mirror of
https://github.com/ComposioHQ/composio.git
synced 2026-09-22 11:46:35 +08:00
vercel-example@0.1.11
5111 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Alberto Schiabel
|
fa775cc38d |
docs: update Python SDK reference from source (#4179)
## Summary Auto-generated Python SDK reference docs from `python/composio/`. Regenerates pages at `docs/content/reference/sdk-reference/python/` to reflect changes in the Python package's public API (new methods, updated signatures, changed types). |
||
|
jkomyno
|
8fe03eff47 |
test(json-schema): add strict-mode edge cases enumerated with a second model
Extends strict-cases.json to 68 cases with shapes enumerated independently (single-element and three-member type arrays, null-only and null-carrying enum/const properties, nested compositions, nullable objects in arrays, tuple and boolean items, conditional and dependency keywords, oneOf beside anyOf, boolean and malformed properties, $ref siblings and chains, legacy definitions next to $defs, non-string required entries, ten-level nesting) plus null-omission pairs for nullable, composed and $ref-typed arguments. Checks in the generator that derives the pinned JSON. Co-authored-by: AseemPrasad <aseemprasad0520@gmail.com> Claude-Session: https://claude.ai/code/session_01TDrxCHn2hg51HmxVstSUgs |
||
|
jkomyno
|
84684c6c8d |
fix(python): mirror the strict-mode incompatibility and branch rules
to_strict_json_schema reports the same constructs as the TypeScript implementation (tuple items, boolean subschemas, malformed properties, oneOf beside anyOf, conditional and dependency keywords), accepts a root typed ["object"], leaves enum/const that already include null alone, and omit_null_tool_arguments follows the composition branch matching the argument's shape. Co-authored-by: AseemPrasad <aseemprasad0520@gmail.com> Claude-Session: https://claude.ai/code/session_01TDrxCHn2hg51HmxVstSUgs |
||
|
jkomyno
|
b47d5137c2 |
fix(core): report every construct strict mode cannot rewrite
Tuple-form items, boolean subschemas, malformed properties, oneOf left beside anyOf, and the conditional and dependency keywords (not, if, then, else, dependencies, dependentSchemas, propertyNames, contains, additionalItems, unevaluatedItems, unevaluatedProperties) are now reported as unsupported so the tool is sent without strict mode instead of with a schema the API rejects. A root typed ["object"] is accepted, and an enum or const that already includes null is not wrapped again. omitNullToolArguments now follows the anyOf/oneOf branch that matches an argument's shape, so nulls inside an object sent for a composed property are reconciled against that branch. Co-authored-by: AseemPrasad <aseemprasad0520@gmail.com> Claude-Session: https://claude.ai/code/session_01TDrxCHn2hg51HmxVstSUgs |
||
|
jkomyno
|
678ac7260a | fix(docs): complete generated string escaping | ||
|
jkomyno
|
3ca07210d3 |
test(json-schema): drive strict-mode cases from a shared corpus
strict-cases.json (one byte-identical copy per language, next to object-cases.json) pins the exact strict schema or the reported incompatibilities for 44 shapes: optional widening at every depth, nullable type arrays, compositions, enum/const wrapping, annotation stripping, keyword-named and prototype-named properties, dynamic-key and free-form objects, allOf/prefixItems, $defs recursion, dangling and external refs, malformed required, non-object roots, plus null-omission argument pairs. The TypeScript suite pins the implementation and the Python suite checks parity against the same file. Co-authored-by: AseemPrasad <aseemprasad0520@gmail.com> Claude-Session: https://claude.ai/code/session_01TDrxCHn2hg51HmxVstSUgs |
||
|
jkomyno
|
e4d24bc04b |
fix(python): treat a non-array required as absent under strict mode
to_strict_json_schema iterated a string-valued required character by character, so a malformed required kept same-named properties non-nullable while the TypeScript implementation treats it as absent and widens every property. Both SDKs now agree. Co-authored-by: AseemPrasad <aseemprasad0520@gmail.com> Claude-Session: https://claude.ai/code/session_01TDrxCHn2hg51HmxVstSUgs |
||
|
jkomyno
|
991c57af80 |
fix(core): keep properties named like prototype keys under strict mode
toStrictJsonSchema assigned rewritten property schemas by name, so a property called __proto__ set the prototype of the properties map instead of being stored and disappeared from the strict schema. Own properties are now defined explicitly, matching the other schema walkers in this module. Co-authored-by: AseemPrasad <aseemprasad0520@gmail.com> Claude-Session: https://claude.ai/code/session_01TDrxCHn2hg51HmxVstSUgs |
||
|
jkomyno
|
9692db5c0a |
fix(openai-agents): honor the strict option
OpenAIAgentsProvider accepted { strict } but always registered tools with
strict: false and additionalProperties: true. Strict mode now registers
tools with strict: true and a schema normalized by toStrictJsonSchema
(optional parameters required-nullable), drops null arguments the tool
schema rejects before execution, and registers tools strict mode cannot
express without strict mode with a warning.
Co-authored-by: AseemPrasad <aseemprasad0520@gmail.com>
Claude-Session: https://claude.ai/code/session_01TDrxCHn2hg51HmxVstSUgs
|
||
|
jkomyno
|
3c3b4dae94 |
fix(mastra): keep optional parameters under strict mode
MastraProvider strict mode used the root-only, input-mutating removeNonRequiredProperties, so "strict" meant something different from the OpenAI providers. It now runs the same toStrictJsonSchema rewrite: optional parameters become required-nullable, tools strict mode cannot express keep their original schema with a warning, and null arguments the tool schema rejects are dropped before execution. Co-authored-by: AseemPrasad <aseemprasad0520@gmail.com> Claude-Session: https://claude.ai/code/session_01TDrxCHn2hg51HmxVstSUgs |
||
|
Alberto Schiabel
|
b6e079ba3d |
fix(ci): prevent cache poisoning in CLI releases (#4255)
This PR: - fixes all 11 open CodeQL alerts ([#118](https://github.com/ComposioHQ/composio/security/code-scanning/118) through [#128](https://github.com/ComposioHQ/composio/security/code-scanning/128)) for cache poisoning through untrusted code execution - makes the workflow-selected `github.sha` authoritative for CLI build and release checkouts - requires stable promotion to run at the immutable beta tag and rejects tag/release commit mismatches - removes the manually supplied `beta_tag` data path into executable jobs - updates the CLI release playbook for tag-scoped promotion - verifies the release contract with `pnpm test:release-workflow`, agent-skill validators, shell syntax, formatting, and changeset validation |
||
|
jkomyno
|
e6fb9f9d32 |
feat(core): keep $defs recursion under strict mode
OpenAI structured outputs support local $ref pointers, including recursive definitions, so toStrictJsonSchema no longer inlines them: $defs and definitions are normalized where they are declared, an optional $ref property is widened with an anyOf null branch, and external or dangling $refs are reported as unsupported. omitNullToolArguments follows local $refs when deciding whether a null is accepted. The Vercel provider still inlines definitions before converting to Zod, which does not follow $ref. Co-authored-by: AseemPrasad <aseemprasad0520@gmail.com> Claude-Session: https://claude.ai/code/session_01TDrxCHn2hg51HmxVstSUgs |
||
|
jkomyno
|
b015075910 | fix(ci): prevent cache poisoning in CLI releases | ||
|
jkomyno
|
15e2b72f3d |
fix(python): emit strict and keep base provider config in OpenAIResponsesProvider
The strict flag now calls the base initializer (schema_config kwargs keep working), emits strict on the wrapped tool, and mirrors the TypeScript pipeline: optional parameters become required-nullable, unsupported schemas downgrade the tool to non-strict, and null arguments the tool schema rejects are dropped before execution. Co-authored-by: AseemPrasad <aseemprasad0520@gmail.com> Claude-Session: https://claude.ai/code/session_01TDrxCHn2hg51HmxVstSUgs |
||
|
jkomyno
|
fb30e8f299 |
fix(vercel): keep optional parameters available under strict mode
VercelProvider strict mode now widens optional parameters to nullable instead of dropping them, keeps the original schema for tools strict mode cannot express, and drops null arguments the tool schema rejects before execution. The README and docs page described the old dropping behavior. Co-authored-by: AseemPrasad <aseemprasad0520@gmail.com> Claude-Session: https://claude.ai/code/session_01TDrxCHn2hg51HmxVstSUgs |
||
|
jkomyno
|
6a7ddbad06 |
fix(openai): send tools strict mode cannot express without strict
OpenAIResponsesProvider emits the strict schema and strict: true only when the rewrite is lossless; otherwise the tool keeps its original schema with strict: false and a warning names the tool and path. Tools without parameters get a canonical empty closed object. Null arguments the tool schema rejects are dropped before execution. Co-authored-by: AseemPrasad <aseemprasad0520@gmail.com> Claude-Session: https://claude.ai/code/session_01TDrxCHn2hg51HmxVstSUgs |
||
|
jkomyno
|
4f69975475 |
fix(core): keep optional parameters under strict mode instead of dropping them
toStrictJsonSchema now follows the contract OpenAI documents for structured outputs: every property becomes required and optional ones are widened to accept null, so the model keeps every parameter it could pass before. Type arrays stay as they are (the API accepts them and rejects type next to anyOf), so nullable objects stay nullable. Constructs strict mode cannot express (objects with arbitrary keys, allOf, prefixItems, unresolved $refs, non-object roots) are reported in `unsupported` instead of being narrowed. omitNullToolArguments drops a null argument only where the tool's own schema rejects it, so nullable fields keep an explicit null. The keyword taxonomy shared by the three schema walkers now lives in one place. Co-authored-by: AseemPrasad <aseemprasad0520@gmail.com> Claude-Session: https://claude.ai/code/session_01TDrxCHn2hg51HmxVstSUgs |
||
|
Alberto Schiabel
|
c6c4b76810 |
docs(kb): refresh public support knowledge (#4252)
Automated knowledge-base refresh for `ComposioHQ/support-knowledge`. - Source commit: `5eac683455ff252a7a3b62f33ab6566445009b52` (unchanged; rebuilt a stale semantic artifact) - Regenerated public KB pages and search records - Reused unchanged vectors and rebuilt the checked semantic artifact - Ran KB freshness and semantic-artifact verification |
||
|
jkomyno
|
94f3d93ccc | docs(kb): refresh public support knowledge | ||
|
Alberto Schiabel
|
d567b07321 |
fix(docs): stabilize toolkit knowledge and refresh KB (#4234)
## What changed - refresh the public KB from merged [support-knowledge #11](https://github.com/ComposioHQ/support-knowledge/pull/11), pinned to `5eac683` - add production-readiness and session-policy guides plus current toolkit/OAuth corrections - route single-resource KB toolkit pages directly to canonical toolkit docs across HTML, `.md`, sitemap, and agent discovery - preserve reviewed curation during refreshes, validate sources/links, and report automation failures - automatically rebuild stale semantic artifacts on current same-repo MEMBER/OWNER docs PRs; public and fork PRs remain read-only - rebuild semantic search with 888 public Docs/KB records Most changed files are generated KB pages updating the source pin. ## Verification - 521 static tests + 88 production-build integration tests - typecheck, lint, Actions lint, link validation, production build, and semantic freshness pass - [Vercel preview](https://docs-git-codex-docs-toolkit-kb-routing.preview.composio.dev) ## Follow-up Release Bot still needs `support-knowledge` read access before automatic upstream refresh can run. Failures are tracked in [#4241](https://github.com/ComposioHQ/composio/issues/4241). Context: [Sarah’s Slack thread](https://composioworkspace.slack.com/archives/C0AK054L1T6/p1787367361647249?thread_ts=1787365155.082829) · [PRD](https://app.notion.com/p/composio/Support-Knowledge-Platform-PRD-3bcf261a6dfe816297f9feeb5398a9af) |
||
|
jkomyno
|
3ce6196d2d | merge: integrate next (KB identifier-URL fix + self-healing CI) into #4234 | ||
|
Alberto Schiabel
|
56b7b19e45 |
docs(kb): refresh public support knowledge (#4251)
Automated knowledge-base refresh for `ComposioHQ/support-knowledge`. - Source commit: `d57f3d69079ee3819f4136df54512cdf0416cec0` (unchanged; rebuilt a stale semantic artifact) - Regenerated public KB pages and search records - Reused unchanged vectors and rebuilt the checked semantic artifact - Ran KB freshness and semantic-artifact verification |
||
|
jkomyno
|
1a6ced0220 | docs(kb): refresh public support knowledge | ||
|
Alberto Schiabel
|
1a059f7c80 |
ci(docs): degrade KB refresh to artifact-only when upstream token fails (#4250)
This PR: - continues past a failed `support-knowledge` token mint instead of failing the whole KB refresh job - skips the upstream checkout and sync check when no token could be minted (treats upstream as unchanged) - unblocks the staleness-based semantic-artifact rebuild from #4249, which needs only this repository ## Context Every scheduled run of `Docs - Update Support Knowledge` since at least Aug 25 dies at step 1: the release-bot app has no installation on the internal `ComposioHQ/support-knowledge` repo, so `create-github-app-token` 404s. The upstream import genuinely needs that token, but the artifact rebuild does not. Until a human installs the app on `support-knowledge`, upstream sync stays degraded and this keeps the artifact-refresh half of the job functional. |
||
|
jkomyno
|
f39d37be77 |
ci(docs): degrade KB refresh to artifact-only when upstream token fails
Every scheduled run of the KB refresh workflow has failed at the first step: the release-bot app has no installation on the internal support-knowledge repository, so the token request 404s and the whole job dies before anything runs. The upstream import needs that token, but the stale-artifact rebuild needs only this repository. Continue past a token failure, skip the support-knowledge checkout and sync check, and let the staleness-based rebuild proceed. Upstream sync stays degraded until the app is installed on support-knowledge. |
||
|
Alberto Schiabel
|
9a60a91874 |
fix(docs): render KB identifier URLs as code spans, not dead links (#4249)
This PR: - Closes #4205 (nightly docs external-link check failing) - demotes bare identifier URLs — Google OAuth scope URIs (`googleapis.com/auth/*`) and version-only API roots like `https://api.ahrefs.com/v3` — to inline code spans in the KB generation layer (`markdownForMdx`), so they stop publishing as links that 404 by design - regenerates the two affected guides (`toolkits-ahrefs`, `toolkits-googlemeet`); explicit markdown links keep their authored form - adds a regression test covering the exact URLs from #4205 plus link/autolink/code-span edge cases - records the rule in `docs/decisions/public-knowledge-base.md` - makes the scheduled KB workflow rebuild `docs/kb/semantic-index.json` when it is stale against the checked-in corpus, not only when the upstream `support-knowledge` commit moves ## Context The failing URLs are machine identifiers, not documents — fetching them 404s by design, so no link target could ever satisfy the nightly sweep. Upstream support prose cites them bare, the generator copied them verbatim, and GFM autolinks published them as clickable links. Sibling KB articles already used the backtick convention, confirming the intended presentation. `check:kb-semantic` is expected to fail on this PR: 4 embedded record chunks change, and the artifact rebuild needs `OPENAI_API_KEY` (CI-owned). After merge, the scheduled job (now staleness-aware) proposes the artifact refresh PR on `docs/auto-update-kb`; until it merges, that gate stays red for docs PRs. Verified locally: `bun run lint:links:external` (the failing nightly command) — 0 errors; `bun test tests/static/` — 506 pass; `lint:links`, `generate:kb --check`, `types:check`, `lint` — pass. |
||
|
jkomyno
|
b42d3451a7 |
ci(docs): rebuild stale KB semantic artifact from the scheduled job
The KB refresh workflow only rebuilt docs/kb/semantic-index.json when the
upstream support-knowledge commit moved, but any docs-side text change
(guide edits, generator updates) invalidates the artifact record hashes
too. The PR-path check:kb-semantic gate then stays red until someone
with OPENAI_API_KEY refreshes the artifact by hand, as
|
||
|
Tri
|
230c7932bc |
docs: replace hardcoded "1,000+" toolkit counts with the live catalog count (#4247)
## Problem
The docs hero, feature cards, site metadata, and `llms.txt` /
`llms-full.txt` all hardcoded **"1,000+"** (variously written `1,000+`
and `1000+`) apps. The actual published catalog is **1,327 toolkits** —
the length of the committed `docs/public/data/toolkits-list.json`, which
the `/toolkits` page already renders. The copy was stale and
understated.
## Approach
Reuse the same `toolkits-list.json` the `/toolkits` page reads. A new
server-only helper `docs/lib/toolkit-count.ts` imports it and derives a
rounded-down, human-friendly label:
```ts
const roundedToolkitCount = Math.floor(toolkitsData.length / 100) * 100; // 1327 -> 1300
export const TOOLKIT_COUNT_LABEL = `${roundedToolkitCount.toLocaleString('en-US')}+`; // "1,300+"
```
The count stays correct as the catalog grows, and the locale is pinned
to `en-US` so the grouping separator is always a comma regardless of the
build host's locale (never `1.300+` or `1 300+`).
## Files
Helper (new):
- `docs/lib/toolkit-count.ts`
Six consumers, all server-side (none is a `"use client"` module):
- `docs/components/docs-hero-v2.tsx`
- `docs/components/home-features.tsx`
- `docs/components/home-resources.tsx`
- `docs/app/layout.tsx` (metadata description, OpenGraph, Twitter,
JSON-LD)
- `docs/app/llms.txt/route.ts`
- `docs/app/llms-full.txt/route.ts`
## No client bundle cost
Every importer resolves in a server graph, so the ~1,300-row JSON array
is read at build time only and never ships to the browser.
## Scope / deferred follow-up
Deliberately narrow: no MDX content and no generator scripts are
touched. The remaining ~15 hardcoded literals in MDX frontmatter/prose,
and the meta-tools generator's `"500+"`, are a **deferred follow-up**
and are **not** in this PR.
## Verification
Cross-model (Codex / GPT-5.6) adversarial review: GREEN. Codex ran `bun
run types:check` and a production `next build` in the working tree —
both pass. Locally I confirmed the count (1327 -> "1,300+"), that no
importer is `"use client"`, and that no stray `1000+` / `1,000+` /
`500+` remains in the six files. CI should re-verify typecheck/build.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
|
||
|
Tridhatri Vallamkondu
|
4352f210dc |
docs: replace hardcoded "1,000+" toolkit counts with the live catalog count
The docs hero, feature cards, site metadata, and llms.txt all hardcoded
"1,000+" apps, while the published catalog is 1,327 toolkits (the length of
docs/public/data/toolkits-list.json, already rendered by the /toolkits page).
Add a server-only helper docs/lib/toolkit-count.ts that imports that same
JSON and exports TOOLKIT_COUNT_LABEL = Math.floor(len/100)*100 -> "1,300+",
with the locale pinned (toLocaleString('en-US')) so the separator is a comma
on any build host. Six server-side files now consume it. No client bundle
cost: none of the importers is a "use client" module, so the JSON never
reaches the browser.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
||
|
jkomyno
|
3fb74d5c98 |
fix(docs): render KB identifier URLs as code spans, not dead links
Nightly external-link sweeps (#4205) failed on four KB URLs that are machine identifiers, not documents: Google OAuth scope URIs (googleapis.com/auth/meetings.space.*) and Ahrefs API surface roots (api.ahrefs.com/v3, the wrong-host ahrefs.com/v3). Support prose cites them bare, the KB generator copied them verbatim, and GFM autolinks published them as links that 404 by design — unfixable by pointing them anywhere. The generation layer now demotes bare citations and <url> autolinks of these identifier shapes to inline code spans, matching the convention sibling KB articles already use. Explicit markdown links keep their authored form. Regenerated the two affected guides. Verified: bun run test (506 pass), bun run lint:links, bun run lint:links:external (0 errors — the failing nightly command), bun run types:check, bun run generate:kb --check. Follow-up: docs/kb/semantic-index.json needs a rebuild with OPENAI_API_KEY (bun run build:kb-semantic) because four embedded record chunks changed. |
||
|
sdkrelease[bot]
|
1fe2fe30cc |
docs: update guides for SDK changes (#4105)
## Summary
Automated docs update triggered by SDK source changes on `next`.
- Claude reviewed the SDK diff and updated guides, FAQs, or examples
that reference changed APIs or features.
- The docs `@composio/*` dependencies were realigned to their latest
published releases so Twoslash snippets and example apps validate
against versions users can actually install.
## Review checklist
- [ ] Changes accurately reflect the new SDK behavior
- [ ] No unrelated docs were modified
- [ ] Code examples are correct and complete
- [ ] If a documented feature is not published yet, the Twoslash build
will fail — wait for the release instead of working around it
Generated by Claude Code via GitHub Actions.
---------
Co-authored-by: jkomyno <12381818+jkomyno@users.noreply.github.com>
Co-authored-by: jkomyno <alberto@composio.dev>
|
||
|
Alberto Schiabel
|
18944df9eb |
fix(cli): verify codex-acp tarballs against the lockfile before packaging them (#4217)
# Description Found by the scheduled security audit while reviewing the CLI release pipeline. `ts/packages/cli/scripts/_acp-adapters.ts` downloads four `@zed-industries/codex-acp-<platform>` tarballs directly from the registry at release-build time — it has to, because `pnpm` only installs the optional dependency matching the runner's own platform while the archive must name all four. Those bytes were then extracted, `chmod 0755`'d, and packaged inside the published `composio` CLI archive **without being checked against any known hash**. That made the codex-acp binaries the one dependency in the release that received none of the integrity verification `pnpm install --frozen-lockfile` applies to everything else, despite `pnpm-lock.yaml` already pinning a `sha512` for each of them: ``` '@zed-industries/codex-acp-linux-x64@0.16.0': resolution: {integrity: sha512-xs5zZBLpJuciEbZNx6ZSNL0qCa9h3i/zWpj40sp6QtF+L4Ow/7qzHdBzboGhHdcz1jrLedfZeRFDA2Elj8TLMA==} ``` Distribution is `curl -fsSL https://composio.dev/install | sh`, so anything that reached those bytes between the registry and the archive would ship executable to every CLI user inside an otherwise-signed release. ## What changed New `scripts/_tarball-integrity.ts`: - `parseLockfileIntegrity` — maps every `name@version` in `pnpm-lock.yaml` to its recorded hash. Line-based rather than a YAML parse: the shape being read is two adjacent lines, and this keeps a build script free of a YAML dependency. - `expectedIntegrityFor` — returns the pinned hash, and **throws** for a package the lockfile never resolved. - `assertBytesMatchIntegrity` — Web Crypto digest compared against the pinned value; the algorithm is read from the expected string so a lockfile that moves off sha512 keeps working. - `findLockfilePath` / `loadLockfileIntegrity` — walk up from the script rather than resolving a fixed `../../..`. `_acp-adapters.ts` now looks the hash up *before* the download and verifies the archive bytes before extracting them. Two deliberate choices: - **Checked against the lockfile, not the registry's `dist.integrity`** — whoever can serve the tarball can serve the metadata that vouches for it. - **Fail-closed throughout** — a missing lockfile, or a package absent from it, aborts the build rather than packaging unverified bytes. Scope is limited to the integrity gap. The `@zed-industries/codex-acp*` family is deprecated upstream ("replaced by `@agentclientprotocol/codex-acp`") and pinned at `0.16.0`; migrating it is a separate call for whoever owns the ACP integration. # How did I test this PR **Unit — 16 new tests, all passing:** ``` $ vitest run test/src/scripts/tarball-integrity.test.ts Test Files 1 passed (1) Tests 16 passed (16) ``` Covers quoted scoped keys and unquoted bare keys, resolutions carrying no integrity, `snapshots:` repeats, a package absent from the lockfile, a version pinned under a different number, tampered bytes, a single flipped byte, an uncomputable algorithm, sha256 as well as sha512, and the upward lockfile walk (including the no-lockfile-anywhere case). One test asserts this repository actually pins a hash for all four packaged codex-acp binaries. **Live end-to-end against the real registry** — the real 74,914,872-byte `@zed-industries/codex-acp-linux-x64@0.16.0` tarball, downloaded and run through the same code path the build uses: ``` downloaded 74914872 bytes from https://registry.npmjs.org/@zed-industries/codex-acp-linux-x64/-/codex-acp-linux-x64-0.16.0.tgz PASS: real tarball matches the lockfile pin PASS: tampered rejected — TarballIntegrityError: Integrity mismatch for @zed-industries/codex-acp-linux-x64@0.16.0. PASS: unpinned version refused — TarballIntegrityError: @zed-industries/codex-acp-linux-x64@0.99.0 has no integrity hash in pnpm-lock.yaml; refusing to package unverified bytes. ``` So the check passes on genuine bytes, rejects a single flipped byte in a 75 MB archive, and refuses a version the lockfile does not pin. **Lint / types / boundaries:** - `oxlint` on all three files — clean. (First draft used `node:crypto`; `no-restricted-imports` bans it, so the digest went to Web Crypto.) - `prettier --check` — clean. - `tsc --noEmit` — no errors in any of the three changed files. This sandbox has 820 pre-existing errors from an unbuilt workspace (only 7 of 70 projects installed); `test/src/scripts/release-artifacts.test.ts` fails to import here for the same reason, on `next` as well as on this branch. - `pnpm run validate:boundaries` — `lint boundaries OK: 4 registered disables across 4 files` (unchanged; `scripts/` and `test/` sit outside the `src/` Effect boundary policy). # Security - **Grype** — `grype dir:ts/packages/cli/scripts --only-fixed --fail-on medium` → `No vulnerabilities found`. - **Socket** — could not run. `doppler secrets get SOCKET_API_TOKEN --plain --project hermes --config dev_zen` returns empty in this cron sandbox, so `socket ci` exits with `Auth Error`. Reporting rather than skipping silently; this change adds no dependency, so the dependency-alert surface is unchanged. - No new dependencies, no new network destinations. The one behavioural change is a fail-closed integrity check on bytes that were previously trusted unverified. Origin: cron-48e51eab745f / [zen-cron-44e260352d1a](https://zen.corp.composio.io/dashboard/#/chat/zen-cron-44e260352d1a) Triggered by: saransh@composio.dev | Source: unknown Session: https://zen.corp.composio.io/dashboard/#/chat/zen-cron-44e260352d1a@composio/cli@0.4.1-beta.369 |
||
|
Soham Basu
|
23ae2cdf19 | fix(docs): stabilize toolkit knowledge and refresh KB | ||
|
jkomyno
|
121edf4e65 | docs: auto-generate Python SDK reference | ||
|
Alberto Schiabel
|
9e958948c5 |
fix(core): block sensitive upload paths hidden behind a symlinked directory (#4218)
# Description
Found by the scheduled security audit, while checking whether a test
failure on my other PR was pre-existing. It was — and the reason it
fails is a real gap in a shipped security control.
`isBlockedSensitiveFileUploadPath` (the GHSA-hp3h-89pf-5q58 denylist)
matched deny segments **only against the symlink-resolved path**. That
catches a benign name pointing at a secret — `~/innocent-name ->
~/nested/.aws/creds`, which the existing test covers — but misses the
inverse:
| Layout | Written path | Resolved path | Blocked before? |
|---|---|---|---|
| `~/innocent -> ~/.aws/creds` | no `.aws` | **`.aws`** | yes |
| `~/.claude -> /state/claude` | **`.claude`** | no `.claude` | **no** |
`~/.claude/settings.json` resolves to `/state/claude/settings.json`,
which has no `.claude` segment, so it sailed through — and `.claude` is
on the denylist precisely because it *"may contain API keys and project
context read by assistants"*.
This layout is not exotic. Dotfile managers (chezmoi, stow, yadm) and
containerised home directories produce it routinely — Composio's own
agent sandbox image has `/home/zen/.claude -> /state/claude`. For every
user in that shape the control was silently inactive, which is the worst
failure mode for a denylist: no error, no warning, upload proceeds.
The same hiding trick applies to the basename check (`~/.env ->
/state/plain-config`), so that path is fixed too.
## Why CI never caught this
`ts/packages/core/test/utils/sensitiveFileUploadPaths.test.ts` **already
asserts** the blocked behaviour:
```ts
expect(isBlockedSensitiveFileUploadPath(path.join(os.homedir(), '.claude', 'settings.json'))).toBe(true);
```
That assertion has been failing on `next` on any machine where
`~/.claude` is a symlink. It passes in CI only because `~/.claude` does
not exist on the runners: `existsSync` is false, no `realpath` runs, and
the written path keeps its `.claude` segment. The test is
environment-dependent, so green CI was never evidence the control
worked.
## The fix
The TypeScript `normalizePath` helper now returns both the written and
resolved segments, and the segment scan and basename check each consider
both. The Python guard now applies the same rule. Either path can carry
the denied name, so both SDKs inspect both forms.
# How did I test this PR
**The TypeScript fix is gated by tests — 3 fail without it, 13/13 pass
with it.**
Without the `src` change (test file only):
```
× blocks common credential directory segments
× blocks a sensitive directory that is itself a symlink to a plain path
× blocks a denied basename whose symlink target is named innocuously
Tests 3 failed | 10 passed (13)
```
With the fix:
```
Test Files 1 passed (1)
Tests 13 passed (13)
```
Note the first of those three is the **pre-existing** assertion quoted
above — this PR turns it green rather than adding it.
Three tests added, each building a real symlink in a temp dir:
- sensitive directory that is itself a symlink to a plain path (the
`~/.claude -> /state/claude` case), asserting both
`isBlockedSensitiveFileUploadPath` and that `assertSafeFileUploadPath`
throws
- denied basename whose symlink target is named innocuously (`.env ->
plain-config`)
- **negative case**: an ordinary file reached through a symlinked
directory (`docs/document.pdf`) is still allowed, so the fix does not
over-block
The Python parity change adds the same three cases. Before the Python
source change, the sensitive written directory and basename both
returned `False`; with the fix, all 11 focused Python tests pass.
**Full verification:**
| Command | Result |
|---|---|
| `vitest run` in `ts/packages/core` | **48 files, 1114 tests passed** |
| `pnpm typecheck` (workspace) | **14/14 tasks successful**, exit 0 |
| `oxlint` on both changed files | exit 0, clean |
| `prettier --check` on both changed files | "All matched files use
Prettier code style!" |
| `nox -s chk` in `python/` | Ruff and mypy passed |
| `nox -s tst` in `python/` | **1339 passed, 33 skipped**, exit 0 |
# Security
- No dependency changes, no new network calls, no new imports. The diff
is limited to the equivalent TypeScript and Python guards, their tests,
and the required `@composio/core` patch changeset.
- This **strengthens** an existing control and cannot weaken it: the
previous match set is a strict subset of the new one, so nothing that
was blocked before is allowed now. The added negative test pins that the
widening does not over-block ordinary files.
- **Grype** — `grype dir:ts/packages/core --only-fixed --fail-on medium`
→ reported below.
- **Socket** — could not run; `doppler secrets get SOCKET_API_TOKEN
--plain --project hermes --config dev_zen` returns empty in this cron
sandbox, so `socket ci` exits `Auth Error`. Reporting rather than
skipping silently.
- Unrelated pre-existing note: the repo's `pnpm audit --prod` comment
flags `extract-zip <=2.0.1` with `Patched versions >=2.0.2`, a version
that does not exist on npm. Details in #4217.
Origin: cron-48e51eab745f /
[zen-cron-44e260352d1a](https://zen.corp.composio.io/dashboard/#/chat/zen-cron-44e260352d1a)
Triggered by: saransh@composio.dev | Source: unknown
Session:
https://zen.corp.composio.io/dashboard/#/chat/zen-cron-44e260352d1a
|
||
|
jkomyno
|
449f4e128a | chore: add changeset for symlink path protection | ||
|
jkomyno
|
43545ec889 | fix(python): block sensitive paths hidden by symlinks | ||
|
Alberto Schiabel
|
52f8861c95 |
docs(gemini): update to use gemini 3.7 and new models (#4244)
## Summary Updates docs and sample scripts to use latest Gemini models. ## Changes - Vertex & Gemini sample scripts updated - Plus accompanying markdown ## Type of change - [ ] Bug fix - [ ] New feature - [ ] Refactor/Chore - [x] Documentation - [ ] Breaking change ## How Has This Been Tested? Visual inspection ## Checklist - [x] I have read the Code of Conduct and this PR adheres to it - [x] I ran linters/tests locally and they passed - [x] I updated documentation as needed - [ ] I added tests or explain why not applicable - [ ] I added a changeset if this change affects published packages ## Additional context |
||
|
Alberto Schiabel
|
3353374105 |
fix(deps): bump the github-actions group across 1 directory with 7 updates (#4239)
Bumps the github-actions group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `4.4.0` | `7.0.1` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.2` | `7.0.1` | | [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) | `1.0.185` | `1.0.199` | | [actions/setup-python](https://github.com/actions/setup-python) | `5.6.0` | `7.0.0` | | [actions/cache](https://github.com/actions/cache) | `4.3.0` | `6.1.0` | | [openai/codex-action](https://github.com/openai/codex-action) | `1.11` | `1.12` | | [anthropics/claude-code-action/base-action](https://github.com/anthropics/claude-code-action) | `1.0.185` | `1.0.199` | Updates `actions/checkout` from 4.4.0 to 7.0.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p> <blockquote> <h2>v7.0.1</h2> <h2>What's Changed</h2> <ul> <li>skip running unsafe pr check if input is default by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li> <li>trim only ascii whitespace for branch by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li> <li>escape values passed to --unset by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li> <li>Various dependency updates</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v7...v7.0.1">https://github.com/actions/checkout/compare/v7...v7.0.1</a></p> <h2>v7.0.0</h2> <h2>What's Changed</h2> <ul> <li>block checking out fork pr for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li> <li>Bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li> <li>Bump js-yaml from 4.1.0 to 4.2.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li> <li>Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li> <li>upgrade module to esm and update dependencies by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li> <li>Bump the minor-npm-dependencies group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li> <li>getting ready for checkout v7 release by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2464">actions/checkout#2464</a></li> <li>update error wording by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2467">actions/checkout#2467</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.3...v7.0.0">https://github.com/actions/checkout/compare/v6.0.3...v7.0.0</a></p> <h2>v6.1.0</h2> <h2>What's Changed</h2> <ul> <li><strong>[BREAKING]</strong> backport <code>allow-unsafe-pr-checkout</code> to v6 by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2500">actions/checkout#2500</a></li> <li>backport fixes to releases-v6 by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2527">actions/checkout#2527</a></li> </ul> <p><a href="https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/">https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/</a> for more details about this breaking change</p> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.3...v6.1.0">https://github.com/actions/checkout/compare/v6.0.3...v6.1.0</a></p> <h2>v6.0.3</h2> <h2>What's Changed</h2> <ul> <li>Update changelog by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2357">actions/checkout#2357</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>Update changelog for v6.0.3 by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2446">actions/checkout#2446</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/yaananth"><code>@yaananth</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6...v6.0.3">https://github.com/actions/checkout/compare/v6...v6.0.3</a></p> <h2>v6.0.2</h2> <h2>What's Changed</h2> <ul> <li>Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by <a href="https://github.com/TingluoHuang"><code>@TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2355">actions/checkout#2355</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v7.0.1</h2> <ul> <li>Skip running unsafe pr check if input is default by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li> <li>Trim only ascii whitespace for branch by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li> <li>Escape values passed to --unset by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li> <li>Various dependency updates</li> </ul> <h2>v7.0.0</h2> <ul> <li>Block checking out fork PR for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Various dependency updates</li> </ul> <h2>v6.0.3</h2> <ul> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <h2>v6.0.2</h2> <ul> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <h2>v6.0.1</h2> <ul> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> </ul> <h2>v6.0.0</h2> <ul> <li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li> <li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li> </ul> <h2>v5.0.1</h2> <ul> <li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li> </ul> <h2>v5.0.0</h2> <ul> <li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li> </ul> <h2>v4.3.1</h2> <ul> <li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li> </ul> <h2>v4.3.0</h2> <ul> <li>docs: update README.md by <a href="https://github.com/motss"><code>@motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li> <li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li> <li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li> <li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li> <li>Update README.md by <a href="https://github.com/nebuk89"><code>@nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li> <li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li> <li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li> </ul> <h2>v4.2.2</h2> <ul> <li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li> <li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li> </ul> <h2>v4.2.1</h2> <ul> <li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/checkout/commit/3d3c42e5aac5ba805825da76410c181273ba90b1"><code>3d3c42e</code></a> prep v7.0.1 release (<a href="https://redirect.github.com/actions/checkout/issues/2531">#2531</a>)</li> <li><a href="https://github.com/actions/checkout/commit/28802689a136bfcdb721715abd713740beecbe07"><code>2880268</code></a> escape values passed to --unset (<a href="https://redirect.github.com/actions/checkout/issues/2530">#2530</a>)</li> <li><a href="https://github.com/actions/checkout/commit/12cd2235efa0937479335606d7c3ac9f6c0973b1"><code>12cd223</code></a> trim only ascii whitespace for branch (<a href="https://redirect.github.com/actions/checkout/issues/2521">#2521</a>)</li> <li><a href="https://github.com/actions/checkout/commit/62661c4e71a304b2823ed026347b8d34c3eac541"><code>62661c4</code></a> skip running unsafe pr check if input is default (<a href="https://redirect.github.com/actions/checkout/issues/2518">#2518</a>)</li> <li><a href="https://github.com/actions/checkout/commit/e8d4307400f9427dba7cb98e488d6ab85f1cec5f"><code>e8d4307</code></a> Bump the minor-actions-dependencies group with 2 updates (<a href="https://redirect.github.com/actions/checkout/issues/2499">#2499</a>)</li> <li><a href="https://github.com/actions/checkout/commit/631c942040754b6e095e929c1677c07e10ed4f87"><code>631c942</code></a> eslint 9 (<a href="https://redirect.github.com/actions/checkout/issues/2474">#2474</a>)</li> <li><a href="https://github.com/actions/checkout/commit/4f1f4aec02e41874fa0262ea8ff5172d7978ad1e"><code>4f1f4ae</code></a> Bump actions/upload-artifact from 4 to 7 (<a href="https://redirect.github.com/actions/checkout/issues/2476">#2476</a>)</li> <li><a href="https://github.com/actions/checkout/commit/ba097532fb203f7e88c9c3c0b899b49469908a92"><code>ba09753</code></a> Bump actions/checkout from 6 to 7 (<a href="https://redirect.github.com/actions/checkout/issues/2488">#2488</a>)</li> <li><a href="https://github.com/actions/checkout/commit/b9e0990d219a03df7633c93f6f005a8fecbcab22"><code>b9e0990</code></a> Bump docker/login-action from 3.3.0 to 4.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2479">#2479</a>)</li> <li><a href="https://github.com/actions/checkout/commit/e8cb398be4a550817e382abf69e4c12c76fce1f2"><code>e8cb398</code></a> Bump docker/build-push-action from 6.5.0 to 7.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2478">#2478</a>)</li> <li>Additional commits viewable in <a href="https://github.com/actions/checkout/compare/v4.4.0...3d3c42e5aac5ba805825da76410c181273ba90b1">compare view</a></li> </ul> </details> <br /> Updates `actions/upload-artifact` from 4.6.2 to 7.0.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/upload-artifact/releases">actions/upload-artifact's releases</a>.</em></p> <blockquote> <h2>v7.0.1</h2> <h2>What's Changed</h2> <ul> <li>Update the readme with direct upload details by <a href="https://github.com/danwkennedy"><code>@danwkennedy</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/795">actions/upload-artifact#795</a></li> <li>Readme: bump all the example versions to v7 by <a href="https://github.com/danwkennedy"><code>@danwkennedy</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/796">actions/upload-artifact#796</a></li> <li>Include changes in typespec/ts-http-runtime 0.3.5 by <a href="https://github.com/yacaovsnc"><code>@yacaovsnc</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/797">actions/upload-artifact#797</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/upload-artifact/compare/v7...v7.0.1">https://github.com/actions/upload-artifact/compare/v7...v7.0.1</a></p> <h2>v7.0.0</h2> <h2>v7 What's new</h2> <h3>Direct Uploads</h3> <p>Adds support for uploading single files directly (unzipped). Callers can set the new <code>archive</code> parameter to <code>false</code> to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The <code>name</code> parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.</p> <h3>ESM</h3> <p>To support new versions of the <code>@actions/*</code> packages, we've upgraded the package to ESM.</p> <h2>What's Changed</h2> <ul> <li>Add proxy integration test by <a href="https://github.com/Link"><code>@Link</code></a>- in <a href="https://redirect.github.com/actions/upload-artifact/pull/754">actions/upload-artifact#754</a></li> <li>Upgrade the module to ESM and bump dependencies by <a href="https://github.com/danwkennedy"><code>@danwkennedy</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/762">actions/upload-artifact#762</a></li> <li>Support direct file uploads by <a href="https://github.com/danwkennedy"><code>@danwkennedy</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/764">actions/upload-artifact#764</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Link"><code>@Link</code></a>- made their first contribution in <a href="https://redirect.github.com/actions/upload-artifact/pull/754">actions/upload-artifact#754</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/upload-artifact/compare/v6...v7.0.0">https://github.com/actions/upload-artifact/compare/v6...v7.0.0</a></p> <h2>v6.0.0</h2> <h2>v6 - What's new</h2> <blockquote> <p>[!IMPORTANT] actions/upload-artifact@v6 now runs on Node.js 24 (<code>runs.using: node24</code>) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.</p> </blockquote> <h3>Node.js 24</h3> <p>This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.</p> <h2>What's Changed</h2> <ul> <li>Upload Artifact Node 24 support by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/719">actions/upload-artifact#719</a></li> <li>fix: update <code>@actions/artifact</code> for Node.js 24 punycode deprecation by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/744">actions/upload-artifact#744</a></li> <li>prepare release v6.0.0 for Node.js 24 support by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/745">actions/upload-artifact#745</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/upload-artifact/compare/v5.0.0...v6.0.0">https://github.com/actions/upload-artifact/compare/v5.0.0...v6.0.0</a></p> <h2>v5.0.0</h2> <h2>What's Changed</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/upload-artifact/commit/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"><code>043fb46</code></a> Merge pull request <a href="https://redirect.github.com/actions/upload-artifact/issues/797">#797</a> from actions/yacaovsnc/update-dependency</li> <li><a href="https://github.com/actions/upload-artifact/commit/634250c1388765ea7ed0f053e636f1f399000b94"><code>634250c</code></a> Include changes in typespec/ts-http-runtime 0.3.5</li> <li><a href="https://github.com/actions/upload-artifact/commit/e454baaac2be505c9450e11b8f3215c6fc023ce8"><code>e454baa</code></a> Readme: bump all the example versions to v7 (<a href="https://redirect.github.com/actions/upload-artifact/issues/796">#796</a>)</li> <li><a href="https://github.com/actions/upload-artifact/commit/74fad66b98a6d799dc004d3353ccd0e6f6b2530e"><code>74fad66</code></a> Update the readme with direct upload details (<a href="https://redirect.github.com/actions/upload-artifact/issues/795">#795</a>)</li> <li><a href="https://github.com/actions/upload-artifact/commit/bbbca2ddaa5d8feaa63e36b76fdaad77386f024f"><code>bbbca2d</code></a> Support direct file uploads (<a href="https://redirect.github.com/actions/upload-artifact/issues/764">#764</a>)</li> <li><a href="https://github.com/actions/upload-artifact/commit/589182c5a4cec8920b8c1bce3e2fab1c97a02296"><code>589182c</code></a> Upgrade the module to ESM and bump dependencies (<a href="https://redirect.github.com/actions/upload-artifact/issues/762">#762</a>)</li> <li><a href="https://github.com/actions/upload-artifact/commit/47309c993abb98030a35d55ef7ff34b7fa1074b5"><code>47309c9</code></a> Merge pull request <a href="https://redirect.github.com/actions/upload-artifact/issues/754">#754</a> from actions/Link-/add-proxy-integration-tests</li> <li><a href="https://github.com/actions/upload-artifact/commit/02a8460834e70dab0ce194c64360c59dc1475ef0"><code>02a8460</code></a> Add proxy integration test</li> <li><a href="https://github.com/actions/upload-artifact/commit/b7c566a772e6b6bfb58ed0dc250532a479d7789f"><code>b7c566a</code></a> Merge pull request <a href="https://redirect.github.com/actions/upload-artifact/issues/745">#745</a> from actions/upload-artifact-v6-release</li> <li><a href="https://github.com/actions/upload-artifact/commit/e516bc8500aaf3d07d591fcd4ae6ab5f9c391d5b"><code>e516bc8</code></a> docs: correct description of Node.js 24 support in README</li> <li>Additional commits viewable in <a href="https://github.com/actions/upload-artifact/compare/v4.6.2...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a">compare view</a></li> </ul> </details> <br /> Updates `anthropics/claude-code-action` from 1.0.185 to 1.0.199 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/anthropics/claude-code-action/releases">anthropics/claude-code-action's releases</a>.</em></p> <blockquote> <h2>v1.0.199</h2> <h2>What's Changed</h2> <ul> <li>fix(github): honor GITHUB_GRAPHQL_URL for the GraphQL client by <a href="https://github.com/rover0811"><code>@rover0811</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1575">anthropics/claude-code-action#1575</a></li> <li>fix(cleanup): keep the base-branch config revert out of the auto-commit by <a href="https://github.com/GautamSharma99"><code>@GautamSharma99</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1677">anthropics/claude-code-action#1677</a></li> <li>fix(mcp): recognize mcp__github aggregate selector for GitHub MCP server initialization by <a href="https://github.com/anishesg"><code>@anishesg</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1657">anthropics/claude-code-action#1657</a></li> <li>Document 1M gateway models and surface resolved limits by <a href="https://github.com/ulofiai"><code>@ulofiai</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1608">anthropics/claude-code-action#1608</a></li> <li>fix: teach claude_args --allowedTools in the signed prompt by <a href="https://github.com/WeAreResilience"><code>@WeAreResilience</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1704">anthropics/claude-code-action#1704</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/rover0811"><code>@rover0811</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1575">anthropics/claude-code-action#1575</a></li> <li><a href="https://github.com/GautamSharma99"><code>@GautamSharma99</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1677">anthropics/claude-code-action#1677</a></li> <li><a href="https://github.com/WeAreResilience"><code>@WeAreResilience</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1704">anthropics/claude-code-action#1704</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1.0.198...v1.0.199">https://github.com/anthropics/claude-code-action/compare/v1.0.198...v1.0.199</a></p> <h2>v1.0.198</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1.0.197...v1.0.198">https://github.com/anthropics/claude-code-action/compare/v1.0.197...v1.0.198</a></p> <h2>v1.0.197</h2> <h2>What's Changed</h2> <ul> <li>fix: neutralize the checkout credential under actions/checkout v6+ include layout (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1510">#1510</a>) by <a href="https://github.com/TemRevil"><code>@TemRevil</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1526">anthropics/claude-code-action#1526</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/TemRevil"><code>@TemRevil</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1526">anthropics/claude-code-action#1526</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1.0.196...v1.0.197">https://github.com/anthropics/claude-code-action/compare/v1.0.196...v1.0.197</a></p> <h2>v1.0.196</h2> <h2>What's Changed</h2> <ul> <li>fix(security): unify secret redaction in public comment outputs by <a href="https://github.com/Juwan-Hwang"><code>@Juwan-Hwang</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1693">anthropics/claude-code-action#1693</a></li> <li>fix: strip unused ALL_INPUTS environment variable from Claude subprocess env by <a href="https://github.com/Juwan-Hwang"><code>@Juwan-Hwang</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1692">anthropics/claude-code-action#1692</a></li> <li>fix(github): match bot actors in comment filters using GraphQL __typename by <a href="https://github.com/Neal006"><code>@Neal006</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1616">anthropics/claude-code-action#1616</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Juwan-Hwang"><code>@Juwan-Hwang</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1693">anthropics/claude-code-action#1693</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1.0.195...v1.0.196">https://github.com/anthropics/claude-code-action/compare/v1.0.195...v1.0.196</a></p> <h2>v1.0.195</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1.0.194...v1.0.195">https://github.com/anthropics/claude-code-action/compare/v1.0.194...v1.0.195</a></p> <h2>v1.0.194</h2> <h2>What's Changed</h2> <ul> <li>Harden delete_files MCP tool: validate paths within repo root (consistency with commit_files) by <a href="https://github.com/GabrielOnRails"><code>@GabrielOnRails</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1636">anthropics/claude-code-action#1636</a></li> <li>Only limit fetch depth when the checkout is already shallow by <a href="https://github.com/winklemad"><code>@winklemad</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1647">anthropics/claude-code-action#1647</a></li> <li>fix(base-action): add ~/.local/bin to $GITHUB_PATH after auto-install by <a href="https://github.com/anishesg"><code>@anishesg</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1643">anthropics/claude-code-action#1643</a></li> <li>feat(context): include diffHunk in PR review comment context by <a href="https://github.com/rishavnaskar"><code>@rishavnaskar</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1584">anthropics/claude-code-action#1584</a></li> <li>ci: skip Claude-backed test jobs on fork PRs by <a href="https://github.com/ashwin-ant"><code>@ashwin-ant</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1655">anthropics/claude-code-action#1655</a></li> <li>fix: bump shell-quote to 1.8.4 to remediate CVE-2026-9277 by <a href="https://github.com/doshidhaval"><code>@doshidhaval</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1557">anthropics/claude-code-action#1557</a></li> <li>fix(images): bound attachment downloads by <a href="https://github.com/abhinavkr26104"><code>@abhinavkr26104</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1625">anthropics/claude-code-action#1625</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/anthropics/claude-code-action/commit/dcb57747bfceeaa1fa72638cae52295d1d853d4a"><code>dcb5774</code></a> chore: bump Claude Code to 2.1.239 and Agent SDK to 0.3.239</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/492d2d78ee1f7dd5b58581c639b49752db9a2fab"><code>492d2d7</code></a> fix: teach claude_args --allowedTools in the signed prompt (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1704">#1704</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/2ca5fb40278a805fe7cb3dbd6fc7b5f26405448b"><code>2ca5fb4</code></a> fix: surface resolved model limits (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1608">#1608</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/f3f2789f0a82eb276afdbac6f0d7cb10f4e7a460"><code>f3f2789</code></a> fix(mcp): recognize mcp__github aggregate selector for GitHub MCP server init...</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/6a5f1d8e0a0fcd8d2f8e79932c1880b600c9e5e7"><code>6a5f1d8</code></a> fix(cleanup): keep the base-branch config revert out of the auto-commit (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1677">#1677</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/39ad3c89776dd68327979412d8ad0e9bec1805ef"><code>39ad3c8</code></a> fix(github): honor GITHUB_GRAPHQL_URL for the GraphQL client (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1575">#1575</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/3f854a8fb5146b39d5cbf8b57f70d80810e1366f"><code>3f854a8</code></a> chore: bump Claude Code to 2.1.238 and Agent SDK to 0.3.238</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/5ee796a55f92566ecd7e39d70dd613abcbea0d7c"><code>5ee796a</code></a> chore: bump Claude Code to 2.1.237 and Agent SDK to 0.3.237</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/cff8d3c8f08ae322e07a1c98ef1b882dc32ddc46"><code>cff8d3c</code></a> fix(git-config): neutralize checkout credential in include-based config (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1526">#1526</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/e2a4b761cd77a1138a5b41410eda9b28581f9bcd"><code>e2a4b76</code></a> chore: bump Claude Code to 2.1.236 and Agent SDK to 0.3.236</li> <li>Additional commits viewable in <a href="https://github.com/anthropics/claude-code-action/compare/9db594c7a0e82298c121c18b7f08aa1579ce7341...dcb57747bfceeaa1fa72638cae52295d1d853d4a">compare view</a></li> </ul> </details> <br /> Updates `actions/setup-python` from 5.6.0 to 7.0.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/setup-python/releases">actions/setup-python's releases</a>.</em></p> <blockquote> <h2>v7.0.0</h2> <h2>What's Changed</h2> <h3>Enhancements</h3> <ul> <li>Migrate to ESM and upgrade dependencies by <a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1330">actions/setup-python#1330</a></li> <li>Pin SHA commits and update docs with latest versions by <a href="https://github.com/HarithaVattikuti"><code>@HarithaVattikuti</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1338">actions/setup-python#1338</a></li> <li>Remove the pip-install input by <a href="https://github.com/gowridurgad"><code>@gowridurgad</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1336">actions/setup-python#1336</a></li> </ul> <h3>Bug Fix</h3> <ul> <li>Fix to Classify stderr warning messages as warnings instead of errors in annotations by <a href="https://github.com/lmvysakh"><code>@lmvysakh</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1335">actions/setup-python#1335</a></li> <li>Validate and retry manifest fetch to prevent silent failures by <a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1332">actions/setup-python#1332</a></li> </ul> <h3>Dependency Upgrade</h3> <ul> <li>Bump certifi from 2020.6.20 to 2024.7.4 in /<strong>tests</strong>/data by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1328">actions/setup-python#1328</a></li> <li>Remove EOL Python versions and Bumps numpy text fixture by <a href="https://github.com/priya-kinthali"><code>@priya-kinthali</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1333">actions/setup-python#1333</a></li> <li>Upgrade <code>@actions/cache</code> to 6.2.0 by <a href="https://github.com/philip-gai"><code>@philip-gai</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1337">actions/setup-python#1337</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/lmvysakh"><code>@lmvysakh</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-python/pull/1335">actions/setup-python#1335</a></li> <li><a href="https://github.com/philip-gai"><code>@philip-gai</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-python/pull/1337">actions/setup-python#1337</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-python/compare/v6...v7.0.0">https://github.com/actions/setup-python/compare/v6...v7.0.0</a></p> <h2>v6.3.0</h2> <h2>What's Changed</h2> <h3>Enhancement</h3> <ul> <li>Add RHEL support and include Linux distro in cache keys by <a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1323">actions/setup-python#1323</a></li> <li>Fix pip cache error handling on Windows by <a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1040">actions/setup-python#1040</a></li> </ul> <h3>Dependency update</h3> <ul> <li>Upgrade minimatch from 3.1.2 to 3.1.5 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1281">actions/setup-python#1281</a></li> <li>Upgrade actions dependencies by <a href="https://github.com/gowridurgad"><code>@gowridurgad</code></a> with <a href="https://github.com/Copilot"><code>@Copilot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1303">actions/setup-python#1303</a></li> <li>Upgrade <code>@actions/cache</code> to 5.1.0, log cache write denied by <a href="https://github.com/jasongin"><code>@jasongin</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1324">actions/setup-python#1324</a></li> <li>Upgrade dependency versions and test workflow configuration by <a href="https://github.com/HarithaVattikuti"><code>@HarithaVattikuti</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1322">actions/setup-python#1322</a></li> </ul> <h3>Documentation</h3> <ul> <li>Update advanced-usage.md by <a href="https://github.com/Dunky-Z"><code>@Dunky-Z</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/811">actions/setup-python#811</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/gowridurgad"><code>@gowridurgad</code></a> with <a href="https://github.com/Copilot"><code>@Copilot</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-python/pull/1303">actions/setup-python#1303</a></li> <li><a href="https://github.com/jasongin"><code>@jasongin</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-python/pull/1324">actions/setup-python#1324</a></li> <li><a href="https://github.com/Dunky-Z"><code>@Dunky-Z</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-python/pull/811">actions/setup-python#811</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-python/compare/v6.2.0...v6.3.0">https://github.com/actions/setup-python/compare/v6.2.0...v6.3.0</a></p> <h2>v6.2.0</h2> <h2>What's Changed</h2> <h3>Dependency Upgrades</h3> <ul> <li>Upgrade dependencies to Node 24 compatible versions by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1259">actions/setup-python#1259</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/setup-python/commit/5fda3b95a4ea91299a34e894583c3862153e4b97"><code>5fda3b9</code></a> Pin SHA commits and update docs with latest versions (<a href="https://redirect.github.com/actions/setup-python/issues/1338">#1338</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/4ab7e95f05e168b4356aebde89dd84f59c283d8e"><code>4ab7e95</code></a> Merge pull request <a href="https://redirect.github.com/actions/setup-python/issues/1337">#1337</a> from actions/philip-gai/bump-actions-cache-6-2-0</li> <li><a href="https://github.com/actions/setup-python/commit/0f3a009f475dbea83c0371cd85d099690fee8c5c"><code>0f3a009</code></a> Remove the pip-install input (<a href="https://redirect.github.com/actions/setup-python/issues/1336">#1336</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/f8cf4291c8b8e273ddd26e569454615c7315d932"><code>f8cf429</code></a> Migrate to ESM and upgrade dependencies (<a href="https://redirect.github.com/actions/setup-python/issues/1330">#1330</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/54baeea5b34417d10a7479663a23cca53ea209b5"><code>54baeea</code></a> Validate and retry manifest fetch to prevent silent failures (<a href="https://redirect.github.com/actions/setup-python/issues/1332">#1332</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/c7092773a316760f4ecfe498e4af668a4dafeac5"><code>c709277</code></a> Annotation code fix (<a href="https://redirect.github.com/actions/setup-python/issues/1335">#1335</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/6849080452e69b330395e8a6d23cf90f56d76a1a"><code>6849080</code></a> remove EOL Python versions and Bumps numpy text fixture (<a href="https://redirect.github.com/actions/setup-python/issues/1333">#1333</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/0903b469fbf4441aadfe4f4b249dc5b1fba3a73e"><code>0903b46</code></a> Bump certifi from 2020.6.20 to 2024.7.4 in /<strong>tests</strong>/data (<a href="https://redirect.github.com/actions/setup-python/issues/1328">#1328</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/ece7cb06caefa5fff74198d8649806c4678c61a1"><code>ece7cb0</code></a> Fix pip cache error handling on Windows. (<a href="https://redirect.github.com/actions/setup-python/issues/1040">#1040</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/1d18d7af5f767c1259ede05a0a5bcc30f3dcf1cf"><code>1d18d7a</code></a> Update advanced-usage.md (<a href="https://redirect.github.com/actions/setup-python/issues/811">#811</a>)</li> <li>Additional commits viewable in <a href="https://github.com/actions/setup-python/compare/v5.6.0...5fda3b95a4ea91299a34e894583c3862153e4b97">compare view</a></li> </ul> </details> <br /> Updates `actions/cache` from 4.3.0 to 6.1.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/cache/releases">actions/cache's releases</a>.</em></p> <blockquote> <h2>v6.1.0</h2> <h2>What's Changed</h2> <ul> <li>Bump <code>@actions/cache</code> to v6.1.0 - handle read-only cache access by <a href="https://github.com/jasongin"><code>@jasongin</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1768">actions/cache#1768</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v6...v6.1.0">https://github.com/actions/cache/compare/v6...v6.1.0</a></p> <h2>v6.0.0</h2> <h2>What's Changed</h2> <ul> <li>Update packages, migrate to ESM by <a href="https://github.com/Samirat"><code>@Samirat</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1760">actions/cache#1760</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v6.0.0">https://github.com/actions/cache/compare/v5...v6.0.0</a></p> <h2>v5.1.0</h2> <h2>What's Changed</h2> <ul> <li>Bump <code>@actions/cache</code> to v5.1.0 - handle read-only cache access by <a href="https://github.com/jasongin"><code>@jasongin</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1775">actions/cache#1775</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v5.1.0">https://github.com/actions/cache/compare/v5...v5.1.0</a></p> <h2>v5.0.5</h2> <h2>What's Changed</h2> <ul> <li>Update ts-http-runtime dependency by <a href="https://github.com/yacaovsnc"><code>@yacaovsnc</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1747">actions/cache#1747</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v5.0.5">https://github.com/actions/cache/compare/v5...v5.0.5</a></p> <h2>v5.0.4</h2> <h2>What's Changed</h2> <ul> <li>Add release instructions and update maintainer docs by <a href="https://github.com/Link"><code>@Link</code></a>- in <a href="https://redirect.github.com/actions/cache/pull/1696">actions/cache#1696</a></li> <li>Potential fix for code scanning alert no. 52: Workflow does not contain permissions by <a href="https://github.com/Link"><code>@Link</code></a>- in <a href="https://redirect.github.com/actions/cache/pull/1697">actions/cache#1697</a></li> <li>Fix workflow permissions and cleanup workflow names / formatting by <a href="https://github.com/Link"><code>@Link</code></a>- in <a href="https://redirect.github.com/actions/cache/pull/1699">actions/cache#1699</a></li> <li>docs: Update examples to use the latest version by <a href="https://github.com/XZTDean"><code>@XZTDean</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1690">actions/cache#1690</a></li> <li>Fix proxy integration tests by <a href="https://github.com/Link"><code>@Link</code></a>- in <a href="https://redirect.github.com/actions/cache/pull/1701">actions/cache#1701</a></li> <li>Fix cache key in examples.md for bun.lock by <a href="https://github.com/RyPeck"><code>@RyPeck</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1722">actions/cache#1722</a></li> <li>Update dependencies & patch security vulnerabilities by <a href="https://github.com/Link"><code>@Link</code></a>- in <a href="https://redirect.github.com/actions/cache/pull/1738">actions/cache#1738</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/XZTDean"><code>@XZTDean</code></a> made their first contribution in <a href="https://redirect.github.com/actions/cache/pull/1690">actions/cache#1690</a></li> <li><a href="https://github.com/RyPeck"><code>@RyPeck</code></a> made their first contribution in <a href="https://redirect.github.com/actions/cache/pull/1722">actions/cache#1722</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v5.0.4">https://github.com/actions/cache/compare/v5...v5.0.4</a></p> <h2>v5.0.3</h2> <h2>What's Changed</h2> <ul> <li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a href="https://github.com/actions/cache/security/dependabot/33">https://github.com/actions/cache/security/dependabot/33</a>)</li> <li>Bump <code>@actions/core</code> to v2.0.3</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/cache/blob/main/RELEASES.md">actions/cache's changelog</a>.</em></p> <blockquote> <h1>Releases</h1> <h2>How to prepare a release</h2> <blockquote> <p>[!NOTE] Relevant for maintainers with write access only.</p> </blockquote> <ol> <li>Switch to a new branch from <code>main</code>.</li> <li>Run <code>npm test</code> to ensure all tests are passing.</li> <li>Update the version in <a href="https://github.com/actions/cache/blob/main/package.json"><code>https://github.com/actions/cache/blob/main/package.json</code></a>.</li> <li>Run <code>npm run build</code> to update the compiled files.</li> <li>Update this <a href="https://github.com/actions/cache/blob/main/RELEASES.md"><code>https://github.com/actions/cache/blob/main/RELEASES.md</code></a> with the new version and changes in the <code>## Changelog</code> section.</li> <li>Run <code>licensed cache</code> to update the license report.</li> <li>Run <code>licensed status</code> and resolve any warnings by updating the <a href="https://github.com/actions/cache/blob/main/.licensed.yml"><code>https://github.com/actions/cache/blob/main/.licensed.yml</code></a> file with the exceptions.</li> <li>Commit your changes and push your branch upstream.</li> <li>Open a pull request against <code>main</code> and get it reviewed and merged.</li> <li>Draft a new release <a href="https://github.com/actions/cache/releases">https://github.com/actions/cache/releases</a> use the same version number used in <code>package.json</code> <ol> <li>Create a new tag with the version number.</li> <li>Auto generate release notes and update them to match the changes you made in <code>RELEASES.md</code>.</li> <li>Toggle the set as the latest release option.</li> <li>Publish the release.</li> </ol> </li> <li>Navigate to <a href="https://github.com/actions/cache/actions/workflows/release-new-action-version.yml">https://github.com/actions/cache/actions/workflows/release-new-action-version.yml</a> <ol> <li>There should be a workflow run queued with the same version number.</li> <li>Approve the run to publish the new version and update the major tags for this action.</li> </ol> </li> </ol> <h2>Changelog</h2> <h3>6.1.0</h3> <ul> <li>Bump <code>@actions/cache</code> to v6.1.0 to pick up <a href="https://redirect.github.com/actions/toolkit/pull/2435">actions/toolkit#2435 Handle cache write error due to read-only token</a></li> <li>Switch redundant "Cache save failed" warning to debug log in save-only</li> </ul> <h3>6.0.0</h3> <ul> <li>Updated <code>@actions/cache</code> to ^6.0.1, <code>@actions/core</code> to ^3.0.1, <code>@actions/exec</code> to ^3.0.0, <code>@actions/io</code> to ^3.0.2</li> <li>Migrated to ESM module system</li> <li>Upgraded Jest to v30 and test infrastructure to be ESM compatible</li> </ul> <h3>5.0.4</h3> <ul> <li>Bump <code>minimatch</code> to v3.1.5 (fixes ReDoS via globstar patterns)</li> <li>Bump <code>undici</code> to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)</li> <li>Bump <code>fast-xml-parser</code> to v5.5.6</li> </ul> <h3>5.0.3</h3> <ul> <li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a href="https://github.com/actions/cache/security/dependabot/33">https://github.com/actions/cache/security/dependabot/33</a>)</li> <li>Bump <code>@actions/core</code> to v2.0.3</li> </ul> <h3>5.0.2</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/cache/commit/55cc8345863c7cc4c66a329aec7e433d2d1c52a9"><code>55cc834</code></a> Merge pull request <a href="https://redirect.github.com/actions/cache/issues/1768">#1768</a> from jasongin/readonly-cache</li> <li><a href="https://github.com/actions/cache/commit/d8cd72f230726cdf4457ebb61ec1b593a8d12337"><code>d8cd72f</code></a> Bump <code>@actions/cache</code> to v6.1.0 - handle cache write error due to RO token</li> <li><a href="https://github.com/actions/cache/commit/2c8a9bd7457de244a408f35966fab2fb45fda9c8"><code>2c8a9bd</code></a> Merge pull request <a href="https://redirect.github.com/actions/cache/issues/1760">#1760</a> from actions/samirat/esm_migration_and_package_update</li> <li><a href="https://github.com/actions/cache/commit/e9b91fdc3fea7d79165fceb79042ef45c2d51023"><code>e9b91fd</code></a> Prettier fixes</li> <li><a href="https://github.com/actions/cache/commit/e4884b8ff7f92ef6b52c79eda480bbc86e685adb"><code>e4884b8</code></a> Rebuild dist</li> <li><a href="https://github.com/actions/cache/commit/10baf0191a3c426ea0fa4a3253a5c04233b6e18f"><code>10baf01</code></a> Fixed licenses</li> <li><a href="https://github.com/actions/cache/commit/e39b386c9004d72a15d864ade8c0b3a702d47a37"><code>e39b386</code></a> Fix test mock return order</li> <li><a href="https://github.com/actions/cache/commit/b6928203372a8571ff984c0c883ef3a1adfb0c06"><code>b692820</code></a> PR feedback</li> <li><a href="https://github.com/actions/cache/commit/60749128a44d25d3c520a489e576380cf00ff3f1"><code>6074912</code></a> Rebuild dist bundles as ESM to match type:module</li> <li><a href="https://github.com/actions/cache/commit/5a912e8b4af820fa082a0e75cfd2c782f8fbfe0e"><code>5a912e8</code></a> Fix lint and jest issues</li> <li>Additional commits viewable in <a href="https://github.com/actions/cache/compare/v4.3.0...55cc8345863c7cc4c66a329aec7e433d2d1c52a9">compare view</a></li> </ul> </details> <br /> Updates `openai/codex-action` from 1.11 to 1.12 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/openai/codex-action/blob/main/CHANGELOG.md">openai/codex-action's changelog</a>.</em></p> <blockquote> <h1>codex-action Changelog</h1> <h2><a href="https://github.com/openai/codex-action/tree/v1.12">v1.12</a> (2026-08-20)</h2> <ul> <li>Strengthen Linux runner privilege isolation and Responses API proxy credential handling.</li> <li>Reject Codex arguments and configuration overrides that conflict with protected execution settings.</li> <li>Require unprivileged user namespaces for Linux <code>drop-sudo</code>; run the action after steps that need <code>sudo</code>, Docker, or privileged service sockets.</li> <li>Document runner requirements, permission-profile behavior, and trusted configuration boundaries.</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.11">v1.11</a> (2026-07-04)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/116">#116</a> keep the permission profile helper backward compatible</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.10">v1.10</a> (2026-07-02)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/113">#113</a> add Codex permission profile support</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.9">v1.9</a> (2026-06-22)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/85">#85</a> update the internal <code>setup-node</code> pin to <code>v6.3.0</code></li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.8">v1.8</a> (2026-04-29)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/91">#91</a> tighten what bots are allowed</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.7">v1.7</a> (2026-04-24)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/89">#89</a> restrict bot permission bypass</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.6">v1.6</a> (2026-03-16)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/77">#77</a> enable GitHub-hosted Linux bubblewrap support</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.5">v1.5</a> (2026-03-16)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/74">#74</a> harden shell interpolation in action workflows</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.4">v1.4</a> (2025-11-19)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/58">#58</a> revert <a href="https://redirect.github.com/openai/codex-action/issues/56">#56</a> and use the latest stable version of Codex CLI again</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.3">v1.3</a> (2025-11-19)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/56">#56</a> temporarily set the default version of Codex CLI to <code>0.58.0</code></li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.2">v1.2</a> (2025-11-07)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/52">#52</a> add <code>baseUrl</code> to <code>Octokit</code> constructor, if appropriate, for GHE</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.1">v1.1</a> (2025-11-05)</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/openai/codex-action/commit/86365089eb2b84e0a8fb0717b304f8bdcb13b20e"><code>8636508</code></a> fix: improve runner setup and configuration handling</li> <li><a href="https://github.com/openai/codex-action/commit/c385816875cc2fc8e033ed9d1cba96f8c331210e"><code>c385816</code></a> Retry network errors/transient HTTP errors in GitHub API requests (<a href="https://redirect.github.com/openai/codex-action/issues/128">#128</a>)</li> <li><a href="https://github.com/openai/codex-action/commit/dd78cb653811af44014baa08fe954e28d32c1bf9"><code>dd78cb6</code></a> docs: update CHANGELOG for v1.11 (<a href="https://redirect.github.com/openai/codex-action/issues/117">#117</a>)</li> <li>See full diff in <a href="https://github.com/openai/codex-action/compare/52fe01ec70a42f454c9d2ebd47598f9fd6893d56...86365089eb2b84e0a8fb0717b304f8bdcb13b20e">compare view</a></li> </ul> </details> <br /> Updates `anthropics/claude-code-action/base-action` from 1.0.185 to 1.0.199 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/anthropics/claude-code-action/releases">anthropics/claude-code-action/base-action's releases</a>.</em></p> <blockquote> <h2>v1.0.199</h2> <h2>What's Changed</h2> <ul> <li>fix(github): honor GITHUB_GRAPHQL_URL for the GraphQL client by <a href="https://github.com/rover0811"><code>@rover0811</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1575">anthropics/claude-code-action#1575</a></li> <li>fix(cleanup): keep the base-branch config revert out of the auto-commit by <a href="https://github.com/GautamSharma99"><code>@GautamSharma99</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1677">anthropics/claude-code-action#1677</a></li> <li>fix(mcp): recognize mcp__github aggregate selector for GitHub MCP server initialization by <a href="https://github.com/anishesg"><code>@anishesg</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1657">anthropics/claude-code-action#1657</a></li> <li>Document 1M gateway models and surface resolved limits by <a href="https://github.com/ulofiai"><code>@ulofiai</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1608">anthropics/claude-code-action#1608</a></li> <li>fix: teach claude_args --allowedTools in the signed prompt by <a href="https://github.com/WeAreResilience"><code>@WeAreResilience</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1704">anthropics/claude-code-action#1704</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/rover0811"><code>@rover0811</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1575">anthropics/claude-code-action#1575</a></li> <li><a href="https://github.com/GautamSharma99"><code>@GautamSharma99</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1677">anthropics/claude-code-action#1677</a></li> <li><a href="https://github.com/WeAreResilience"><code>@WeAreResilience</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1704">anthropics/claude-code-action#1704</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1.0.198...v1.0.199">https://github.com/anthropics/claude-code-action/compare/v1.0.198...v1.0.199</a></p> <h2>v1.0.198</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1.0.197...v1.0.198">https://github.com/anthropics/claude-code-action/compare/v1.0.197...v1.0.198</a></p> <h2>v1.0.197</h2> <h2>What's Changed</h2> <ul> <li>fix: neutralize the checkout credential under actions/checkout v6+ include layout (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1510">#1510</a>) by <a href="https://github.com/TemRevil"><code>@TemRevil</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1526">anthropics/claude-code-action#1526</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/TemRevil"><code>@TemRevil</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1526">anthropics/claude-code-action#1526</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1.0.196...v1.0.197">https://github.com/anthropics/claude-code-action/compare/v1.0.196...v1.0.197</a></p> <h2>v1.0.196</h2> <h2>What's Changed</h2> <ul> <li>fix(security): unify secret redaction in public comment outputs by <a href="https://github.com/Juwan-Hwang"><code>@Juwan-Hwang</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1693">anthropics/claude-code-action#1693</a></li> <li>fix: strip unused ALL_INPUTS environment variable from Claude subprocess env by <a href="https://github.com/Juwan-Hwang"><code>@Juwan-Hwang</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1692">anthropics/claude-code-action#1692</a></li> <li>fix(github): match bot actors in comment filters using GraphQL __typename by <a href="https://github.com/Neal006"><code>@Neal006</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1616">anthropics/claude-code-action#1616</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Juwan-Hwang"><code>@Juwan-Hwang</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1693">anthropics/claude-code-action#1693</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1.0.195...v1.0.196">https://github.com/anthropics/claude-code-action/compare/v1.0.195...v1.0.196</a></p> <h2>v1.0.195</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1.0.194...v1.0.195">https://github.com/anthropics/claude-code-action/compare/v1.0.194...v1.0.195</a></p> <h2>v1.0.194</h2> <h2>What's Changed</h2> <ul> <li>Harden delete_files MCP tool: validate paths within repo root (consistency with commit_files) by <a href="https://github.com/GabrielOnRails"><code>@GabrielOnRails</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1636">anthropics/claude-code-action#1636</a></li> <li>Only limit fetch depth when the checkout is already shallow by <a href="https://github.com/winklemad"><code>@winklemad</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1647">anthropics/claude-code-action#1647</a></li> <li>fix(base-action): add ~/.local/bin to $GITHUB_PATH after auto-install by <a href="https://github.com/anishesg"><code>@anishesg</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1643">anthropics/claude-code-action#1643</a></li> <li>feat(context): include diffHunk in PR review comment context by <a href="https://github.com/rishavnaskar"><code>@rishavnaskar</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1584">anthropics/claude-code-action#1584</a></li> <li>ci: skip Claude-backed test jobs on fork PRs by <a href="https://github.com/ashwin-ant"><code>@ashwin-ant</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1655">anthropics/claude-code-action#1655</a></li> <li>fix: bump shell-quote to 1.8.4 to remediate CVE-2026-9277 by <a href="https://github.com/doshidhaval"><code>@doshidhaval</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1557">anthropics/claude-code-action#1557</a></li> <li>fix(images): bound attachment downloads by <a href="https://github.com/abhinavkr26104"><code>@abhinavkr26104</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1625">anthropics/claude-code-action#1625</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/anthropics/claude-code-action/commit/dcb57747bfceeaa1fa72638cae52295d1d853d4a"><code>dcb5774</code></a> chore: bump Claude Code to 2.1.239 and Agent SDK to 0.3.239</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/492d2d78ee1f7dd5b58581c639b49752db9a2fab"><code>492d2d7</code></a> fix: teach claude_args --allowedTools in the signed prompt (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1704">#1704</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/2ca5fb40278a805fe7cb3dbd6fc7b5f26405448b"><code>2ca5fb4</code></a> fix: surface resolved model limits (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1608">#1608</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/f3f2789f0a82eb276afdbac6f0d7cb10f4e7a460"><code>f3f2789</code></a> fix(mcp): recognize mcp__github aggregate selector for GitHub MCP server init...</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/6a5f1d8e0a0fcd8d2f8e79932c1880b600c9e5e7"><code>6a5f1d8</code></a> fix(cleanup): keep the base-branch config revert out of the auto-commit (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1677">#1677</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/39ad3c89776dd68327979412d8ad0e9bec1805ef"><code>39ad3c8</code></a> fix(github): honor GITHUB_GRAPHQL_URL for the GraphQL client (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1575">#1575</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/3f854a8fb5146b39d5cbf8b57f70d80810e1366f"><code>3f854a8</code></a> chore: bump Claude Code to 2.1.238 and Agent SDK to 0.3.238</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/5ee796a55f92566ecd7e39d70dd613abcbea0d7c"><code>5ee796a</code></a> chore: bump Claude Code to 2.1.237 and Agent SDK to 0.3.237</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/cff8d3c8f08ae322e07a1c98ef1b882dc32ddc46"><code>cff8d3c</code></a> fix(git-config): neutralize checkout credential in include-based config (<a href="https://redirect.g... _Description has been truncated_ |
||
|
Alberto Schiabel
|
c5be77b52a |
fix(docs): restore data sync and toolkit route availability (#4242)
This PR: - restores `Docs - Update Data` by requesting only GitHub App permissions granted to the installation and using `github.token` for same-repository issues - makes the support-knowledge token and every dependent verification step non-fatal, while closing the data-sync failure issue after recovery - keeps toolkit pages snapshot-first, then resolves one validated production slug without exposing custom, disabled, or excluded toolkits - bounds live lookups with a 15-second timeout, one-hour positive revalidation, a bounded 60-second negative cache, and concurrent request coalescing - monitors a known toolkit as HTTP 200 and an invalid toolkit as HTTP 404, and runs workflow contract tests for workflow-only edits - records ownership, rollback, deployment, and deferred `/llms.mdx` parity in the docs decision log Related: #4204 ## Validation - `bun run test`: 505 passed - `bun run types:check`: passed - `bun run lint:links`: passed - `bun run lint`: passed with pre-existing warnings only - exact-head [`Docs - Update Data` run 32850296811](https://github.com/ComposioHQ/composio/actions/runs/32850296811) passed token creation, generation, PR update, and recovery tracking at `0fb5438c3b7f1d61af357a7d80a9ec36e393cd94` - the generated-data update remains open for review: [GitHub PR #4189](https://github.com/ComposioHQ/composio/pull/4189) · [Glen review](https://app.tryglen.com/ComposioHQ/composio/pull/4189) - exact-head [`Docs Health Check` run 32850304920](https://github.com/ComposioHQ/composio/actions/runs/32850304920) confirmed the new toolkit probes as 200 and 404; the workflow still failed on the existing `/api/knowledge-search` hybrid-mode assertion - exact-head [`Docs - Tests` run 32849568061](https://github.com/ComposioHQ/composio/actions/runs/32849568061) passed static tests, semantic-artifact verification, the production build, and integration tests - `bun run check:kb-semantic` passes with a refreshed 876-record artifact - the local live-miss integration assertion was skipped because no local production API key is configured; hosted `COMPOSIO_API_KEY` presence is confirmed, but its production read scope is not ## Post-deploy monitoring - Owner/window: Docs and SDK maintainers, first production deployment through 24 hours - Healthy: snapshot toolkit 200, production-only native toolkit 200, invalid/custom/disabled toolkit 404, and no recurring data-sync failure issue - Watch: Vercel logs for `[Toolkits] Production toolkit lookup failed`, GitHub Actions for token HTTP 422 or `docs-data-sync-failure`, and health-check status drift - Roll back: set `COMPOSIO_TOOLKIT_LIVE_FALLBACK=0` and create a new Vercel deployment, or revert the route fallback and deploy that revision --- [](https://github.com/EveryInc/compound-engineering-plugin)  |
||
|
Alberto Schiabel
|
f174b28c3a |
fix(sdk): omit empty file-uploadable arguments from tool execution (#4238)
This PR: - closes https://github.com/ComposioHQ/composio/issues/4233 - stops forwarding `""` for a `file_uploadable` parameter (e.g. Gmail `attachment`) to the backend, which rejected it with `Input should be a valid dictionary or instance of FileUploadable` - Python: parameterizes the upload walker on a `leaf` handler and adds `FileHelper.drop_empty_file_uploads()`, run on both `Tools.execute` paths when `dangerously_allow_auto_upload_download_files` is off (the default) - TypeScript: moves the walker into the runtime-neutral `walkFileUploadableLeaves()` with a `DELETE_VALUE` sentinel and `dropEmptyFileUploads()`, so the flag-off path also works on edge runtimes; with the flag on, `''` is no longer attempted as an upload (previously threw `Either path or blob must be provided`) - TypeScript: `schemaHasFileProperty()` now looks through `$defs`/`definitions`, so the flag-off pass (and the existing one-shot warning) fire for `$ref`-based file schemas - keeps each SDK's existing `null` semantics: Python omits `None` as before, TypeScript still passes `null` through for schemas with a `null` variant - adds regression tests for both SDKs and a `@composio/core` changeset ## Context Reproduced against staging with `composio==0.16.0` and the current SDK: the live `GMAIL_CREATE_EMAIL_DRAFT` schema is `anyOf[FileUploadable, array[FileUploadable]]` with no `null` variant, and `""` yields the exact error from the issue on `no_auth` file tools (`TEXT_TO_PDF_UPLOAD_FILE`). With this change the backend sees the parameter as not provided, matching what the playground UI sends. |
||
|
jkomyno
|
4ee3ff83bc | fix(python): preserve null nested file containers | ||
|
jkomyno
|
0fb5438c3b | fix(docs): refresh semantic search artifact | ||
|
jkomyno
|
6873867bda | ci(docs): add semantic artifact rebuild dispatch | ||
|
Mark McDonald
|
96c6260b8c | Merge branch 'next' into 37f-docs | ||
|
Mark McDonald
|
e3d2c093e3 | docs(gemini): update to use gemini 3.7 and new models | ||
|
jkomyno
|
cfc5be7a5d | fix(docs): support canonical public toolkit slugs | ||
|
jkomyno
|
aabbff9d31 | fix(docs): normalize toolkit resolver slugs | ||
|
jkomyno
|
a2f4778512 | fix(ci): isolate toolkit resolver tests | ||
|
jkomyno
|
765d67ad65 | fix(ts): preserve proxy compatibility suppression |