build(deps): Bump the compatible-updates group across 1 directory with 3 updates

[dependabot]

Bumps the compatible-updates group with 3 updates in the / directory: @composio/core, mcp-remote and zod.

Updates @composio/core from 0.14.0 to 0.19.0

Changelog

Sourced from @​composio/core's changelog.

0.19.0

Minor Changes

• efc2e52: Keep TypeScript realtime subscription errors inside the SDK logging boundary so an asynchronous Pusher subscription failure cannot escape as an uncaught exception. The full subscription error payload is now logged, the success message is logged only once Pusher confirms the subscription, and PusherService.subscribe / Triggers.subscribe accept an optional onSubscriptionError callback so applications can react to subscription failures programmatically.

• 4b5920b: Add session.ensureConnected(toolkit, options?): it returns immediately when the session already resolves an active connection (or the toolkit is no-auth), and only when needed starts the authorization flow via session.authorize() and waits for the new connection to become active. This prevents authorize() from spawning duplicate pending connections for toolkits that are already connected. The session.execute() account option is now documented as accepted on every project — on single-account projects the identifier must match one of the session's active connections for the toolkit (matching the API behavior).

• c7843d8: Expose the server-side session configuration on sessions and return it from update(). session.config now carries the toolkit/tool allowlists, tags, auth configs, connected accounts, manage_connections, preload and sandbox settings the API returned for the session (from create(), use() and after every update()), and session.update() resolves to that updated config instead of void. Previously the only config reachable on a session object at runtime was the SDK's own ComposioConfig, and reading the live allowlist after sessions.use(id) required dropping to the raw client.

  config is a required member of the Session interface, so objects you construct yourself to satisfy Session (test doubles, wrappers) now need a config value. Callers of SDK-created sessions are unaffected. The read side is the raw API shape (toolkits.enabled, manage_connections), while update() keeps taking the SDK's camelCase input.

Patch Changes

• 62e51e8: Refresh runtime dependencies and extend provider peer compatibility to the latest supported Anthropic and OpenAI Agents SDK releases.
• 7055914: Move published dependency ranges to their current upstream releases: zod 4.5, openai 7.10, typebox 1.3.27, @​mastra/schema-compat 1.3.8, and @​cloudflare/workers-types 5.20260905. @composio/anthropic also accepts @anthropic-ai/sdk 0.124 as a peer, the line it is now tested against.
• b4b9fc4: Guard schema pattern and patternProperties compilation. A pattern that does not compile or exceeds 1024 characters now fails conversion with an InvalidPatternError that names the offending property path instead of a raw SyntaxError. @composio/core surfaces that path in the JsonSchemaToZodError message. No backtracking heuristic is applied: a hostile pattern that backtracks catastrophically remains a known limitation.
• d4d3060: Fix composio.mcp.update() silently dropping parts of the requested configuration. Tool-only updates (allowedTools without toolkits) sent no tools field at all, updates with toolkits sent the deprecated create-time custom_tools alias that the update endpoint ignores instead of allowed_tools, and manuallyManageConnections was forwarded as-is instead of being inverted into managed_auth_via_composio (so manuallyManageConnections: true stored the opposite configuration). create() and update() now also keep the auth config of a { toolkit, authConfigId } toolkit entry instead of discarding it, and create() sends allowed_tools rather than the deprecated custom_tools alias, matching the Python SDK.
• 9d0cb2c: Export readResponseBodyWithLimit and MAX_URL_UPLOAD_SIZE_BYTES so downstream packages can apply the SDK's 100 MiB cap when they download a file from a user-supplied URL. The CLI's tool-input file uploads now use it instead of buffering the whole response.
• ba85f4d: Apply the Fetch standard's redirect rules in ssrfSafeFetch, which following redirects manually meant fetch never applied: a 303 now retries as a bodiless GET instead of replaying an upload's method and body at a result URL, a 301/302 does the same for a POST, and 307/308 keep replaying both. Only 301, 302, 303, 307 and 308 count as redirects to follow, so a 304 or 305 carrying a Location is returned to the caller rather than followed.
• ba85f4d: Close the IPv6 transition ranges the SSRF guard's address blocklist let through: 6to4 (2002::/16), Teredo and the rest of 2001::/23, local-use NAT64 (64:ff9b:1::/48), 100::/64, 2001:db8::/32 and site-local fec0::/10 each carry or reach an arbitrary IPv4 address, so 2002:7f00:1:: was a public-looking literal for 127.0.0.1. IPv4 multicast and the 192.88.99.0/24 6to4 relay range are blocked too.
• 85996c4: Drop Authorization, Proxy-Authorization, and Cookie from the request headers when the SSRF guard follows a redirect to a different origin, as the Fetch standard does for automatic redirects. Same-origin redirects keep them.
• eccb80e: Add an opt-in strict mode to ssrfSafeFetch that rejects configured network routes when the connection cannot be pinned to the validated address.
• 8bb1d29: Stop reporting every failed tool lookup as ComposioToolNotFoundError. tools.getRawComposioToolBySlug, and the tools.get / tools.execute paths that call it, now raise ComposioToolNotFoundError only when the API answers 404 or 400. Any other failure, such as an invalid API key (401), a server error, or a network fault, raises the new ComposioToolFetchError with the client error preserved as cause. toolkits.get(slug) now applies its 404/400 check against the Composio client's APIError instead of the OpenAI one, so an unknown toolkit raises ComposioToolkitNotFoundError as documented.
• e9fcbe3: Stop dropping is_secret, legacy_template_name and auth_hint_url from toolkit auth config details. transformToolkitRetrieveResponse passed the auth field groups through unchanged, so the snake_case keys never matched ToolkitAuthFieldSchema and zod stripped them during validation; auth_hint_url was never mapped at all. Fields returned by toolkits.getConnectedAccountInitiationFields() and toolkits.getAuthConfigCreationFields() now carry isSecret, which the API documents as the signal for whether a client should mask the input, plus legacyTemplateName; auth config details returned by toolkits.get() now carry authHintUrl. Each of these keys is present only when the API sends it, so spreading a field no longer overwrites a caller's own fallback with undefined. An auth config detail that omits a field group entirely now yields empty lists for that group, matching how the docs pipeline defaults them, instead of failing validation and leaving the other group unusable.
• 9a69683: Correct the JSDoc for tools.getInput and tools.proxyExecute. The getInput example now passes the required text field and reads the generated arguments. The proxyExecute example now uses the flat endpoint / method / connectedAccountId shape and explains that a relative endpoint is appended to the toolkit's base URL, which can already include a path. The tools.execute example shows where to find the version to pin.
• Updated dependencies [b4b9fc4]
  • @​composio/json-schema-to-zod@​0.3.3

0.18.1

Patch Changes

• 8a56383: Fix: automatic S3 file downloads are now capped at 100 MiB (configurable per call) to prevent memory exhaustion from oversized or streaming responses.
• 7420927: Fix custom toolkit child slug mapping: reject response tools that have local handles but no exact toolkit match instead of silently dropping them or binding another toolkit's handler, derive bare-slug ambiguity from local definitions, and only reuse a same-toolkit bare alias in customToolkits().
• 1d31c80: Redact credential-shaped values at the SDK log boundary.
• 95f9d32: Expose the runtime-conditional SSRF-safe fetch helper for protected URL upload consumers.
• 0d28bef: Map file-download transport failures to the SDK error contract and bound streamed response bodies.
• 52efb5b: Fix trigger subscriptions ignoring the authConfigId filter.
• Updated dependencies [ab289d6]
  • @​composio/json-schema-to-zod@​0.3.2

0.18.0

Minor Changes

• 04817cb: Fix strict-mode tool schemas for OpenAI structured outputs. Strict normalization now applies OpenAI's contract at every depth (nested objects, anyOf branches, array items, inlined $ref/$defs): every object lists all of its properties in required and sets additionalProperties: false, so tools with nested or optional parameters no longer produce schemas the API rejects with a 400. Optional parameters are no longer dropped: they stay available and are widened to accept null, the emulation of optional fields OpenAI documents, and the strict providers drop a null argument the tool's own schema does not accept before executing the tool. Tools whose schema strict mode cannot express (objects with arbitrary keys, allOf, prefixItems, unresolved $refs) are sent without strict mode with a warning naming the tool and path, instead of being narrowed. @composio/core exports the new toStrictJsonSchema() and omitNullToolArguments() utilities; removeNonRequiredProperties is unchanged for other callers. The Python OpenAIResponsesProvider gains a matching opt-in strict=True constructor flag that also emits strict: true on the wrapped tool.

Patch Changes

• 449f4e1: Block automatic uploads when a sensitive directory or file name is hidden by symlink resolution.

... (truncated)

Commits

• 781cee4 Release: update version (#4373)
• d4d3060 fix(sdk): save tool-only MCP updates and connection-management intent (#4512)
• 62e51e8 chore(deps): refresh safe dependencies and Effect v4 (#4538)
• 4b5920b feat(sdk): add session.ensureConnected to reconcile connection state (#4536)
• c7843d8 feat(core): return session config from session.update() (#4533)
• 756ea91 docs: update TypeScript SDK reference from source (#4486)
• aefc3ec feat(typesafe): add TypeSafe Jev provider for TypeScript and Python (#4513)
• a648cef fix(docs): preserve generated parameter metadata
• 1501ae6 test: classify the TypeSafe provider in the $ref handling contract
• eccb80e fix(cli): block SSRF in proxy binary downloads (#4511)
• Additional commits viewable in compare view

Updates mcp-remote from 0.8.3 to 0.14.3

Release notes

Sourced from mcp-remote's releases.

v0.14.3

0.14.3 (2026-09-21)

Bug Fixes

• keep a stored token's expires_at and issuer across re-saves (#368) (6a06aca)

v0.14.2

0.14.2 (2026-09-13)

Bug Fixes

• keep the stored token when a client_credentials renewal fails, and renew through the transport's fetch (#364) (8ba22bd)

v0.14.1

0.14.1 (2026-09-13)

Bug Fixes

• bypass SDK discovery for explicit client_credentials endpoints (ae70420)

v0.14.0

0.14.0 (2026-09-13)

Bug Fixes

• forward the callback iss to finishAuth for RFC 9207 validation (5c3b4e0)

Features

• support explicit client_credentials token endpoints (0a47c02)

v0.13.5

0.13.5 (2026-09-11)

Bug Fixes

• stop a stale exchange freeing a reused request id, and release every hold the proxy answers itself (1dd81a1)

v0.13.4

0.13.4 (2026-09-11)

Bug Fixes

... (truncated)

Commits

• 6a06aca fix: keep a stored token's expires_at and issuer across re-saves (#368)
• 8ba22bd fix: keep the stored token when a client_credentials renewal fails, and renew...
• ae70420 fix: bypass SDK discovery for explicit client_credentials endpoints
• 0a47c02 feat: support explicit client_credentials token endpoints
• 5c3b4e0 fix: forward the callback iss to finishAuth for RFC 9207 validation
• 1dd81a1 fix: stop a stale exchange freeing a reused request id, and release every hol...
• 36076bc fix: honour a cancellation raised before any retry leg exists, and stop a reu...
• e19c4fe refactor: give each multi-round-trip exchange a token, so a reused request id...
• 2e8895b fix: handle a cancellation that arrives before the request is sent, and stop ...
• 75c3eab fix: stop cancelled subscriptions leaking answers, timers and a latched filter
• Additional commits viewable in compare view

Updates zod from 4.5.4 to 4.6.5

Release notes

Sourced from zod's releases.

v4.6.5

Commits:

• d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch highlights to the 4.6 post
• f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
• de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties section with the check and add a Zod Mini tab (#6598)
• 56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the .properties() shape off the instance type (#6600)
• ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"
• cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""
• 0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5
• 59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

A patch on top of 4.6.3.

• d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)
• ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)
• 2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
• f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

• 413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged
• 75d63ee1 docs: show only the .properties() method form in the 4.6 post
• 46da9572 docs: match the error-message examples to what the parsers emit

v4.6.2

A patch on top of 4.6.1.

• 9446b5cc fix: preserve undefined prefault outputs and object keys (#6587) — closes #6585
• 0c483c58 docs: the Zod 4.6 announcement post (#6546)
• a00c3f34 docs: use Trigger.dev's brand-kit lockups for the platinum card

v4.6.1

A patch on top of 4.6.0.

• b12aa523 fix: preserve unique tags with defaulted discriminators (#6582) — closes #6577
• dd9c36fa fix(v4): defer recursive object index inference (#6580)
• 3b154992 feat(lang): add Tajik (tg) locale (#6581) by @​ismoil77
• 2efa8b80 ci: give the npm wait a real budget and drop the back-publish path (#6583)

v4.6.0

Zod 4.6 is now available.

npm install zod@latest

At a glance:

... (truncated)

Commits

• 59bbc03 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump
• 0f3f5ee 4.6.5
• cc4cd4e Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, ref...
• ca0229a Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed w...
• 56222cd feat(instanceof): key the .properties() shape off the instance type (#6600)
• de65a5c docs: lead the properties section with the check and add a Zod Mini tab (#6598)
• f1448f7 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
• d2b135c docs: add the 4.6.x patch highlights to the 4.6 post
• 2bb0871 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
• 743aedb 4.6.4
• Additional commits viewable in compare view

[makeitfutureDev]

Superseded by 05b36e1 on beta: the same bumps plus the matching mcp-remote pin in containers/versions.json, which this PR's CI failure (pins: the image installs the same mcp-remote the daemon depends on) required, and the hono audit fix. It reaches main with the next release.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml