Release: update version by sdkrelease[bot] · Pull Request #4373 · ComposioHQ/composio

sdkrelease · 2026-09-07T10:36:13Z

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to next, this PR will be updated.

Releases

@composio/core@0.18.2

Patch Changes

7055914: Move published dependency ranges to their current upstream releases: zod 4.5, openai 7.10, typebox 1.3.27, @mastra/schema-compat 1.3.8, and @cloudflare/workers-types 5.20260905. @composio/anthropic also accepts @anthropic-ai/sdk 0.124 as a peer, the line it is now tested against.
b4b9fc4: Guard schema pattern and patternProperties compilation. A pattern that does not compile or exceeds 1024 characters now fails conversion with an InvalidPatternError that names the offending property path instead of a raw SyntaxError. @composio/core surfaces that path in the JsonSchemaToZodError message. No backtracking heuristic is applied: a hostile pattern that backtracks catastrophically remains a known limitation.
9d0cb2c: Export readResponseBodyWithLimit and MAX_URL_UPLOAD_SIZE_BYTES so downstream packages can apply the SDK's 100 MiB cap when they download a file from a user-supplied URL. The CLI's tool-input file uploads now use it instead of buffering the whole response.
ba85f4d: Apply the Fetch standard's redirect rules in ssrfSafeFetch, which following redirects manually meant fetch never applied: a 303 now retries as a bodiless GET instead of replaying an upload's method and body at a result URL, a 301/302 does the same for a POST, and 307/308 keep replaying both. Only 301, 302, 303, 307 and 308 count as redirects to follow, so a 304 or 305 carrying a Location is returned to the caller rather than followed.
ba85f4d: Close the IPv6 transition ranges the SSRF guard's address blocklist let through: 6to4 (2002::/16), Teredo and the rest of 2001::/23, local-use NAT64 (64:ff9b:1::/48), 100::/64, 2001:db8::/32 and site-local fec0::/10 each carry or reach an arbitrary IPv4 address, so 2002:7f00:1:: was a public-looking literal for 127.0.0.1. IPv4 multicast and the 192.88.99.0/24 6to4 relay range are blocked too.
85996c4: Drop Authorization, Proxy-Authorization, and Cookie from the request headers when the SSRF guard follows a redirect to a different origin, as the Fetch standard does for automatic redirects. Same-origin redirects keep them.
8bb1d29: Stop reporting every failed tool lookup as ComposioToolNotFoundError. tools.getRawComposioToolBySlug, and the tools.get / tools.execute paths that call it, now raise ComposioToolNotFoundError only when the API answers 404 or 400. Any other failure, such as an invalid API key (401), a server error, or a network fault, raises the new ComposioToolFetchError with the client error preserved as cause. toolkits.get(slug) now applies its 404/400 check against the Composio client's APIError instead of the OpenAI one, so an unknown toolkit raises ComposioToolkitNotFoundError as documented.
Updated dependencies [b4b9fc4]
- @composio/json-schema-to-zod@0.3.3

@composio/experimental@0.2.5

Patch Changes

7055914: Move published dependency ranges to their current upstream releases: zod 4.5, openai 7.10, typebox 1.3.27, @mastra/schema-compat 1.3.8, and @cloudflare/workers-types 5.20260905. @composio/anthropic also accepts @anthropic-ai/sdk 0.124 as a peer, the line it is now tested against.
100d568: Stamp eve's durable callback descriptors on the tools EveProvider wraps. eve only stamps descriptors on defineTool calls it finds in an agent's own source, so tools built inside node_modules were rejected at resolve time and every Composio tool was dropped from the step. Each wrapped tool now persists only its slug and an id for the resolve that produced it, and re-attaches to that resolve's Composio executor when eve replays or resumes a parked call.

@composio/json-schema-to-zod@0.3.3

Patch Changes

b4b9fc4: Guard schema pattern and patternProperties compilation. A pattern that does not compile or exceeds 1024 characters now fails conversion with an InvalidPatternError that names the offending property path instead of a raw SyntaxError. @composio/core surfaces that path in the JsonSchemaToZodError message. No backtracking heuristic is applied: a hostile pattern that backtracks catastrophically remains a known limitation.

@composio/anthropic@0.11.2

Patch Changes

7055914: Move published dependency ranges to their current upstream releases: zod 4.5, openai 7.10, typebox 1.3.27, @mastra/schema-compat 1.3.8, and @cloudflare/workers-types 5.20260905. @composio/anthropic also accepts @anthropic-ai/sdk 0.124 as a peer, the line it is now tested against.
20aaa95: Accept the upcoming core prerelease and the upstream versions already used to build and test providers.

@composio/claude-agent-sdk@0.12.1

Patch Changes

7055914: Move published dependency ranges to their current upstream releases: zod 4.5, openai 7.10, typebox 1.3.27, @mastra/schema-compat 1.3.8, and @cloudflare/workers-types 5.20260905. @composio/anthropic also accepts @anthropic-ai/sdk 0.124 as a peer, the line it is now tested against.
20aaa95: Accept the upcoming core prerelease and the upstream versions already used to build and test providers.

@composio/cloudflare@0.10.3

Patch Changes

7055914: Move published dependency ranges to their current upstream releases: zod 4.5, openai 7.10, typebox 1.3.27, @mastra/schema-compat 1.3.8, and @cloudflare/workers-types 5.20260905. @composio/anthropic also accepts @anthropic-ai/sdk 0.124 as a peer, the line it is now tested against.
20aaa95: Accept the upcoming core prerelease and the upstream versions already used to build and test providers.

@composio/google@0.11.1

Patch Changes

20aaa95: Accept the upcoming core prerelease and the upstream versions already used to build and test providers.

@composio/langchain@0.11.1

Patch Changes

20aaa95: Accept the upcoming core prerelease and the upstream versions already used to build and test providers.

@composio/llamaindex@0.11.1

Patch Changes

20aaa95: Accept the upcoming core prerelease and the upstream versions already used to build and test providers.

@composio/mastra@0.10.5

Patch Changes

7055914: Move published dependency ranges to their current upstream releases: zod 4.5, openai 7.10, typebox 1.3.27, @mastra/schema-compat 1.3.8, and @cloudflare/workers-types 5.20260905. @composio/anthropic also accepts @anthropic-ai/sdk 0.124 as a peer, the line it is now tested against.
20aaa95: Accept the upcoming core prerelease and the upstream versions already used to build and test providers.

@composio/openai@0.12.3

Patch Changes

20aaa95: Accept the upcoming core prerelease and the upstream versions already used to build and test providers.

@composio/openai-agents@0.11.1

Patch Changes

7055914: Move published dependency ranges to their current upstream releases: zod 4.5, openai 7.10, typebox 1.3.27, @mastra/schema-compat 1.3.8, and @cloudflare/workers-types 5.20260905. @composio/anthropic also accepts @anthropic-ai/sdk 0.124 as a peer, the line it is now tested against.
20aaa95: Accept the upcoming core prerelease and the upstream versions already used to build and test providers.

@composio/vercel@0.12.1

Patch Changes

20aaa95: Accept the upcoming core prerelease and the upstream versions already used to build and test providers.

@composio/slim@0.18.2

Patch Changes

7055914: Move published dependency ranges to their current upstream releases: zod 4.5, openai 7.10, typebox 1.3.27, @mastra/schema-compat 1.3.8, and @cloudflare/workers-types 5.20260905. @composio/anthropic also accepts @anthropic-ai/sdk 0.124 as a peer, the line it is now tested against.
85996c4: Drop Authorization, Proxy-Authorization, and Cookie from the request headers when the SSRF guard follows a redirect to a different origin, as the Fetch standard does for automatic redirects. Same-origin redirects keep them.
Updated dependencies [b4b9fc4]
- @composio/json-schema-to-zod@0.3.3

@e2e-tests/cf-workers-basic@0.0.3

Patch Changes

Updated dependencies [7055914]
Updated dependencies [b4b9fc4]
Updated dependencies [9d0cb2c]
Updated dependencies [ba85f4d]
Updated dependencies [ba85f4d]
Updated dependencies [85996c4]
Updated dependencies [8bb1d29]
- @composio/core@0.18.2

@e2e-tests/cf-workers-files@0.0.3

Patch Changes

Updated dependencies [7055914]
Updated dependencies [b4b9fc4]
Updated dependencies [9d0cb2c]
Updated dependencies [ba85f4d]
Updated dependencies [ba85f4d]
Updated dependencies [85996c4]
Updated dependencies [8bb1d29]
- @composio/core@0.18.2

@e2e-tests/cf-workers-tool-router-ai@0.0.3

Patch Changes

Updated dependencies [7055914]
Updated dependencies [b4b9fc4]
Updated dependencies [9d0cb2c]
Updated dependencies [ba85f4d]
Updated dependencies [ba85f4d]
Updated dependencies [85996c4]
Updated dependencies [8bb1d29]
Updated dependencies [20aaa95]
- @composio/core@0.18.2
- @composio/vercel@0.12.1

@e2e-tests/deno-tool-execution@0.0.1

Patch Changes

Updated dependencies [7055914]
Updated dependencies [b4b9fc4]
Updated dependencies [9d0cb2c]
Updated dependencies [ba85f4d]
Updated dependencies [ba85f4d]
Updated dependencies [85996c4]
Updated dependencies [8bb1d29]
- @composio/core@0.18.2

@e2e-tests/node-claude-agent-sdk@0.0.3

Patch Changes

Updated dependencies [7055914]
Updated dependencies [b4b9fc4]
Updated dependencies [9d0cb2c]
Updated dependencies [ba85f4d]
Updated dependencies [ba85f4d]
Updated dependencies [85996c4]
Updated dependencies [8bb1d29]
Updated dependencies [20aaa95]
- @composio/claude-agent-sdk@0.12.1
- @composio/core@0.18.2

@e2e-tests/node-custom-tools@0.0.3

Patch Changes

Updated dependencies [7055914]
Updated dependencies [b4b9fc4]
Updated dependencies [9d0cb2c]
Updated dependencies [ba85f4d]
Updated dependencies [ba85f4d]
Updated dependencies [85996c4]
Updated dependencies [8bb1d29]
- @composio/core@0.18.2

@e2e-tests/node-json-schema-to-zod-v3@0.0.3

Patch Changes

Updated dependencies [b4b9fc4]
- @composio/json-schema-to-zod@0.3.3

@e2e-tests/node-json-schema-to-zod-v4@0.0.3

Patch Changes

Updated dependencies [b4b9fc4]
- @composio/json-schema-to-zod@0.3.3

@e2e-tests/node-mastra-tool-router-zod-v3@0.0.3

Patch Changes

Updated dependencies [7055914]
Updated dependencies [b4b9fc4]
Updated dependencies [9d0cb2c]
Updated dependencies [ba85f4d]
Updated dependencies [ba85f4d]
Updated dependencies [85996c4]
Updated dependencies [8bb1d29]
Updated dependencies [20aaa95]
- @composio/core@0.18.2
- @composio/mastra@0.10.5

@e2e-tests/node-mastra-tool-router-zod-v4@0.0.3

Patch Changes

Updated dependencies [7055914]
Updated dependencies [b4b9fc4]
Updated dependencies [9d0cb2c]
Updated dependencies [ba85f4d]
Updated dependencies [ba85f4d]
Updated dependencies [85996c4]
Updated dependencies [8bb1d29]
Updated dependencies [20aaa95]
- @composio/core@0.18.2
- @composio/mastra@0.10.5

@e2e-tests/node-tool-router-files@0.0.3

Patch Changes

Updated dependencies [7055914]
Updated dependencies [b4b9fc4]
Updated dependencies [9d0cb2c]
Updated dependencies [ba85f4d]
Updated dependencies [ba85f4d]
Updated dependencies [85996c4]
Updated dependencies [8bb1d29]
- @composio/core@0.18.2

@e2e-tests/node-tool-router-pagination@0.0.3

Patch Changes

Updated dependencies [7055914]
Updated dependencies [b4b9fc4]
Updated dependencies [9d0cb2c]
Updated dependencies [ba85f4d]
Updated dependencies [ba85f4d]
Updated dependencies [85996c4]
Updated dependencies [8bb1d29]
- @composio/core@0.18.2

anthropic-example@0.1.3

Patch Changes

Updated dependencies [7055914]
Updated dependencies [b4b9fc4]
Updated dependencies [9d0cb2c]
Updated dependencies [ba85f4d]
Updated dependencies [ba85f4d]
Updated dependencies [85996c4]
Updated dependencies [8bb1d29]
Updated dependencies [20aaa95]
- @composio/anthropic@0.11.2
- @composio/claude-agent-sdk@0.12.1
- @composio/core@0.18.2

connected-accounts-example@0.1.12

Patch Changes

Updated dependencies [7055914]
Updated dependencies [b4b9fc4]
Updated dependencies [9d0cb2c]
Updated dependencies [ba85f4d]
Updated dependencies [ba85f4d]
Updated dependencies [85996c4]
Updated dependencies [8bb1d29]
- @composio/core@0.18.2

error-handling-example@0.1.12

Patch Changes

Updated dependencies [7055914]
Updated dependencies [b4b9fc4]
Updated dependencies [9d0cb2c]
Updated dependencies [ba85f4d]
Updated dependencies [ba85f4d]
Updated dependencies [85996c4]
Updated dependencies [8bb1d29]
- @composio/core@0.18.2

file-handling-example@0.1.3

Patch Changes

Updated dependencies [7055914]
Updated dependencies [b4b9fc4]
Updated dependencies [9d0cb2c]
Updated dependencies [ba85f4d]
Updated dependencies [ba85f4d]
Updated dependencies [85996c4]
Updated dependencies [8bb1d29]
- @composio/core@0.18.2

google-example@0.1.3

Patch Changes

Updated dependencies [7055914]
Updated dependencies [b4b9fc4]
Updated dependencies [9d0cb2c]
Updated dependencies [ba85f4d]
Updated dependencies [ba85f4d]
Updated dependencies [85996c4]
Updated dependencies [8bb1d29]
Updated dependencies [20aaa95]
- @composio/core@0.18.2
- @composio/google@0.11.1

json-schema-to-zod-example@0.1.3

Patch Changes

Updated dependencies [7055914]
Updated dependencies [b4b9fc4]
Updated dependencies [9d0cb2c]
Updated dependencies [ba85f4d]
Updated dependencies [ba85f4d]
Updated dependencies [85996c4]
Updated dependencies [8bb1d29]
Updated dependencies [20aaa95]
- @composio/core@0.18.2
- @composio/vercel@0.12.1

langchain-example@0.1.12

Patch Changes

Updated dependencies [7055914]
Updated dependencies [b4b9fc4]
Updated dependencies [9d0cb2c]
Updated dependencies [ba85f4d]
Updated dependencies [ba85f4d]
Updated dependencies [85996c4]
Updated dependencies [8bb1d29]
Updated dependencies [20aaa95]
- @composio/core@0.18.2
- @composio/langchain@0.11.1

llamaindex-example@0.1.3

Patch Changes

Updated dependencies [7055914]
Updated dependencies [b4b9fc4]
Updated dependencies [9d0cb2c]
Updated dependencies [ba85f4d]
Updated dependencies [ba85f4d]
Updated dependencies [85996c4]
Updated dependencies [8bb1d29]
Updated dependencies [20aaa95]
- @composio/core@0.18.2
- @composio/llamaindex@0.11.1

mastra-example@0.1.3

Patch Changes

Updated dependencies [7055914]
Updated dependencies [b4b9fc4]
Updated dependencies [9d0cb2c]
Updated dependencies [ba85f4d]
Updated dependencies [ba85f4d]
Updated dependencies [85996c4]
Updated dependencies [8bb1d29]
Updated dependencies [20aaa95]
- @composio/core@0.18.2
- @composio/mastra@0.10.5

mcp-example@0.1.3

Patch Changes

Updated dependencies [7055914]
Updated dependencies [b4b9fc4]
Updated dependencies [9d0cb2c]
Updated dependencies [ba85f4d]
Updated dependencies [ba85f4d]
Updated dependencies [85996c4]
Updated dependencies [8bb1d29]
Updated dependencies [20aaa95]
- @composio/core@0.18.2
- @composio/vercel@0.12.1

modifiers-example@0.1.12

Patch Changes

Updated dependencies [7055914]
Updated dependencies [b4b9fc4]
Updated dependencies [9d0cb2c]
Updated dependencies [ba85f4d]
Updated dependencies [ba85f4d]
Updated dependencies [85996c4]
Updated dependencies [8bb1d29]
Updated dependencies [20aaa95]
- @composio/core@0.18.2
- @composio/vercel@0.12.1

openai-example@0.1.12

Patch Changes

Updated dependencies [7055914]
Updated dependencies [b4b9fc4]
Updated dependencies [9d0cb2c]
Updated dependencies [ba85f4d]
Updated dependencies [ba85f4d]
Updated dependencies [85996c4]
Updated dependencies [8bb1d29]
Updated dependencies [20aaa95]
- @composio/core@0.18.2
- @composio/openai-agents@0.11.1
- @composio/openai@0.12.3

session-management-example@0.1.3

Patch Changes

Updated dependencies [7055914]
Updated dependencies [b4b9fc4]
Updated dependencies [9d0cb2c]
Updated dependencies [ba85f4d]
Updated dependencies [ba85f4d]
Updated dependencies [85996c4]
Updated dependencies [8bb1d29]
- @composio/core@0.18.2

tool-router-example@1.0.13

Patch Changes

Updated dependencies [7055914]
Updated dependencies [b4b9fc4]
Updated dependencies [9d0cb2c]
Updated dependencies [ba85f4d]
Updated dependencies [ba85f4d]
Updated dependencies [85996c4]
Updated dependencies [8bb1d29]
Updated dependencies [20aaa95]
- @composio/claude-agent-sdk@0.12.1
- @composio/core@0.18.2
- @composio/openai-agents@0.11.1
- @composio/vercel@0.12.1

toolkits-example@0.1.12

Patch Changes

Updated dependencies [7055914]
Updated dependencies [b4b9fc4]
Updated dependencies [9d0cb2c]
Updated dependencies [ba85f4d]
Updated dependencies [ba85f4d]
Updated dependencies [85996c4]
Updated dependencies [8bb1d29]
Updated dependencies [20aaa95]
- @composio/core@0.18.2
- @composio/vercel@0.12.1

tools-example@0.1.3

Patch Changes

Updated dependencies [7055914]
Updated dependencies [b4b9fc4]
Updated dependencies [9d0cb2c]
Updated dependencies [ba85f4d]
Updated dependencies [ba85f4d]
Updated dependencies [85996c4]
Updated dependencies [8bb1d29]
Updated dependencies [20aaa95]
- @composio/core@0.18.2
- @composio/vercel@0.12.1

triggers-example@0.1.3

Patch Changes

Updated dependencies [7055914]
Updated dependencies [b4b9fc4]
Updated dependencies [9d0cb2c]
Updated dependencies [ba85f4d]
Updated dependencies [ba85f4d]
Updated dependencies [85996c4]
Updated dependencies [8bb1d29]
- @composio/core@0.18.2

vercel-example@0.1.12

Patch Changes

Updated dependencies [7055914]
Updated dependencies [b4b9fc4]
Updated dependencies [9d0cb2c]
Updated dependencies [ba85f4d]
Updated dependencies [ba85f4d]
Updated dependencies [85996c4]
Updated dependencies [8bb1d29]
Updated dependencies [20aaa95]
- @composio/core@0.18.2
- @composio/vercel@0.12.1

versioning-example@0.1.3

Patch Changes

Updated dependencies [7055914]
Updated dependencies [b4b9fc4]
Updated dependencies [9d0cb2c]
Updated dependencies [ba85f4d]
Updated dependencies [ba85f4d]
Updated dependencies [85996c4]
Updated dependencies [8bb1d29]
- @composio/core@0.18.2

vercel · 2026-09-07T10:36:20Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Sep 14, 2026 11:29am UTC

github-actions · 2026-09-07T10:36:56Z

⚠️ Security Audit Warning

The pnpm audit --prod check found security vulnerabilities in production dependencies.

Please review and fix the vulnerabilities. You can try running:

pnpm audit --fix --prod

Audit output

┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ extract-zip unvalidated symlink path traversal         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ extract-zip                                            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <=2.0.1                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=2.0.2                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ ts__packages__cli>extract-zip                          │
│                     │                                                        │
│                     │ ts__packages__cli-local-tools>extract-zip              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-jmr9-qjv8-65gv      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ fast-uri vulnerable to host confusion via skipped IDN  │
│                     │ canonicalization on scheme-relative references         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ fast-uri                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=3.1.3 <3.1.6                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=3.1.6                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ ts__e2e-tests__runtimes__node__claude-agent-           │
│                     │ sdk>@anthropic-ai/claude-agent-                        │
│                     │ sdk>@modelcontextprotocol/sdk>ajv>fast-uri             │
│                     │                                                        │
│                     │ ts__e2e-tests__runtimes__node__claude-agent-           │
│                     │ sdk>@anthropic-ai/claude-agent-                        │
│                     │ sdk>@modelcontextprotocol/sdk>ajv-formats>ajv>fast-uri │
│                     │                                                        │
│                     │ ts__e2e-tests__runtimes__node__mastra-tool-router-zod- │
│                     │ v3>@mastra/core>@modelcontextprotocol/sdk>ajv>fast-uri │
│                     │                                                        │
│                     │ ... Found 65 paths, run `pnpm why fast-uri` for more   │
│                     │ information                                            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-5jgf-p345-68v8      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ fast-uri vulnerable to server-side request forgery via │
│                     │ malformed IPv6 normalization                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ fast-uri                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=3.0.0 <3.1.6                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=3.1.6                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ ts__e2e-tests__runtimes__node__claude-agent-           │
│                     │ sdk>@anthropic-ai/claude-agent-                        │
│                     │ sdk>@modelcontextprotocol/sdk>ajv>fast-uri             │
│                     │                                                        │
│                     │ ts__e2e-tests__runtimes__node__claude-agent-           │
│                     │ sdk>@anthropic-ai/claude-agent-                        │
│                     │ sdk>@modelcontextprotocol/sdk>ajv-formats>ajv>fast-uri │
│                     │                                                        │
│                     │ ts__e2e-tests__runtimes__node__mastra-tool-router-zod- │
│                     │ v3>@mastra/core>@modelcontextprotocol/sdk>ajv>fast-uri │
│                     │                                                        │
│                     │ ... Found 65 paths, run `pnpm why fast-uri` for more   │
│                     │ information                                            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-f65p-4m7j-42xc      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ fast-uri vulnerable to server-side request forgery via │
│                     │ repeated hostname percent-decoding                     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ fast-uri                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=3.1.2 <3.1.6                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=3.1.6                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ ts__e2e-tests__runtimes__node__claude-agent-           │
│                     │ sdk>@anthropic-ai/claude-agent-                        │
│                     │ sdk>@modelcontextprotocol/sdk>ajv>fast-uri             │
│                     │                                                        │
│                     │ ts__e2e-tests__runtimes__node__claude-agent-           │
│                     │ sdk>@anthropic-ai/claude-agent-                        │
│                     │ sdk>@modelcontextprotocol/sdk>ajv-formats>ajv>fast-uri │
│                     │                                                        │
│                     │ ts__e2e-tests__runtimes__node__mastra-tool-router-zod- │
│                     │ v3>@mastra/core>@modelcontextprotocol/sdk>ajv>fast-uri │
│                     │                                                        │
│                     │ ... Found 65 paths, run `pnpm why fast-uri` for more   │
│                     │ information                                            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-fph4-wmhf-6fwf      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ fast-uri vulnerable to host confusion via              │
│                     │ percent-encoded scheme normalization                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ fast-uri                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=3.0.0 <3.1.6                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=3.1.6                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ ts__e2e-tests__runtimes__node__claude-agent-           │
│                     │ sdk>@anthropic-ai/claude-agent-                        │
│                     │ sdk>@modelcontextprotocol/sdk>ajv>fast-uri             │
│                     │                                                        │
│                     │ ts__e2e-tests__runtimes__node__claude-agent-           │
│                     │ sdk>@anthropic-ai/claude-agent-                        │
│                     │ sdk>@modelcontextprotocol/sdk>ajv-formats>ajv>fast-uri │
│                     │                                                        │
│                     │ ts__e2e-tests__runtimes__node__mastra-tool-router-zod- │
│                     │ v3>@mastra/core>@modelcontextprotocol/sdk>ajv>fast-uri │
│                     │                                                        │
│                     │ ... Found 65 paths, run `pnpm why fast-uri` for more   │
│                     │ information                                            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-jqff-g426-hqxp      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ toml-node: Uncontrolled Recursion                      │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ toml                                                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <4.2.0                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=4.2.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ ts__packages__cli>@effect/cli>toml                     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-82x6-q7mm-w9cf      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ toml-node: Prototype Pollution Leads to                │
│                     │ `Object.prototype` Corruption via `__proto__` Key-Path │
│                     │ Desynchronization                                      │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ toml                                                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <4.1.2                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=4.1.2                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ ts__packages__cli>@effect/cli>toml                     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-v5mp-jgw5-2x6j      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ qs array-limit bypass via bracket-key comma parsing    │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ qs                                                     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=6.14.2 <=6.15.3                                      │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=6.15.4                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ ts__e2e-tests__runtimes__node__claude-agent-           │
│                     │ sdk>@anthropic-ai/claude-agent-                        │
│                     │ sdk>@modelcontextprotocol/sdk>express>body-parser>qs   │
│                     │                                                        │
│                     │ ts__e2e-tests__runtimes__node__claude-agent-           │
│                     │ sdk>@anthropic-ai/claude-agent-                        │
│                     │ sdk>@modelcontextprotocol/sdk>express>qs               │
│                     │                                                        │
│                     │ ts__e2e-tests__runtimes__node__claude-agent-           │
│                     │ sdk>@anthropic-ai/claude-agent-                        │
│                     │ sdk>@modelcontextprotocol/sdk>express-rate-            │
│                     │ limit>express>body-parser>qs                           │
│                     │                                                        │
│                     │ ... Found 100 paths, run `pnpm why qs` for more        │
│                     │ information                                            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-x5fp-wj9c-mxmx      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ qs: Denial of Service via Attacker Controlled isBuffer │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ qs                                                     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=2.2.5 <6.16.0                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=6.16.0                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ ts__e2e-tests__runtimes__node__claude-agent-           │
│                     │ sdk>@anthropic-ai/claude-agent-                        │
│                     │ sdk>@modelcontextprotocol/sdk>express>body-parser>qs   │
│                     │                                                        │
│                     │ ts__e2e-tests__runtimes__node__claude-agent-           │
│                     │ sdk>@anthropic-ai/claude-agent-                        │
│                     │ sdk>@modelcontextprotocol/sdk>express>qs               │
│                     │                                                        │
│                     │ ts__e2e-tests__runtimes__node__claude-agent-           │
│                     │ sdk>@anthropic-ai/claude-agent-                        │
│                     │ sdk>@modelcontextprotocol/sdk>express-rate-            │
│                     │ limit>express>body-parser>qs                           │
│                     │                                                        │
│                     │ ... Found 100 paths, run `pnpm why qs` for more        │
│                     │ information                                            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-4mjr-xmp4-gh2g      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ low                 │ @ai-sdk/provider-utils has an Uncontrolled Resource    │
│                     │ Consumption issue                                      │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ @ai-sdk/provider-utils                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <=3.0.97                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=3.0.98                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ ts__e2e-tests__runtimes__node__mastra-tool-router-zod- │
│                     │ v3>@mastra/core>@ai-sdk/provider-utils                 │
│                     │                                                        │
│                     │ ts__e2e-tests__runtimes__node__mastra-tool-router-zod- │
│                     │ v3>@mastra/mcp>@mastra/core>@ai-sdk/provider-utils     │
│                     │                                                        │
│                     │ ts__e2e-tests__runtimes__node__mastra-tool-router-zod- │
│                     │ v4>@mastra/core>@ai-sdk/provider-utils                 │
│                     │                                                        │
│                     │ ... Found 14 paths, run `pnpm why                      │
│                     │ @ai-sdk/provider-utils` for more information           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-866g-f22w-33x8      │
└─────────────────────┴────────────────────────────────────────────────────────┘
10 vulnerabilities found
Severity: 1 low | 2 moderate | 7 high

greptile-apps · 2026-09-10T18:51:03Z

Greptile Summary

This automated release PR consumes nine changesets and publishes synchronized patch-version and changelog updates across the TypeScript packages, examples, and end-to-end fixtures.

Updates @composio/core and @composio/slim to 0.18.2.
Updates affected providers and supporting packages to their next patch versions.
Propagates workspace dependency releases into example and end-to-end package metadata.
Removes the consumed changeset files.

Confidence Score: 5/5

The release metadata changes appear safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
ts/packages/core/package.json	Updates the core package version from 0.18.1 to 0.18.2.
ts/packages/core/CHANGELOG.md	Adds the 0.18.2 release notes corresponding to the consumed core changesets.
ts/packages/experimental/package.json	Updates the experimental package version from 0.2.4 to 0.2.5.
ts/packages/json-schema-to-zod/package.json	Updates the schema conversion package version from 0.3.2 to 0.3.3.
ts/packages/slim/package.json	Updates the slim package version from 0.18.1 to 0.18.2.
ts/packages/providers/anthropic/package.json	Updates the Anthropic provider version from 0.11.1 to 0.11.2.
ts/packages/providers/claude-agent-sdk/package.json	Updates the Claude Agent SDK provider version from 0.12.0 to 0.12.1.
ts/packages/providers/vercel/package.json	Updates the Vercel provider version from 0.12.0 to 0.12.1.

_{Reviews (16): Last reviewed commit: "Release: update version" | Re-trigger Greptile}

sdkrelease Bot requested a review from Alberto Schiabel (jkomyno) as a code owner September 7, 2026 10:36

sdkrelease Bot force-pushed the changeset-release/next branch from 718ce16 to 9c838e2 Compare September 7, 2026 10:36

sdkrelease Bot force-pushed the changeset-release/next branch from 9c838e2 to 5462930 Compare September 7, 2026 10:37

vercel Bot deployed to Preview September 7, 2026 10:39 View deployment

sdkrelease Bot force-pushed the changeset-release/next branch 2 times, most recently from 9aa671a to 7fb90d4 Compare September 7, 2026 13:17

vercel Bot deployed to Preview September 7, 2026 13:18 View deployment

sdkrelease Bot force-pushed the changeset-release/next branch from 7fb90d4 to d6c432d Compare September 7, 2026 14:02

vercel Bot deployed to Preview September 7, 2026 14:03 View deployment

sdkrelease Bot force-pushed the changeset-release/next branch from d6c432d to d24d77b Compare September 8, 2026 11:35

vercel Bot deployed to Preview September 8, 2026 11:36 View deployment

sdkrelease Bot force-pushed the changeset-release/next branch from d24d77b to 9cd6aec Compare September 8, 2026 13:01

vercel Bot deployed to Preview September 8, 2026 13:03 View deployment

sdkrelease Bot force-pushed the changeset-release/next branch from 9cd6aec to ae796d5 Compare September 8, 2026 14:17

vercel Bot deployed to Preview September 8, 2026 14:19 View deployment

sdkrelease Bot force-pushed the changeset-release/next branch from ae796d5 to 93b6f87 Compare September 8, 2026 14:30

vercel Bot deployed to Preview September 8, 2026 14:32 View deployment

sdkrelease Bot force-pushed the changeset-release/next branch from 93b6f87 to e048939 Compare September 8, 2026 16:13

vercel Bot deployed to Preview September 8, 2026 16:15 View deployment

sdkrelease Bot force-pushed the changeset-release/next branch from e048939 to c74cc53 Compare September 8, 2026 16:16

vercel Bot deployed to Preview September 8, 2026 16:17 View deployment

sdkrelease Bot force-pushed the changeset-release/next branch 2 times, most recently from 32f0869 to 00d9491 Compare September 8, 2026 18:53

vercel Bot deployed to Preview September 8, 2026 18:55 View deployment

sdkrelease Bot force-pushed the changeset-release/next branch 3 times, most recently from 7959ebf to 214f248 Compare September 9, 2026 14:00

vercel Bot deployed to Preview September 9, 2026 14:02 View deployment

vercel Bot deployed to Preview September 10, 2026 00:19 View deployment

sdkrelease Bot force-pushed the changeset-release/next branch 2 times, most recently from de245d0 to 770231b Compare September 10, 2026 14:00

vercel Bot deployed to Preview September 10, 2026 14:01 View deployment

sdkrelease Bot force-pushed the changeset-release/next branch from 770231b to 270f138 Compare September 10, 2026 15:17

vercel Bot deployed to Preview September 10, 2026 15:19 View deployment

sdkrelease Bot force-pushed the changeset-release/next branch from 270f138 to e933bba Compare September 10, 2026 15:49

vercel Bot deployed to Preview September 10, 2026 15:51 View deployment

sdkrelease Bot force-pushed the changeset-release/next branch from e933bba to 6f1a13c Compare September 10, 2026 16:23

vercel Bot deployed to Preview September 10, 2026 16:24 View deployment

sdkrelease Bot force-pushed the changeset-release/next branch from 6f1a13c to 7257674 Compare September 10, 2026 16:35

vercel Bot deployed to Preview September 10, 2026 16:36 View deployment

sdkrelease Bot force-pushed the changeset-release/next branch from 7257674 to 8116a9b Compare September 10, 2026 16:54

vercel Bot deployed to Preview September 10, 2026 16:55 View deployment

sdkrelease Bot force-pushed the changeset-release/next branch from 8116a9b to 0b678c2 Compare September 10, 2026 17:57

vercel Bot deployed to Preview September 10, 2026 17:59 View deployment

sdkrelease Bot force-pushed the changeset-release/next branch from 0b678c2 to 0c88ea3 Compare September 10, 2026 18:49

vercel Bot deployed to Preview September 10, 2026 18:51 View deployment

sdkrelease Bot force-pushed the changeset-release/next branch from 0c88ea3 to a5493f0 Compare September 10, 2026 18:51

vercel Bot deployed to Preview September 10, 2026 18:53 View deployment

sdkrelease Bot force-pushed the changeset-release/next branch from a5493f0 to 92f5f8f Compare September 10, 2026 18:54

vercel Bot deployed to Preview September 10, 2026 18:56 View deployment

sdkrelease Bot force-pushed the changeset-release/next branch from 92f5f8f to a5be391 Compare September 10, 2026 19:05

vercel Bot deployed to Preview September 10, 2026 19:07 View deployment

sdkrelease Bot force-pushed the changeset-release/next branch from a5be391 to 4d49048 Compare September 10, 2026 19:13

vercel Bot deployed to Preview September 10, 2026 19:15 View deployment

sdkrelease Bot force-pushed the changeset-release/next branch from 4d49048 to 8c4270e Compare September 10, 2026 20:28

vercel Bot deployed to Preview September 10, 2026 20:29 View deployment

Release: update version

43ad9a0

Navigation Menu

Uh oh!

Release: update version - #4373

Release: update version#4373
sdkrelease[bot] wants to merge 1 commit into
nextfrom
changeset-release/next

sdkrelease Bot commented Sep 7, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Sep 7, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 7, 2026

Uh oh!

greptile-apps Bot commented Sep 10, 2026 •

edited

Loading

Important Files Changed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

sdkrelease Bot commented Sep 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Releases

@composio/core@0.18.2

Patch Changes

@composio/experimental@0.2.5

Patch Changes

@composio/json-schema-to-zod@0.3.3

Patch Changes

@composio/anthropic@0.11.2

Patch Changes

@composio/claude-agent-sdk@0.12.1

Patch Changes

@composio/cloudflare@0.10.3

Patch Changes

@composio/google@0.11.1

Patch Changes

@composio/langchain@0.11.1

Patch Changes

@composio/llamaindex@0.11.1

Patch Changes

@composio/mastra@0.10.5

Patch Changes

@composio/openai@0.12.3

Patch Changes

@composio/openai-agents@0.11.1

Patch Changes

@composio/vercel@0.12.1

Patch Changes

@composio/slim@0.18.2

Patch Changes

@e2e-tests/cf-workers-basic@0.0.3

Patch Changes

@e2e-tests/cf-workers-files@0.0.3

Patch Changes

@e2e-tests/cf-workers-tool-router-ai@0.0.3

Patch Changes

@e2e-tests/deno-tool-execution@0.0.1

Patch Changes

@e2e-tests/node-claude-agent-sdk@0.0.3

Patch Changes

@e2e-tests/node-custom-tools@0.0.3

Patch Changes

@e2e-tests/node-json-schema-to-zod-v3@0.0.3

Patch Changes

@e2e-tests/node-json-schema-to-zod-v4@0.0.3

Patch Changes

@e2e-tests/node-mastra-tool-router-zod-v3@0.0.3

Patch Changes

@e2e-tests/node-mastra-tool-router-zod-v4@0.0.3

Patch Changes

@e2e-tests/node-tool-router-files@0.0.3

Patch Changes

@e2e-tests/node-tool-router-pagination@0.0.3

Patch Changes

anthropic-example@0.1.3

Patch Changes

connected-accounts-example@0.1.12

Patch Changes

error-handling-example@0.1.12

Patch Changes

file-handling-example@0.1.3

Patch Changes

google-example@0.1.3

Patch Changes

json-schema-to-zod-example@0.1.3

Patch Changes

langchain-example@0.1.12

Patch Changes

llamaindex-example@0.1.3

Patch Changes

mastra-example@0.1.3

Patch Changes

mcp-example@0.1.3

Patch Changes

modifiers-example@0.1.12

Patch Changes

openai-example@0.1.12

sdkrelease Bot commented Sep 7, 2026 •

edited

Loading

vercel Bot commented Sep 7, 2026 •

edited

Loading

greptile-apps Bot commented Sep 10, 2026 •

edited

Loading