build(deps): Bump the compatible-updates group with 3 updates

[dependabot]

Bumps the compatible-updates group with 3 updates: @composio/core, mcp-remote and zod.

Updates @composio/core from 0.14.0 to 0.18.1

Release notes

Sourced from @​composio/core's releases.

@​composio/core@​0.18.1

Patch Changes

• 8a56383: Fix: automatic S3 file downloads are now capped at 100 MiB (configurable per call) to prevent memory exhaustion from oversized or streaming responses.
• 7420927: Fix custom toolkit child slug mapping: reject response tools that have local handles but no exact toolkit match instead of silently dropping them or binding another toolkit's handler, derive bare-slug ambiguity from local definitions, and only reuse a same-toolkit bare alias in customToolkits().
• 1d31c80: Redact credential-shaped values at the SDK log boundary.
• 95f9d32: Expose the runtime-conditional SSRF-safe fetch helper for protected URL upload consumers.
• 0d28bef: Map file-download transport failures to the SDK error contract and bound streamed response bodies.
• 52efb5b: Fix trigger subscriptions ignoring the authConfigId filter.
• Updated dependencies [ab289d6]
  • @​composio/json-schema-to-zod@​0.3.2

Changelog

Sourced from @​composio/core's changelog.

0.18.1

Patch Changes

• 8a56383: Fix: automatic S3 file downloads are now capped at 100 MiB (configurable per call) to prevent memory exhaustion from oversized or streaming responses.
• 7420927: Fix custom toolkit child slug mapping: reject response tools that have local handles but no exact toolkit match instead of silently dropping them or binding another toolkit's handler, derive bare-slug ambiguity from local definitions, and only reuse a same-toolkit bare alias in customToolkits().
• 1d31c80: Redact credential-shaped values at the SDK log boundary.
• 95f9d32: Expose the runtime-conditional SSRF-safe fetch helper for protected URL upload consumers.
• 0d28bef: Map file-download transport failures to the SDK error contract and bound streamed response bodies.
• 52efb5b: Fix trigger subscriptions ignoring the authConfigId filter.
• Updated dependencies [ab289d6]
  • @​composio/json-schema-to-zod@​0.3.2

0.18.0

Minor Changes

• 04817cb: Fix strict-mode tool schemas for OpenAI structured outputs. Strict normalization now applies OpenAI's contract at every depth (nested objects, anyOf branches, array items, inlined $ref/$defs): every object lists all of its properties in required and sets additionalProperties: false, so tools with nested or optional parameters no longer produce schemas the API rejects with a 400. Optional parameters are no longer dropped: they stay available and are widened to accept null, the emulation of optional fields OpenAI documents, and the strict providers drop a null argument the tool's own schema does not accept before executing the tool. Tools whose schema strict mode cannot express (objects with arbitrary keys, allOf, prefixItems, unresolved $refs) are sent without strict mode with a warning naming the tool and path, instead of being narrowed. @composio/core exports the new toStrictJsonSchema() and omitNullToolArguments() utilities; removeNonRequiredProperties is unchanged for other callers. The Python OpenAIResponsesProvider gains a matching opt-in strict=True constructor flag that also emits strict: true on the wrapped tool.

Patch Changes

• 449f4e1: Block automatic uploads when a sensitive directory or file name is hidden by symlink resolution.
• 9545806: Bound the best-effort telemetry requests with a timeout so a stalled telemetry endpoint cannot leave an SDK call pending indefinitely.
• db7b576: Declare Node.js 22.22.3 as the minimum supported runtime for every published TypeScript package so package managers surface incompatible runtimes before users encounter ESM loading failures.
• fe66cbe: Omit empty-string file-uploadable arguments from tool execution requests instead of forwarding them to the backend, which rejected them with "Input should be a valid dictionary or instance of FileUploadable". This now also applies when dangerouslyAllowAutoUploadDownloadFiles is off, and with it on an empty value is no longer attempted as an upload.
• c0f1609: Fix three ComposioError subclasses (ComposioToolVersionRequiredError, JsonSchemaToZodError, JsonSchemaRefResolutionError) that omitted their this.name assignment and therefore reported name as 'ComposioError' instead of their own class name, mis-grouping distinct error types in error telemetry.
• d544006: Close a DNS-rebinding window in the SSRF guard: the address validated by assertSafeFetchTarget is now the address ssrfSafeFetch connects to, so a hostname is no longer resolved a second time between the check and the connection. Each redirect hop is re-validated and re-pinned. The request still carries the original hostname in Host and TLS SNI, so certificate verification is unchanged. Hops whose effective dispatcher is a configured route — a caller-supplied dispatcher, a global ProxyAgent/EnvHttpProxyAgent, or NODE_USE_ENV_PROXY env-proxy mode — keep the pre-flight check only, mirroring the Python guard's documented proxy residual.
• Updated dependencies [db7b576]
  • @​composio/json-schema-to-zod@​0.3.1

0.17.0

Minor Changes

• 760f8d0: Allow OpenAI and Anthropic provider tool-call helpers to execute through a supplied Tool Router session. Session meta-tools now retain their session context while provider argument normalization remains intact; existing user-ID calls continue to use direct execution. Anthropic helper failures now preserve their error text in { error } results without changing successful payloads. Custom provider subclasses overriding executeToolCall or handleToolCalls may require updates because these methods now accept session targets.

Patch Changes

• 6ba9179: Validate the URLs that come from API responses before fetching them. Tool-execution downloads (s3Url), S3 presigned uploads (new_presigned_url), Tool Router session file downloads (RemoteFile.buffer() / blob() / text() / save()) and session file uploads (upload_url) now go through the same SSRF guard that already covered user-supplied URLs, so a response naming a private, loopback, or link-local address is refused instead of fetched. Redirect hops are re-validated. Edge runtimes keep their current behavior: session file transfers are not blocked there, since a Worker cannot resolve DNS to check and its fetch does not originate inside the caller's network.

0.16.0

Minor Changes

• 5e57815: Keep free-form object roots, patternProperties, and additionalProperties when parsing a tool schema.

  ToolSchema.parse used to reject a bare { "type": "object" } root, drop root patternProperties as an unknown key, and reject a root additionalProperties written as a schema instead of a boolean. Free-form roots now parse successfully, and both constraints survive parsing exactly as written. The public ToolSchema type now makes properties optional to reflect those valid property-less object schemas.

  This matters downstream. Every provider reads inputParameters after parsing, so a tool that declares dynamic keys had those rules stripped before the model ever saw them.

... (truncated)

Commits

• 2573c64 Release: update version (#4285)
• ab289d6 fix(sdk): preserve primitive JSON Schema semantics (#4316)
• 7420927 fix(sdk): qualify custom toolkit child slug mapping across Python and TypeScr...
• 52efb5b fix(core): respect authConfigId in trigger subscriptions (#4298)
• 0d28bef fix(sdk): map streamed file transport failures (#4321)
• 95f9d32 fix(cli): guard URL file uploads against SSRF (#4319)
• 1d31c80 fix(sdk): keep credentials private in storage and logs (#4318)
• 2777545 test(core): make $ref contract holdout exclusive, flag polluting-key refs unr...
• 98f16fe test(core,providers): restore $ref contract and property suites
• 9f77e64 test(core): use the node: prefix for the fs import
• Additional commits viewable in compare view

Updates mcp-remote from 0.8.3 to 0.13.4

Release notes

Sourced from mcp-remote's releases.

v0.13.4

0.13.4 (2026-09-11)

Bug Fixes

• honour a cancellation raised before any retry leg exists, and stop a reused request id crossing answers (36076bc)

v0.13.3

0.13.3 (2026-09-11)

Bug Fixes

• handle a cancellation that arrives before the request is sent, and stop holding ordinary request ids (2e8895b)

v0.13.2

0.13.2 (2026-09-11)

Bug Fixes

• stop cancelled subscriptions leaking answers, timers and a latched filter (75c3eab)

v0.13.1

0.13.1 (2026-09-11)

Bug Fixes

• correct the subscription refresh, exchange cancellation and id namespace defects (7a615dc)

v0.13.0

0.13.0 (2026-09-11)

Features

• honour the methods the 2026-07-28 era retired, and close the remaining review findings (d8182b1)

v0.12.1

0.12.1 (2026-09-11)

Bug Fixes

• correct defects found reviewing the protocol bridge and the auth retry changes (5114ce3)

v0.12.0

0.12.0 (2026-09-11)

... (truncated)

Commits

• 36076bc fix: honour a cancellation raised before any retry leg exists, and stop a reu...
• e19c4fe refactor: give each multi-round-trip exchange a token, so a reused request id...
• 2e8895b fix: handle a cancellation that arrives before the request is sent, and stop ...
• 75c3eab fix: stop cancelled subscriptions leaking answers, timers and a latched filter
• 7a615dc fix: correct the subscription refresh, exchange cancellation and id namespace...
• d8182b1 feat: honour the methods the 2026-07-28 era retired, and close the remaining ...
• 5114ce3 fix: correct defects found reviewing the protocol bridge and the auth retry c...
• 81d0e56 feat: bridge subscriptions/listen and multi-round-trip requests to a legacy c...
• 2acd281 feat: add the client_credentials grant, and give a sibling token handover its...
• 950eb99 fix: raise zod to the version the v2 SDK requires
• Additional commits viewable in compare view

Updates zod from 4.5.4 to 4.6.2

Release notes

Sourced from zod's releases.

v4.6.2

A patch on top of 4.6.1.

• 9446b5cc fix: preserve undefined prefault outputs and object keys (#6587) — closes #6585
• 0c483c58 docs: the Zod 4.6 announcement post (#6546)
• a00c3f34 docs: use Trigger.dev's brand-kit lockups for the platinum card

v4.6.1

A patch on top of 4.6.0.

• b12aa523 fix: preserve unique tags with defaulted discriminators (#6582) — closes #6577
• dd9c36fa fix(v4): defer recursive object index inference (#6580)
• 3b154992 feat(lang): add Tajik (tg) locale (#6581) by @​ismoil77
• 2efa8b80 ci: give the npm wait a real budget and drop the back-publish path (#6583)

v4.6.0

Zod 4.6 is now available.

npm install zod@latest

At a glance:

• .validate() — checks input validity without building a result (up to 35x faster than .safeParse().success on a compiled schema)
• z.instanceof().properties() — validates properties of an instance
• fromJSONSchema() — enforces six validation keywords it used to ignore
• z.iban() — electronic-format IBAN plus mod-97 checksum
• z.withParser() — installs a parser generated elsewhere, for environments without new Function
• Faster CommonJS — drops the getter on every export (~3x faster z.validate() under require)
• Memory retention in recursive schemas — releases the parsed input, fixing a 4.5 out-of-memory regression
• @zod/mini — Zod Mini as a standalone package, versioned in lockstep with zod since 4.5

.validate()

Standalone boolean validation, in Zod, Zod Mini, and Zod Core. It answers "is this input valid?" without constructing a ZodError, which makes rejection cheap. The return type is a guard on the schema's input type.

z.validate(z.string(), "hi"); // true
z.validate(z.string(), 42);   // false

It is a method on Zod Classic schemas too. (#6547)

const Player = z.object({
  username: z.string(),
  xp: z.number(),
});
</tr></table>

... (truncated)

Commits

• e359f73 4.6.2
• 9446b5c fix: preserve undefined prefault outputs and object keys (#6587)
• 0c483c5 docs: Zod 4.6 announcement post (#6546)
• a00c3f3 docs: use Trigger.dev's brand-kit lockups for the platinum card
• 62311eb 4.6.1
• 2efa8b8 ci: give the npm wait a real budget and drop the back-publish path (#6583)
• b12aa52 fix: preserve unique tags with defaulted discriminators (#6582)
• dd9c36f fix(v4): defer recursive object index inference (#6580)
• 574d480 fix(locales): clarify Tajik discriminator value message
• c532d76 test(locales): cover Tajik error branches
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions