# Composio changelog

> A tool-calling platform that connects AI agents to third-party applications.

- Vendor: Composio
- Category: AI
- Official site: https://composio.dev
- Tracked by: What's New (https://whatsnew.fyi/product/composio)
- Harvested from: GitHub (ComposioHQ/composio)
- Entries below: 6 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## Releases

### 0.15.0

- Date: 2026-08-07
- Version: 0.15.0
- Original notes: https://github.com/ComposioHQ/composio/releases/tag/%40composio/core%400.15.0
- Permalink: https://whatsnew.fyi/product/composio/releases/0.15.0

- **changed** — Replace the loose JSON Schema property type with a recursive, type-safe definition for JSONSchemaProperty
- **fixed** — Bound the background npm version check so registry outages cannot leave the request pending indefinitely
- **fixed** — Match sensitive upload path segments using the target filesystem's actual case sensitivity to prevent case-insensitive mounts from bypassing the denylist
- **fixed** — Redact secrets that appear inside JSON payloads in telemetry error text
- **changed** — Refresh the OpenAI runtime dependency to version 7
- **fixed** — Release unread response bodies on the paths the SDK knowingly abandons by canceling intermediate redirect bodies and releasing response bodies before throwing on failed requests
- **removed** — Remove the unused internal isNewerVersion helper

###### Minor Changes

- 1503786: Replace the loose JSON Schema property type with a recursive, type-safe definition.

  `JSONSchemaProperty` (re-exported from `@composio/core` and reachable through
  `Tool.input_parameters` / `Tool.output_parameters`) is now a concrete recursive
  interface instead of effectively `any`. Runtime behavior is unchanged, but
  consumer code that indexed into it without narrowing (for example
  `schema.properties.foo.type` or `schema.default.someField`) may see new type
  errors: `properties` entries are now possibly `undefined` and `default` /
  `enum` values are `unknown`. Narrow with optional chaining or explicit type
  guards when upgrading.

###### Patch Changes

- 2ac6ad3: Bound the background npm version check so registry outages cannot leave the request pending indefinitely.
- 5105612: Match sensitive upload path segments using the target filesystem's actual case sensitivity so case-insensitive mounts cannot bypass the denylist without over-blocking distinct paths on case-sensitive mounts.
- 051c8c5: Redact secrets that appear inside JSON payloads in telemetry error text. The key/value rule required the separator to follow the key name directly, so a serialized body such as `{"api_key": "..."}` — the shape error messages usually carry — was sent unredacted.
- e5c9ada: Refresh the OpenAI runtime dependency to version 7.
- ecd0861: Release unread response bodies on the paths the SDK knowingly abandons: cancel every intermediate redirect body in `ssrfSafeFetch`, and the response body before throwing on `!response.ok` in both URL-upload call sites, instead of leaving them for the garbage collector to reclaim.
- 2a6a051: Remove the unused internal `isNewerVersion` helper.
- Updated dependencies [1503786]
  - @composio/json-schema-to-zod@0.2.2

### 0.14.1

- Date: 2026-07-30
- Version: 0.14.1
- Original notes: https://github.com/ComposioHQ/composio/releases/tag/%40composio/core%400.14.1
- Permalink: https://whatsnew.fyi/product/composio/releases/0.14.1

- **security** — Replace backtracking leading/trailing-slash-trim regexes in the Cloudflare Workers/Edge platform path helpers with index-walk loops to close polynomial-time regular expression denial-of-service vulnerability on long runs of slash characters
- **changed** — Refresh runtime dependencies across the TypeScript SDK packages
- **security** — Guard Tool Router session URL uploads against SSRF, revalidate redirect targets, and enforce a streamed 100 MiB response limit across TypeScript URL upload paths

###### Patch Changes

- 577a3d4: Replace the backtracking leading/trailing-slash-trim regexes in the Cloudflare Workers/Edge platform path helpers with index-walk loops, closing a polynomial-time regular expression denial-of-service (CodeQL js/polynomial-redos) on long runs of slash characters. Output is unchanged for every input.
- 503b50a: Refresh runtime dependencies across the TypeScript SDK packages.
- 2f63fe5: Guard Tool Router session URL uploads against SSRF, revalidate redirect targets, and enforce a streamed 100 MiB response limit across TypeScript URL upload paths.

### 0.14.0

- Date: 2026-07-16
- Version: 0.14.0
- Original notes: https://github.com/ComposioHQ/composio/releases/tag/%40composio/core%400.14.0
- Permalink: https://whatsnew.fyi/product/composio/releases/0.14.0

- **added** — Export the sensitive-file-upload denylist guard from the package root: `assertSafeFileUploadPath`, `isBlockedSensitiveFileUploadPath`, and `BUILTIN_FILE_UPLOAD_PATH_DENY_SEGMENTS`
- **changed** — The sensitive-file-upload guard now routes filesystem access through the internal `#platform` abstraction and is edge/workerd-safe with no static `node:*` imports
- **changed** — The `#platform` abstraction now includes a `realpathSync` platform method
- **changed** — `triggers.create` now resolves the connection from `user_id` on the backend instead of client-side
- **changed** — The SDK no longer makes an extra `connectedAccounts.list()` call when creating triggers; the backend resolves the first active connection for the user and toolkit
- **changed** — `triggers.create` no longer throws `ComposioConnectedAccountNotFoundError` for a missing or invalid connection; this now surfaces as a backend error from the upsert call
- **fixed** — Normalize duplicate JSON Schema `required` entries before provider tool schemas are emitted
- **fixed** — Disable client retries on `tools.execute` and `tools.proxyExecute` to prevent duplicate side effects on non-idempotent writes
- **added** — Add an eve provider: `EveProvider` makes `session.tools()` return eve-native `defineTool`s and `defineComposioTools` is the replay-safe `step.started` resolver
- **added** — Eve provider hooks can rewrite, deny, or transform Tool Router meta-tool calls
- **fixed** — Preserve successful local-tool results when the remote half of a mixed `COMPOSIO_MULTI_EXECUTE_TOOL` batch fails at the transport layer
- **fixed** — Fix the `homepage` links in package.json files to point at `tree/next/...` instead of the non-existent `tree/main/...` branch
- **fixed** — Treat local file paths that begin with `http` as paths instead of URLs, ensuring upload allowlist and sensitive-file denylist checks still run
- **fixed** — Execute every parallel tool call in `OpenAIProvider.handleToolCalls`; it previously only ran the first tool call and dropped the rest
- **security** — Add SSRF guard on URL file inputs to refuse private, loopback, link-local, CGNAT, and reserved addresses, reject non-`http(s)` schemes, and manually follow redirects with re-validation
- **security** — Redact error telemetry by stripping URL query strings, `Authorization` credentials, and secret-like `key=value` pairs before transport
- **fixed** — Resolve toolkit version pins case-insensitively by normalizing slugs symmetrically on both write and read paths

###### Minor Changes

- fc17c37: Export the sensitive-file-upload denylist guard from the package root so downstream packages share one implementation: `assertSafeFileUploadPath`, `isBlockedSensitiveFileUploadPath`, and `BUILTIN_FILE_UPLOAD_PATH_DENY_SEGMENTS`. The guard now routes its filesystem access through the internal `#platform` abstraction (adding a `realpathSync` platform method), so it is edge/workerd-safe and the module carries no static `node:*` imports. Behavior on Node/Bun is unchanged.
- 20a4711: `triggers.create` now resolves the connection from `user_id` on the backend instead of client-side.

  - The SDK no longer makes an extra `connectedAccounts.list()` call. When `connectedAccountId` is omitted, the backend resolves the first active connection for the user and the trigger's toolkit (ordered by most recently created), matching tool execution.
  - **Behavior change:** `create` no longer throws `ComposioConnectedAccountNotFoundError` for a missing or invalid connection. That case now surfaces as the backend error from the upsert call. `ComposioTriggerTypeNotFoundError` (invalid slug) and `ValidationError` (including empty `userId`) are still thrown client-side.
  - **Requires a backend that resolves the trigger connection from `user_id` on upsert** ([ComposioHQ/platform#10932](https://github.com/ComposioHQ/platform/pull/10932)). Self-hosted deployments must be on a version that includes it.

###### Patch Changes

- 7125576: Normalize duplicate JSON Schema `required` entries before provider tool schemas are emitted.
- 58bc93b: Refresh dependency ranges and lockfiles across the workspace.
- 4c3a321: Disable client retries on `tools.execute` and `tools.proxyExecute`. These are non-idempotent writes, so a silent retry after a read timeout could duplicate the side effect (e.g. send the same email more than once). Both now route through a sibling client built with `maxRetries: 0`; reads keep the default retry behaviour.
- b07fcad: Add an eve provider: `EveProvider` makes `session.tools()` return eve-native `defineTool`s, `defineComposioTools` is the replay-safe `step.started` resolver, and `(ctx, next)` hooks can rewrite, deny, or transform Tool Router meta-tool calls.

  Preserve successful local-tool results when the remote half of a mixed `COMPOSIO_MULTI_EXECUTE_TOOL` batch fails at the transport layer, so callers can see which side effects already completed before retrying.

- fa933a6: Fix the `homepage` links in these packages' `package.json`. They pointed at `github.com/ComposioHQ/composio/tree/main/...`, but the default branch is `next` and no `main` branch exists, so every link 404'd on npm and in editor tooltips. They now point at `tree/next/...`.
- 2ef40ce: Treat local file paths that begin with `http` as paths instead of URLs, ensuring that upload allowlist and sensitive-file denylist checks still run.
- e78ed31: Execute every parallel tool call in `OpenAIProvider.handleToolCalls`. It previously only ran the first tool call in each assistant message, so parallel tool calls (on by default) dropped the rest and left their `tool_call_id`s unanswered, failing the next request.

  The calls are run sequentially, in the order the model returned them — here "parallel" means the model issued several calls in one turn, not that they execute concurrently — so each `tool_call_id` is answered exactly once and the tool messages come back in a deterministic order.

  Only the first choice is handled. Tool results are fed back into a single assistant turn, so with `n > 1` iterating over every choice would run each tool call once per choice and orphan the `tool_call_id`s from the alternative completions.

- a0f37a7: Close two secret/SSRF exposure surfaces in the TypeScript SDK:

  - **SSRF guard on URL file inputs.** `composio.files.upload(url)` and automatic file upload during tool execution previously did a raw `fetch()` on user-supplied URLs with no guard. They now resolve the host and refuse private, loopback, link-

_[Truncated at 4000 characters — full notes: https://github.com/ComposioHQ/composio/releases/tag/%40composio/core%400.14.0]_

### 0.13.1

- Date: 2026-06-26
- Version: 0.13.1
- Original notes: https://github.com/ComposioHQ/composio/releases/tag/%40composio/core%400.13.1
- Permalink: https://whatsnew.fyi/product/composio/releases/0.13.1

###### Patch Changes

- 605a726: Add Tool Router session deletion APIs.

### 0.13.0

- Date: 2026-06-26
- Version: 0.13.0
- Original notes: https://github.com/ComposioHQ/composio/releases/tag/%40composio/core%400.13.0
- Permalink: https://whatsnew.fyi/product/composio/releases/0.13.0

- **added** — Add first-class `composio.sessions.create()` API while keeping `composio.create()` as an alias
- **added** — Expose shared-connection ACL patch helper as `connectedAccounts.updateAcl()` while keeping `experimental.updateAcl()` as an alias
- **added** — Include SDK docs and source in the published package
- **changed** — Make MCP opt-in; sessions return native tools by default and the hosted MCP endpoint is only surfaced when creating with `{ mcp: true }`
- **changed** — Sessions now return `SessionWithoutMcp` type by default instead of including MCP in the type
- **changed** — Surface the resolved workbench config on Tool Router sessions via `Session.workbench` populated from the API response
- **changed** — Prefer `sandbox` for session code-execution configuration while continuing to accept the existing `workbench` alias
- **added** — Add `triggers.parse()` to parse and optionally verify incoming webhook requests
- **added** — Add `triggers.setWebhookSubscription()` to create or update the project webhook subscription from the TypeScript SDK

###### Minor Changes

- d17a268: Add the first-class `composio.sessions.create()` API while keeping `composio.create()` as an alias, expose the experimental shared-connection ACL patch helper as `connectedAccounts.updateAcl()` while keeping `experimental.updateAcl()` as an alias, and include SDK docs/source in the published package.

  **MCP is now opt-in.** Sessions return native tools by default; the hosted MCP endpoint is only surfaced on the type when you create the session with `{ mcp: true }`. The default `create()` / `use()` now return `SessionWithoutMcp` (the runtime object is unchanged — `session.mcp` still exists at runtime — but it is no longer in the type).

  Migration: read `session.mcp` only after creating with `{ mcp: true }`.

- d17a268: Surface the resolved workbench config on Tool Router sessions.

  - `Session.workbench` is now populated from the API response (on create/retrieve/attach/update). It exposes the resolved workbench config, e.g. `session.workbench?.enable` (defaults to `true` server-side).

  This lets callers create a session with the remote workbench disabled (`workbench: { enable: false }`) and detect that state — the foundation for running code in a sandbox you own via the experimental `@composio/experimental/workbench` helpers.

###### Patch Changes

- d17a268: Prefer `sandbox` for session code-execution configuration while continuing to accept the existing `workbench` alias.
- d17a268: Add `triggers.parse()` to parse and optionally verify incoming webhook requests.
- d17a268: Add `triggers.setWebhookSubscription()` to create or update the project webhook subscription from the TypeScript SDK.

### 0.12.0

- Date: 2026-06-25
- Version: 0.12.0
- Original notes: https://github.com/ComposioHQ/composio/releases/tag/%40composio/core%400.12.0
- Permalink: https://whatsnew.fyi/product/composio/releases/0.12.0

- **added** — Add per-request cancellation to public SDK methods via ComposioRequestOptions with an optional AbortSignal parameter
- **added** — Introduce ComposioRequestCancelledError for detecting caller-initiated request aborts
- **added** — Expose AbortSignal via SessionContext.signal for custom tool cooperative cancellation
- **added** — Add pre-execute signal check to throw ComposioRequestCancelledError if the signal is already aborted before user code runs
- **added** — Expose search and showDisabled filters on authConfigs.list()
- **added** — Add provider-agnostic JSON-schema property-key sanitizer with sanitizeSchemaPropertyKeys, restoreOriginalKeys, mappingHasRenames functions and KeyMapping and KeySanitizationPolicy types
- **changed** — Drop CommonJS entrypoints and publish TypeScript SDK packages as ESM-only, requiring Node.js 22.22.3 or newer
- **changed** — Replace chalk with picocolors for colored error and log output
- **removed** — Remove the deprecated uuid field from the auth config retrieve and list response type

###### Minor Changes

- a0bef5d: Bump `@composio/client` to `0.1.0-alpha.74`.
- dfd7a08: Add per-request cancellation to public SDK methods via a new `ComposioRequestOptions` (`{ signal?: AbortSignal }`) trailing argument, plus a typed `ComposioRequestCancelledError` for detecting caller-initiated aborts.

  Without this, a slow `tools.get` or `tools.execute` had no way to be cancelled — a 100s search would block the calling agent indefinitely. The new shape:

  ```typescript
  try {
    const tools = await composio.tools.get(
      'user_1',
      { search: 'send email', limit: 50 },
      { signal: AbortSignal.timeout(5_000) }
    );
  } catch (err) {
    if (err instanceof ComposioRequestCancelledError) {
      return;
    }
    throw err;
  }
  ```

  The signal is forwarded to the underlying `@composio/client` fetch. Any abort error (`APIUserAbortError`, `AbortError`, or `DOMException(name='AbortError')`) coming back is normalized to `ComposioRequestCancelledError` so callers can `instanceof`-detect cancellation without unwrapping nested causes. Catch-and-wrap paths in `tools.execute` / `tools.getRawComposioToolBySlug` / `toolkits.get` re-throw the cancellation error rather than remapping it to `ComposioToolExecutionError` / `ComposioToolNotFoundError` / `ComposioToolkitFetchError`.

  Wired through on:
  - **Tools**: `get`, `getRawComposioTools`, `getRawComposioToolBySlug`, `getRawToolRouterSessionTools`, `execute`, `executeSessionTool`, `getToolsEnum`, `getInput`, `proxyExecute`
  - **Toolkits**: `get`, `listCategories`
  - **AuthConfigs**: `list`, `create`, `get`, `update`, `delete`, `updateStatus`, `enable`, `disable`
  - **ConnectedAccounts**: `list`, `get`, `delete`, `refresh`, `updateStatus`, `enable`, `disable`, `update`
  - **Triggers**: `listActive`, `create`, `update`, `delete`, `enable`, `disable`, `listTypes`, `getType`, `listEnum`
  - **MCP**: `create`, `list`, `get`, `delete`, `update`, `generate`
  - **ToolRouter** (`composio.create` / `composio.use`, `composio.toolRouter.create` / `.use`) — long-running session-creation paths
  - **ToolRouterSession**: `authorize`, `toolkits`, `search`, `execute`, `proxyExecute`, `update`

  ### Custom-tool cooperative cancellation

  Native tool execution is cancelled by the SDK (the underlying `fetch` is aborted). Custom tools are different — the SDK can't preempt user-supplied JavaScript. Two affordances are added so callers get sensible behavior anyway:

  1. **Pre-execute signal check**: if `signal.aborted` is true before the user's `execute` runs, the SDK throws `ComposioRequestCancelledError` and never invokes user code.
  2. **Cooperative signal forwarding**: the same `AbortSignal` is exposed via `SessionContext.signal` for Tool Router custom tools. Long-running implementations can wire `ctx.signal` into their own `fetch` (or any abortable IO) to abort mid-execution; the resulting `AbortError` is normalized to `ComposioRequestCancelledError` by the SDK.

  ```typescript
  import { experimental_createTool } from '@composio/core';

  const longRunningFetch = experimental_createTool('LONG_RUNNING_FETCH', {
    name: 'Long-running fetch',
    description: 'Fetches a URL with cooperative cancellation',
    inputParams: z.object({ url: z.string() }),
    execute: async (input, ctx) => {
      // Pass ctx.signal into fetch so a session.execute(...) abort cancels
      // the in-flight HTTP request mid-flight.
      const resp = await fetch(input.url, { signal: ctx.signal });
      return { result: await resp.json() };
    },
  });
  ```

- 025a657: Drop CommonJS entrypoints and publish the TypeScript SDK packages as ESM-only packages. This is a breaking change within the existing 0.x release line: consumers must use Node.js 22.22.3 or newer. CommonJS callers can only rely on Node's native `require(esm)` interop, and the SDK no longer ships custom CommonJS compatibility machinery or `.cjs` artifacts.
- 4b76dbf: Remove the deprecated `uuid` field from the auth config retri

_[Truncated at 4000 characters — full notes: https://github.com/ComposioHQ/composio/releases/tag/%40composio/core%400.12.0]_