build(deps): bump the non-major group with 53 updates

Merged
DE
3mo ago
+281-299

Bumps the non-major group with 53 updates:

PackageFromTo
@ai-sdk/anthropic4.0.124.0.16
@ai-sdk/fal3.0.83.0.12
@ai-sdk/gateway4.0.164.0.23
@ai-sdk/google4.0.124.0.18
@ai-sdk/mistral4.0.84.0.13
@ai-sdk/openai4.0.114.0.16
@ai-sdk/react4.0.234.0.34
@composio/core0.13.10.14.0
@composio/vercel0.11.00.11.1
@fontsource/architects-daughter5.2.75.3.0
@fontsource/atkinson-hyperlegible5.2.85.3.0
@fontsource/atkinson-hyperlegible-mono5.2.105.3.0
@fontsource/dm-sans5.2.85.3.0
@fontsource/fira-mono5.2.75.3.0
@fontsource/geist-mono5.2.85.3.0
@fontsource/geist-sans5.2.55.3.0
@fontsource/ibm-plex-mono5.2.75.3.0
@fontsource/inter5.2.85.3.0
@fontsource/jetbrains-mono5.2.85.3.0
@fontsource/open-sans5.2.75.3.0
@fontsource/space-grotesk5.2.105.3.0
@radix-ui/react-alert-dialog1.1.191.1.20
@radix-ui/react-avatar1.2.21.2.3
@radix-ui/react-checkbox1.3.71.3.8
@radix-ui/react-dialog1.1.191.1.20
@radix-ui/react-dropdown-menu2.1.202.1.21
@radix-ui/react-hover-card1.1.191.1.20
@radix-ui/react-label2.1.112.1.12
@radix-ui/react-popover1.1.191.1.20
@radix-ui/react-progress1.1.121.1.13
@radix-ui/react-radio-group1.4.31.4.4
@radix-ui/react-scroll-area1.2.141.2.15
@radix-ui/react-select2.3.32.3.4
@radix-ui/react-separator1.1.111.1.12
@radix-ui/react-switch1.3.31.3.4
@radix-ui/react-tabs1.1.171.1.18
@radix-ui/react-tooltip1.2.121.2.13
@radix-ui/react-use-controllable-state1.2.31.2.4
@tailwindcss/vite4.3.24.3.3
@tanstack/react-router1.170.171.170.18
@tanstack/react-start1.168.271.168.32
ai7.0.227.0.31
convex1.42.11.42.3
katex0.17.00.18.1
lucide-react1.24.01.25.0
posthog-js1.399.21.404.1
posthog-node5.41.05.45.2
tailwindcss4.3.24.3.3
lint-staged17.0.817.1.0
oxfmt0.58.00.59.0
oxlint1.73.01.74.0
oxlint-tsgolint0.24.00.25.0
vite8.1.48.1.5

Updates @ai-sdk/anthropic from 4.0.12 to 4.0.16

Release notes

Sourced from @​ai-sdk/anthropic's releases.

@​ai-sdk/openai@​4.0.16

Patch Changes

  • 75f86f4: fix(provider/openai, provider/open-responses): throw a descriptive error when the Responses API returns a 200 with no output

    A successful (200) Responses body missing the output array previously threw an opaque output is not iterable TypeError from doGenerate. Both providers now surface a clear APICallError ("Responses API returned no output …"), including the incomplete-details reason (and status, for open-responses) when present. When the body includes a response.error, its message is surfaced first so upstream error details aren't masked by the generic fallback. This makes malformed/incomplete upstream responses actionable instead of a cryptic crash.

  • Updated dependencies [cd06458]

    • @​ai-sdk/provider-utils@​5.0.11

@​ai-sdk/xai@​4.0.16

Patch Changes

  • 1e2ae1f: fix(xai): handle empty HTTP 202 responses while polling videos
  • 54e5498: fix(provider/xai): preserve images in Responses API tool results
  • Updated dependencies [cd06458]
    • @​ai-sdk/provider-utils@​5.0.11
    • @​ai-sdk/openai-compatible@​3.0.12

@​ai-sdk/mistral@​4.0.13

Patch Changes

  • Updated dependencies [cd06458]
    • @​ai-sdk/provider-utils@​5.0.11
Changelog

Sourced from @​ai-sdk/anthropic's changelog.

4.0.16

Patch Changes

  • afcf19c: fix(provider/anthropic): preserve web search citations when replaying assistant messages
  • Updated dependencies [cd06458]
    • @​ai-sdk/provider-utils@​5.0.11

4.0.15

Patch Changes

  • Updated dependencies [31c7be8]
    • @​ai-sdk/provider-utils@​5.0.10

4.0.14

Patch Changes

  • 4be62c1: fix(provider-utils): validate provider-response URLs in getFromApi

    getFromApi now has a validateUrl flag. It is optional so existing callers keep compiling (omitting it behaves like false, i.e. no validation), but all AI SDK provider packages set it explicitly at every call site so each one makes a visible trust decision. When true, the URL is routed through fetchWithValidatedRedirects — the same guard used by downloadBlob — which rejects private/loopback/link-local targets, re-validates every redirect hop, strips proxy/metadata/cookie request headers, and drops all caller headers except the user-agent on cross-origin redirects (custom API-key headers must not follow a redirect off-origin any more than Authorization may); blocked URLs throw DownloadError. It is enabled at the image/video/audio download and polling call sites where the URL comes from a provider response body; URLs built from developer-configured endpoints pass validateUrl: false and are unaffected.

    A new optional credentialedOrigin withholds caller headers unless the URL is same-origin with it, so the API key is not sent to a response-supplied host on a different origin.

    A new optional trustedOrigin exempts URLs (and redirect hops) that are same-origin with the developer-configured provider endpoint from target validation, so self-hosted and localhost deployments whose response URLs point back at the configured host keep working; all other hops are still validated.

    Also closes range gaps in validateDownloadUrl (IPv4 224.0.0.0/4 multicast and the TEST-NET documentation ranges 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24; IPv6 documentation ranges 2001:db8::/32 and 3fff::/20), and follows only the fetch-spec redirect status codes (301/302/303/307/308) — a Location header on any other status is not followed. This guard performs string/literal checks only and does not resolve DNS; hostnames that resolve to private addresses and DNS rebinding remain out of scope and must be constrained at the network layer (or by injecting a Node fetch that pins the resolved IP at connect time) for server deployments handling untrusted URLs. See contributing/secure-url-handling.md.

  • cd12954: Reject empty OpenAI, Anthropic, and Replicate base URLs with a helpful AI SDK invalid argument error.

  • Updated dependencies [4be62c1]

  • Updated dependencies [7805e4a]

  • Updated dependencies [cd12954]

    • @​ai-sdk/provider-utils@​5.0.9

4.0.13

Patch Changes

  • Updated dependencies [e193290]
    • @​ai-sdk/provider-utils@​5.0.8
Commits
  • 9352ac1 Version Packages (#17417)
  • afcf19c fix: preserve Anthropic web search citations across multi-turn assistant mess...
  • 6976682 Version Packages (#17196)
  • cb68fa6 Version Packages (#17175)
  • cd12954 fix: reject empty OpenAI, Anthropic, and Replicate base URLs with a helpful e...
  • cc3ab3a Version Packages (#17172)
  • 4be62c1 fix(provider-utils): route provider-response URLs through the download-URL gu...
  • See full diff in compare view

Updates @ai-sdk/fal from 3.0.8 to 3.0.12

Release notes

Sourced from @​ai-sdk/fal's releases.

@​ai-sdk/luma@​3.0.12

Patch Changes

  • Updated dependencies [cd06458]
    • @​ai-sdk/provider-utils@​5.0.11

@​ai-sdk/openai-compatible@​3.0.12

Patch Changes

  • Updated dependencies [cd06458]
    • @​ai-sdk/provider-utils@​5.0.11

@​ai-sdk/replicate@​3.0.12

Patch Changes

  • Updated dependencies [cd06458]
    • @​ai-sdk/provider-utils@​5.0.11

@​ai-sdk/vercel@​3.0.12

Patch Changes

  • Updated dependencies [cd06458]
    • @​ai-sdk/provider-utils@​5.0.11
    • @​ai-sdk/openai-compatible@​3.0.12

@​ai-sdk/hume@​3.0.11

Patch Changes

  • Updated dependencies [cd06458]
    • @​ai-sdk/provider-utils@​5.0.11

@​ai-sdk/lmnt@​3.0.11

Patch Changes

  • Updated dependencies [cd06458]
    • @​ai-sdk/provider-utils@​5.0.11

@​ai-sdk/revai@​3.0.11

Patch Changes

  • Updated dependencies [cd06458]
    • @​ai-sdk/provider-utils@​5.0.11

@​ai-sdk/valibot@​3.0.11

Patch Changes

  • Updated dependencies [cd06458]
    • @​ai-sdk/provider-utils@​5.0.11
Changelog

Sourced from @​ai-sdk/fal's changelog.

3.0.12

Patch Changes

  • Updated dependencies [cd06458]
    • @​ai-sdk/provider-utils@​5.0.11

3.0.11

Patch Changes

  • Updated dependencies [31c7be8]
    • @​ai-sdk/provider-utils@​5.0.10

3.0.10

Patch Changes

  • 4be62c1: fix(provider-utils): validate provider-response URLs in getFromApi

    getFromApi now has a validateUrl flag. It is optional so existing callers keep compiling (omitting it behaves like false, i.e. no validation), but all AI SDK provider packages set it explicitly at every call site so each one makes a visible trust decision. When true, the URL is routed through fetchWithValidatedRedirects — the same guard used by downloadBlob — which rejects private/loopback/link-local targets, re-validates every redirect hop, strips proxy/metadata/cookie request headers, and drops all caller headers except the user-agent on cross-origin redirects (custom API-key headers must not follow a redirect off-origin any more than Authorization may); blocked URLs throw DownloadError. It is enabled at the image/video/audio download and polling call sites where the URL comes from a provider response body; URLs built from developer-configured endpoints pass validateUrl: false and are unaffected.

    A new optional credentialedOrigin withholds caller headers unless the URL is same-origin with it, so the API key is not sent to a response-supplied host on a different origin.

    A new optional trustedOrigin exempts URLs (and redirect hops) that are same-origin with the developer-configured provider endpoint from target validation, so self-hosted and localhost deployments whose response URLs point back at the configured host keep working; all other hops are still validated.

    Also closes range gaps in validateDownloadUrl (IPv4 224.0.0.0/4 multicast and the TEST-NET documentation ranges 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24; IPv6 documentation ranges 2001:db8::/32 and 3fff::/20), and follows only the fetch-spec redirect status codes (301/302/303/307/308) — a Location header on any other status is not followed. This guard performs string/literal checks only and does not resolve DNS; hostnames that resolve to private addresses and DNS rebinding remain out of scope and must be constrained at the network layer (or by injecting a Node fetch that pins the resolved IP at connect time) for server deployments handling untrusted URLs. See contributing/secure-url-handling.md.

  • Updated dependencies [4be62c1]

  • Updated dependencies [7805e4a]

  • Updated dependencies [cd12954]

    • @​ai-sdk/provider-utils@​5.0.9

3.0.9

Patch Changes

  • Updated dependencies [e193290]
    • @​ai-sdk/provider-utils@​5.0.8
Commits

Updates @ai-sdk/gateway from 4.0.16 to 4.0.23

Release notes

Sourced from @​ai-sdk/gateway's releases.

@​ai-sdk/google@​4.0.18

Patch Changes

  • Updated dependencies [cd06458]
    • @​ai-sdk/provider-utils@​5.0.11
Changelog

Sourced from @​ai-sdk/gateway's changelog.

4.0.23

Patch Changes

  • Updated dependencies [cd06458]
    • @​ai-sdk/provider-utils@​5.0.11

4.0.22

Patch Changes

  • 341616a: feat: add kimi-k3 model and reasoningEffort provider option
  • 70fc45c: chore(provider/gateway): update gateway model settings files

4.0.21

Patch Changes

  • 7069785: chore(provider/gateway): update gateway model settings files
  • 4bf9ac2: feat (provider/gateway): add gateway.experimental_transcription.getToken for minting transcription-bound client secrets

4.0.20

Patch Changes

  • 4d096f6: chore(provider/gateway): update gateway model settings files
  • Updated dependencies [31c7be8]
    • @​ai-sdk/provider-utils@​5.0.10

4.0.19

Patch Changes

  • 4be62c1: fix(provider-utils): validate provider-response URLs in getFromApi

    getFromApi now has a validateUrl flag. It is optional so existing callers keep compiling (omitting it behaves like false, i.e. no validation), but all AI SDK provider packages set it explicitly at every call site so each one makes a visible trust decision. When true, the URL is routed through fetchWithValidatedRedirects — the same guard used by downloadBlob — which rejects private/loopback/link-local targets, re-validates every redirect hop, strips proxy/metadata/cookie request headers, and drops all caller headers except the user-agent on cross-origin redirects (custom API-key headers must not follow a redirect off-origin any more than Authorization may); blocked URLs throw DownloadError. It is enabled at the image/video/audio download and polling call sites where the URL comes from a provider response body; URLs built from developer-configured endpoints pass validateUrl: false and are unaffected.

    A new optional credentialedOrigin withholds caller headers unless the URL is same-origin with it, so the API key is not sent to a response-supplied host on a different origin.

    A new optional trustedOrigin exempts URLs (and redirect hops) that are same-origin with the developer-configured provider endpoint from target validation, so self-hosted and localhost deployments whose response URLs point back at the configured host keep working; all other hops are still validated.

    Also closes range gaps in validateDownloadUrl (IPv4 224.0.0.0/4 multicast and the TEST-NET documentation ranges 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24; IPv6 documentation ranges 2001:db8::/32 and 3fff::/20), and follows only the fetch-spec redirect status codes (301/302/303/307/308) — a Location header on any other status is not followed. This guard performs string/literal checks only and does not resolve DNS; hostnames that resolve to private addresses and DNS rebinding remain out of scope and must be constrained at the network layer (or by injecting a Node fetch that pins the resolved IP at connect time) for server deployments handling untrusted URLs. See contributing/secure-url-handling.md.

  • f8e82fd: Add experimental streaming transcription support to the gateway provider (GatewayTranscriptionModel.doStream), speaking the shared transcription-stream WebSocket envelope from @ai-sdk/provider-utils. experimental_streamTranscribe now works with gateway string model IDs, e.g. experimental_streamTranscribe({ model: 'openai/gpt-realtime-whisper', ... }).

  • Updated dependencies [4be62c1]

  • Updated dependencies [7805e4a]

  • Updated dependencies [cd12954]

    • @​ai-sdk/provider-utils@​5.0.9

4.0.18

... (truncated)

Commits
  • 9352ac1 Version Packages (#17417)
  • 2667d27 Version Packages (#17351)
  • 70fc45c chore(provider/gateway): update gateway model settings files (#17385)
  • 6427ca9 Version Packages (#17324)
  • 4bf9ac2 feat (provider/gateway): transcription client-secret minting via gateway.expe...
  • 7069785 chore(provider/gateway): update gateway model settings files (#17320)
  • b13b5fa Revert "fix: AI Gateway usage token counts are undefined in AI SDK results" (...
  • 880622b fix: AI Gateway usage token counts are undefined in AI SDK results (#17227)
  • 6976682 Version Packages (#17196)
  • 4d096f6 chore(provider/gateway): update gateway model settings files (#17236)
  • Additional commits viewable in compare view

Updates @ai-sdk/google from 4.0.12 to 4.0.18

Release notes

Sourced from @​ai-sdk/google's releases.

@​ai-sdk/google@​4.0.18

Patch Changes

  • Updated dependencies [cd06458]
    • @​ai-sdk/provider-utils@​5.0.11
Changelog

Sourced from @​ai-sdk/google's changelog.

4.0.18

Patch Changes

  • Updated dependencies [cd06458]
    • @​ai-sdk/provider-utils@​5.0.11

4.0.17

Patch Changes

  • 5b4a299: fix(provider/google): forward Vertex-only imageConfig options (personGeneration, prominentPeople, imageOutputOptions)

4.0.16

Patch Changes

  • 662ddfc: Allow google.interactions agent requests to include supported tools, including file_search.

4.0.15

Patch Changes

  • Updated dependencies [31c7be8]
    • @​ai-sdk/provider-utils@​5.0.10

4.0.14

Patch Changes

  • 4be62c1: fix(provider-utils): validate provider-response URLs in getFromApi

    getFromApi now has a validateUrl flag. It is optional so existing callers keep compiling (omitting it behaves like false, i.e. no validation), but all AI SDK provider packages set it explicitly at every call site so each one makes a visible trust decision. When true, the URL is routed through fetchWithValidatedRedirects — the same guard used by downloadBlob — which rejects private/loopback/link-local targets, re-validates every redirect hop, strips proxy/metadata/cookie request headers, and drops all caller headers except the user-agent on cross-origin redirects (custom API-key headers must not follow a redirect off-origin any more than Authorization may); blocked URLs throw DownloadError. It is enabled at the image/video/audio download and polling call sites where the URL comes from a provider response body; URLs built from developer-configured endpoints pass validateUrl: false and are unaffected.

    A new optional credentialedOrigin withholds caller headers unless the URL is same-origin with it, so the API key is not sent to a response-supplied host on a different origin.

    A new optional trustedOrigin exempts URLs (and redirect hops) that are same-origin with the developer-configured provider endpoint from target validation, so self-hosted and localhost deployments whose response URLs point back at the configured host keep working; all other hops are still validated.

    Also closes range gaps in validateDownloadUrl (IPv4 224.0.0.0/4 multicast and the TEST-NET documentation ranges 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24; IPv6 documentation ranges 2001:db8::/32 and 3fff::/20), and follows only the fetch-spec redirect status codes (301/302/303/307/308) — a Location header on any other status is not followed. This guard performs string/literal checks only and does not resolve DNS; hostnames that resolve to private addresses and DNS rebinding remain out of scope and must be constrained at the network layer (or by injecting a Node fetch that pins the resolved IP at connect time) for server deployments handling untrusted URLs. See contributing/secure-url-handling.md.

  • Updated dependencies [4be62c1]

  • Updated dependencies [7805e4a]

  • Updated dependencies [cd12954]

    • @​ai-sdk/provider-utils@​5.0.9

4.0.13

Patch Changes

  • Updated dependencies [e193290]

... (truncated)

Commits

Updates @ai-sdk/mistral from 4.0.8 to 4.0.13

Release notes

Sourced from @​ai-sdk/mistral's releases.

@​ai-sdk/mistral@​4.0.13

Patch Changes

  • Updated dependencies [cd06458]
    • @​ai-sdk/provider-utils@​5.0.11
Changelog

Sourced from @​ai-sdk/mistral's changelog.

4.0.13

Patch Changes

  • Updated dependencies [cd06458]
    • @​ai-sdk/provider-utils@​5.0.11

4.0.12

Patch Changes

  • ba433f7: Add non-streaming Voxtral text-to-speech generation with saved voice IDs and one-off reference audio.

4.0.11

Patch Changes

  • Updated dependencies [31c7be8]
    • @​ai-sdk/provider-utils@​5.0.10

4.0.10

Patch Changes

  • Updated dependencies [4be62c1]
  • Updated dependencies [7805e4a]
  • Updated dependencies [cd12954]
    • @​ai-sdk/provider-utils@​5.0.9

4.0.9

Patch Changes

  • Updated dependencies [e193290]
    • @​ai-sdk/provider-utils@​5.0.8
Commits

Updates @ai-sdk/openai from 4.0.11 to 4.0.16

Release notes

Sourced from @​ai-sdk/openai's releases.

@​ai-sdk/openai@​4.0.16

Patch Changes

  • 75f86f4: fix(provider/openai, provider/open-responses): throw a descriptive error when the Responses API returns a 200 with no output

    A successful (200) Responses body missing the output array previously threw an opaque output is not iterable TypeError from doGenerate. Both providers now surface a clear APICallError ("Responses API returned no output …"), including the incomplete-details reason (and status, for open-responses) when present. When the body includes a response.error, its message is surfaced first so upstream error details aren't masked by the generic fallback. This makes malformed/incomplete upstream responses actionable instead of a cryptic crash.

  • Updated dependencies [cd06458]

    • @​ai-sdk/provider-utils@​5.0.11
Changelog

Sourced from @​ai-sdk/openai's changelog.

4.0.16

Patch Changes

  • 75f86f4: fix(provider/openai, provider/open-responses): throw a descriptive error when the Responses API returns a 200 with no output

    A successful (200) Responses body missing the output array previously threw an opaque output is not iterable TypeError from doGenerate. Both providers now surface a clear APICallError ("Responses API returned no output …"), including the incomplete-details reason (and status, for open-responses) when present. When the body includes a response.error, its message is surfaced first so upstream error details aren't masked by the generic fallback. This makes malformed/incomplete upstream responses actionable instead of a cryptic crash.

  • Updated dependencies [cd06458]

    • @​ai-sdk/provider-utils@​5.0.11

4.0.15

Patch Changes

  • 0063c2d: Add the client-executed OpenAI Responses API computer tool with batched actions and screenshot outputs.

4.0.14

Patch Changes

  • Updated dependencies [31c7be8]
    • @​ai-sdk/provider-utils@​5.0.10

4.0.13

Patch Changes

  • 7805e4a: Fix realtime transcription auth header handling: per-call authorization headers now override configuration headers regardless of header-key casing (last case-variant wins), and the Bearer scheme is matched case-insensitively.
  • cd12954: Reject empty OpenAI, Anthropic, and Replicate base URLs with a helpful AI SDK invalid argument error.
  • Updated dependencies [4be62c1]
  • Updated dependencies [7805e4a]
  • Updated dependencies [cd12954]
    • @​ai-sdk/provider-utils@​5.0.9

4.0.12

Patch Changes

  • e193290: Add connectToWebSocket to @ai-sdk/provider-utils: a shared WebSocket connect layer (constructor resolution, header hygiene, abort wiring, message decoding) analogous to postToApi for HTTP. The openai and xai streaming transcription models now use it instead of hand-rolled connects. For openai and xai this also means WebSocket constructor failures now surface as stream errors instead of throwing synchronously from doStream, an already-aborted signal no longer constructs a socket, and the caller's audio stream is cancelled on pre-open failures. Messages are processed in order with close handling deferred behind pending frames, audio send loops apply backpressure via the socket's bufferedAmount, and failed sends cancel the caller's audio stream.
  • e193290: Fix streaming transcription over header-capable WebSocket implementations: the realtime WebSocket handshake sent the api key in both the openai-insecure-api-key subprotocol and the Authorization header, which OpenAI rejects ("You must only send one of protocol api key and Authorization header"). The Authorization header is now stripped when the subprotocol carries the key.
  • e193290: Strip undefined header values before the streaming transcription WebSocket constructor (header-capable implementations like ws throw on undefined values).
  • Updated dependencies [e193290]
    • @​ai-sdk/provider-utils@​5.0.8
Commits
  • 9352ac1 Version Packages (#17417)
  • 75f86f4 fix(provider/openai, provider/open-responses): guard Responses API responses ...
  • b8241a6 Version Packages (#17264)
  • 0063c2d feat: add OpenAI Responses API computer tool support (#17290)
  • 6976682 Version Packages (#17196)
  • cb68fa6 Version Packages (#17175)
  • cd12954 fix: reject empty OpenAI, Anthropic, and Replicate base URLs with a helpful e...
  • 7805e4a feat(provider-utils): experimental transcription-stream WebSocket envelope (#...
  • cc3ab3a Version Packages (#17172)
  • e193290 fix: streaming transcription WebSocket fixes + shared connect layer (#17093)
  • See full diff in compare view

Updates @ai-sdk/react from 4.0.23 to 4.0.34

Release notes

Sourced from @​ai-sdk/react's releases.

@​ai-sdk/react@​4.0.34

Patch Changes

  • Updated dependencies [70f18c3]
  • Updated dependencies [cd06458]
  • Updated dependencies [d84ea43]
    • ai@7.0.31
    • @​ai-sdk/provider-utils@​5.0.11
    • @​ai-sdk/mcp@​2.0.15
Changelog

Sourced from @​ai-sdk/react's changelog.

4.0.34

Patch Changes

  • Updated dependencies [70f18c3]
  • Updated dependencies [cd06458]
  • Updated dependencies [d84ea43]
    • ai@7.0.31
    • @​ai-sdk/provider-utils@​5.0.11
    • @​ai-sdk/mcp@​2.0.15

4.0.33

Patch Changes

  • ai@7.0.30

4.0.32

Patch Changes

  • ai@7.0.29

4.0.31

Patch Changes

  • 48e7e78: Harden MCP Apps handling of server-supplied resource metadata and the host/iframe bridge:

    • Runtime-validate _meta.ui and drop malformed or non-string fields.
    • Gate iframe permissions deny-by-default via a new sandbox.allowedPermissions allowlist.
    • Derive a concrete postMessage target origin and validate inbound message origins.
    • Validate inbound bridge params: limit resources/read to ui:// resources and allow only https/http/mailto in ui/open-link.
    • Add fingerprintMCPAppResource / detectMCPAppResourceDrift for pinning and comparing app resources.

  • Updated dependencies [48e7e78]

    • @​ai-sdk/mcp@​2.0.14

4.0.30

Patch Changes

  • Updated dependencies [0bc8d4f]
    • ai@7.0.28

4.0.29

Patch Changes

  • 519c72b: fix (react/mcp-apps): sanitize server-supplied CSP domains in getMCPAppCSP so values cannot inject extra directives, sources, or policies into the generated Content-Security-Policy

... (truncated)

Commits

Updates @composio/core from 0.13.1 to 0.14.0

Release notes

Sourced from @​composio/core's releases.

@​composio/core@​0.14.0

Minor Changes

  • fc17c37: Export the sensitive-file-upload denylist guard from the package root so downstream packages share one implementation: assertSafeFileUploadPath, isBlockedSensitiveFileUploadPath, and BUILTIN_FILE_UPLOAD_PATH_DENY_SEGMENTS. The guard now routes its filesystem access through the internal #platform abstraction (adding a realpathSync platform method), so it is edge/workerd-safe and the module carries no static node:* imports. Behavior on Node/Bun is unchanged.

  • 20a4711: triggers.create now resolves the connection from user_id on the backend instead of client-side.

    • The SDK no longer makes an extra connectedAccounts.list() call. When connectedAccountId is omitted, the backend resolves the first active connection for the user and the trigger's toolkit (ordered by most recently created), matching tool execution.
    • Behavior change: create no longer throws ComposioConnectedAccountNotFoundError for a missing or invalid connection. That case now surfaces as the backend error from the upsert call. ComposioTriggerTypeNotFoundError (invalid slug) and ValidationError (including empty userId) are still thrown client-side.
    • Requires a backend that resolves the trigger connection from user_id on upsert (ComposioHQ/platform#10932). Self-hosted deployments must be on a version that includes it.

Patch Changes

  • 7125576: Normalize duplicate JSON Schema required entries before provider tool schemas are emitted.

  • 58bc93b: Refresh dependency ranges and lockfiles across the workspace.

  • 4c3a321: Disable client retries on tools.execute and tools.proxyExecute. These are non-idempotent writes, so a silent retry after a read timeout could duplicate the side effect (e.g. send the same email more than once). Both now route through a sibling client built with maxRetries: 0; reads keep the default retry behaviour.

  • b07fcad: Add an eve provider: EveProvider makes session.tools() return eve-native defineTools, defineComposioTools is the replay-safe step.started resolver, and (ctx, next) hooks can rewrite, deny, or transform Tool Router meta-tool calls.

    Preserve successful local-tool results when the remote half of a mixed COMPOSIO_MULTI_EXECUTE_TOOL batch fails at the transport layer, so callers can see which side effects already completed before retrying.

  • fa933a6: Fix the homepage links in these packages' package.json. They pointed at github.com/ComposioHQ/composio/tree/main/..., but the default branch is next and no main branch exists, so every link 404'd on npm and in editor tooltips. They now point at tree/next/....

  • 2ef40ce: Treat local file paths that begin with http as paths instead of URLs, ensuring that upload allowlist and sensitive-file denylist checks still run.

  • e78ed31: Execute every parallel tool call in OpenAIProvider.handleToolCalls. It previously only ran the first tool call in each assistant message, so parallel tool calls (on by default) dropped the rest and left their tool_call_ids unanswered, failing the next request.

    The calls are run sequentially, in the order the model returned them — here "parallel" means the model issued several calls in one turn, not that they execute concurrently — so each tool_call_id is answered exactly once and the tool messages come back in a deterministic order.

    Only the first choice is handled. Tool results are fed back into a single assistant turn, so with n > 1 iterating over every choice would run each tool call once per choice and orphan the tool_call_ids from the alternative completions.

  • a0f37a7: Close two secret/SSRF exposure surfaces in the TypeScript SDK:

    • SSRF guard on URL file inputs. composio.files.upload(url) and automatic file upload during tool execution previously did a raw fetch() on user-supplied URLs with no guard. They now resolve the host and refuse private, loopback, link-local (incl. the 169.254.169.254 cloud-metadata endpoint), CGNAT, and reserved addresses, reject non-http(s) schemes, and follow redirects manually so each hop is re-validated (blocking a public URL that redirects into internal space). Blocked requests throw ComposioBlockedInternalUrlError. Node-only; behaviour for public URLs is unchanged.
    • Telemetry redaction. Error telemetry previously shipped error.message / error.stack verbatim. They are now passed through a redactor that strips URL query strings, Authorization bearer/basic credentials, and secret-like key=value pairs (API keys, tokens, client secrets, passwords) before transport.

  • 820abb9: Resolve toolkit version pins case-insensitively. Version maps are keyed by normalized (lowercase) slugs, but getToolkitVersion previously looked them up with the raw slug, so a pin configured under a different casing (e.g. { GitHub: '20250101_00' } or COMPOSIO_TOOLKIT_VERSION_GITHUB) could silently fall back to 'latest'. Normalization is now centralized in a single normalizeToolkitSlug helper used symmetrically on both the write (map-building) and read (lookup) paths, so the two sides can no longer drift. This mirrors the equivalent fix in the Python SDK.

  • Updated dependencies [58bc93b]

  • Updated dependencies [fa933a6]

    • @​composio/json-schema-to-zod@​0.2.1
Changelog

Sourced from @​composio/core's changelog.

0.14.0

Minor Changes

  • fc17c37: Export the sensitive-file-upload denylist guard from the package root so downstream packages share one implementation: assertSafeFileUploadPath, isBlockedSensitiveFileUploadPath, and BUILTIN_FILE_UPLOAD_PATH_DENY_SEGMENTS. The guard now routes its filesystem access through the internal #platform abstraction (adding a realpathSync platform method), so it is edge/workerd-safe and the module carries no static node:* imports. Behavior on Node/Bun is unchanged.

  • 20a4711: triggers.create now resolves the connection from user_id on the backend instead of client-side.

    • The SDK no longer makes an extra connectedAccounts.list() call. When connectedAccountId is omitted, the backend resolves the first active connection for the user and the trigger's toolkit (ordered by most recently created), matching tool execution.
    • Behavior change: create no longer throws ComposioConnectedAccountNotFoundError for a missing or invalid connection. That case now surfaces as the backend error from the upsert call. ComposioTriggerTypeNotFoundError (invalid slug) and ValidationError (including empty userId) are still thrown client-side.
    • Requires a backend that resolves the trigger connection from user_id on upsert (ComposioHQ/platform#10932). Self-hosted deployments must be on a version that includes it.

Patch Changes

  • 7125576: Normalize duplicate JSON Schema required entries before provider tool schemas are emitted.

  • 58bc93b: Refresh dependency ranges and lockfiles across the workspace.

  • 4c3a321: Disable client retries on tools.execute and tools.proxyExecute. These are non-idempotent writes, so a silent retry after a read timeout could duplicate the side effect (e.g. send the same email more than once). Both now route through a sibling client built with maxRetries: 0; reads keep the default retry behaviour.

  • b07fcad: Add an eve provider: EveProvider makes session.tools() return eve-native defineTools, defineComposioTools is the replay-safe step.started resolver, and (ctx, next) hooks can rewrite, deny, or transform Tool Router meta-tool calls.

    Preserve successful local-tool results when the remote half of a mixed COMPOSIO_MULTI_EXECUTE_TOOL batch fails at the transport layer, so callers can see which side effects already completed before retrying.

  • fa933a6: Fix the homepage links in these packages' package.json. They pointed at github.com/ComposioHQ/composio/tree/main/..., but the default branch is next and no main branch exists, so every link 404'd on npm and in editor tooltips. They now point at tree/next/....

  • 2ef40ce: Treat local file paths that begin with http as paths instead of URLs, ensuring that upload allowlist and sensitive-file denylist checks still run.

  • e78ed31: Execute every parallel tool call in OpenAIProvider.handleToolCalls. It previously only ran the first tool call in each assistant message, so parallel tool calls (on by default) dropped the rest and left their tool_call_ids unanswered, failing the next request.

    The calls are run sequentially, in the order the model returned them — here "parallel" means the model issued several calls in one turn, not that they execute concurrently — so each tool_call_id is answered exactly once and the tool messages come back in a deterministic order.

    Only the first choice is handled. Tool results are fed back into a single assistant turn, so with n > 1 iterating over every choice would run each tool call once per choice and orphan the tool_call_ids from the alternative completions.

  • a0f37a7: Close two secret/SSRF exposure surfaces in the TypeScript SDK:

    • SSRF guard on URL file inputs. composio.files.upload(url) and automatic file upload during tool execution previously did a raw fetch() on user-supplied URLs with no guard. They now resolve the host and refuse private, loopback, link-local (incl. the 169.254.169.254 cloud-metadata endpoint), CGNAT, and reserved addresses, reject non-http(s) schemes, and follow redirects manually so each hop is re-validated (blocking a public URL that redirects into internal space). Blocked requests throw ComposioBlockedInternalUrlError. Node-only; behaviour for public URLs is unchanged.
    • Telemetry redaction. Error telemetry previously shipped error.message / error.stack verbatim. They are now passed through a redactor that strips URL query strings, Authorization bearer/basic credentials, and secret-like key=value pairs (API keys, tokens, client secrets, passwords) before transport.

  • 820abb9: Resolve toolkit version pins case-insensitively. Version maps are keyed by normalized (lowercase) slugs, but getToolkitVersion previously looked them up with the raw slug, so a pin configured under a different casing (e.g. { GitHub: '20250101_00' } or COMPO...

    Description has been truncated

    Summary by cubic

    Update 53 non‑major dependencies to improve security, stability, and provider tooling. Also adjust KaTeX styles for katex@0.18 so equation numbers render correctly.

    • Dependencies

      • AI SDK: @ai-sdk/anthropic, @ai-sdk/openai, @ai-sdk/google, @ai-sdk/gateway, @ai-sdk/mistral, @ai-sdk/fal, @ai-sdk/react, ai — better URL validation, clearer errors, transcription support, and security hardening.
      • Composio: @composio/core@0.14.0, @composio/vercel — adds SSRF guard for file uploads, disables retries on non‑idempotent tool calls, backend‑resolved trigger connections.
      • UI: @radix-ui/*, lucide-react, @fontsource/* — minor fixes and updates.
      • Tooling: tailwindcss and @tailwindcss/vite 4.3.3, vite 8.1.5, lint-staged 17.1.0, oxfmt/oxlint — patch/minor improvements.
      • Analytics: posthog-js 1.404.1, posthog-node 5.45.2.
      • Other: convex 1.42.3, katex 0.18.1.

    • Migration

      • If you self-host Composio, ensure your platform version supports resolving trigger connections from user_id on upsert.