# Composio 0.17.0

- Product: Composio (https://whatsnew.fyi/product/composio)
- Vendor: Composio
- Date: 2026-08-18
- Version: 0.17.0
- Original notes: https://github.com/ComposioHQ/composio/releases/tag/%40composio/core%400.17.0
- Permalink: https://whatsnew.fyi/product/composio/releases/0.17.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **changed** — Allow OpenAI and Anthropic provider tool-call helpers to execute through a supplied Tool Router session, with session meta-tools retaining their session context while provider argument normalization remains intact
- **changed** — Anthropic helper failures now preserve their error text in { error } results without changing successful payloads
- **changed** — Custom provider subclasses overriding executeToolCall or handleToolCalls now accept session targets as method parameters
- **fixed** — Validate URLs from API responses before fetching them, applying SSRF guards to tool-execution downloads, S3 presigned uploads, Tool Router session file downloads, and session file uploads to refuse private, loopback, or link-local addresses

###### Minor Changes

- 760f8d0: Allow OpenAI and Anthropic provider tool-call helpers to execute through a supplied Tool Router session. Session meta-tools now retain their session context while provider argument normalization remains intact; existing user-ID calls continue to use direct execution. Anthropic helper failures now preserve their error text in `{ error }` results without changing successful payloads. Custom provider subclasses overriding `executeToolCall` or `handleToolCalls` may require updates because these methods now accept session targets.

###### Patch Changes

- 6ba9179: Validate the URLs that come from API responses before fetching them. Tool-execution downloads (`s3Url`), S3 presigned uploads (`new_presigned_url`), Tool Router session file downloads (`RemoteFile.buffer()` / `blob()` / `text()` / `save()`) and session file uploads (`upload_url`) now go through the same SSRF guard that already covered user-supplied URLs, so a response naming a private, loopback, or link-local address is refused instead of fetched. Redirect hops are re-validated. Edge runtimes keep their current behavior: session file transfers are not blocked there, since a Worker cannot resolve DNS to check and its `fetch` does not originate inside the caller's network.