# Composio 0.14.1

- Product: Composio (https://whatsnew.fyi/product/composio)
- Vendor: Composio
- Date: 2026-07-30
- Version: 0.14.1
- Original notes: https://github.com/ComposioHQ/composio/releases/tag/%40composio/core%400.14.1
- Permalink: https://whatsnew.fyi/product/composio/releases/0.14.1

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Replace backtracking leading/trailing-slash-trim regexes in the Cloudflare Workers/Edge platform path helpers with index-walk loops to close polynomial-time regular expression denial-of-service vulnerability on long runs of slash characters
- **changed** — Refresh runtime dependencies across the TypeScript SDK packages
- **security** — Guard Tool Router session URL uploads against SSRF, revalidate redirect targets, and enforce a streamed 100 MiB response limit across TypeScript URL upload paths

###### Patch Changes

- 577a3d4: Replace the backtracking leading/trailing-slash-trim regexes in the Cloudflare Workers/Edge platform path helpers with index-walk loops, closing a polynomial-time regular expression denial-of-service (CodeQL js/polynomial-redos) on long runs of slash characters. Output is unchanged for every input.
- 503b50a: Refresh runtime dependencies across the TypeScript SDK packages.
- 2f63fe5: Guard Tool Router session URL uploads against SSRF, revalidate redirect targets, and enforce a streamed 100 MiB response limit across TypeScript URL upload paths.