# Composio 0.18.1

- Product: Composio (https://whatsnew.fyi/product/composio)
- Vendor: Composio
- Date: 2026-09-04
- Version: 0.18.1
- Original notes: https://github.com/ComposioHQ/composio/releases/tag/%40composio/core%400.18.1
- Permalink: https://whatsnew.fyi/product/composio/releases/0.18.1

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **fixed** — Automatic S3 file downloads are now capped at 100 MiB (configurable per call) to prevent memory exhaustion from oversized or streaming responses
- **fixed** — Custom toolkit child slug mapping now rejects response tools that have local handles but no exact toolkit match instead of silently dropping them or binding another toolkit's handler
- **fixed** — Redact credential-shaped values at the SDK log boundary
- **added** — Expose the runtime-conditional SSRF-safe fetch helper for protected URL upload consumers
- **fixed** — Map file-download transport failures to the SDK error contract and bound streamed response bodies
- **fixed** — Fix trigger subscriptions ignoring the authConfigId filter

###### Patch Changes

- 8a56383: Fix: automatic S3 file downloads are now capped at 100 MiB (configurable per call) to prevent memory exhaustion from oversized or streaming responses.
- 7420927: Fix custom toolkit child slug mapping: reject response tools that have local handles but no exact toolkit match instead of silently dropping them or binding another toolkit's handler, derive bare-slug ambiguity from local definitions, and only reuse a same-toolkit bare alias in customToolkits().
- 1d31c80: Redact credential-shaped values at the SDK log boundary.
- 95f9d32: Expose the runtime-conditional SSRF-safe fetch helper for protected URL upload consumers.
- 0d28bef: Map file-download transport failures to the SDK error contract and bound streamed response bodies.
- 52efb5b: Fix trigger subscriptions ignoring the `authConfigId` filter.
- Updated dependencies [ab289d6]
  - @composio/json-schema-to-zod@0.3.2