Composio Release Notes

What's Changed

• ci: label-triggered docs agent eval (V1, informational) by Soumya Medapati (@soumya1971) in #4158
• ci(security): harden docs-agent-eval caller (Bugbot fixes) by Soumya Medapati (@soumya1971) in #4199
• ci: docs-eval engine pin → false-PASS fix by Soumya Medapati (@soumya1971) in #4201
• feat(docs): launch unified support knowledge MVP by Soham Basu (@sohambasu963) in #4159
• ci: docs-eval uses dedicated COMPOSIO_ORG_API_KEY_FOR_CODING_AGENT_EVAL secret by Soumya Medapati (@soumya1971) in #4202
• fix(docs): deduplicate and clarify knowledge search results by Soham Basu (@sohambasu963) in #4203
• docs(auth): point custom OAuth callback URL to v1 (UXE-261) by Sarah Simionescu (@sarahsimionescu) in #4206
• fix(python): own the proxy_execute response shape by Alberto Schiabel (@jkomyno) in #4180
• fix(cli): refuse symlink entries when extracting archives by Alberto Schiabel (@jkomyno) in #4210

New Contributors

• Soham Basu (@sohambasu963) made their first contribution in #4159

Full Changelog: https://github.com/ComposioHQ/composio/compare/@composio/[email protected]...@composio/[email protected]

What's Changed

• fix(python): create the cache directory on first use instead of at import time by Alberto Schiabel (@jkomyno) in #4162
• fix(py): send Content-Type on S3 PUTs and parse Content-Length by Alberto Schiabel (@jkomyno) in #4168
• fix(sdk): route provider tool calls through sessions by Soumya Medapati (@soumya1971) in #4098
• docs: update documentation for new changelog entries by @sdkrelease[bot] in #4137
• chore(sdk): prepare Python 0.20.0 and TypeScript 0.17.0 releases by Alberto Schiabel (@jkomyno) in #4170
• Release: update version by @sdkrelease[bot] in #4161
• docs(providers): resolve session-aware helper pins to published versions by Alberto Schiabel (@jkomyno) in #4171
• docs: update toolkits, API spec, and meta tools data by @sdkrelease[bot] in #4125
• docs: update toolkits, API spec, and meta tools data by @sdkrelease[bot] in #4173
• docs(white-labeling): document the Connect Link theme editor (PRDE-1196) by Sarah Simionescu (@sarahsimionescu) in #4175
• fix(sdk): pin the validated address when fetching URLs (SSRF DNS rebinding) by Alberto Schiabel (@jkomyno) in #4172
• fix(py): normalize toolkit-less tool metadata by Alberto Schiabel (@jkomyno) in #4178
• chore(cli): bump Bun to 1.4.0 and replace tar with Bun.Archive by Alberto Schiabel (@jkomyno) in #4183

Full Changelog: https://github.com/ComposioHQ/composio/compare/@composio/[email protected]...@composio/[email protected]

What's Changed

fix(python): create the cache directory on first use instead of at import time by Alberto Schiabel (@jkomyno) in #4162

fix(py): send Content-Type on S3 PUTs and parse Content-Length by Alberto Schiabel (@jkomyno) in #4168

fix(sdk): route provider tool calls through sessions by Soumya Medapati (@soumya1971) in #4098

docs: update documentation for new changelog entries by @sdkrelease[bot] in #4137

chore(sdk): prepare Python 0.20.0 and TypeScript 0.17.0 releases by Alberto Schiabel (@jkomyno) in #4170

Release: update version by @sdkrelease[bot] in #4161

docs(providers): resolve session-aware helper pins to published versions by Alberto Schiabel (@jkomyno) in #4171

docs: update toolkits, API spec, and meta tools data by @sdkrelease[bot] in #4125

docs: update toolkits, API spec, and meta tools data by @sdkrelease[bot] in #4173

docs(white-labeling): document the Connect Link theme editor (PRDE-1196) by Sarah Simionescu (@sarahsimionescu) in #4175

fix(sdk): pin the validated address when fetching URLs (SSRF DNS rebinding) by Alberto Schiabel (@jkomyno) in #4172

fix(py): normalize toolkit-less tool metadata by Alberto Schiabel (@jkomyno) in #4178

chore(cli): bump Bun to 1.4.0 and replace tar with Bun.Archive by Alberto Schiabel (@jkomyno) in #4183

Full Changelog: https://github.com/ComposioHQ/composio/compare/@composio/[email protected]...@composio/[email protected]

SDK versions

Python composio 0.20.0

TypeScript @composio/core 0.17.0

TypeScript @composio/slim 0.17.0

TypeScript @composio/anthropic 0.11.0

TypeScript @composio/openai 0.12.0

Session-aware provider tool-call helpers

Type-level breaking change

handleToolCalls / executeToolCall (TypeScript) and handle_tool_calls / execute_tool_call (Python) now accept an explicit execution target — a user ID or a Tool Router session. Custom provider subclasses that override these methods may need updates to match the new signatures. Existing user-ID calls are unchanged and keep using direct execution.

Previously, calling these helpers with tools obtained from session.tools() still executed through the globally injected direct Tools.execute function, discarding the Tool Router session context. Session meta-tools such as COMPOSIO_SEARCH_TOOLS failed as a result. Calling session.execute() directly preserved the session but skipped provider-specific behavior, such as Anthropic's input normalization and schema-alias restoration.

The helpers now route normalized provider arguments through the supplied session when one is given, while keeping provider-specific normalization intact. Anthropic helper failures now preserve their error text in { error } results without changing successful payloads.

API-response URL validation

Both SDKs already validated user-supplied URLs against SSRF before fetching them. That guard did not cover URLs that arrive inside an API response. It now does, across every response-driven fetch: tool-execution downloads, S3 presigned uploads, Tool Router session file downloads and uploads, and RemoteFile.buffer() / blob() / text() / save(). Redirect hops are re-validated on each hop, so a validated URL cannot redirect into private address space. Edge runtimes that cannot resolve DNS to check keep their current behavior for session file transfers, since a Worker's fetch does not originate inside the caller's network.

Python file handling fixes

• Importing composio no longer creates the local cache directory or fails on a read-only filesystem. Directory creation is deferred to the first actual file download, so environments like AWS Lambda, distroless containers, and read-only Kubernetes root filesystems can import the SDK without ever touching disk. COMPOSIO_CACHE_DIR is also now honored correctly when it is set, instead of eagerly resolving the home directory first.
• File uploads to S3 presigned URLs now send the Content-Type the presign request was signed with on every upload path, and a rejected upload raises with its HTTP status instead of a path-only error. A malformed or negative Content-Length on a fetched URL now degrades to an unknown size instead of raising.
• Filesystem path construction for API-provided slugs and filenames is now centralized and rejects traversal, Windows-invalid names, invalid Unicode, and overlong encoded filenames before creating directories or writing files.

Dependency updates

Runtime dependencies across the TypeScript SDK packages and the Python core and provider packages have been refreshed.

Backward compatibility

Existing user-ID based provider helper calls are unchanged. Custom provider subclasses overriding the tool-call helpers should review the updated signatures.

Minor Changes

760f8d0: Allow OpenAI and Anthropic provider tool-call helpers to execute through a supplied Tool Router session. Session meta-tools now retain their session context while provider argument normalization remains intact; existing user-ID calls continue to use direct execution. Anthropic helper failures now preserve their error text in { error } results without changing successful payloads. Custom provider subclasses overriding executeToolCall or handleToolCalls may require updates because these methods now accept session targets.

Minor Changes

760f8d0: Allow OpenAI and Anthropic provider tool-call helpers to execute through a supplied Tool Router session. Session meta-tools now retain their session context while provider argument normalization remains intact; existing user-ID calls continue to use direct execution. Anthropic helper failures now preserve their error text in { error } results without changing successful payloads. Custom provider subclasses overriding executeToolCall or handleToolCalls may require updates because these methods now accept session targets.

Patch Changes

6ba9179: Validate the URLs that come from API responses before fetching them. Tool-execution downloads (s3Url), S3 presigned uploads (new_presigned_url), Tool Router session file downloads (RemoteFile.buffer() / blob() / text() / save()) and session file uploads (upload_url) now go through the same SSRF guard that already covered user-supplied URLs, so a response naming a private, loopback, or link-local address is refused instead of fetched. Redirect hops are re-validated. Edge runtimes keep their current behavior: session file transfers are not blocked there, since a Worker cannot resolve DNS to check and its fetch does not originate inside the caller's network.

Minor Changes

760f8d0: Allow OpenAI and Anthropic provider tool-call helpers to execute through a supplied Tool Router session. Session meta-tools now retain their session context while provider argument normalization remains intact; existing user-ID calls continue to use direct execution. Anthropic helper failures now preserve their error text in { error } results without changing successful payloads. Custom provider subclasses overriding executeToolCall or handleToolCalls may require updates because these methods now accept session targets.