin-ant</code></a> in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1655">anthropics/claude-code-action#1655</a></li>
<li>fix: bump shell-quote to 1.8.4 to remediate CVE-2026-9277 by <a
href="https://github.com/doshidhaval"><code>@​doshidhaval</code></a> in
<a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1557">anthropics/claude-code-action#1557</a></li>
<li>fix(images): bound attachment downloads by <a
href="https://github.com/abhinavkr26104"><code>@​abhinavkr26104</code></a>
in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1625">anthropics/claude-code-action#1625</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/anthropics/claude-code-action/commit/dcb57747bfceeaa1fa72638cae52295d1d853d4a"><code>dcb5774</code></a>
chore: bump Claude Code to 2.1.239 and Agent SDK to 0.3.239</li>
<li><a
href="https://github.com/anthropics/claude-code-action/commit/492d2d78ee1f7dd5b58581c639b49752db9a2fab"><code>492d2d7</code></a>
fix: teach claude_args --allowedTools in the signed prompt (<a
href="https://redirect.github.com/anthropics/claude-code-action/issues/1704">#1704</a>)</li>
<li><a
href="https://github.com/anthropics/claude-code-action/commit/2ca5fb40278a805fe7cb3dbd6fc7b5f26405448b"><code>2ca5fb4</code></a>
fix: surface resolved model limits (<a
href="https://redirect.github.com/anthropics/claude-code-action/issues/1608">#1608</a>)</li>
<li><a
href="https://github.com/anthropics/claude-code-action/commit/f3f2789f0a82eb276afdbac6f0d7cb10f4e7a460"><code>f3f2789</code></a>
fix(mcp): recognize mcp__github aggregate selector for GitHub MCP server
init...</li>
<li><a
href="https://github.com/anthropics/claude-code-action/commit/6a5f1d8e0a0fcd8d2f8e79932c1880b600c9e5e7"><code>6a5f1d8</code></a>
fix(cleanup): keep the base-branch config revert out of the auto-commit
(<a
href="https://redirect.github.com/anthropics/claude-code-action/issues/1677">#1677</a>)</li>
<li><a
href="https://github.com/anthropics/claude-code-action/commit/39ad3c89776dd68327979412d8ad0e9bec1805ef"><code>39ad3c8</code></a>
fix(github): honor GITHUB_GRAPHQL_URL for the GraphQL client (<a
href="https://redirect.github.com/anthropics/claude-code-action/issues/1575">#1575</a>)</li>
<li><a
href="https://github.com/anthropics/claude-code-action/commit/3f854a8fb5146b39d5cbf8b57f70d80810e1366f"><code>3f854a8</code></a>
chore: bump Claude Code to 2.1.238 and Agent SDK to 0.3.238</li>
<li><a
href="https://github.com/anthropics/claude-code-action/commit/5ee796a55f92566ecd7e39d70dd613abcbea0d7c"><code>5ee796a</code></a>
chore: bump Claude Code to 2.1.237 and Agent SDK to 0.3.237</li>
<li><a
href="https://github.com/anthropics/claude-code-action/commit/cff8d3c8f08ae322e07a1c98ef1b882dc32ddc46"><code>cff8d3c</code></a>
fix(git-config): neutralize checkout credential in include-based config
(<a
href="https://redirect.github.com/anthropics/claude-code-action/issues/1526">#1526</a>)</li>
<li><a
href="https://github.com/anthropics/claude-code-action/commit/e2a4b761cd77a1138a5b41410eda9b28581f9bcd"><code>e2a4b76</code></a>
chore: bump Claude Code to 2.1.236 and Agent SDK to 0.3.236</li>
<li>Additional commits viewable in <a
href="https://github.com/anthropics/claude-code-action/compare/9db594c7a0e82298c121c18b7f08aa1579ce7341...dcb57747bfceeaa1fa72638cae52295d1d853d4a">compare
view</a></li>
</ul>
</details>
<br />

Updates `actions/setup-python` from 5.6.0 to 7.0.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/setup-python/releases">actions/setup-python's
releases</a>.</em></p>
<blockquote>
<h2>v7.0.0</h2>
<h2>What's Changed</h2>
<h3>Enhancements</h3>
<ul>
<li>Migrate to ESM and upgrade dependencies by <a
href="https://github.com/priyagupta108"><code>@​priyagupta108</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1330">actions/setup-python#1330</a></li>
<li>Pin SHA commits and update docs with latest versions by <a
href="https://github.com/HarithaVattikuti"><code>@​HarithaVattikuti</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1338">actions/setup-python#1338</a></li>
<li>Remove the pip-install input by <a
href="https://github.com/gowridurgad"><code>@​gowridurgad</code></a> in
<a
href="https://redirect.github.com/actions/setup-python/pull/1336">actions/setup-python#1336</a></li>
</ul>
<h3>Bug Fix</h3>
<ul>
<li>Fix to Classify stderr warning messages as warnings instead of
errors in annotations by <a
href="https://github.com/lmvysakh"><code>@​lmvysakh</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1335">actions/setup-python#1335</a></li>
<li>Validate and retry manifest fetch to prevent silent failures by <a
href="https://github.com/priyagupta108"><code>@​priyagupta108</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1332">actions/setup-python#1332</a></li>
</ul>
<h3>Dependency Upgrade</h3>
<ul>
<li>Bump certifi from 2020.6.20 to 2024.7.4 in
/<strong>tests</strong>/data by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1328">actions/setup-python#1328</a></li>
<li>Remove EOL Python versions and Bumps numpy text fixture by <a
href="https://github.com/priya-kinthali"><code>@​priya-kinthali</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1333">actions/setup-python#1333</a></li>
<li>Upgrade <code>@​actions/cache</code> to 6.2.0 by <a
href="https://github.com/philip-gai"><code>@​philip-gai</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1337">actions/setup-python#1337</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/lmvysakh"><code>@​lmvysakh</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/setup-python/pull/1335">actions/setup-python#1335</a></li>
<li><a
href="https://github.com/philip-gai"><code>@​philip-gai</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/setup-python/pull/1337">actions/setup-python#1337</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/setup-python/compare/v6...v7.0.0">https://github.com/actions/setup-python/compare/v6...v7.0.0</a></p>
<h2>v6.3.0</h2>
<h2>What's Changed</h2>
<h3>Enhancement</h3>
<ul>
<li>Add RHEL support and include Linux distro in cache keys by <a
href="https://github.com/priyagupta108"><code>@​priyagupta108</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1323">actions/setup-python#1323</a></li>
<li>Fix pip cache error handling on Windows by <a
href="https://github.com/priyagupta108"><code>@​priyagupta108</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1040">actions/setup-python#1040</a></li>
</ul>
<h3>Dependency update</h3>
<ul>
<li>Upgrade minimatch from 3.1.2 to 3.1.5 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1281">actions/setup-python#1281</a></li>
<li>Upgrade actions dependencies by <a
href="https://github.com/gowridurgad"><code>@​gowridurgad</code></a>
with <a href="https://github.com/Copilot"><code>@​Copilot</code></a> in
<a
href="https://redirect.github.com/actions/setup-python/pull/1303">actions/setup-python#1303</a></li>
<li>Upgrade <code>@​actions/cache</code> to 5.1.0, log cache write
denied by <a
href="https://github.com/jasongin"><code>@​jasongin</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1324">actions/setup-python#1324</a></li>
<li>Upgrade dependency versions and test workflow configuration by <a
href="https://github.com/HarithaVattikuti"><code>@​HarithaVattikuti</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1322">actions/setup-python#1322</a></li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Update advanced-usage.md by <a
href="https://github.com/Dunky-Z"><code>@​Dunky-Z</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/811">actions/setup-python#811</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/gowridurgad"><code>@​gowridurgad</code></a>
with <a href="https://github.com/Copilot"><code>@​Copilot</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/setup-python/pull/1303">actions/setup-python#1303</a></li>
<li><a href="https://github.com/jasongin"><code>@​jasongin</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/setup-python/pull/1324">actions/setup-python#1324</a></li>
<li><a href="https://github.com/Dunky-Z"><code>@​Dunky-Z</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/setup-python/pull/811">actions/setup-python#811</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/setup-python/compare/v6.2.0...v6.3.0">https://github.com/actions/setup-python/compare/v6.2.0...v6.3.0</a></p>
<h2>v6.2.0</h2>
<h2>What's Changed</h2>
<h3>Dependency Upgrades</h3>
<ul>
<li>Upgrade dependencies to Node 24 compatible versions by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1259">actions/setup-python#1259</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/setup-python/commit/5fda3b95a4ea91299a34e894583c3862153e4b97"><code>5fda3b9</code></a>
Pin SHA commits and update docs with latest versions (<a
href="https://redirect.github.com/actions/setup-python/issues/1338">#1338</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/4ab7e95f05e168b4356aebde89dd84f59c283d8e"><code>4ab7e95</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/setup-python/issues/1337">#1337</a>
from actions/philip-gai/bump-actions-cache-6-2-0</li>
<li><a
href="https://github.com/actions/setup-python/commit/0f3a009f475dbea83c0371cd85d099690fee8c5c"><code>0f3a009</code></a>
Remove the pip-install input (<a
href="https://redirect.github.com/actions/setup-python/issues/1336">#1336</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/f8cf4291c8b8e273ddd26e569454615c7315d932"><code>f8cf429</code></a>
Migrate to ESM and upgrade dependencies (<a
href="https://redirect.github.com/actions/setup-python/issues/1330">#1330</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/54baeea5b34417d10a7479663a23cca53ea209b5"><code>54baeea</code></a>
Validate and retry manifest fetch to prevent silent failures (<a
href="https://redirect.github.com/actions/setup-python/issues/1332">#1332</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/c7092773a316760f4ecfe498e4af668a4dafeac5"><code>c709277</code></a>
Annotation code fix (<a
href="https://redirect.github.com/actions/setup-python/issues/1335">#1335</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/6849080452e69b330395e8a6d23cf90f56d76a1a"><code>6849080</code></a>
remove EOL Python versions and Bumps numpy text fixture (<a
href="https://redirect.github.com/actions/setup-python/issues/1333">#1333</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/0903b469fbf4441aadfe4f4b249dc5b1fba3a73e"><code>0903b46</code></a>
Bump certifi from 2020.6.20 to 2024.7.4 in /<strong>tests</strong>/data
(<a
href="https://redirect.github.com/actions/setup-python/issues/1328">#1328</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/ece7cb06caefa5fff74198d8649806c4678c61a1"><code>ece7cb0</code></a>
Fix pip cache error handling on Windows. (<a
href="https://redirect.github.com/actions/setup-python/issues/1040">#1040</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/1d18d7af5f767c1259ede05a0a5bcc30f3dcf1cf"><code>1d18d7a</code></a>
Update advanced-usage.md (<a
href="https://redirect.github.com/actions/setup-python/issues/811">#811</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/setup-python/compare/v5.6.0...5fda3b95a4ea91299a34e894583c3862153e4b97">compare
view</a></li>
</ul>
</details>
<br />

Updates `actions/cache` from 4.3.0 to 6.1.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/cache/releases">actions/cache's
releases</a>.</em></p>
<blockquote>
<h2>v6.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump <code>@​actions/cache</code> to v6.1.0 - handle read-only cache
access by <a
href="https://github.com/jasongin"><code>@​jasongin</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1768">actions/cache#1768</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v6...v6.1.0">https://github.com/actions/cache/compare/v6...v6.1.0</a></p>
<h2>v6.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update packages, migrate to ESM by <a
href="https://github.com/Samirat"><code>@​Samirat</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1760">actions/cache#1760</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v5...v6.0.0">https://github.com/actions/cache/compare/v5...v6.0.0</a></p>
<h2>v5.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump <code>@​actions/cache</code> to v5.1.0 - handle read-only cache
access by <a
href="https://github.com/jasongin"><code>@​jasongin</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1775">actions/cache#1775</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v5...v5.1.0">https://github.com/actions/cache/compare/v5...v5.1.0</a></p>
<h2>v5.0.5</h2>
<h2>What's Changed</h2>
<ul>
<li>Update ts-http-runtime dependency by <a
href="https://github.com/yacaovsnc"><code>@​yacaovsnc</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1747">actions/cache#1747</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v5...v5.0.5">https://github.com/actions/cache/compare/v5...v5.0.5</a></p>
<h2>v5.0.4</h2>
<h2>What's Changed</h2>
<ul>
<li>Add release instructions and update maintainer docs by <a
href="https://github.com/Link"><code>@​Link</code></a>- in <a
href="https://redirect.github.com/actions/cache/pull/1696">actions/cache#1696</a></li>
<li>Potential fix for code scanning alert no. 52: Workflow does not
contain permissions by <a
href="https://github.com/Link"><code>@​Link</code></a>- in <a
href="https://redirect.github.com/actions/cache/pull/1697">actions/cache#1697</a></li>
<li>Fix workflow permissions and cleanup workflow names / formatting by
<a href="https://github.com/Link"><code>@​Link</code></a>- in <a
href="https://redirect.github.com/actions/cache/pull/1699">actions/cache#1699</a></li>
<li>docs: Update examples to use the latest version by <a
href="https://github.com/XZTDean"><code>@​XZTDean</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1690">actions/cache#1690</a></li>
<li>Fix proxy integration tests by <a
href="https://github.com/Link"><code>@​Link</code></a>- in <a
href="https://redirect.github.com/actions/cache/pull/1701">actions/cache#1701</a></li>
<li>Fix cache key in examples.md for bun.lock by <a
href="https://github.com/RyPeck"><code>@​RyPeck</code></a> in <a
href="https://redirect.github.com/actions/cache/pull/1722">actions/cache#1722</a></li>
<li>Update dependencies &amp; patch security vulnerabilities by <a
href="https://github.com/Link"><code>@​Link</code></a>- in <a
href="https://redirect.github.com/actions/cache/pull/1738">actions/cache#1738</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/XZTDean"><code>@​XZTDean</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/cache/pull/1690">actions/cache#1690</a></li>
<li><a href="https://github.com/RyPeck"><code>@​RyPeck</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/cache/pull/1722">actions/cache#1722</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/cache/compare/v5...v5.0.4">https://github.com/actions/cache/compare/v5...v5.0.4</a></p>
<h2>v5.0.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a
href="https://github.com/actions/cache/security/dependabot/33">https://github.com/actions/cache/security/dependabot/33</a>)</li>
<li>Bump <code>@actions/core</code> to v2.0.3</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/cache/blob/main/RELEASES.md">actions/cache's
changelog</a>.</em></p>
<blockquote>
<h1>Releases</h1>
<h2>How to prepare a release</h2>
<blockquote>
<p>[!NOTE]
Relevant for maintainers with write access only.</p>
</blockquote>
<ol>
<li>Switch to a new branch from <code>main</code>.</li>
<li>Run <code>npm test</code> to ensure all tests are passing.</li>
<li>Update the version in <a
href="https://github.com/actions/cache/blob/main/package.json"><code>https://github.com/actions/cache/blob/main/package.json</code></a>.</li>
<li>Run <code>npm run build</code> to update the compiled files.</li>
<li>Update this <a
href="https://github.com/actions/cache/blob/main/RELEASES.md"><code>https://github.com/actions/cache/blob/main/RELEASES.md</code></a>
with the new version and changes in the <code>## Changelog</code>
section.</li>
<li>Run <code>licensed cache</code> to update the license report.</li>
<li>Run <code>licensed status</code> and resolve any warnings by
updating the <a
href="https://github.com/actions/cache/blob/main/.licensed.yml"><code>https://github.com/actions/cache/blob/main/.licensed.yml</code></a>
file with the exceptions.</li>
<li>Commit your changes and push your branch upstream.</li>
<li>Open a pull request against <code>main</code> and get it reviewed
and merged.</li>
<li>Draft a new release <a
href="https://github.com/actions/cache/releases">https://github.com/actions/cache/releases</a>
use the same version number used in <code>package.json</code>
<ol>
<li>Create a new tag with the version number.</li>
<li>Auto generate release notes and update them to match the changes you
made in <code>RELEASES.md</code>.</li>
<li>Toggle the set as the latest release option.</li>
<li>Publish the release.</li>
</ol>
</li>
<li>Navigate to <a
href="https://github.com/actions/cache/actions/workflows/release-new-action-version.yml">https://github.com/actions/cache/actions/workflows/release-new-action-version.yml</a>
<ol>
<li>There should be a workflow run queued with the same version
number.</li>
<li>Approve the run to publish the new version and update the major tags
for this action.</li>
</ol>
</li>
</ol>
<h2>Changelog</h2>
<h3>6.1.0</h3>
<ul>
<li>Bump <code>@actions/cache</code> to v6.1.0 to pick up <a
href="https://redirect.github.com/actions/toolkit/pull/2435">actions/toolkit#2435
Handle cache write error due to read-only token</a></li>
<li>Switch redundant &quot;Cache save failed&quot; warning to debug log
in save-only</li>
</ul>
<h3>6.0.0</h3>
<ul>
<li>Updated <code>@actions/cache</code> to ^6.0.1,
<code>@actions/core</code> to ^3.0.1, <code>@actions/exec</code> to
^3.0.0, <code>@actions/io</code> to ^3.0.2</li>
<li>Migrated to ESM module system</li>
<li>Upgraded Jest to v30 and test infrastructure to be ESM
compatible</li>
</ul>
<h3>5.0.4</h3>
<ul>
<li>Bump <code>minimatch</code> to v3.1.5 (fixes ReDoS via globstar
patterns)</li>
<li>Bump <code>undici</code> to v6.24.1 (WebSocket decompression bomb
protection, header validation fixes)</li>
<li>Bump <code>fast-xml-parser</code> to v5.5.6</li>
</ul>
<h3>5.0.3</h3>
<ul>
<li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a
href="https://github.com/actions/cache/security/dependabot/33">https://github.com/actions/cache/security/dependabot/33</a>)</li>
<li>Bump <code>@actions/core</code> to v2.0.3</li>
</ul>
<h3>5.0.2</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/cache/commit/55cc8345863c7cc4c66a329aec7e433d2d1c52a9"><code>55cc834</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/cache/issues/1768">#1768</a>
from jasongin/readonly-cache</li>
<li><a
href="https://github.com/actions/cache/commit/d8cd72f230726cdf4457ebb61ec1b593a8d12337"><code>d8cd72f</code></a>
Bump <code>@​actions/cache</code> to v6.1.0 - handle cache write error
due to RO token</li>
<li><a
href="https://github.com/actions/cache/commit/2c8a9bd7457de244a408f35966fab2fb45fda9c8"><code>2c8a9bd</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/cache/issues/1760">#1760</a>
from actions/samirat/esm_migration_and_package_update</li>
<li><a
href="https://github.com/actions/cache/commit/e9b91fdc3fea7d79165fceb79042ef45c2d51023"><code>e9b91fd</code></a>
Prettier fixes</li>
<li><a
href="https://github.com/actions/cache/commit/e4884b8ff7f92ef6b52c79eda480bbc86e685adb"><code>e4884b8</code></a>
Rebuild dist</li>
<li><a
href="https://github.com/actions/cache/commit/10baf0191a3c426ea0fa4a3253a5c04233b6e18f"><code>10baf01</code></a>
Fixed licenses</li>
<li><a
href="https://github.com/actions/cache/commit/e39b386c9004d72a15d864ade8c0b3a702d47a37"><code>e39b386</code></a>
Fix test mock return order</li>
<li><a
href="https://github.com/actions/cache/commit/b6928203372a8571ff984c0c883ef3a1adfb0c06"><code>b692820</code></a>
PR feedback</li>
<li><a
href="https://github.com/actions/cache/commit/60749128a44d25d3c520a489e576380cf00ff3f1"><code>6074912</code></a>
Rebuild dist bundles as ESM to match type:module</li>
<li><a
href="https://github.com/actions/cache/commit/5a912e8b4af820fa082a0e75cfd2c782f8fbfe0e"><code>5a912e8</code></a>
Fix lint and jest issues</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/cache/compare/v4.3.0...55cc8345863c7cc4c66a329aec7e433d2d1c52a9">compare
view</a></li>
</ul>
</details>
<br />

Updates `openai/codex-action` from 1.11 to 1.12
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/openai/codex-action/blob/main/CHANGELOG.md">openai/codex-action's
changelog</a>.</em></p>
<blockquote>
<h1>codex-action Changelog</h1>
<h2><a
href="https://github.com/openai/codex-action/tree/v1.12">v1.12</a>
(2026-08-20)</h2>
<ul>
<li>Strengthen Linux runner privilege isolation and Responses API proxy
credential handling.</li>
<li>Reject Codex arguments and configuration overrides that conflict
with protected execution settings.</li>
<li>Require unprivileged user namespaces for Linux
<code>drop-sudo</code>; run the action after steps that need
<code>sudo</code>, Docker, or privileged service sockets.</li>
<li>Document runner requirements, permission-profile behavior, and
trusted configuration boundaries.</li>
</ul>
<h2><a
href="https://github.com/openai/codex-action/tree/v1.11">v1.11</a>
(2026-07-04)</h2>
<ul>
<li><a
href="https://redirect.github.com/openai/codex-action/pull/116">#116</a>
keep the permission profile helper backward compatible</li>
</ul>
<h2><a
href="https://github.com/openai/codex-action/tree/v1.10">v1.10</a>
(2026-07-02)</h2>
<ul>
<li><a
href="https://redirect.github.com/openai/codex-action/pull/113">#113</a>
add Codex permission profile support</li>
</ul>
<h2><a href="https://github.com/openai/codex-action/tree/v1.9">v1.9</a>
(2026-06-22)</h2>
<ul>
<li><a
href="https://redirect.github.com/openai/codex-action/pull/85">#85</a>
update the internal <code>setup-node</code> pin to
<code>v6.3.0</code></li>
</ul>
<h2><a href="https://github.com/openai/codex-action/tree/v1.8">v1.8</a>
(2026-04-29)</h2>
<ul>
<li><a
href="https://redirect.github.com/openai/codex-action/pull/91">#91</a>
tighten what bots are allowed</li>
</ul>
<h2><a href="https://github.com/openai/codex-action/tree/v1.7">v1.7</a>
(2026-04-24)</h2>
<ul>
<li><a
href="https://redirect.github.com/openai/codex-action/pull/89">#89</a>
restrict bot permission bypass</li>
</ul>
<h2><a href="https://github.com/openai/codex-action/tree/v1.6">v1.6</a>
(2026-03-16)</h2>
<ul>
<li><a
href="https://redirect.github.com/openai/codex-action/pull/77">#77</a>
enable GitHub-hosted Linux bubblewrap support</li>
</ul>
<h2><a href="https://github.com/openai/codex-action/tree/v1.5">v1.5</a>
(2026-03-16)</h2>
<ul>
<li><a
href="https://redirect.github.com/openai/codex-action/pull/74">#74</a>
harden shell interpolation in action workflows</li>
</ul>
<h2><a href="https://github.com/openai/codex-action/tree/v1.4">v1.4</a>
(2025-11-19)</h2>
<ul>
<li><a
href="https://redirect.github.com/openai/codex-action/pull/58">#58</a>
revert <a
href="https://redirect.github.com/openai/codex-action/issues/56">#56</a>
and use the latest stable version of Codex CLI again</li>
</ul>
<h2><a href="https://github.com/openai/codex-action/tree/v1.3">v1.3</a>
(2025-11-19)</h2>
<ul>
<li><a
href="https://redirect.github.com/openai/codex-action/pull/56">#56</a>
temporarily set the default version of Codex CLI to
<code>0.58.0</code></li>
</ul>
<h2><a href="https://github.com/openai/codex-action/tree/v1.2">v1.2</a>
(2025-11-07)</h2>
<ul>
<li><a
href="https://redirect.github.com/openai/codex-action/pull/52">#52</a>
add <code>baseUrl</code> to <code>Octokit</code> constructor, if
appropriate, for GHE</li>
</ul>
<h2><a href="https://github.com/openai/codex-action/tree/v1.1">v1.1</a>
(2025-11-05)</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/openai/codex-action/commit/86365089eb2b84e0a8fb0717b304f8bdcb13b20e"><code>8636508</code></a>
fix: improve runner setup and configuration handling</li>
<li><a
href="https://github.com/openai/codex-action/commit/c385816875cc2fc8e033ed9d1cba96f8c331210e"><code>c385816</code></a>
Retry network errors/transient HTTP errors in GitHub API requests (<a
href="https://redirect.github.com/openai/codex-action/issues/128">#128</a>)</li>
<li><a
href="https://github.com/openai/codex-action/commit/dd78cb653811af44014baa08fe954e28d32c1bf9"><code>dd78cb6</code></a>
docs: update CHANGELOG for v1.11 (<a
href="https://redirect.github.com/openai/codex-action/issues/117">#117</a>)</li>
<li>See full diff in <a
href="https://github.com/openai/codex-action/compare/52fe01ec70a42f454c9d2ebd47598f9fd6893d56...86365089eb2b84e0a8fb0717b304f8bdcb13b20e">compare
view</a></li>
</ul>
</details>
<br />

Updates `anthropics/claude-code-action/base-action` from 1.0.185 to
1.0.199
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-code-action/releases">anthropics/claude-code-action/base-action's
releases</a>.</em></p>
<blockquote>
<h2>v1.0.199</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(github): honor GITHUB_GRAPHQL_URL for the GraphQL client by <a
href="https://github.com/rover0811"><code>@​rover0811</code></a> in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1575">anthropics/claude-code-action#1575</a></li>
<li>fix(cleanup): keep the base-branch config revert out of the
auto-commit by <a
href="https://github.com/GautamSharma99"><code>@​GautamSharma99</code></a>
in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1677">anthropics/claude-code-action#1677</a></li>
<li>fix(mcp): recognize mcp__github aggregate selector for GitHub MCP
server initialization by <a
href="https://github.com/anishesg"><code>@​anishesg</code></a> in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1657">anthropics/claude-code-action#1657</a></li>
<li>Document 1M gateway models and surface resolved limits by <a
href="https://github.com/ulofiai"><code>@​ulofiai</code></a> in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1608">anthropics/claude-code-action#1608</a></li>
<li>fix: teach claude_args --allowedTools in the signed prompt by <a
href="https://github.com/WeAreResilience"><code>@​WeAreResilience</code></a>
in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1704">anthropics/claude-code-action#1704</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/rover0811"><code>@​rover0811</code></a>
made their first contribution in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1575">anthropics/claude-code-action#1575</a></li>
<li><a
href="https://github.com/GautamSharma99"><code>@​GautamSharma99</code></a>
made their first contribution in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1677">anthropics/claude-code-action#1677</a></li>
<li><a
href="https://github.com/WeAreResilience"><code>@​WeAreResilience</code></a>
made their first contribution in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1704">anthropics/claude-code-action#1704</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/anthropics/claude-code-action/compare/v1.0.198...v1.0.199">https://github.com/anthropics/claude-code-action/compare/v1.0.198...v1.0.199</a></p>
<h2>v1.0.198</h2>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/anthropics/claude-code-action/compare/v1.0.197...v1.0.198">https://github.com/anthropics/claude-code-action/compare/v1.0.197...v1.0.198</a></p>
<h2>v1.0.197</h2>
<h2>What's Changed</h2>
<ul>
<li>fix: neutralize the checkout credential under actions/checkout v6+
include layout (<a
href="https://redirect.github.com/anthropics/claude-code-action/issues/1510">#1510</a>)
by <a href="https://github.com/TemRevil"><code>@​TemRevil</code></a> in
<a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1526">anthropics/claude-code-action#1526</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/TemRevil"><code>@​TemRevil</code></a>
made their first contribution in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1526">anthropics/claude-code-action#1526</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/anthropics/claude-code-action/compare/v1.0.196...v1.0.197">https://github.com/anthropics/claude-code-action/compare/v1.0.196...v1.0.197</a></p>
<h2>v1.0.196</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(security): unify secret redaction in public comment outputs by
<a href="https://github.com/Juwan-Hwang"><code>@​Juwan-Hwang</code></a>
in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1693">anthropics/claude-code-action#1693</a></li>
<li>fix: strip unused ALL_INPUTS environment variable from Claude
subprocess env by <a
href="https://github.com/Juwan-Hwang"><code>@​Juwan-Hwang</code></a> in
<a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1692">anthropics/claude-code-action#1692</a></li>
<li>fix(github): match bot actors in comment filters using GraphQL
__typename by <a
href="https://github.com/Neal006"><code>@​Neal006</code></a> in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1616">anthropics/claude-code-action#1616</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/Juwan-Hwang"><code>@​Juwan-Hwang</code></a>
made their first contribution in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1693">anthropics/claude-code-action#1693</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/anthropics/claude-code-action/compare/v1.0.195...v1.0.196">https://github.com/anthropics/claude-code-action/compare/v1.0.195...v1.0.196</a></p>
<h2>v1.0.195</h2>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/anthropics/claude-code-action/compare/v1.0.194...v1.0.195">https://github.com/anthropics/claude-code-action/compare/v1.0.194...v1.0.195</a></p>
<h2>v1.0.194</h2>
<h2>What's Changed</h2>
<ul>
<li>Harden delete_files MCP tool: validate paths within repo root
(consistency with commit_files) by <a
href="https://github.com/GabrielOnRails"><code>@​GabrielOnRails</code></a>
in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1636">anthropics/claude-code-action#1636</a></li>
<li>Only limit fetch depth when the checkout is already shallow by <a
href="https://github.com/winklemad"><code>@​winklemad</code></a> in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1647">anthropics/claude-code-action#1647</a></li>
<li>fix(base-action): add ~/.local/bin to $GITHUB_PATH after
auto-install by <a
href="https://github.com/anishesg"><code>@​anishesg</code></a> in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1643">anthropics/claude-code-action#1643</a></li>
<li>feat(context): include diffHunk in PR review comment context by <a
href="https://github.com/rishavnaskar"><code>@​rishavnaskar</code></a>
in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1584">anthropics/claude-code-action#1584</a></li>
<li>ci: skip Claude-backed test jobs on fork PRs by <a
href="https://github.com/ashwin-ant"><code>@​ashwin-ant</code></a> in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1655">anthropics/claude-code-action#1655</a></li>
<li>fix: bump shell-quote to 1.8.4 to remediate CVE-2026-9277 by <a
href="https://github.com/doshidhaval"><code>@​doshidhaval</code></a> in
<a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1557">anthropics/claude-code-action#1557</a></li>
<li>fix(images): bound attachment downloads by <a
href="https://github.com/abhinavkr26104"><code>@​abhinavkr26104</code></a>
in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1625">anthropics/claude-code-action#1625</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/anthropics/claude-code-action/commit/dcb57747bfceeaa1fa72638cae52295d1d853d4a"><code>dcb5774</code></a>
chore: bump Claude Code to 2.1.239 and Agent SDK to 0.3.239</li>
<li><a
href="https://github.com/anthropics/claude-code-action/commit/492d2d78ee1f7dd5b58581c639b49752db9a2fab"><code>492d2d7</code></a>
fix: teach claude_args --allowedTools in the signed prompt (<a
href="https://redirect.github.com/anthropics/claude-code-action/issues/1704">#1704</a>)</li>
<li><a
href="https://github.com/anthropics/claude-code-action/commit/2ca5fb40278a805fe7cb3dbd6fc7b5f26405448b"><code>2ca5fb4</code></a>
fix: surface resolved model limits (<a
href="https://redirect.github.com/anthropics/claude-code-action/issues/1608">#1608</a>)</li>
<li><a
href="https://github.com/anthropics/claude-code-action/commit/f3f2789f0a82eb276afdbac6f0d7cb10f4e7a460"><code>f3f2789</code></a>
fix(mcp): recognize mcp__github aggregate selector for GitHub MCP server
init...</li>
<li><a
href="https://github.com/anthropics/claude-code-action/commit/6a5f1d8e0a0fcd8d2f8e79932c1880b600c9e5e7"><code>6a5f1d8</code></a>
fix(cleanup): keep the base-branch config revert out of the auto-commit
(<a
href="https://redirect.github.com/anthropics/claude-code-action/issues/1677">#1677</a>)</li>
<li><a
href="https://github.com/anthropics/claude-code-action/commit/39ad3c89776dd68327979412d8ad0e9bec1805ef"><code>39ad3c8</code></a>
fix(github): honor GITHUB_GRAPHQL_URL for the GraphQL client (<a
href="https://redirect.github.com/anthropics/claude-code-action/issues/1575">#1575</a>)</li>
<li><a
href="https://github.com/anthropics/claude-code-action/commit/3f854a8fb5146b39d5cbf8b57f70d80810e1366f"><code>3f854a8</code></a>
chore: bump Claude Code to 2.1.238 and Agent SDK to 0.3.238</li>
<li><a
href="https://github.com/anthropics/claude-code-action/commit/5ee796a55f92566ecd7e39d70dd613abcbea0d7c"><code>5ee796a</code></a>
chore: bump Claude Code to 2.1.237 and Agent SDK to 0.3.237</li>
<li><a
href="https://github.com/anthropics/claude-code-action/commit/cff8d3c8f08ae322e07a1c98ef1b882dc32ddc46"><code>cff8d3c</code></a>
fix(git-config): neutralize checkout credential in include-based config
(<a href="https://redirect.g...

_Description has been truncated_
 2026-08-25 16:05:29 +02:00
Alberto Schiabel c5be77b52a fix(docs): restore data sync and toolkit route availability (#4242) 
This PR:

- restores `Docs - Update Data` by requesting only GitHub App
permissions granted to the installation and using `github.token` for
same-repository issues
- makes the support-knowledge token and every dependent verification
step non-fatal, while closing the data-sync failure issue after recovery
- keeps toolkit pages snapshot-first, then resolves one validated
production slug without exposing custom, disabled, or excluded toolkits
- bounds live lookups with a 15-second timeout, one-hour positive
revalidation, a bounded 60-second negative cache, and concurrent request
coalescing
- monitors a known toolkit as HTTP 200 and an invalid toolkit as HTTP
404, and runs workflow contract tests for workflow-only edits
- records ownership, rollback, deployment, and deferred `/llms.mdx`
parity in the docs decision log

Related: #4204

## Validation

- `bun run test`: 505 passed
- `bun run types:check`: passed
- `bun run lint:links`: passed
- `bun run lint`: passed with pre-existing warnings only
- exact-head [`Docs - Update Data` run
32850296811](https://github.com/ComposioHQ/composio/actions/runs/32850296811)
passed token creation, generation, PR update, and recovery tracking at
`0fb5438c3b7f1d61af357a7d80a9ec36e393cd94`
- the generated-data update remains open for review: [GitHub PR
#4189](https://github.com/ComposioHQ/composio/pull/4189) · [Glen
review](https://app.tryglen.com/ComposioHQ/composio/pull/4189)
- exact-head [`Docs Health Check` run
32850304920](https://github.com/ComposioHQ/composio/actions/runs/32850304920)
confirmed the new toolkit probes as 200 and 404; the workflow still
failed on the existing `/api/knowledge-search` hybrid-mode assertion
- exact-head [`Docs - Tests` run
32849568061](https://github.com/ComposioHQ/composio/actions/runs/32849568061)
passed static tests, semantic-artifact verification, the production
build, and integration tests
- `bun run check:kb-semantic` passes with a refreshed 876-record
artifact
- the local live-miss integration assertion was skipped because no local
production API key is configured; hosted `COMPOSIO_API_KEY` presence is
confirmed, but its production read scope is not

## Post-deploy monitoring

- Owner/window: Docs and SDK maintainers, first production deployment
through 24 hours
- Healthy: snapshot toolkit 200, production-only native toolkit 200,
invalid/custom/disabled toolkit 404, and no recurring data-sync failure
issue
- Watch: Vercel logs for `[Toolkits] Production toolkit lookup failed`,
GitHub Actions for token HTTP 422 or `docs-data-sync-failure`, and
health-check status drift
- Roll back: set `COMPOSIO_TOOLKIT_LIVE_FALLBACK=0` and create a new
Vercel deployment, or revert the route fallback and deploy that revision

---

[![Compound
Engineering](https://img.shields.io/badge/Built_with-Compound_Engineering-6366f1)](https://github.com/EveryInc/compound-engineering-plugin)
![GPT-5](https://img.shields.io/badge/GPT--5-000000)
 2026-08-25 16:02:17 +02:00
Alberto Schiabel f174b28c3a fix(sdk): omit empty file-uploadable arguments from tool execution (#4238) 
This PR:

- closes https://github.com/ComposioHQ/composio/issues/4233
- stops forwarding `""` for a `file_uploadable` parameter (e.g. Gmail
`attachment`) to the backend, which rejected it with `Input should be a
valid dictionary or instance of FileUploadable`
- Python: parameterizes the upload walker on a `leaf` handler and adds
`FileHelper.drop_empty_file_uploads()`, run on both `Tools.execute`
paths when `dangerously_allow_auto_upload_download_files` is off (the
default)
- TypeScript: moves the walker into the runtime-neutral
`walkFileUploadableLeaves()` with a `DELETE_VALUE` sentinel and
`dropEmptyFileUploads()`, so the flag-off path also works on edge
runtimes; with the flag on, `''` is no longer attempted as an upload
(previously threw `Either path or blob must be provided`)
- TypeScript: `schemaHasFileProperty()` now looks through
`$defs`/`definitions`, so the flag-off pass (and the existing one-shot
warning) fire for `$ref`-based file schemas
- keeps each SDK's existing `null` semantics: Python omits `None` as
before, TypeScript still passes `null` through for schemas with a `null`
variant
- adds regression tests for both SDKs and a `@composio/core` changeset

## Context

Reproduced against staging with `composio==0.16.0` and the current SDK:
the live `GMAIL_CREATE_EMAIL_DRAFT` schema is `anyOf[FileUploadable,
array[FileUploadable]]` with no `null` variant, and `""` yields the
exact error from the issue on `no_auth` file tools
(`TEXT_TO_PDF_UPLOAD_FILE`). With this change the backend sees the
parameter as not provided, matching what the playground UI sends.
 2026-08-25 16:01:54 +02:00
jkomyno 4ee3ff83bc fix(python): preserve null nested file containers 2026-08-25 14:49:03 +02:00
jkomyno 0fb5438c3b fix(docs): refresh semantic search artifact 2026-08-25 14:47:15 +02:00
jkomyno 6873867bda ci(docs): add semantic artifact rebuild dispatch 2026-08-25 14:43:23 +02:00
Mark McDonald 96c6260b8c Merge branch 'next' into 37f-docs 2026-08-25 15:07:51 +08:00
Mark McDonald e3d2c093e3 docs(gemini): update to use gemini 3.7 and new models 2026-08-25 15:05:11 +08:00
jkomyno cfc5be7a5d fix(docs): support canonical public toolkit slugs 2026-08-25 04:33:16 +02:00
jkomyno aabbff9d31 fix(docs): normalize toolkit resolver slugs 2026-08-25 04:25:14 +02:00
jkomyno a2f4778512 fix(ci): isolate toolkit resolver tests 2026-08-25 04:23:05 +02:00
jkomyno 765d67ad65 fix(ts): preserve proxy compatibility suppression 2026-08-25 04:14:40 +02:00
jkomyno 635d96af9b ci(review): run docs tests for data workflow edits 2026-08-25 04:13:52 +02:00
jkomyno 35f46c567b fix(review): enforce public toolkit fallback policy 2026-08-25 04:13:45 +02:00
jkomyno a61ad27940 fix(ts): preprocess session file uploads 2026-08-25 04:09:48 +02:00
jkomyno cf25f25363 fix(python): preserve nullable file upload arguments 2026-08-25 04:09:41 +02:00
jkomyno 5ff344bc34 fix(docs): bound toolkit miss cache 2026-08-25 03:42:01 +02:00
jkomyno 8ff9e73b2b test(docs): validate workflow YAML shape 2026-08-25 03:40:37 +02:00
jkomyno f61d0d4ad7 docs: record toolkit availability recovery 2026-08-25 03:35:30 +02:00
jkomyno 7545287e21 fix(docs): render live toolkits on snapshot miss 2026-08-25 03:33:09 +02:00
jkomyno 26bc3d08a1 ci(docs): monitor toolkit routes 2026-08-25 03:31:09 +02:00
jkomyno 3716bda4cb fix(docs): resolve snapshot-miss toolkits 2026-08-25 03:26:19 +02:00
jkomyno 46bc17864e fix(docs): isolate data sync credentials 2026-08-25 03:22:53 +02:00
jkomyno 505d8914ad fix(core): keep @ts-ignore on deprecated proxy param 2026-08-25 02:09:19 +02:00
dependabot[bot] cf08a2b2f7 fix(deps): bump the github-actions group across 1 directory with 7 updates 
Bumps the github-actions group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4.4.0` | `7.0.1` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.2` | `7.0.1` |
| [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) | `1.0.185` | `1.0.199` |
| [actions/setup-python](https://github.com/actions/setup-python) | `5.6.0` | `7.0.0` |
| [actions/cache](https://github.com/actions/cache) | `4.3.0` | `6.1.0` |
| [openai/codex-action](https://github.com/openai/codex-action) | `1.11` | `1.12` |
| [anthropics/claude-code-action/base-action](https://github.com/anthropics/claude-code-action) | `1.0.185` | `1.0.199` |



Updates `actions/checkout` from 4.4.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v4.4.0...3d3c42e5aac5ba805825da76410c181273ba90b1)

Updates `actions/upload-artifact` from 4.6.2 to 7.0.1
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v4.6.2...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a)

Updates `anthropics/claude-code-action` from 1.0.185 to 1.0.199
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](https://github.com/anthropics/claude-code-action/compare/9db594c7a0e82298c121c18b7f08aa1579ce7341...dcb57747bfceeaa1fa72638cae52295d1d853d4a)

Updates `actions/setup-python` from 5.6.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](https://github.com/actions/setup-python/compare/v5.6.0...5fda3b95a4ea91299a34e894583c3862153e4b97)

Updates `actions/cache` from 4.3.0 to 6.1.0
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/v4.3.0...55cc8345863c7cc4c66a329aec7e433d2d1c52a9)

Updates `openai/codex-action` from 1.11 to 1.12
- [Changelog](https://github.com/openai/codex-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/openai/codex-action/compare/52fe01ec70a42f454c9d2ebd47598f9fd6893d56...86365089eb2b84e0a8fb0717b304f8bdcb13b20e)

Updates `anthropics/claude-code-action/base-action` from 1.0.185 to 1.0.199
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](https://github.com/anthropics/claude-code-action/compare/9db594c7a0e82298c121c18b7f08aa1579ce7341...dcb57747bfceeaa1fa72638cae52295d1d853d4a)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.199
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: actions/setup-python
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/cache
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: openai/codex-action
  dependency-version: '1.12'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: anthropics/claude-code-action/base-action
  dependency-version: 1.0.199
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-25 00:00:55 +00:00
jkomyno fe66cbeb77 fix(sdk): omit empty file-uploadable arguments from tool execution 
Both SDKs forwarded "" for a file_uploadable parameter (e.g. Gmail
attachment) verbatim to the backend, which rejected it with a Pydantic
validation error. Python only dropped it inside the opt-in auto-upload
walker; TypeScript never did, and with auto-upload on it tried to upload
the empty string.

Run a schema-aware, upload-free pass on the default execute path that
omits empty file values, and reuse the same walker for staging when
auto-upload is enabled.

Closes #4233
 2026-08-25 01:58:52 +02:00
Alberto Schiabel b0cf0f9226 chore(release): migrate to Changesets v3 (#4235) 
This PR:

- migrates the release tooling to `@changesets/cli` 3.0.1 and
`@changesets/read` 1.0.0
- updates the Changesets config schema to v4 while preserving
private-package tagging
- declares the pnpm workspace in the peer-dependent release fixture
required by Changesets v3
- verifies the release guard and release-workflow fixture

Verified with:

- `pnpm validate:changesets`
- `pnpm test:release-workflow`
 2026-08-25 01:55:15 +02:00
jkomyno 994b2f2fff Merge branch next into chore/changesets-v3-migration 2026-08-25 01:44:03 +02:00
dependabot[bot] 96d6c87705 fix(deps): bump the npm-production group across 1 directory with 26 updates (#4231) 
Bumps the npm-production group with 26 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
|
[@anthropic-ai/claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-typescript)
| `0.3.233` | `0.3.239` |
|
[@mastra/mcp](https://github.com/mastra-ai/mastra/tree/HEAD/packages/mcp)
| `1.16.0` | `1.17.1` |
| [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai) | `6.0.256` |
`6.0.263` |
|
[@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript)
| `0.117.1` | `0.120.0` |
| [@google/genai](https://github.com/googleapis/js-genai) | `2.17.1` |
`2.18.0` |
| [@langchain/core](https://github.com/langchain-ai/langchainjs) |
`1.2.8` | `1.2.9` |
|
[@langchain/langgraph](https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core)
| `1.4.10` | `1.4.12` |
| [@langchain/openai](https://github.com/langchain-ai/langchainjs) |
`1.5.8` | `1.5.10` |
| [langchain](https://github.com/langchain-ai/langchainjs) | `1.5.9` |
`1.5.10` |
| [@openai/agents](https://github.com/openai/openai-agents-js) |
`0.16.0` | `0.17.0` |
| [@langchain/anthropic](https://github.com/langchain-ai/langchainjs) |
`1.5.6` | `1.5.8` |
| [@langchain/mcp-adapters](https://github.com/langchain-ai/langchainjs)
| `1.1.3` | `1.1.4` |
|
[@agentclientprotocol/sdk](https://github.com/agentclientprotocol/typescript-sdk)
| `1.3.0` | `1.4.0` |
| [typebox](https://github.com/sinclairzx81/typebox) | `1.3.14` |
`1.3.16` |
| [@ai-sdk/mcp](https://github.com/vercel/ai/tree/HEAD/packages/mcp) |
`2.0.32` | `2.0.34` |
|
[@ai-sdk/openai](https://github.com/vercel/ai/tree/HEAD/packages/openai)
| `4.0.42` | `4.0.45` |
|
[@cloudflare/vitest-pool-workers](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers)
| `0.21.3` | `0.22.0` |
| [@cloudflare/workers-types](https://github.com/cloudflare/workerd) |
`5.20260815.1` | `5.20260821.1` |
|
[@mastra/core](https://github.com/mastra-ai/mastra/tree/HEAD/packages/core)
| `1.52.1` | `1.61.0` |
|
[@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk)
| `1.26.0` | `1.30.0` |
|
[@types/bun](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/bun)
| `1.3.14` | `1.4.0` |
|
[@vitest/ui](https://github.com/vitest-dev/vitest/tree/HEAD/packages/ui)
| `4.1.10` | `4.1.11` |
| [pnpm](https://github.com/pnpm/pnpm/tree/HEAD/pnpm11/pnpm) | `11.21.0`
| `11.22.0` |
|
[publint](https://github.com/publint/publint/tree/HEAD/packages/publint)
| `0.3.23` | `0.3.24` |
|
[vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest)
| `4.1.10` | `4.1.11` |
|
[wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler)
| `4.123.0` | `4.125.0` |


Updates `@anthropic-ai/claude-agent-sdk` from 0.3.233 to 0.3.239
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/releases">@​anthropic-ai/claude-agent-sdk's
releases</a>.</em></p>
<blockquote>
<h2>v0.3.239</h2>
<h2>What's changed</h2>
<ul>
<li><code>total_cost_usd</code> / <code>modelUsage.costUSD</code> now
include the 1.1× US-only-inference (data residency) multiplier when the
response reports <code>inference_geo: &quot;us&quot;</code></li>
<li>A result held back for background subagents in one-shot mode now
reports <code>total_cost_usd</code>, <code>duration_api_ms</code> and
<code>modelUsage</code> as of its release, not the turn-end
snapshot</li>
<li>Fixed <code>SYSTEM_PROMPT_DYNAMIC_BOUNDARY</code> in an array
<code>systemPrompt</code> being sent to the model as literal text on
Bedrock, Vertex, Foundry, and gateway providers</li>
<li>A repeated <code>initialize</code> on a running process is now
followed by a <code>background_tasks_changed</code> snapshot of the live
background tasks, so reconnecting hosts see work that is still
running</li>
</ul>
<h2>Update</h2>
<pre lang="sh"><code>npm install @anthropic-ai/claude-agent-sdk@0.3.239
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.239
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.239
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.239
</code></pre>
<h2>v0.3.238</h2>
<h2>What's changed</h2>
<ul>
<li>Added <code>is_backgrounded</code> and <code>spawn_depth</code> to
<code>task_started</code> events for subagent tasks
(<code>is_backgrounded</code> also on background Bash tasks)</li>
<li>Added <code>suppressOriginalPrompt</code> to
<code>UserPromptExpansion</code> hook output, matching
<code>UserPromptSubmit</code></li>
<li>Added <code>command_lifecycle</code> state <code>refused</code>: a
cross-session peer message the session's receive-side policy declines
now reports this terminal state instead of producing no lifecycle
frames</li>
<li>Fixed SDK hook callbacks silently not applying after a host re-sends
<code>initialize</code> to an already-running CLI; the response now
reports <code>hooks_applied</code></li>
<li>Fixed <code>CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION=true</code> not
keeping <code>prompt_suggestion</code> messages on when the account is
near, but not over, its usage limit</li>
<li>Changed <code>vcs_state_changed</code> push events to emit one event
per pushed branch</li>
</ul>
<h2>Update</h2>
<pre lang="sh"><code>npm install @anthropic-ai/claude-agent-sdk@0.3.238
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.238
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.238
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.238
</code></pre>
<h2>v0.3.237</h2>
<h2>What's changed</h2>
<ul>
<li>Updated to parity with Claude Code v2.1.237</li>
</ul>
<h2>Update</h2>
<pre lang="sh"><code>&lt;/tr&gt;&lt;/table&gt; 
</code></pre>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/blob/main/CHANGELOG.md">@​anthropic-ai/claude-agent-sdk's
changelog</a>.</em></p>
<blockquote>
<h2>0.3.239</h2>
<ul>
<li><code>total_cost_usd</code> / <code>modelUsage.costUSD</code> now
include the 1.1× US-only-inference (data residency) multiplier when the
response reports <code>inference_geo: &quot;us&quot;</code></li>
<li>A result held back for background subagents in one-shot mode now
reports <code>total_cost_usd</code>, <code>duration_api_ms</code> and
<code>modelUsage</code> as of its release, not the turn-end
snapshot</li>
<li>Fixed <code>SYSTEM_PROMPT_DYNAMIC_BOUNDARY</code> in an array
<code>systemPrompt</code> being sent to the model as literal text on
Bedrock, Vertex, Foundry, and gateway providers</li>
<li>A repeated <code>initialize</code> on a running process is now
followed by a <code>background_tasks_changed</code> snapshot of the live
background tasks, so reconnecting hosts see work that is still
running</li>
</ul>
<h2>0.3.238</h2>
<ul>
<li>Added <code>is_backgrounded</code> and <code>spawn_depth</code> to
<code>task_started</code> events for subagent tasks
(<code>is_backgrounded</code> also on background Bash tasks)</li>
<li>Added <code>suppressOriginalPrompt</code> to
<code>UserPromptExpansion</code> hook output, matching
<code>UserPromptSubmit</code></li>
<li>Added <code>command_lifecycle</code> state <code>refused</code>: a
cross-session peer message the session's receive-side policy declines
now reports this terminal state instead of producing no lifecycle
frames</li>
<li>Fixed SDK hook callbacks silently not applying after a host re-sends
<code>initialize</code> to an already-running CLI; the response now
reports <code>hooks_applied</code></li>
<li>Fixed <code>CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION=true</code> not
keeping <code>prompt_suggestion</code> messages on when the account is
near, but not over, its usage limit</li>
<li>Changed <code>vcs_state_changed</code> push events to emit one event
per pushed branch</li>
</ul>
<h2>0.3.237</h2>
<ul>
<li>Updated to parity with Claude Code v2.1.237</li>
</ul>
<h2>0.3.236</h2>
<ul>
<li><code>PostToolUse</code> hooks can return
<code>hookSpecificOutput.classifierContext</code>, a short host-asserted
note about a tool call's result that the auto mode permission classifier
reads alongside that result</li>
</ul>
<h2>0.3.235</h2>
<ul>
<li>Updated to parity with Claude Code v2.1.235</li>
</ul>
<h2>0.3.234</h2>
<ul>
<li>Removed unused <code>bypass_permissions_disabled</code> from
<code>ExitReason</code> type; the value was never emitted — TypeScript
consumers with an explicit <code>case</code> branch get a compile error
on upgrade (runtime unaffected)</li>
<li>Updated the <code>ApiKeySource</code> type to include the values
<code>system/init</code> actually reports
(<code>ANTHROPIC_API_KEY</code>, <code>apiKeyHelper</code>, <code>/login
managed key</code>, <code>none</code>)</li>
<li><code>vcs_state_changed</code> events report the directory the shell
finished in (an inner <code>cd</code> is reflected)</li>
<li>A peer <code>origin</code> injected by the host may declare the
sending session's permission class (<code>fromMode</code>) so a
same-class message is delivered to a recipient that runs without
asking</li>
<li><code>SDKSystemMessage</code>
(<code>system</code>/<code>init</code>) gains an optional
<code>effort</code> field: the session's applied effort level, or
<code>null</code> when none is sent. Set on Remote Control bridge init
frames</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/ae7e3dd656244b67e8634c33b3137775ae5a3fcd"><code>ae7e3dd</code></a>
chore: Update CHANGELOG.md</li>
<li><a
href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/c4fdbe3a4309f7165a4c3bee179c155d0422ff4c"><code>c4fdbe3</code></a>
chore: Update CHANGELOG.md</li>
<li><a
href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/591a180a197a73ce90042a6f97a7c59c100d2c3a"><code>591a180</code></a>
chore: Update CHANGELOG.md</li>
<li><a
href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/d933c997f2282179582d97c562b4d3451e74c0ee"><code>d933c99</code></a>
chore: Update CHANGELOG.md</li>
<li><a
href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/076593f6db4357c3a050a5ed19c39ba1217eab3a"><code>076593f</code></a>
chore: Update CHANGELOG.md</li>
<li><a
href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/a616205d6cb7c2f5907120f660f6391310918369"><code>a616205</code></a>
chore: Update CHANGELOG.md</li>
<li>See full diff in <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/compare/v0.3.233...v0.3.239">compare
view</a></li>
</ul>
</details>
<br />

Updates `@mastra/mcp` from 1.16.0 to 1.17.1
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/mastra-ai/mastra/blob/main/packages/mcp/CHANGELOG.md">@​mastra/mcp's
changelog</a>.</em></p>
<blockquote>
<h2>1.17.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p>Fixed MCP tool listing when a tool has no input schema. (<a
href="https://redirect.github.com/mastra-ai/mastra/pull/21861">#21861</a>)</p>
</li>
<li>
<p>Fixed <code>Cannot find package '@modelcontextprotocol/sdk'</code>
when importing <code>@mastra/mcp</code> in projects that skip automatic
peer installation (e.g. npm with <code>--legacy-peer-deps</code>), by
declaring the MCP SDK v1 peer required by
<code>@modelcontextprotocol/ext-apps</code> as a direct dependency. (<a
href="https://redirect.github.com/mastra-ai/mastra/pull/21999">#21999</a>)</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/mastra-ai/mastra/commit/88d14cac008582a618fecc3d5c7fd3bdf4f6ddc3"><code>88d14ca</code></a>,
<a
href="https://github.com/mastra-ai/mastra/commit/480e491588bd6a7a1c9ee4407590ad625dd33952"><code>480e491</code></a>,
<a
href="https://github.com/mastra-ai/mastra/commit/9267e9b3d9c2fcf16936050495a787054c2431ab"><code>9267e9b</code></a>,
<a
href="https://github.com/mastra-ai/mastra/commit/acc3471de5f3fde8027ee4e355af292b2bc1bc30"><code>acc3471</code></a>,
<a
href="https://github.com/mastra-ai/mastra/commit/b6a771ef23d203ddb348efca8065eff65def8191"><code>b6a771e</code></a>,
<a
href="https://github.com/mastra-ai/mastra/commit/84a5b699f84d6bae0a34efe5a970d891090b9f41"><code>84a5b69</code></a>,
<a
href="https://github.com/mastra-ai/mastra/commit/9267e9b3d9c2fcf16936050495a787054c2431ab"><code>9267e9b</code></a>,
<a
href="https://github.com/mastra-ai/mastra/commit/3bb88ddf07fb98f3cd16d3bff94e51cd3b45d011"><code>3bb88dd</code></a>,
<a
href="https://github.com/mastra-ai/mastra/commit/d23e75d57cc7cf5b9bfdbee896bf5a6a2484fed7"><code>d23e75d</code></a>,
<a
href="https://github.com/mastra-ai/mastra/commit/c8faa4e1cfebaec56b65e754e90b9fe46d153359"><code>c8faa4e</code></a>,
<a
href="https://github.com/mastra-ai/mastra/commit/d378d7511f71309ed61a8f6b93cd0361dc6cb70f"><code>d378d75</code></a>,
<a
href="https://github.com/mastra-ai/mastra/commit/84a5b699f84d6bae0a34efe5a970d891090b9f41"><code>84a5b69</code></a>,
<a
href="https://github.com/mastra-ai/mastra/commit/26d40160ff7f7d8bf95fee2039a52cbc83863533"><code>26d4016</code></a>,
<a
href="https://github.com/mastra-ai/mastra/commit/7c60df5c7872343fbac5c3e5b1175c8076a5abfd"><code>7c60df5</code></a>,
<a
href="https://github.com/mastra-ai/mastra/commit/9267e9b3d9c2fcf16936050495a787054c2431ab"><code>9267e9b</code></a>,
<a
href="https://github.com/mastra-ai/mastra/commit/84a5b699f84d6bae0a34efe5a970d891090b9f41"><code>84a5b69</code></a>,
<a
href="https://github.com/mastra-ai/mastra/commit/f2031a47445e8f67a89ba1309036816f97ab7a65"><code>f2031a4</code></a>,
<a
href="https://github.com/mastra-ai/mastra/commit/9267e9b3d9c2fcf16936050495a787054c2431ab"><code>9267e9b</code></a>,
<a
href="https://github.com/mastra-ai/mastra/commit/cad42082e6aa1776168a94914f523334be45d929"><code>cad4208</code></a>,
<a
href="https://github.com/mastra-ai/mastra/commit/8e529d4ac754efef04b225841349e0da9edf89a6"><code>8e529d4</code></a>,
<a
href="https://github.com/mastra-ai/mastra/commit/57c51035a2a36e3df3c4f32f46bb789a66ed5946"><code>57c5103</code></a>,
<a
href="https://github.com/mastra-ai/mastra/commit/038b7b405cb4ac25ab3f3031334111b1f87ac112"><code>038b7b4</code></a>,
<a
href="https://github.com/mastra-ai/mastra/commit/4132d61f8367077120ee9e6420d3224dffd93c93"><code>4132d61</code></a>,
<a
href="https://github.com/mastra-ai/mastra/commit/d378d7511f71309ed61a8f6b93cd0361dc6cb70f"><code>d378d75</code></a>]:</p>
<ul>
<li><code>@​mastra/core</code><a
href="https://github.com/1"><code>@​1</code></a>.61.0</li>
</ul>
</li>
</ul>
<h2>1.17.1-alpha.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p>Fixed <code>Cannot find package '@modelcontextprotocol/sdk'</code>
when importing <code>@mastra/mcp</code> in projects that skip automatic
peer installation (e.g. npm with <code>--legacy-peer-deps</code>), by
declaring the MCP SDK v1 peer required by
<code>@modelcontextprotocol/ext-apps</code> as a direct dependency. (<a
href="https://redirect.github.com/mastra-ai/mastra/pull/21999">#21999</a>)</p>
</li>
<li>
<p>Updated dependencies:</p>
<ul>
<li><code>@​mastra/core</code><a
href="https://github.com/1"><code>@​1</code></a>.61.0-alpha.4</li>
</ul>
</li>
</ul>
<h2>1.17.1-alpha.0</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p>Fixed MCP tool listing when a tool has no input schema. (<a
href="https://redirect.github.com/mastra-ai/mastra/pull/21861">#21861</a>)</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/mastra-ai/mastra/commit/88d14cac008582a618fecc3d5c7fd3bdf4f6ddc3"><code>88d14ca</code></a>,
<a
href="https://github.com/mastra-ai/mastra/commit/84a5b699f84d6bae0a34efe5a970d891090b9f41"><code>84a5b69</code></a>,
<a
href="https://github.com/mastra-ai/mastra/commit/84a5b699f84d6bae0a34efe5a970d891090b9f41"><code>84a5b69</code></a>,
<a
href="https://github.com/mastra-ai/mastra/commit/84a5b699f84d6bae0a34efe5a970d891090b9f41"><code>84a5b69</code></a>,
<a
href="https://github.com/mastra-ai/mastra/commit/038b7b405cb4ac25ab3f3031334111b1f87ac112"><code>038b7b4</code></a>,
<a
href="https://github.com/mastra-ai/mastra/commit/4132d61f8367077120ee9e6420d3224dffd93c93"><code>4132d61</code></a>]:</p>
<ul>
<li><code>@​mastra/core</code><a
href="https://github.com/1"><code>@​1</code></a>.60.1-alpha.0</li>
</ul>
</li>
</ul>
<h2>1.17.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>
<p>MCP tools served over HTTP now see the authenticated caller. When an
MCP server runs behind a Mastra server with <code>server.auth</code>
configured, the resolved user is bridged into
<code>extra.authInfo</code> automatically, on both the streamable HTTP
and SSE transports. Previously <code>extra.authInfo</code> was always
undefined because the request handed to the MCP transport was rebuilt
without the auth data. (<a
href="https://redirect.github.com/mastra-ai/mastra/pull/21689">#21689</a>)</p>
<p><strong>Custom verification</strong></p>
<p>If your own middleware verifies the caller, build the auth info
yourself with the new <code>server.mcpOptions.setRequestAuth</code>
hook:</p>
<pre lang="ts"><code>export const mastra = new Mastra({
  mcpServers: { myServer },
  server: {
    middleware: [verifyBearerToken],
    mcpOptions: {
      setRequestAuth: (req, requestContext) =&gt; {
        const payload = requestContext.get('bearerPayload');
req.auth = { token: payload.token, clientId: payload.sub, scopes:
payload.scope.split(' ') };
      },
    },
</code></pre>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/mastra-ai/mastra/commit/ce66f918f0e27984772b524220e87be0e69cebe3"><code>ce66f91</code></a>
chore: version - exit prerelease mode</li>
<li><a
href="https://github.com/mastra-ai/mastra/commit/cc6549590e54065c70721a2b4af025c91550792b"><code>cc65495</code></a>
chore: version packages (alpha) (<a
href="https://github.com/mastra-ai/mastra/tree/HEAD/packages/mcp/issues/22001">#22001</a>)</li>
<li><a
href="https://github.com/mastra-ai/mastra/commit/1d41dd06a001c6fee3aab1cdf1ec759f2070df3e"><code>1d41dd0</code></a>
fix(mcp): declare <code>@​modelcontextprotocol/sdk</code> v1 as a direct
dependency (<a
href="https://github.com/mastra-ai/mastra/tree/HEAD/packages/mcp/issues/21999">#21999</a>)</li>
<li><a
href="https://github.com/mastra-ai/mastra/commit/8c6990aefc426c68a63560328bef4033f9ae8f77"><code>8c6990a</code></a>
chore: version packages</li>
<li><a
href="https://github.com/mastra-ai/mastra/commit/64cd7ac22c2c7a6e6b533a4b3a9ede432700f1fb"><code>64cd7ac</code></a>
fix(mcp): list tools without input schemas (<a
href="https://github.com/mastra-ai/mastra/tree/HEAD/packages/mcp/issues/21861">#21861</a>)</li>
<li><a
href="https://github.com/mastra-ai/mastra/commit/c23d44525cb59f271fca8978bbaae05b7b6b3b9e"><code>c23d445</code></a>
chore: version - exit prerelease mode</li>
<li><a
href="https://github.com/mastra-ai/mastra/commit/86bde188a70540ebe849bd8a77594d88ffb77e2f"><code>86bde18</code></a>
chore: version packages (alpha) (<a
href="https://github.com/mastra-ai/mastra/tree/HEAD/packages/mcp/issues/21734">#21734</a>)</li>
<li><a
href="https://github.com/mastra-ai/mastra/commit/39ba1b9ce256a9a910a16f125cc6a59588185bfe"><code>39ba1b9</code></a>
feat(mcp): elicitation on the 2026-07-28 protocol leg via multi
round-trip re...</li>
<li><a
href="https://github.com/mastra-ai/mastra/commit/0f53aeb119158bd9f83bd8ef667f1f675740e8f0"><code>0f53aeb</code></a>
feat(mcp): opt-in MCP protocol revision 2026-07-28 behind a
protocolVersion f...</li>
<li><a
href="https://github.com/mastra-ai/mastra/commit/9f626699ac4422352721b2a3ca95ed5543763294"><code>9f62669</code></a>
chore: version packages (alpha) (<a
href="https://github.com/mastra-ai/mastra/tree/HEAD/packages/mcp/issues/21597">#21597</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/mastra-ai/mastra/commits/@mastra/mcp@1.17.1/packages/mcp">compare
view</a></li>
</ul>
</details>
<br />

Updates `ai` from 6.0.256 to 6.0.263
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/ai/blob/ai@6.0.263/packages/ai/CHANGELOG.md">ai's
changelog</a>.</em></p>
<blockquote>
<h2>6.0.263</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [1e70580]
<ul>
<li><code>@​ai-sdk/gateway</code><a
href="https://github.com/3"><code>@​3</code></a>.0.179</li>
</ul>
</li>
</ul>
<h2>6.0.262</h2>
<h3>Patch Changes</h3>
<ul>
<li>30526e9: Prevent exceptions in streaming <code>onChunk</code> and
<code>onError</code> callbacks from terminating the stream or masking
provider errors.</li>
<li>Updated dependencies [7de3226]</li>
<li>Updated dependencies [504da15]
<ul>
<li><code>@​ai-sdk/gateway</code><a
href="https://github.com/3"><code>@​3</code></a>.0.178</li>
</ul>
</li>
</ul>
<h2>6.0.261</h2>
<h3>Patch Changes</h3>
<ul>
<li>f1afbf9: Fix array-backed language model mocks to return configured
results in order from the first call.</li>
</ul>
<h2>6.0.260</h2>
<h3>Patch Changes</h3>
<ul>
<li>98c656f: fix: reject <code>streamObject</code> result promises and
report failed completion when the provider stream errors</li>
<li>b253d52: Filter preliminary tool outputs when
<code>ignoreIncompleteToolCalls</code> is enabled.</li>
<li>9e15cb4: Prevent automatic tool execution when a model call ends
with an unsafe finish reason.</li>
</ul>
<h2>6.0.259</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [def7999]
<ul>
<li><code>@​ai-sdk/gateway</code><a
href="https://github.com/3"><code>@​3</code></a>.0.177</li>
</ul>
</li>
</ul>
<h2>6.0.258</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [96304fc]
<ul>
<li><code>@​ai-sdk/gateway</code><a
href="https://github.com/3"><code>@​3</code></a>.0.176</li>
</ul>
</li>
</ul>
<h2>6.0.257</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [000b243]
<ul>
<li><code>@​ai-sdk/gateway</code><a
href="https://github.com/3"><code>@​3</code></a>.0.175</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/ai/commit/23e4c50cf56b0a9fca260098b731b1f730fd6254"><code>23e4c50</code></a>
Version Packages (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/19261">#19261</a>)</li>
<li><a
href="https://github.com/vercel/ai/commit/b55c2a9941725e0723a0abb0dc26a00baddab59b"><code>b55c2a9</code></a>
Version Packages (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/19212">#19212</a>)</li>
<li><a
href="https://github.com/vercel/ai/commit/30526e9ec8265181756c24ac6e8ff41b17d4366f"><code>30526e9</code></a>
[v6.0] fix: contain streaming callback exceptions without interrupting
consum...</li>
<li><a
href="https://github.com/vercel/ai/commit/d3f6cc9591a5482656decf88ee5cd08cdfaddc58"><code>d3f6cc9</code></a>
Version Packages (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/19191">#19191</a>)</li>
<li><a
href="https://github.com/vercel/ai/commit/f1afbf981dc66ea4ca290d778232b96640b6c14a"><code>f1afbf9</code></a>
[v6.0] fix: return array-backed mock language model results in
configured ord...</li>
<li><a
href="https://github.com/vercel/ai/commit/bb5526fc0b981bcb2c95accde20bf93b1b317de2"><code>bb5526f</code></a>
Version Packages (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/19131">#19131</a>)</li>
<li><a
href="https://github.com/vercel/ai/commit/9e15cb48a5f82f8e241ed71ad28918341ae5b16a"><code>9e15cb4</code></a>
[v6.0] fix: automatic tools executing after unsafe model finish reasons
(<a
href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/19120">#19120</a>)</li>
<li><a
href="https://github.com/vercel/ai/commit/b253d5245e9cd29a59811d1a18677c63c9a77f93"><code>b253d52</code></a>
[v6.0] fix: omit preliminary tool outputs when ignoring incomplete tool
calls...</li>
<li><a
href="https://github.com/vercel/ai/commit/98c656f768f0ae3a887b4251340f397d878ce5de"><code>98c656f</code></a>
[v6.0] fix: settle streamObject results and report provider stream
failures w...</li>
<li><a
href="https://github.com/vercel/ai/commit/815515120857394d2a3d3979a399f2cf4380a80f"><code>8155151</code></a>
Version Packages (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/19079">#19079</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/ai/commits/ai@6.0.263/packages/ai">compare
view</a></li>
</ul>
</details>
<br />

Updates `@anthropic-ai/sdk` from 0.117.1 to 0.120.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/anthropic-sdk-typescript/releases">@​anthropic-ai/sdk's
releases</a>.</em></p>
<blockquote>
<h2>sdk: v0.120.0</h2>
<h2>0.120.0 (2026-08-19)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.119.0...sdk-v0.120.0">sdk-v0.119.0...sdk-v0.120.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> managed agents web search config and self
hosted sandbox memory (<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/ba8ec50ffe31e10781971a942d54289439307424">ba8ec50</a>)</li>
</ul>
<h3>Chores</h3>
<ul>
<li><strong>internal:</strong> use a single pnpm workspace lockfile (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/359">#359</a>)
(<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/3c32145d2bc4d53888c6c6857c9af216eec95fb9">3c32145</a>)</li>
</ul>
<h2>sdk: v0.119.0</h2>
<h2>0.119.0 (2026-08-19)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.118.0...sdk-v0.119.0">sdk-v0.118.0...sdk-v0.119.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> Files and Skills APIs are now GA; add computer
use and browser use toolsets (<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/ab41aa32b92a7964b35beb42a6be5b0bec1dd735">ab41aa3</a>)</li>
</ul>
<h2>sdk: v0.118.0</h2>
<h2>0.118.0 (2026-08-18)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.117.1...sdk-v0.118.0">sdk-v0.117.1...sdk-v0.118.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> additions to files and memory stores (<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/fdc03790dc3e7fb0352298382f8a9603e92e19c2">fdc0379</a>)</li>
<li><strong>api:</strong> updates to skill, files, and user profiles (<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/671e6b187f475b5a7a797adbbe5b908bd74d3935">671e6b1</a>)</li>
<li><strong>client:</strong> add helpers for accessing the workspace ID
in response headers (<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/28aa5afe3284bcdc2cc35264f6f4d8dd762e186f">28aa5af</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>api:</strong> remove unsupported mid_conv_system content
block (<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/ae6ca9403125b5a0effb22c9d9c65804a99a80bd">ae6ca94</a>)</li>
<li><strong>session-runner:</strong> retry tool-result sends for at
least the lease TTL (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/339">#339</a>)
(<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/7dc632557bfea8475aab8345e27469f02faa6a5a">7dc6325</a>)</li>
</ul>
<h3>Chores</h3>
<ul>
<li><strong>internal:</strong> bump zod to 4.4.3 (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/334">#334</a>)
(<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/faa5b7b841a31967ee4679423c22802d4e70c79f">faa5b7b</a>)</li>
<li><strong>internal:</strong> remove leftover prism references (<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/a163b960ce982ffb2827a0e95a5ae05a1120aa51">a163b96</a>)</li>
<li>stop shipping the v0.50 migration guide and migrate CLI (<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/53992d708ba024c25adabc864fe0268cc065865d">53992d7</a>)</li>
</ul>
<h3>Documentation</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md">@​anthropic-ai/sdk's
changelog</a>.</em></p>
<blockquote>
<h2>0.120.0 (2026-08-19)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.119.0...sdk-v0.120.0">sdk-v0.119.0...sdk-v0.120.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> managed agents web search config and self
hosted sandbox memory (<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/ba8ec50ffe31e10781971a942d54289439307424">ba8ec50</a>)</li>
</ul>
<h3>Chores</h3>
<ul>
<li><strong>internal:</strong> use a single pnpm workspace lockfile (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/359">#359</a>)
(<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/3c32145d2bc4d53888c6c6857c9af216eec95fb9">3c32145</a>)</li>
</ul>
<h2>0.119.0 (2026-08-19)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.118.0...sdk-v0.119.0">sdk-v0.118.0...sdk-v0.119.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> Files and Skills APIs are now GA; add computer
use and browser use toolsets (<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/ab41aa32b92a7964b35beb42a6be5b0bec1dd735">ab41aa3</a>)</li>
</ul>
<h2>0.118.0 (2026-08-18)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.117.1...sdk-v0.118.0">sdk-v0.117.1...sdk-v0.118.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> additions to files and memory stores (<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/fdc03790dc3e7fb0352298382f8a9603e92e19c2">fdc0379</a>)</li>
<li><strong>api:</strong> updates to skill, files, and user profiles (<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/671e6b187f475b5a7a797adbbe5b908bd74d3935">671e6b1</a>)</li>
<li><strong>client:</strong> add helpers for accessing the workspace ID
in response headers (<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/28aa5afe3284bcdc2cc35264f6f4d8dd762e186f">28aa5af</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>api:</strong> remove unsupported mid_conv_system content
block (<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/ae6ca9403125b5a0effb22c9d9c65804a99a80bd">ae6ca94</a>)</li>
<li><strong>session-runner:</strong> retry tool-result sends for at
least the lease TTL (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/339">#339</a>)
(<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/7dc632557bfea8475aab8345e27469f02faa6a5a">7dc6325</a>)</li>
</ul>
<h3>Chores</h3>
<ul>
<li><strong>internal:</strong> bump zod to 4.4.3 (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/334">#334</a>)
(<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/faa5b7b841a31967ee4679423c22802d4e70c79f">faa5b7b</a>)</li>
<li><strong>internal:</strong> remove leftover prism references (<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/a163b960ce982ffb2827a0e95a5ae05a1120aa51">a163b96</a>)</li>
<li>stop shipping the v0.50 migration guide and migrate CLI (<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/53992d708ba024c25adabc864fe0268cc065865d">53992d7</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li><strong>tools:</strong> warn that blocking tool bodies stall the
worker heartbeat (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/299">#299</a>)
(<a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/908fdb5d9de8809190bdcf9d14a8319e80d8f31c">908fdb5</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/bfa9197f0182084941052be9752c948638421601"><code>bfa9197</code></a>
chore: release main</li>
<li><a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/bc167f3c8fe36137c5594a3776e9677d493e6618"><code>bc167f3</code></a>
feat(api): managed agents web search config and self hosted sandbox
memory</li>
<li><a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/83fd8981a7b11321257027c817755305cc0a4b59"><code>83fd898</code></a>
chore(internal): use a single pnpm workspace lockfile (<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/359">#359</a>)</li>
<li><a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/7fe6dd50d509bb68eb0981ad1f7ad046984b426e"><code>7fe6dd5</code></a>
remove internal ticket references from changelog- <a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/360">#360</a></li>
<li><a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/c67e4e2d2329d25ba057f5e60c6dec3b2f33ba97"><code>c67e4e2</code></a>
chore: release main</li>
<li><a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/50fc0dba920417d641734f4abef51627c4785380"><code>50fc0db</code></a>
feat(api): Files and Skills APIs are now GA; add computer use and
browser use...</li>
<li><a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/18ea26d324911c3236f2ce762dd0c87f04d038d3"><code>18ea26d</code></a>
chore: release main</li>
<li><a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/6ed9ddd8924924d20ff4610b83668754629f9478"><code>6ed9ddd</code></a>
feat(api): updates to skill, files, and user profiles</li>
<li><a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/91921f5f0410a8caa638a85b0d38a8102d7e3c91"><code>91921f5</code></a>
fix(session-runner): retry tool-result sends for at least the lease TTL
(<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/339">#339</a>)</li>
<li><a
href="https://github.com/anthropics/anthropic-sdk-typescript/commit/142adcc2b864940a72464e41b63cc5733f38187b"><code>142adcc</code></a>
docs(tools): warn that blocking tool bodies stall the worker heartbeat
(<a
href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/299">#299</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.117.1...sdk-v0.120.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `@google/genai` from 2.17.1 to 2.18.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/js-genai/releases">@​google/genai's
releases</a>.</em></p>
<blockquote>
<h2>v2.18.0</h2>
<h2><a
href="https://github.com/googleapis/js-genai/compare/v2.17.1...v2.18.0">2.18.0</a>
(2026-08-19)</h2>
<h3>Features</h3>
<ul>
<li>Add <code>mode</code> enum (<code>VERBATIM</code>,
<code>SMART</code>) to <code>AudioTranscriptionConfig</code> and
<code>TranscriptionConfig</code>. (<a
href="https://github.com/googleapis/js-genai/commit/4c5208baa923cecea897b7b4fdc9de5e49555709">4c5208b</a>)</li>
<li>Add enable_data_retention to ToolParallelAiSearch, Add step_count to
ReinforcementTuningHyperParameters, Add BidiGenerateContentSetup (<a
href="https://github.com/googleapis/js-genai/commit/f52c20858c1bf6c7892192bc41cfc027d30b57ab">f52c208</a>)</li>
<li>Add IDLE state to live connection status enum and mark
REQUIRES_ACTION as deprecated. (<a
href="https://github.com/googleapis/js-genai/commit/2f110f23372cf2ea52452fe57ddf3a4e30833857">2f110f2</a>)</li>
<li>add video resolution and extension task parameters (<a
href="https://github.com/googleapis/js-genai/commit/39b2a2dea4c5ff75c1754581b213b9d480504e7d">39b2a2d</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>fix examples (<a
href="https://github.com/googleapis/js-genai/commit/3f631be857d0faec43012c2510ce17caea5bffe8">3f631be</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/js-genai/blob/main/CHANGELOG.md">@​google/genai's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/googleapis/js-genai/compare/v2.17.1...v2.18.0">2.18.0</a>
(2026-08-19)</h2>
<h3>Features</h3>
<ul>
<li>Add <code>mode</code> enum (<code>VERBATIM</code>,
<code>SMART</code>) to <code>AudioTranscriptionConfig</code> and
<code>TranscriptionConfig</code>. (<a
href="https://github.com/googleapis/js-genai/commit/4c5208baa923cecea897b7b4fdc9de5e49555709">4c5208b</a>)</li>
<li>Add enable_data_retention to ToolParallelAiSearch, Add step_count to
ReinforcementTuningHyperParameters, Add BidiGenerateContentSetup (<a
href="https://github.com/googleapis/js-genai/commit/f52c20858c1bf6c7892192bc41cfc027d30b57ab">f52c208</a>)</li>
<li>Add IDLE state to live connection status enum and mark
REQUIRES_ACTION as deprecated. (<a
href="https://github.com/googleapis/js-genai/commit/2f110f23372cf2ea52452fe57ddf3a4e30833857">2f110f2</a>)</li>
<li>add video resolution and extension task parameters (<a
href="https://github.com/googleapis/js-genai/commit/39b2a2dea4c5ff75c1754581b213b9d480504e7d">39b2a2d</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>fix examples (<a
href="https://github.com/googleapis/js-genai/commit/3f631be857d0faec43012c2510ce17caea5bffe8">3f631be</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/googleapis/js-genai/commit/128781fdfec5d33f24d8305d90964f3b75b0774f"><code>128781f</code></a>
chore(main): release 2.18.0 (<a
href="https://redirect.github.com/googleapis/js-genai/issues/1856">#1856</a>)</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/67f4cf7c48059de776d2841a5cf5129361a97c49"><code>67f4cf7</code></a>
chore: Internal Changes</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/2f110f23372cf2ea52452fe57ddf3a4e30833857"><code>2f110f2</code></a>
feat: Add IDLE state to live connection status enum and mark
REQUIRES_ACTION ...</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/3f631be857d0faec43012c2510ce17caea5bffe8"><code>3f631be</code></a>
fix: fix examples</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/4c5208baa923cecea897b7b4fdc9de5e49555709"><code>4c5208b</code></a>
feat: Add <code>mode</code> enum (<code>VERBATIM</code>,
<code>SMART</code>) to <code>AudioTranscriptionConfig</code> and...</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/f52c20858c1bf6c7892192bc41cfc027d30b57ab"><code>f52c208</code></a>
feat: Add enable_data_retention to ToolParallelAiSearch, Add step_count
to Re...</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/39b2a2dea4c5ff75c1754581b213b9d480504e7d"><code>39b2a2d</code></a>
feat: add video resolution and extension task parameters</li>
<li>See full diff in <a
href="https://github.com/googleapis/js-genai/compare/v2.17.1...v2.18.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `@langchain/core` from 1.2.8 to 1.2.9
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchainjs/releases">@​langchain/core's
releases</a>.</em></p>
<blockquote>
<h2><code>@​langchain/core</code><a
href="https://github.com/1"><code>@​1</code></a>.2.9</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11402">#11402</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/43e439698fa7794c10ab8d7355d4433e058e4d62"><code>43e4396</code></a>
Thanks <a
href="https://github.com/thushanth-bengre-langchain"><code>@​thushanth-bengre-langchain</code></a>!
- Fix ChatVertexAI/ChatGoogle content blocks: include
<code>tool_call</code> blocks from <code>message.tool_calls</code> and
skip spurious empty <code>text</code> blocks in
<code>contentBlocks</code>.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/e493ed653d734e31a8d051f78ab29b067f530e4b"><code>e493ed6</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11393">#11393</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/83848481ea27502c4221a01b4c55a87f1fa7c472"><code>8384848</code></a>
fix(google-common): release endpoint routing fix as patch (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11413">#11413</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/8cfff4dced1327fc87893a86dfc63c553403aec0"><code>8cfff4d</code></a>
feat(google): add gateway support for genai (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11405">#11405</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/7df258c0af8362fede14d42bb982597a56f41b78"><code>7df258c</code></a>
chore(langchain): update langgraph deps (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11412">#11412</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/3ceef4baadfaec8f0b1e43191b9363cfcc04187f"><code>3ceef4b</code></a>
fix(anthropic): round-trip tool search server-tool result blocks (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11407">#11407</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/fe8eec1915cc5580b8e7a2f3d4f68fe5e577d641"><code>fe8eec1</code></a>
fix(openai): drop Gemini functionCall content blocks in Chat Completions
mess...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/0e7c7654c8bd84b80fe9a2495ab2703355ff8c1e"><code>0e7c765</code></a>
fix(google-genai): throw ContentBlockedError when Gemini candidate has
no con...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/5c9fdf2f0339deb92db84eaa838cf35c7dcdb027"><code>5c9fdf2</code></a>
fix(openai): retain cache_write_tokens, update to v7 sdk (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11399">#11399</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/5ff9179e25f594d7cd21e176fdadd953190375c5"><code>5ff9179</code></a>
fix(google-genai): guard streaming chunks when candidate has no content
(<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10742">#10742</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/43e439698fa7794c10ab8d7355d4433e058e4d62"><code>43e4396</code></a>
fix(core): include tool_call blocks and skip empty text blocks in
ChatVertexA...</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchainjs/compare/@langchain/core@1.2.8...@langchain/core@1.2.9">compare
view</a></li>
</ul>
</details>
<br />

Updates `@langchain/langgraph` from 1.4.10 to 1.4.12
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langgraphjs/releases">@​langchain/langgraph's
releases</a>.</em></p>
<blockquote>
<h2><code>@​langchain/langgraph</code><a
href="https://github.com/1"><code>@​1</code></a>.4.12</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2714">#2714</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/a2a59ec6f8fdd93d4520d86fceab8a234dacf978"><code>a2a59ec</code></a>
Thanks <a href="https://github.com/hntrl"><code>@​hntrl</code></a>! -
Update checkpoint integrations to require the patched checkpoint
serializer release.</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/a2a59ec6f8fdd93d4520d86fceab8a234dacf978"><code>a2a59ec</code></a>]:</p>
<ul>
<li><code>@​langchain/langgraph-checkpoint</code><a
href="https://github.com/1"><code>@​1</code></a>.1.5</li>
</ul>
</li>
</ul>
<h2><code>@​langchain/langgraph</code><a
href="https://github.com/1"><code>@​1</code></a>.4.11</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2706">#2706</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/eaa5472fa480fad2671659d1c9ed0686a55d42bd"><code>eaa5472</code></a>
Thanks <a
href="https://github.com/zduric-langchain"><code>@​zduric-langchain</code></a>!
- fix(langgraph): dedupe merged callback handlers by identity</p>
<p><code>mergeCallbacks</code> concatenated <code>handlers</code> and
<code>inheritableHandlers</code> while
deduping <code>tags</code>, so a handler inherited by both the ambient
and the explicit
config picked up an extra registration at every graph boundary. With
tracing
on, a nested <code>streamMode: &quot;messages&quot;</code> run delivered
every token twice.</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/3ce9f8d11dd64b1d091a25162603c49e6f4a426f"><code>3ce9f8d</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/51b42020f7c730a15193aa907056881e3d961924"><code>51b4202</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/a86f813954e010fbf30711c37baa5c53444613d5"><code>a86f813</code></a>]:</p>
<ul>
<li><code>@​langchain/langgraph-sdk</code><a
href="https://github.com/1"><code>@​1</code></a>.9.30</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langgraphjs/blob/main/libs/langgraph-core/CHANGELOG.md">@​langchain/langgraph's
changelog</a>.</em></p>
<blockquote>
<h2>1.4.12</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2714">#2714</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/a2a59ec6f8fdd93d4520d86fceab8a234dacf978"><code>a2a59ec</code></a>
Thanks <a href="https://github.com/hntrl"><code>@​hntrl</code></a>! -
Update checkpoint integrations to require the patched checkpoint
serializer release.</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/a2a59ec6f8fdd93d4520d86fceab8a234dacf978"><code>a2a59ec</code></a>]:</p>
<ul>
<li><code>@​langchain/langgraph-checkpoint</code><a
href="https://github.com/1"><code>@​1</code></a>.1.5</li>
</ul>
</li>
</ul>
<h2>1.4.11</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2706">#2706</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/eaa5472fa480fad2671659d1c9ed0686a55d42bd"><code>eaa5472</code></a>
Thanks <a
href="https://github.com/zduric-langchain"><code>@​zduric-langchain</code></a>!
- fix(langgraph): dedupe merged callback handlers by identity</p>
<p><code>mergeCallbacks</code> concatenated <code>handlers</code> and
<code>inheritableHandlers</code> while
deduping <code>tags</code>, so a handler inherited by both the ambient
and the explicit
config picked up an extra registration at every graph boundary. With
tracing
on, a nested <code>streamMode: &quot;messages&quot;</code> run delivered
every token twice.</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/langchain-ai/langgraphjs/commit/3ce9f8d11dd64b1d091a25162603c49e6f4a426f"><code>3ce9f8d</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/51b42020f7c730a15193aa907056881e3d961924"><code>51b4202</code></a>,
<a
href="https://github.com/langchain-ai/langgraphjs/commit/a86f813954e010fbf30711c37baa5c53444613d5"><code>a86f813</code></a>]:</p>
<ul>
<li><code>@​langchain/langgraph-sdk</code><a
href="https://github.com/1"><code>@​1</code></a>.9.30</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/6530ba9b4c577c560422d9c9de18914e67411d9d"><code>6530ba9</code></a>
chore: version packages (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2715">#2715</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/c3b27a997c682a64f65904b2a97a5ee4d6e741b0"><code>c3b27a9</code></a>
fix(checkpoint): narrow re-constructable types in JsonPlusSerializer (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2709">#2709</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/659d628d196f6b1ba7aa46b30293c31ff5715cf4"><code>659d628</code></a>
chore: version packages (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2704">#2704</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/eaa5472fa480fad2671659d1c9ed0686a55d42bd"><code>eaa5472</code></a>
fix(langgraph): dedupe merged callback handlers by identity (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2706">#2706</a>)</li>
<li>See full diff in <a
href="https://github.com/langchain-ai/langgraphjs/commits/@langchain/langgraph@1.4.12/libs/langgraph-core">compare
view</a></li>
</ul>
</details>
<br />

Updates `@langchain/openai` from 1.5.8 to 1.5.10
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchainjs/releases">@​langchain/openai's
releases</a>.</em></p>
<blockquote>
<h2><code>@​langchain/openai</code><a
href="https://github.com/1"><code>@​1</code></a>.5.10</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11419">#11419</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/c26c87e41bccd01111e170c32ba1e5eec94ba3a6"><code>c26c87e</code></a>
Thanks <a href="https://github.com/chiliec"><code>@​chiliec</code></a>!
- fix(openai): send content null (not []) for tool-call-only v1
assistant messages</li>
</ul>
<h2><code>@​langchain/openai</code><a
href="https://github.com/1"><code>@​1</code></a>.5.9</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11399">#11399</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/5c9fdf2f0339deb92db84eaa838cf35c7dcdb027"><code>5c9fdf2</code></a>
Thanks <a
href="https://github.com/gethin-langchain"><code>@​gethin-langchain</code></a>!
- update to v7 openai sdk</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11403">#11403</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/fe8eec1915cc5580b8e7a2f3d4f68fe5e577d641"><code>fe8eec1</code></a>
Thanks <a
href="https://github.com/thushanth-bengre-langchain"><code>@​thushanth-bengre-langchain</code></a>!
- Drop Gemini-native <code>functionCall</code> content blocks (already
carried in <code>tool_calls</code>) when converting messages to Chat
Completions API params, fixing requests that fail when a
<code>ChatGoogleGenerativeAI</code> message is passed to
<code>ChatOpenAI</code> (e.g. a cross-provider handoff in
LangGraph).</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11399">#11399</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/5c9fdf2f0339deb92db84eaa838cf35c7dcdb027"><code>5c9fdf2</code></a>
Thanks <a
href="https://github.com/gethin-langchain"><code>@​gethin-langchain</code></a>!
- Map OpenAI's <code>cache_write_tokens</code> to
<code>cache_creation</code> in
<code>usage_metadata.input_token_details</code>, mirroring the existing
<code>cached_tokens</code> -&gt; <code>cache_read</code> mapping across
the Chat Completions and Responses APIs. Previously, prompt cache-write
token counts were silently dropped.</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/d5264a180b2dd121d5fba54e9272d34352875d7b"><code>d5264a1</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11427">#11427</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/c26c87e41bccd01111e170c32ba1e5eec94ba3a6"><code>c26c87e</code></a>
fix(openai): send content null (not []) for tool-call-only v1 assistant
messa...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/041a75581666a7fd551e6df62226dcf873be50cc"><code>041a755</code></a>
fix(anthropic): preserve generic tool_search_tool_result blocks (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11421">#11421</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/e493ed653d734e31a8d051f78ab29b067f530e4b"><code>e493ed6</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11393">#11393</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/83848481ea27502c4221a01b4c55a87f1fa7c472"><code>8384848</code></a>
fix(google-common): release endpoint routing fix as patch (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11413">#11413</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/8cfff4dced1327fc87893a86dfc63c553403aec0"><code>8cfff4d</code></a>
feat(google): add gateway support for genai (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11405">#11405</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/7df258c0af8362fede14d42bb982597a56f41b78"><code>7df258c</code></a>
chore(langchain): update langgraph deps (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11412">#11412</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/3ceef4baadfaec8f0b1e43191b9363cfcc04187f"><code>3ceef4b</code></a>
fix(anthropic): round-trip tool search server-tool result blocks (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11407">#11407</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/fe8eec1915cc5580b8e7a2f3d4f68fe5e577d641"><code>fe8eec1</code></a>
fix(openai): drop Gemini functionCall content blocks in Chat Completions
mess...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/0e7c7654c8bd84b80fe9a2495ab2703355ff8c1e"><code>0e7c765</code></a>
fix(google-genai): throw ContentBlockedError when Gemini candidate has
no con...</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchainjs/compare/@langchain/openai@1.5.8...@langchain/openai@1.5.10">compare
view</a></li>
</ul>
</details>
<br />

Updates `langchain` from 1.5.9 to 1.5.10
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchainjs/releases">langchain's
releases</a>.</em></p>
<blockquote>
<h2>langchain@1.5.10</h2>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11412">#11412</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/7df258c0af8362fede14d42bb982597a56f41b78"><code>7df258c</code></a>
Thanks <a href="https://github.com/hntrl"><code>@​hntrl</code></a>! -
chore(langgraph): update langgraph deps to track serialization fix</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/e493ed653d734e31a8d051f78ab29b067f530e4b"><code>e493ed6</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11393">#11393</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/83848481ea27502c4221a01b4c55a87f1fa7c472"><code>8384848</code></a>
fix(google-common): release endpoint routing fix as patch (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11413">#11413</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/8cfff4dced1327fc87893a86dfc63c553403aec0"><code>8cfff4d</code></a>
feat(google): add gateway support for genai (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11405">#11405</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/7df258c0af8362fede14d42bb982597a56f41b78"><code>7df258c</code></a>
chore(langchain): update langgraph deps (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11412">#11412</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/3ceef4baadfaec8f0b1e43191b9363cfcc04187f"><code>3ceef4b</code></a>
fix(anthropic): round-trip tool search server-tool result blocks (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11407">#11407</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/fe8eec1915cc5580b8e7a2f3d4f68fe5e577d641"><code>fe8eec1</code></a>
fix(openai): drop Gemini functionCall content blocks in Chat Completions
mess...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/0e7c7654c8bd84b80fe9a2495ab2703355ff8c1e"><code>0e7c765</code></a>
fix(google-genai): throw ContentBlockedError when Gemini candidate has
no con...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/5c9fdf2f0339deb92db84eaa838cf35c7dcdb027"><code>5c9fdf2</code></a>
fix(openai): retain cache_write_tokens, update to v7 sdk (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11399">#11399</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/5ff9179e25f594d7cd21e176fdadd953190375c5"><code>5ff9179</code></a>
fix(google-genai): guard streaming chunks when candidate has no content
(<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/10742">#10742</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/43e439698fa7794c10ab8d7355d4433e058e4d62"><code>43e4396</code></a>
fix(core): include tool_call blocks and skip empty text blocks in
ChatVertexA...</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchainjs/compare/langchain@1.5.9...langchain@1.5.10">compare
view</a></li>
</ul>
</details>
<br />

Updates `@openai/agents` from 0.16.0 to 0.17.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/openai/openai-agents-js/releases">@​openai/agents's
releases</a>.</em></p>
<blockquote>
<h2>v0.17.0</h2>
<h2>Key Changes</h2>
<h3>Output-guardrail replay safety</h3>
<p>Serialized output-bearing approval checkpoints now fail closed with
<code>UserError</code> when the SDK cannot prove which response owns a
pending terminal tool output. Continue with the live
<code>RunState</code> when possible, or start a new run from safe input
instead of replaying ambiguous serialized items. When an output
guardrail rejects a completed function-tool result used as final output,
the SDK replaces rejected content in SDK-owned replay surfaces with
<code>Output withheld by an output guardrail.</code>, sanitizes current
guardrail metadata, and preserves earlier accepted history. This does
not undo external tool side effects or erase application-owned
copies.</p>
<h3>Complete guardrail batch results</h3>
<p>Guardrails started in the same batch now settle before the runner
surfaces a tripwire or execution failure. Completed sibling results
remain available in run state while further run processing is
halted.</p>
<h3>Explicit OpenAI client configuration</h3>
<p><code>OpenAIProvider</code> now rejects <code>organization</code> or
<code>project</code> when <code>openAIClient</code> is also supplied
because provider-level values cannot modify an already-created client.
Configure these values when constructing the <code>OpenAI</code> client,
then pass that client through <code>openAIClient</code>.</p>
<h2>What's Changed</h2>
<ul>
<li>fix(core): redact blocked tool outputs and aliases from replay state
by <a href="https://github.com/seratch"><code>@​seratch</code></a> in <a
href="https://redirect.github.com/openai/openai-agents-js/pull/1712">openai/openai-agents-js#1712</a></li>
<li>fix(openai): reject ignored explicit-client options by <a
href="https://github.com/seratch"><code>@​seratch</code></a> in <a
href="https://redirect.github.com/openai/openai-agents-js/pull/1718">openai/openai-agents-js#1718</a></li>
</ul>
<h3>Documentation &amp; Other Changes</h3>
<ul>
<li>docs: v01.6.1 release by <a
href="https://github.com/seratch"><code>@​seratch</code></a> in <a
href="https://redirect.github.com/openai/openai-agents-js/pull/1696">openai/openai-agents-js#1696</a></li>
<li>docs: fix access token typo in connectors example by <a
href="https://github.com/Chair403"><code>@​Chair403</code></a> in <a
href="https://redirect.github.com/openai/openai-agents-js/pull/1716">openai/openai-agents-js#1716</a></li>
<li>fix: keep Codex verification for development sandboxed by <a
href="https://github.com/seratch"><code>@​seratch</code></a> in <a
href="https://redirect.github.com/openai/openai-agents-js/pull/1707">openai/openai-agents-js#1707</a></li>
<li>chore: update versions by <a
href="https://github.com/github-actions"><code>@​github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/openai/openai-agents-js/pull/1717">openai/openai-agents-js#1717</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/Chair403"><code>@​Chair403</code></a>
made their first contribution in <a
href="https://redirect.github.com/openai/openai-agents-js/pull/1716">openai/openai-agents-js#1716</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/openai/openai-agents-js/compare/v0.16.1...v0.17.0">https://github.com/openai/openai-agents-js/compare/v0.16.1...v0.17.0</a></p>
<h2>v0.16.1</h2>
<h2>What's Changed</h2>
<ul>
<li>feat(core): add model call timeouts by <a
href="https://github.com/seratch"><code>@​seratch</code></a> in <a
href="https://redirect.github.com/openai/openai-agents-js/pull/1679">openai/openai-agents-js#1679</a></li>
<li>feat(sandbox): add run-scoped sandbox working directories by <a
href="https://github.com/seratch"><code>@​seratch</code></a> in <a
href="https://redirect.github.com/openai/openai-agents-js/pull/1683">openai/openai-agents-js#1683</a></li>
<li>feat(sandbox): allow Docker sandboxes to disable networking by <a
href="https://github.com/seratch"><code>@​seratch</code></a> in <a
href="https://redirect.github.com/openai/openai-agents-js/pull/1695">openai/openai-agents-js#1695</a></li>
<li>feat(extensions): add Modal sandbox resource options by <a
href="https://github.com/seratch"><code>@​seratch</code></a> in <a
href="https://redirect.github.com/openai/openai-agents-js/pull/1693">openai/openai-agents-js#1693</a></li>
<li>fix(core): honor exact call approval decisions by <a
href="https://github.com/seratch"><code>@​seratch</code></a> in <a
href="https://redirect.github.com/openai/openai-agents-js/pull/1694">openai/openai-agents-js#1694</a></li>
<li>fix(sandbox): validate view_image raster content by <a
href="https://github.com/seratch"><code>@​seratch</code></a> in <a
href="https://redirect.github.com/openai/openai-agents-js/pull/1704">openai/openai-agents-js#1704</a></li>
<li>fix(sandbox): validate dynamic compaction ratios by <a
href="https://github.com/sylvesterkaczmarek"><code>@​sylvesterkaczmarek</code></a>
in <a
href="https://redirect.github.com/openai/openai-agents-js/pull/1691">openai/openai-agents-js#1691</a></li>
<li>fix(sandbox): trace effective run-scoped sandbox paths by <a
href="https://github.com/sylvesterkaczmarek"><code>@​sylvesterkaczmarek</code></a>
in <a
href="https://redirect.github.com/openai/openai-agents-js/pull/1697">openai/openai-agents-js#1697</a></li>
</ul>
<h3>Documentation &amp; Other Changes</h3>
<ul>
<li>docs: prepare v0.16.0 release documentation by <a
href="https://github.com/seratch"><code>@​seratch</code></a> in <a
href="https://redirect.github.com/openai/openai-agents-js/pull/1646">openai/openai-agents-js#1646</a></li>
<li>docs: document Agent.clone list property sharing by <a
href="https://github.com/thegoodengineer"><code>@​thegoodengineer</code></a>
in <a
href="https://redirect.github.com/openai/openai-agents-js/pull/1705">openai/openai-agents-js#1705</a></li>
<li>chore: update versions by <a
href="https://github.com/github-actions"><code>@​github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/openai/openai-agents-js/pull/1688">openai/openai-agents-js#1688</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/openai/openai-agents-js/commit/0319b657e64e0c132629fe9ed4d524f7cde93445"><code>0319b65</code></a>
chore: update versions (<a
href="https://redirect.github.com/openai/openai-agents-js/issues/1717">#1717</a>)</li>
<li><a
href="https://github.com/openai/openai-agents-js/commit/d80736ace3c8ac32c41ba2b353a3e64ed31354b3"><code>d80736a</code></a>
fix(openai): reject ignored explicit-client options (<a
href="https://redirect.github.com/openai/openai-agents-js/issues/1718">#1718</a>)</li>
<li><a
href="https://github.com/openai/openai-agents-js/commit/b9ecb03ede8845fd8e2da74667242b7d2cf3d7c3"><code>b9ecb03</code></a>
docs: fix access token typo in connectors example (<a
href="https://redirect.github.com/openai/openai-agents-js/issues/1716">#1716</a>)</li>
<li><a
href="https://github.com/openai/openai-agents-js/commit/33fe55c62e5a0535766f8adbac63430593b7acd9"><code>33fe55c</code></a>
fix(core): redact blocked tool outputs and aliases from replay state (<a
href="https://redirect.github.com/openai/openai-agents-js/issues/1712">#1712</a>)</li>
<li><a
href="https://github.com/openai/openai-agents-js/commit/2d68a10f8c1593f37a8e291e7bce00634ba3e5dd"><code>2d68a10</code></a>
test: remove flaky example process-group test</li>
<li><a
href="https://github.com/openai/openai-agents-js/commit/dcbb1e7ba9bcf5ce50052a2a8d287c94d1d84daf"><code>dcbb1e7</code></a>
chore: move example and integration runners out of skills</li>
<li><a href="https://github.com/openai/openai-agents-js/commit/272...

_Description has been truncated_

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: jkomyno <alberto@composio.dev>
@composio/cli@0.4.1-beta.368 		2026-08-25 01:38:21 +02:00
dependabot[bot] ec24c54ffc fix(deps-dev): bump langchain-openai 
Bumps the pip-version group with 1 update in the /python directory: [langchain-openai](https://github.com/langchain-ai/langchain).


Updates `langchain-openai` from 1.4.3 to 1.6.0
- [Release notes](https://github.com/langchain-ai/langchain/releases)
- [Commits](https://github.com/langchain-ai/langchain/compare/langchain-openai==1.4.3...langchain-openai==1.6.0)

---
updated-dependencies:
- dependency-name: langchain-openai
  dependency-version: 1.5.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: pip-version
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-24 23:23:14 +00:00
Alberto Schiabel 0421f1fb52 chore(deps): stop Dependabot proposing ag2 majors for composio-autogen (#4236) 
## Summary

Closes #4197 as not-actionable and stops Dependabot from re-raising it.

`ag2` 1.0 removed the top-level `autogen` package. The 1.x wheel ships
only `ag2`:

```
$ python -c "import zipfile; print(sorted({n.split('/')[0] for n in zipfile.ZipFile('ag2-1.0.2-py3-none-any.whl').namelist()}))"
['ag2', 'ag2-1.0.2.dist-info']
```

`composio_autogen/provider.py` imports `autogen`,
`autogen.agentchat.register_function`, and
`autogen.agentchat.conversable_agent.ConversableAgent` — none of which
exist in 1.x. #4197 widened the requirement to `<2.0` and CI resolved
`ag2==1.0.2`, which failed the fresh-install import guard on all three
Python versions:

```
File ".../composio_autogen/provider.py", line 6, in <module>
    import autogen
ModuleNotFoundError: No module named 'autogen'
```

This is the same failure mode as #3728 (pyautogen 0.10 shipping no
`autogen`), one framework rename later. Adopting ag2 1.x is a provider
rewrite against the new `ag2.tools` / middleware API, not a requirement
widening — so it needs its own PR, not an automated bump.

## Changes

- `.github/dependabot.yml`: ignore `version-update:semver-major` for
`ag2` in the pip ecosystem, matching the existing convention for
compatibility-boundary majors. Security updates are unaffected.
- Record why the `<1.0` cap exists in both `pyproject.toml` and
`setup.py`, so the next reader doesn't widen it by hand.

## Follow-up

Migrating `composio-autogen` to ag2 1.x remains open and unscheduled.
Remove the ignore entry when that lands.
 2026-08-25 01:20:54 +02:00
Alberto Schiabel 700327c2a6 Merge branch 'next' into chore/changesets-v3-migration 2026-08-25 01:18:03 +02:00
jkomyno 3e8ce1eae2 fix(release): use Changesets v3 action protocol 2026-08-25 01:11:35 +02:00
tgolob db7b576437 fix(ts): declare the supported Node.js engine floor (#4219) 
## Summary

The ESM-only transition in #3494 established Node.js 22.22.3 as the
minimum supported runtime for the public TypeScript SDK packages, but
their published manifests still omit `engines.node`.

That leaves package managers without a package-level compatibility
signal before an older runtime encounters an ESM loading failure. For
example, the current `@composio/core@0.17.0` package fails with
`ERR_REQUIRE_ESM` when required on Node.js 22.0.0, while the same load
succeeds on Node.js 22.22.3.

This aligns the published metadata with the support floor already
documented and tested by the repository.

Related: #3494

## Changes

- Add `"engines": { "node": ">=22.22.3" }` to all 14 public TypeScript
release workspaces.
- Add a release-workflow invariant that discovers public TypeScript
workspaces from the root workspace configuration and rejects missing or
drifted Node.js engine ranges.
- Add a patch changeset covering exactly those 14 published packages.

<details>
<summary>Package scope</summary>

- Core packages: `@composio/core`, `@composio/slim`,
`@composio/experimental`, and `@composio/json-schema-to-zod`
- Providers: Anthropic, Claude Agent SDK, Cloudflare, Google, LangChain,
LlamaIndex, Mastra, OpenAI Agents, OpenAI, and Vercel
- Excluded as private/unpublished: CLI, CLI keyring, CLI local tools,
JSON Schema to Effect Schema, and TypeScript builders

</details>

## Type of change

- [x] Bug fix
- [ ] New feature
- [ ] Refactor/Chore
- [ ] Documentation
- [ ] Breaking change

## How Has This Been Tested?

Validated with the repository-pinned Node.js 24.17.0, pnpm 11.8.0, and
Bun 1.4.0 toolchain:

- `pnpm install --frozen-lockfile`
- `pnpm run test:release-workflow`
- `pnpm validate:changesets`
- `pnpm exec changeset status --since=origin/next` (exactly 14 patch
releases)
- `pnpm build:packages` (19/19 packages)
- `pnpm typecheck` (14/14 tasks)
- `pnpm lint:packages` (successful; only pre-existing warnings in
untouched source files)
- Prettier over every touched file
- `git diff --check origin/next...HEAD`

The published-package probe also confirmed that `@composio/core@0.17.0`
has no `engines` metadata, CommonJS loading fails on Node.js 22.0.0, and
the same package loads successfully on Node.js 22.22.3.

No lockfiles, generated files, or runtime source files changed.

## Screenshots (if applicable)

Not applicable.

## Checklist

- [x] I have read the Code of Conduct and this PR adheres to it
- [x] I ran linters/tests locally and they passed
- [x] I updated documentation as needed
- [x] I added tests or explain why not applicable
- [x] I added a changeset if this change affects published packages

## Additional context

The runtime floor itself is not new: #3494 shipped and documented it as
a breaking change in the existing `0.x` line. This patch makes registry
metadata accurately reflect that existing support contract, so the
accompanying releases are patches.

---------

Co-authored-by: Tomas Golob <tgolob@users.noreply.github.com>
Co-authored-by: Alberto Schiabel <jkomyno@users.noreply.github.com>
Co-authored-by: jkomyno <alberto@composio.dev>
 2026-08-25 01:11:05 +02:00