mirror of
https://github.com/ComposioHQ/composio.git
synced 2026-09-22 11:46:35 +08:00
Alberto Schiabel
705591451c
This PR: - upgrades every CI action to its latest release (only `changesets/action` had one: v2.1.1 -> v2.1.2, SHA-pinned) and every outdated dependency across the pnpm workspace, the docs bun workspace, and all three `uv.lock` files - moves zod to 4.5.4 everywhere first-party — catalog, docs, `@composio/json-schema-to-zod`, `@composio/claude-agent-sdk` and the zod-v4 e2e fixtures; the `*-zod-v3` fixtures stay on 3.25.76 because that is what they exercise - moves `@mastra/core` 1.52.1 -> 1.53.0, which is the ceiling rather than a preference: bisecting `ts/examples/mastra`'s `cf:dry-run` shows 1.54.0 moved the workspace/sandbox subsystem behind `@mastra/core/agent`, which drags execa (-> `npm-run-path` -> `unicorn-magic`) into the Workers bundle where esbuild cannot link it. `@mastra/mcp` is capped at 1.17.2 for the same reason — 1.17.3 wants `@mastra/core` >=1.64. The docs bun workspace mirrors that cap as an explicit devDependency plus `overrides` entry, because bun does not apply overrides to auto-installed peers - clears every production advisory that has a published fix, so the audit gate can run without `--ignore`, which does not filter a single run: it writes the advisory into `auditConfig` and exits 0 whatever else is outstanding, so the gate was passing over nine advisories - `qs` -> >=6.16.0, `fast-uri` -> >=3.1.6, `toml` -> the 4.x line, all via overrides in the existing `# temporary: … drop when` style - `extract-zip` (GHSA-jmr9-qjv8-65gv) has no fixed version to move to — 2.0.1 is the newest release and GitHub records `first_patched_version` as null — so it moves to `auditConfig.ignoreGhsas` pointing at the `extractZipSafely` mitigation that already covers it - GHSA-866g-f22w-33x8 (`@ai-sdk/provider-utils` 3.x, low) also has nothing to move to: the advisory names 3.0.98 as patched but the 3.x line stopped at 3.0.30 and GitHub records no fixed version. It only enters the tree through `@mastra/core`, which is a peer or dev dependency of every published package, so all flagged paths are private examples and e2e fixtures. It goes in `ignoreGhsas` with that rationale so the un-levelled `pnpm audit --prod` step stops posting a warning comment on every PR - widens `@composio/anthropic`'s `@anthropic-ai/sdk` peer range to include `^0.124.0`, the line its devDependency now tests against (for a `0.x` caret, `^0.120.0` excluded it); the package is in the changeset for that reason - adapts three call sites that upstream broke: `eve` 0.52 moved `ApprovalContext` to `eve/tools/approval`, `@pierre/diffs` 1.4 gave `FileDiffProps` a second type parameter, and `fumadocs-openapi` 11.4 fixed the undeclared-tag drop that a docs guard test asserted (the guard now also asserts the page positively, so it cannot pass vacuously) - drops the stale `hono` `minimumReleaseAgeExclude` entry (its comment said to after 2026-08-06) and adds an `undici` `peerDependencyRules` allowance for openai 7.10's new optional peer ## Context Some upgrades were deliberately declined, each for a reason recorded next to the pin: - `vitest`/`@vitest/ui` stay on 4.1.11 — `@cloudflare/vitest-pool-workers@0.22.0` (latest) peers on `vitest ^4.1.0` - `undici` stays on `^7` in core — `pinnedDispatcher.node.ts` documents that Node's `fetch` rejects undici 8 dispatchers - the `pnpm` catalog entry stays on `^11` to match the mise-owned toolchain - `eve` stays on 0.27.6 in docs — 0.52 changes the `defineAgent` model definition and the `useEveAgent` helpers, so `agent/agent.ts` and `components/eve-chat.tsx` fail `types:check`; migrating the docs agent is its own PR - `@earendil-works/pi-coding-agent` stays on 0.84.4 — 0.85.x imports `@earendil-works/pi-server` without declaring it, so `test/pi.test.ts` fails to load `declareOperationTags` is kept as a safety net rather than retired, even though `fumadocs-openapi` 11.4 makes it redundant: removing it changes how specs are normalised at sync time and is worth its own PR. Verified locally: `pnpm build:packages`, `pnpm typecheck`, `pnpm test`, `pnpm typecheck:examples`, `pnpm lint:examples`, `turbo cf:dry-run --filter='./ts/examples/*'`, `pnpm peers check`, `pnpm audit --prod --audit-level=high` (exit 0), frozen-lockfile installs for pnpm and bun, docs `types:check` + 542 static tests, and Python `make chk` + `make tst` (1790 passed). https://claude.ai/code/session_018evFic47PFPXuB95uRE1aw EOF -R ComposioHQ/composio
Composio Docs
Documentation site for Composio, built with Fumadocs.
Getting Started
bun install
bun run dev
Open http://localhost:3000.
Project Structure
docs/
├── app/ # Next.js app router
├── content/ # MDX content
│ ├── docs/
│ ├── examples/
│ ├── changelog/
│ └── reference/
├── components/ # React components
├── lib/ # Utilities
└── public/ # Static assets
Adding Content
Create an .mdx file in content/, add frontmatter, then add to meta.json:
---
title: Page Title
description: Brief description
---
Content here...
Components
<Tabs items={['Python', 'TypeScript']}>
<Tab value="Python">...</Tab>
<Tab value="TypeScript">...</Tab>
</Tabs>
<Callout type="info">Note</Callout>
<Cards>
<Card title="Title" href="/path" />
</Cards>
Sidebar
Each folder has meta.json for ordering:
{
"pages": ["page-one", "page-two"]
}
TypeScript Code Blocks
All TypeScript code blocks in MDX files are type-checked at build time using Twoslash. This ensures docs stay in sync with the SDK.
- Use
// @noErrorsto skip checking for partial snippets - Use
// ---cut---to hide setup code from output - Run
bun run buildlocally to validate before pushing
See CLAUDE.md for detailed patterns and troubleshooting.
Search
Docs search uses Algolia when NEXT_PUBLIC_ALGOLIA_SEARCH_API_KEY is set; otherwise it falls back to the local Fumadocs /api/search endpoint for development and tests. The sync script builds a first-party index from MDX/OpenAPI/toolkit data (no crawler required), splits long pages into section-sized records, configures searchable attributes/custom ranking/distinct, requests clickAnalytics, and sends search result view/click events with search-insights.
NEXT_PUBLIC_ALGOLIA_APP_ID=62HI9PQZ1L # optional; default shown
NEXT_PUBLIC_ALGOLIA_SEARCH_API_KEY=...
NEXT_PUBLIC_ALGOLIA_INDEX_NAME=docs_composio # optional; default shown
Sync the Algolia index with an admin key:
ALGOLIA_APP_ID=62HI9PQZ1L
ALGOLIA_ADMIN_API_KEY=...
ALGOLIA_INDEX_NAME=docs_composio bun run sync:search
Preview the generated records or test live relevance:
bun run sync:search --dry-run --samples
ALGOLIA_SEARCH_API_KEY=... bun run test:search "oauth auth config" "gmail send email"
Commands
| Command | Description |
|---|---|
bun run dev |
Dev server |
bun run build |
Production build (validates TS code blocks) |
bun run types:check |
Type check |
bun run sync:search |
Sync docs search records to Algolia |
bun run test:search |
Query the configured Algolia index from the terminal |