[dependabot]

Bumps the compatible-updates group with 3 updates in the / directory: @composio/core, mcp-remote and zod.

Updates @composio/core from 0.22.0 to 0.27.0

Release notes

Sourced from @​composio/core's releases.

@​composio/core@​0.27.0

Minor Changes

• c2bbfa8: Add session hooks. A hook can block a tool call before it runs, or block its result before the agent sees it.

  create() and update() accept hooks. On update(), hooks replaces the whole list and null removes every hook. hooks cannot be combined with experimental.sessionConfigId.

  const session = await composio.create('user_123', {
    hooks: [
      {
        type: 'before_execute',
        id: 'no_external_email',
        name: 'No external email',
        appliesTo: { toolkits: ['gmail'] },
        handler: {
          type: 'condition_check',
          condition: 'Sending email to anyone outside example.org',
          action: 'block',
        },
      },
    ],
  });

  A blocked call comes back from session.execute() and session.executeMeta() with resultType: 'blocked', empty data, the hook's message in error, and blockReason. Provider integrations hand it to the agent as a failed call with that message. Every result also carries hookResults when a hook applied.

  session.proxyExecute() and ctx.proxyExecute() now return resultType: 'completed' or resultType: 'blocked'. A blocked request has no HTTP response, so TypeScript code that reads status has to check resultType first.

@​composio/core@​0.26.0

Minor Changes

• e08c84f: Requires @composio/client 2.0.0-rc.18. The SDK now hands the API client its credential as the client's auth option and its organization and project as scope, instead of placing them in default headers. The apiKey, userApiKey, orgApiKey, orgId and projectId options, their environment fallbacks and the credentials sent on each request are unchanged, with one exception: with apiKey: null and only an organization API key (the orgApiKey option, COMPOSIO_ORG_API_KEY, or an x-org-api-key default header), every request now carries x-org-api-key, and so do trigger channel authorization and session.mcp.headers. Before, only the organization-owner operations did, and every other request went out without a credential.

  Credential and scope headers in defaultHeaders or createSession({ headers }) keep working, but the SDK folds them into its own options instead of forwarding them: an x-user-api-key or x-org-api-key entry becomes the credential every request carries, an x-api-key entry becomes the project key, and x-org-id / x-project-id entries become orgId / projectId. getConfig() reports the folded values (for example apiKey: null and userApiKey for an x-user-api-key entry) and no longer lists those entries under defaultHeaders. Setting more than one of x-api-key, x-user-api-key and x-org-api-key now throws a ComposioError; the API rejected every such request.

  On the client returned by getClient(), apiKey, userApiKey and orgApiKey are read-only and deprecated (read the keys from getConfig(), or authMode and scope from the client), and a per-call headers option can no longer name a credential or scope header. The API client no longer reads the environment itself: the SDK still honours COMPOSIO_ALLOW_INSECURE_HTTP=1, and no longer applies COMPOSIO_CUSTOM_HEADERS; pass defaultHeaders instead.

  The deprecated customConnectionData now requires val.access_token for S2S_OAUTH2, as the API does.

• 57de614: Requires @composio/client 2.0.0-rc.19. The SDK forwards the API client's log lines through a Console-shaped object instead of the client's removed Logger interface; what is logged, and at which SDK level, is unchanged. With rc.19, the client returned by getClient() no longer has apiKey, userApiKey, orgApiKey or logger, and its baseURL, maxRetries, timeout and logLevel are read-only: read the keys from getConfig(), and derive a client with withOptions() to change the others.

Patch Changes

• 9d26fb8: Fold OpenAPI nullable into the type in strict tool schemas

  toStrictJsonSchema no longer passes OpenAPI nullable through. Anthropic strict tool use rejects it on an object schema with a 400 for the whole request. A node with nullable: true now accepts null through its type (["object", "null"]) or a null branch, matching how the tool's arguments are validated, and the rewrite is reported as a nullable-converted change. nullable: false is removed as an unsupported-keyword-stripped change. omitNullToolArguments now keeps a null for a property marked nullable: true, as it already does for one whose type includes null.

• 3dd9a2c: Strip string format values that OpenAI structured outputs rejects from strict tool schemas

... (truncated)

Changelog

Sourced from @​composio/core's changelog.

0.27.0

Minor Changes

• c2bbfa8: Add session hooks. A hook can block a tool call before it runs, or block its result before the agent sees it.

  create() and update() accept hooks. On update(), hooks replaces the whole list and null removes every hook. hooks cannot be combined with experimental.sessionConfigId.

  const session = await composio.create('user_123', {
    hooks: [
      {
        type: 'before_execute',
        id: 'no_external_email',
        name: 'No external email',
        appliesTo: { toolkits: ['gmail'] },
        handler: {
          type: 'condition_check',
          condition: 'Sending email to anyone outside example.org',
          action: 'block',
        },
      },
    ],
  });

  A blocked call comes back from session.execute() and session.executeMeta() with resultType: 'blocked', empty data, the hook's message in error, and blockReason. Provider integrations hand it to the agent as a failed call with that message. Every result also carries hookResults when a hook applied.

  session.proxyExecute() and ctx.proxyExecute() now return resultType: 'completed' or resultType: 'blocked'. A blocked request has no HTTP response, so TypeScript code that reads status has to check resultType first.

0.26.0

Minor Changes

• e08c84f: Requires @composio/client 2.0.0-rc.18. The SDK now hands the API client its credential as the client's auth option and its organization and project as scope, instead of placing them in default headers. The apiKey, userApiKey, orgApiKey, orgId and projectId options, their environment fallbacks and the credentials sent on each request are unchanged, with one exception: with apiKey: null and only an organization API key (the orgApiKey option, COMPOSIO_ORG_API_KEY, or an x-org-api-key default header), every request now carries x-org-api-key, and so do trigger channel authorization and session.mcp.headers. Before, only the organization-owner operations did, and every other request went out without a credential.

  Credential and scope headers in defaultHeaders or createSession({ headers }) keep working, but the SDK folds them into its own options instead of forwarding them: an x-user-api-key or x-org-api-key entry becomes the credential every request carries, an x-api-key entry becomes the project key, and x-org-id / x-project-id entries become orgId / projectId. getConfig() reports the folded values (for example apiKey: null and userApiKey for an x-user-api-key entry) and no longer lists those entries under defaultHeaders. Setting more than one of x-api-key, x-user-api-key and x-org-api-key now throws a ComposioError; the API rejected every such request.

  On the client returned by getClient(), apiKey, userApiKey and orgApiKey are read-only and deprecated (read the keys from getConfig(), or authMode and scope from the client), and a per-call headers option can no longer name a credential or scope header. The API client no longer reads the environment itself: the SDK still honours COMPOSIO_ALLOW_INSECURE_HTTP=1, and no longer applies COMPOSIO_CUSTOM_HEADERS; pass defaultHeaders instead.

  The deprecated customConnectionData now requires val.access_token for S2S_OAUTH2, as the API does.

• 57de614: Requires @composio/client 2.0.0-rc.19. The SDK forwards the API client's log lines through a Console-shaped object instead of the client's removed Logger interface; what is logged, and at which SDK level, is unchanged. With rc.19, the client returned by getClient() no longer has apiKey, userApiKey, orgApiKey or logger, and its baseURL, maxRetries, timeout and logLevel are read-only: read the keys from getConfig(), and derive a client with withOptions() to change the others.

Patch Changes

• 9d26fb8: Fold OpenAPI nullable into the type in strict tool schemas

  toStrictJsonSchema no longer passes OpenAPI nullable through. Anthropic strict tool use rejects it on an object schema with a 400 for the whole request. A node with nullable: true now accepts null through its type (["object", "null"]) or a null branch, matching how the tool's arguments are validated, and the rewrite is reported as a nullable-converted change. nullable: false is removed as an unsupported-keyword-stripped change. omitNullToolArguments now keeps a null for a property marked nullable: true, as it already does for one whose type includes null.

... (truncated)

Commits

• 19a8404 Release: update version (#5057)
• 9a4977f feat(core): add session hooks to TS and Python sessions (#4958)
• a15956a Release: update version (#4928)
• bff8c4a feat(core): rename hook handlers to condition_check and prompt_injection_check
• 9d26fb8 fix(core): fold OpenAPI nullable into the type in strict tool schemas (#4997)
• f1898b6 fix(sdk): enforce hooks/session-config parity and precise hook_results errors
• f744fdf fix(core): match the hooks contract on staging
• c2bbfa8 feat(core): add session hooks to TS and Python sessions
• be12ce1 feat(core): warn once per deprecated toolkit version reported by the API (PLE...
• 3dd9a2c fix(core): strip string formats strict mode rejects (#4936)
• Additional commits viewable in compare view

Updates mcp-remote from 0.14.3 to 0.15.2

Release notes

Sourced from mcp-remote's releases.

v0.15.2

0.15.2 (2026-10-20)

Bug Fixes

• open the browser for the client registered after a stale one is cleared (#383) (373f732)

v0.15.1

0.15.1 (2026-10-14)

Bug Fixes

• keep the static OAuth client and its secret out of the credential store (b529ea1)

v0.15.0

0.15.0 (2026-10-14)

Features

• add optional OAuth completion page URL (#373) (34f7fd2)

v0.14.5

0.14.5 (2026-10-14)

Bug Fixes

• give the callback port back once a sign-in has finished (#372) (65bb414)
• persist OAuth discovery state for the authorization callback leg (#376) (e0a520e)
• stop OAuth retries after follower timeout (#370) (55a61a9)

v0.14.4

0.14.4 (2026-10-14)

Bug Fixes

• serve the OAuth error callback as plain text, not HTML (#375) (6a4ff90)

Commits

• 373f732 fix: open the browser for the client registered after a stale one is cleared ...
• 71cadf3 test: make the suite pass on Windows so the pre-commit hook stops rejecting c...
• b529ea1 fix: keep the static OAuth client and its secret out of the credential store
• 34f7fd2 feat: add optional OAuth completion page URL (#373)
• 55a61a9 fix: stop OAuth retries after follower timeout (#370)
• 65bb414 fix: give the callback port back once a sign-in has finished (#372)
• e0a520e fix: persist OAuth discovery state for the authorization callback leg (#376)
• 6a4ff90 fix: serve the OAuth error callback as plain text, not HTML (#375)
• See full diff in compare view

Updates zod from 4.6.5 to 4.6.7

Release notes

Sourced from zod's releases.

v4.6.7

Commits:

• b500a2ee95134f81d74da7911d7378dd2853d042 4.6.7

v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.

Commits:

• 0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini
• 9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from zod/locales, not z.locales
• 34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales tree-shaking note
• 74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions instead of publishing them (#6622)
• b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to bronze sponsors
• 8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for Japan logo and list it first in bronze
• bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for Japan logo to match the other bronze tiles
• c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on the release-approval environment until the staged versions are approved (#6638)
• a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record output and input as members, not base type arguments (#6645)
• a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set and map size bounds before parsing elements (#6652)
• 529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6
• 9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a failed OIDC token exchange says why

Commits

• b500a2e 4.6.7
• 9c21983 ci: stage at verbose so a failed OIDC token exchange says why
• 529f78d 4.6.6
• a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#6652)
• a2ba4a6 fix(types): declare record output and input as members, not base type argumen...
• c42596b release: hold the run on the release-approval environment until the staged ve...
• bacad51 docs: square the Code for Japan logo to match the other bronze tiles
• 8fb2faf docs: crop the Code for Japan logo and list it first in bronze
• b2ef983 docs: add Code for Japan to bronze sponsors
• 74304ce release: stage npm versions instead of publishing them (#6622)
• Additional commits viewable in compare view