mirror of https://github.com/ComposioHQ/composio.git synced 2026-09-22 11:46:35 +08:00

Files

T

Alberto Schiabel eccb80ef10 fix(cli): block SSRF in proxy binary downloads (#4511 )

This PR:
- closes
[SEC-1179](https://linear.app/composio/issue/SEC-1179/composio-attacker-can-reach-internal-services-using-ssrf-to-steal)
- routes proxy binary downloads through the core `ssrfSafeFetch` guard
- requires validation-to-connection pinning and fails closed when a
configured dispatcher or proxy prevents it
- reapplies that requirement on every redirect hop while preserving
default SDK proxy compatibility
- covers direct metadata targets, configured-route bypasses, redirects,
and the bundled Bun companion
- verifies the full core and CLI suites plus the TypeScript workspace
typecheck

2026-09-17 15:20:37 +02:00

config.json

chore(release): migrate to Changesets v3

2026-08-25 01:01:10 +02:00

heavy-toes-repeat.md

chore(deps): upgrade CI actions and every outdated dependency (#4381 )

2026-09-08 16:15:34 +02:00

json-schema-to-zod-pattern-guard.md

fix(json-schema-to-zod): guard schema pattern compilation (#4405 )

2026-09-09 19:53:07 +02:00

lucky-pugs-attend.md

fix(experimental): stamp eve durable callback descriptors (#4385 )

2026-09-08 20:51:33 +02:00

quiet-pumas-recover.md

feat(core): add optional onSubscriptionError callback for trigger subscriptions

2026-09-15 16:33:00 +02:00

read-response-body-export.md

fix(cli): cap remote file downloads in tool uploads (SEC-908) (#4417 )

2026-09-10 15:57:13 +02:00

README.md

Add changesets

2025-05-19 19:30:29 +05:30

ssrf-redirect-semantics.md

fix(sdk): honor Fetch redirect semantics in both SSRF guards (#4387 )

2026-09-08 20:51:12 +02:00

ssrf-transition-ranges.md

fix(sdk): honor Fetch redirect semantics in both SSRF guards (#4387 )

2026-09-08 20:51:12 +02:00

strip-credentials-cross-origin-redirect.md

fix(sdk): harden pusher auth and cross-origin redirect headers (#4406 )

2026-09-09 21:29:18 +02:00

tidy-keys-protect.md

fix(cli): block SSRF in proxy binary downloads (#4511 )

2026-09-17 15:20:37 +02:00

tool-not-found-only-on-404.md

fix(core): raise tool not found only on 404/400

2026-09-11 22:54:53 +02:00

toolkit-auth-field-is-secret.md

fix(core): normalize a missing toolkit auth field group instead of throwing

2026-09-15 15:11:27 +02:00

tools-jsdoc-examples.md

docs(core): fix tools getInput, proxyExecute, and execute examples

2026-09-14 13:56:26 +02:00

witty-shrimps-check.md

ci(ts): verify packed provider compatibility (#4355 )

2026-09-07 12:33:53 +02:00

README.md

Changesets

Hello and welcome! This folder has been automatically generated by @changesets/cli, a build tool that works with multi-package repos, or single-package repos to help you version and publish your code. You can find the full documentation for it in our repository

We have a quick list of common questions to get you started engaging with this project in our documentation