[dependabot]

Bumps the compatible-updates group with 6 updates:

Package	From	To
@composio/core	0.22.0	0.28.0
@modelcontextprotocol/sdk	1.32.1	1.32.2
imapflow	2.9.1	2.10.2
mcp-remote	0.14.3	0.16.1
nodemailer	10.2.1	10.3.1
zod	4.6.5	4.6.7

Updates @composio/core from 0.22.0 to 0.28.0

Release notes

Sourced from @​composio/core's releases.

@​composio/core@​0.27.0

Minor Changes

• c2bbfa8: Add session hooks. A hook can block a tool call before it runs, or block its result before the agent sees it.

  create() and update() accept hooks. On update(), hooks replaces the whole list and null removes every hook. hooks cannot be combined with experimental.sessionConfigId.

  const session = await composio.create('user_123', {
    hooks: [
      {
        type: 'before_execute',
        id: 'no_external_email',
        name: 'No external email',
        appliesTo: { toolkits: ['gmail'] },
        handler: {
          type: 'condition_check',
          condition: 'Sending email to anyone outside example.org',
          action: 'block',
        },
      },
    ],
  });

  A blocked call comes back from session.execute() and session.executeMeta() with resultType: 'blocked', empty data, the hook's message in error, and blockReason. Provider integrations hand it to the agent as a failed call with that message. Every result also carries hookResults when a hook applied.

  session.proxyExecute() and ctx.proxyExecute() now return resultType: 'completed' or resultType: 'blocked'. A blocked request has no HTTP response, so TypeScript code that reads status has to check resultType first.

@​composio/core@​0.26.0

Minor Changes

• e08c84f: Requires @composio/client 2.0.0-rc.18. The SDK now hands the API client its credential as the client's auth option and its organization and project as scope, instead of placing them in default headers. The apiKey, userApiKey, orgApiKey, orgId and projectId options, their environment fallbacks and the credentials sent on each request are unchanged, with one exception: with apiKey: null and only an organization API key (the orgApiKey option, COMPOSIO_ORG_API_KEY, or an x-org-api-key default header), every request now carries x-org-api-key, and so do trigger channel authorization and session.mcp.headers. Before, only the organization-owner operations did, and every other request went out without a credential.

  Credential and scope headers in defaultHeaders or createSession({ headers }) keep working, but the SDK folds them into its own options instead of forwarding them: an x-user-api-key or x-org-api-key entry becomes the credential every request carries, an x-api-key entry becomes the project key, and x-org-id / x-project-id entries become orgId / projectId. getConfig() reports the folded values (for example apiKey: null and userApiKey for an x-user-api-key entry) and no longer lists those entries under defaultHeaders. Setting more than one of x-api-key, x-user-api-key and x-org-api-key now throws a ComposioError; the API rejected every such request.

  On the client returned by getClient(), apiKey, userApiKey and orgApiKey are read-only and deprecated (read the keys from getConfig(), or authMode and scope from the client), and a per-call headers option can no longer name a credential or scope header. The API client no longer reads the environment itself: the SDK still honours COMPOSIO_ALLOW_INSECURE_HTTP=1, and no longer applies COMPOSIO_CUSTOM_HEADERS; pass defaultHeaders instead.

  The deprecated customConnectionData now requires val.access_token for S2S_OAUTH2, as the API does.

• 57de614: Requires @composio/client 2.0.0-rc.19. The SDK forwards the API client's log lines through a Console-shaped object instead of the client's removed Logger interface; what is logged, and at which SDK level, is unchanged. With rc.19, the client returned by getClient() no longer has apiKey, userApiKey, orgApiKey or logger, and its baseURL, maxRetries, timeout and logLevel are read-only: read the keys from getConfig(), and derive a client with withOptions() to change the others.

Patch Changes

• 9d26fb8: Fold OpenAPI nullable into the type in strict tool schemas

  toStrictJsonSchema no longer passes OpenAPI nullable through. Anthropic strict tool use rejects it on an object schema with a 400 for the whole request. A node with nullable: true now accepts null through its type (["object", "null"]) or a null branch, matching how the tool's arguments are validated, and the rewrite is reported as a nullable-converted change. nullable: false is removed as an unsupported-keyword-stripped change. omitNullToolArguments now keeps a null for a property marked nullable: true, as it already does for one whose type includes null.

• 3dd9a2c: Strip string format values that OpenAI structured outputs rejects from strict tool schemas

... (truncated)

Changelog

Sourced from @​composio/core's changelog.

0.28.0

Minor Changes

• d2d4148: Requires @composio/client 2.0.0. POST and PATCH requests, including tool execution and trigger creation, are now sent once instead of being retried on a lost response or a retryable status, because a write can complete on the server after its response is lost. Other requests keep their retries. On the client returned by getClient(), a write retries only when that call sets maxRetries.

• e87ed85: Requires @composio/client 2.0.0-rc.20. The SDK imports the client's types from the one @composio/client/resources/* spelling rc.20 publishes and reaches nested types by indexed access; every type the SDK exports keeps its shape. With rc.20, the resources of the client returned by getClient() are plain objects typed by interfaces: the resource classes, Composio.Tools-style statics and namespace-member types such as SessionCreateParams.Experimental are gone, and the .js/.mjs subpath spellings no longer resolve.

• 3f3df9a: Requires @composio/client 2.0.0-rc.21. The SDK's behaviour is unchanged. With rc.21, the client returned by getClient() no longer has request(), Composio.Composio or Composio.DEFAULT_TIMEOUT: call the raw verb for the method (get, post, patch, put, delete), which takes the same query, body and request options.

• 54a935f: Requires @composio/client 2.0.0-rc.23. composio.sessionConfigs.list() no longer sends search, which the Composio API removed: the option is deprecated, ignored, and logs a warning when set; filter items by name instead. With rc.23, the client returned by getClient() no longer has cli.createCodactFailure (now under client._internal, typed through @composio/client/internal) or org.clanker.createClaim, and its sessionConfigs.list() no longer accepts search.

• 7434e02: Requires @composio/client 2.0.0-rc.22. composio.toolkits.get(slug) now returns meta.appUrl when the API sends the toolkit's app URL; it was always left out before. composio.sessionConfigs.get() keeps the require_approval lists of a stored policy, and no longer fails validation on a policy entry that only sets require_approval; SessionConfigPolicy gains the matching optional require_approval fields and the approval-only entry. Session hooks, blocked calls and hook results are read from the API types of @composio/client instead of SDK copies, with the same results and errors for well-formed responses; a malformed hook_results or blocked response is no longer re-validated by the SDK, matching every other API response.

• a5a1fc8: Requires @composio/client 2.0.1. Adds composio.experimental.customToolkits.create() and update(), which call the v3.1 custom toolkit create and update endpoints. create() takes userId ('all' to share the toolkit, or the user it is private to), generates the slug, and returns a connectLink for a private toolkit. upsert() is deprecated and logs a warning once per process; it keeps working.

  API-key auth schemes accept additionalFields.genericId with a required displayName and optional description to collect the value used by {{generic_id}} headers.

• d2d4148: composio.triggers.create() accepts type ('webhook' or 'poll', for a trigger that supports both) and pollingInterval (minutes between polls, which wins over triggerConfig.interval), and returns the instance's type, fallbackReason and pollingInterval along with triggerId. composio.triggers.listActive() items carry the same three fields, and getType() / listTypes() return each trigger type's type, types and requiresWebhookEndpointSetup.

Patch Changes

• e547eb0: Upload local files with the MIME type of their extension

  A file uploaded from a local path used to be sent as application/octet-stream whatever it was, so tools that check the file's type, such as Canva's design import, rejected it. The SDK now infers the type from the file name's extension (a .pptx uploads as application/vnd.openxmlformats-officedocument.presentationml.presentation) and keeps application/octet-stream only for missing or unknown extensions. The TypeScript and Python SDKs now use the same extension table, so a file uploads with the same type from either SDK and from the CLI. Files passed as File objects and URLs keep the type they carry.

• 30f8ca1: getExtensionFromMimeType now maps text/csv to csv from its table, matching the Python SDK. The returned extension is unchanged.

• f6368e0: Add the missing experimental option to the ToolRouterAuthorizeFn type. session.authorize() already accepted experimental: { accountType, aclConfigForShared } at runtime, but sessions returned by composio.create() and composio.use() rejected it at compile time.

0.27.0

Minor Changes

• c2bbfa8: Add session hooks. A hook can block a tool call before it runs, or block its result before the agent sees it.

  create() and update() accept hooks. On update(), hooks replaces the whole list and null removes every hook. hooks cannot be combined with experimental.sessionConfigId.

  const session = await composio.create('user_123', {
    hooks: [
      {
        type: 'before_execute',
        id: 'no_external_email',
        name: 'No external email',
        appliesTo: { toolkits: ['gmail'] },
        handler: {
          type: 'condition_check',
          condition: 'Sending email to anyone outside example.org',
          action: 'block',
        },
      },
    ],
  });

... (truncated)

Commits

• fea4e93 Release: update version (#5070)
• a4101e3 fix(core): preserve custom toolkit connection fields
• a5a1fc8 feat(core,python): add custom toolkit create/update, deprecate upsert (PLEN-4...
• d2d4148 feat: add trigger instance type and polling interval to triggers.create (PLEN...
• f6368e0 fix(core): accept experimental in the session authorize type (#4665)
• 54a935f feat: move to @​composio/client 2.0.0-rc.23 (#5169)
• 30f8ca1 fix(py): keep the extension of files fetched from extensionless URLs (#5119)
• e547eb0 fix(cli): upload local files with their MIME type (#5037)
• d9f672f chore(deps-dev): bump the npm-development group across 1 directory with 9 upd...
• 7434e02 fix: move to @​composio/client rc.22 and drop the spec-gap workarounds (#5090)
• Additional commits viewable in compare view

Updates @modelcontextprotocol/sdk from 1.32.1 to 1.32.2

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.32.2

What's Changed

• fix: add explicit | undefined to Transport optional properties (v1.x backport of #1766) by @​kishormorol in modelcontextprotocol/typescript-sdk#2814
• [v1.x] fix: allow registering after connect() when the capability was declared by @​claude[bot] in modelcontextprotocol/typescript-sdk#2958
• chore: bump version to 1.32.2 by @​claude[bot] in modelcontextprotocol/typescript-sdk#3089

New Contributors

• @​kishormorol made their first contribution in modelcontextprotocol/typescript-sdk#2814

Full Changelog: modelcontextprotocol/typescript-sdk@1.32.1...1.32.2

Commits

• 3b73021 chore: bump version to 1.32.2 (#3089)
• fa56d81 [v1.x] fix: allow registering after connect() when the capability was declare...
• 6919e95 fix: add explicit | undefined to Transport optional properties (v1.x backport...
• See full diff in compare view

Updates imapflow from 2.9.1 to 2.10.2

Release notes

Sourced from imapflow's releases.

v2.10.2

2.10.2 (2026-11-04)

Bug Fixes

• update dependencies (eb1e6d9)

v2.10.1

2.10.1 (2026-11-04)

Bug Fixes

• update dependencies (73e298e)
• update dependencies (ad607d2)

v2.10.0

2.10.0 (2026-10-29)

Summary

A small feature release: download() gains a decodeText option for saving a text part as the original file instead of as decoded text. Default behavior is unchanged.

Who should upgrade

No hurry unless you offer inline text/plain or text/html parts as downloadable files. Nothing changes for existing callers.

Highlights

• download(range, part, { decodeText: false }) returns the part with only the transfer encoding (base64, quoted-printable) removed. It skips the format=flowed unwrapping and the charset conversion, so the saved bytes match the original file. meta.charset still reports the part's charset. Requested in #455.

Features

• add decodeText option to download() for transfer-decoded file bytes (9c9bec2), closes #455

Changelog

Sourced from imapflow's changelog.

2.10.2 (2026-11-04)

Bug Fixes

• update dependencies (eb1e6d9)

2.10.1 (2026-11-04)

Bug Fixes

• update dependencies (73e298e)
• update dependencies (ad607d2)

2.10.0 (2026-10-29)

Features

• add decodeText option to download() for transfer-decoded file bytes (9c9bec2), closes #455

Commits

• f0bc48c Merge pull request #460 from postalsys/release-please--branches--master--comp...
• 199e1e3 chore(master): release 2.10.2 [skip-ci]
• eb1e6d9 fix: update dependencies
• 4f35792 Merge pull request #459 from postalsys/release-please--branches--master--comp...
• ca495c5 chore(master): release 2.10.1 [skip-ci]
• 73e298e fix: update dependencies
• ad607d2 fix: update dependencies
• 7d797b9 Merge pull request #456 from postalsys/release-please--branches--master--comp...
• f7fc8f6 chore(deps): update development dependencies
• 4fb7d3e chore(master): release 2.10.0 [skip-ci]
• Additional commits viewable in compare view

Updates mcp-remote from 0.14.3 to 0.16.1

Release notes

Sourced from mcp-remote's releases.

v0.16.1

0.16.1 (2026-11-05)

Bug Fixes

• build against zod 4.6.6 or later, outside GHSA-mrhx-c7xc-m3w5 (#387) (5e407e5)

v0.16.0

0.16.0 (2026-11-02)

Features

• add --bind-host to choose the OAuth callback server's listen address (#386) (11984b0)

v0.15.2

0.15.2 (2026-10-20)

Bug Fixes

• open the browser for the client registered after a stale one is cleared (#383) (373f732)

v0.15.1

0.15.1 (2026-10-14)

Bug Fixes

• keep the static OAuth client and its secret out of the credential store (b529ea1)

v0.15.0

0.15.0 (2026-10-14)

Features

• add optional OAuth completion page URL (#373) (34f7fd2)

v0.14.5

0.14.5 (2026-10-14)

Bug Fixes

• give the callback port back once a sign-in has finished (#372) (65bb414)
• persist OAuth discovery state for the authorization callback leg (#376) (e0a520e)
• stop OAuth retries after follower timeout (#370) (55a61a9)

... (truncated)

Commits

• 5e407e5 fix: build against zod 4.6.6 or later, outside GHSA-mrhx-c7xc-m3w5 (#387)
• 11984b0 feat: add --bind-host to choose the OAuth callback server's listen address (#...
• 373f732 fix: open the browser for the client registered after a stale one is cleared ...
• 71cadf3 test: make the suite pass on Windows so the pre-commit hook stops rejecting c...
• b529ea1 fix: keep the static OAuth client and its secret out of the credential store
• 34f7fd2 feat: add optional OAuth completion page URL (#373)
• 55a61a9 fix: stop OAuth retries after follower timeout (#370)
• 65bb414 fix: give the callback port back once a sign-in has finished (#372)
• e0a520e fix: persist OAuth discovery state for the authorization callback leg (#376)
• 6a4ff90 fix: serve the OAuth error callback as plain text, not HTML (#375)
• See full diff in compare view

Updates nodemailer from 10.2.1 to 10.3.1

Release notes

Sourced from nodemailer's releases.

v10.3.1

10.3.1 (2026-10-29)

Bug Fixes

• apply the otp option in MailComposer too (1d4087f)

v10.3.0

10.3.0 (2026-10-29)

Summary

This release adds support for the OTP-Token header from the IETF draft draft-goto-otp-token, which lets mail clients and browsers offer a one-time passcode for autofill on the site it belongs to. It also fixes how a Content-ID header is encoded.

Who should upgrade

• Anyone sending one-time passcodes by email who wants them to be machine-readable.
• Anyone already setting an OTP-Token header through headers: before this release it went out MIME encoded and could not be parsed.
• Anyone embedding images with a cid that holds a non-ASCII character or a quote.

Highlights

• New otp message option: otp: { code: '123456', origin: 'https://example.com' } adds OTP-Token: "123456"; origin="https://example.com". The origin is reduced to its canonical form, only https (or http on a loopback host) is accepted, and invalid values fail the send with the new EOTP error code. See Message configuration.
• A custom OTP-Token header is no longer MIME word encoded. Line breaks and control characters are still removed.
• OTP-Token is included in the DKIM signature by default.
• A Content-ID header, from an attachment cid or set through headers, is now encoded as a message id rather than as text, so a cid with a non-ASCII character or a quote keeps matching the cid: URL in the HTML.
• Groundmail added to the well-known services.

Features

• add the otp option for the OTP-Token header (7789e15)

Bug Fixes

• encode a Content-ID header as a message id (#1904) (47f2b25)

Changelog

Sourced from nodemailer's changelog.

10.3.1 (2026-10-29)

Bug Fixes

• apply the otp option in MailComposer too (1d4087f)

10.3.0 (2026-10-29)

Features

• add the otp option for the OTP-Token header (7789e15)

Bug Fixes

• encode a Content-ID header as a message id (#1904) (47f2b25)

Commits

• 26555d0 Merge pull request #1906 from nodemailer/release-please--branches--master--co...
• 3e5bb55 chore(master): release 10.3.1
• 1d4087f fix: apply the otp option in MailComposer too
• 488ce9c chore(deps): update development dependencies
• 41eda65 chore(deps): update development dependencies
• 5de343d chore(master): release 10.3.0 (#1905)
• 7789e15 feat: add the otp option for the OTP-Token header
• 47f2b25 fix: encode a Content-ID header as a message id (#1904)
• a6e7a70 chore(services): add Groundmail (#1903)
• a0cea19 chore(deps): update development dependencies [skip ci]
• Additional commits viewable in compare view

Updates zod from 4.6.5 to 4.6.7

Release notes

Sourced from zod's releases.

v4.6.7

Commits:

• b500a2ee95134f81d74da7911d7378dd2853d042 4.6.7

v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.

Commits:

• 0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini
• 9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from zod/locales, not z.locales
• 34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales tree-shaking note
• 74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions instead of publishing them (#6622)
• b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to bronze sponsors
• 8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for Japan logo and list it first in bronze
• bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for Japan logo to match the other bronze tiles
• c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on the release-approval environment until the staged versions are approved (#6638)
• a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record output and input as members, not base type arguments (#6645)
• a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set and map size bounds before parsing elements (#6652)
• 529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6
• 9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a failed OIDC token exchange says why

Commits

• b500a2e 4.6.7
• 9c21983 ci: stage at verbose so a failed OIDC token exchange says why
• 529f78d 4.6.6
• a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#6652)
• a2ba4a6 fix(types): declare record output and input as members, not base type argumen...
• c42596b release: hold the run on the release-approval environment until the staged ve...
• bacad51 docs: square the Code for Japan logo to match the other bronze tiles
• 8fb2faf docs: crop the Code for Japan logo and list it first in bronze
• b2ef983 docs: add Code for Japan to bronze sponsors
• 74304ce release: stage npm versions instead of publishing them (#6622)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions