Skip to content

Conversation

@anshugarg15
Copy link
Contributor

@anshugarg15 anshugarg15 commented Jan 8, 2026

Summary

https://github.com/ComposioHQ/hermes/pull/7598

Changes

  • Documents the breaking change in PATCH /api/v3/auth_configs/{id} endpoint where fields are now preserved when not explicitly provided (true PATCH semantics) instead of being reset to defaults (PUT-like behavior).

Type of change

  • Bug fix
  • New feature
  • Refactor/Chore
  • Documentation
  • Breaking change

How Has This Been Tested?

Vitests for the changes in hermes + Tested the python code snippets from changelog

Screenshots (if applicable)

Checklist

  • I have read the Code of Conduct and this PR adheres to it
  • I ran linters/tests locally and they passed
  • I updated documentation as needed
  • I added tests or explain why not applicable
  • I added a changeset if this change affects published packages

e2e test report

E2E Test Report - Auth Config PATCH Semantics

Environment: Staging (https://staging-backend.composio.dev)
Test Date: 2026-01-08


Python SDK Tests ✅ 4/4

# Test Result
1 Create custom auth config
2 Update only client_secret (credentials merged)
3 Update tool_access_config WITHOUT credentials
4 Clear tool_access_config with []

TypeScript SDK Tests ✅ 4/4

# Test Result
1 Create custom auth config
2 Update credentials
3 Update credentials + toolAccessConfig
4 Credential preservation (partial update merges, not replaces)

Raw HTTP API Tests ✅ 11/11

# Test Result
1 Get initial auth config state
2 Update only client_secret (credentials merged)
3 Update tool_access_config WITHOUT credentials
4 Set proxy_config
5 Clear proxy_config with null
6 Clear tool_access_config with []
7 Create default type auth config
8 Get initial default auth config
9 Update scopes for default type
10 Update tool_access_config (scopes preserved)
11 Update shared_credentials

Changelog Code Verification ✅ 5/5

Every curl command in the changelog was executed on staging and verified:

Example Description Verified
1 Rotate single credential client_id preserved
2 Update tool_access_config without credentials ✅ credentials preserved
3 Update scopes for default type ✅ scopes updated
4 Clear proxy_config with null ✅ cleared
5 Clear tool_access_config with [] ✅ cleared

Summary

Category Passed Total
Python SDK 4 4
TypeScript SDK 4 4
Raw HTTP API 11 11
Changelog Examples 5 5
Total 24 24

All 24 tests passed

Documents the breaking change in PATCH /api/v3/auth_configs/{id} endpoint
where fields are now preserved when not explicitly provided (true PATCH
semantics) instead of being reset to defaults (PUT-like behavior).
@vercel
Copy link

vercel bot commented Jan 8, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Review Updated (UTC)
fumadocs Ready Ready Preview, Comment Jan 9, 2026 5:09am

@github-actions
Copy link
Contributor

github-actions bot commented Jan 8, 2026

- Add TypeScript and Python examples
- Remove duplication and redundant sections
- Follow repo changelog standards
- Remove unnecessary Benefits section
@github-actions
Copy link
Contributor

github-actions bot commented Jan 8, 2026

@github-actions
Copy link
Contributor

github-actions bot commented Jan 8, 2026

@github-actions
Copy link
Contributor

github-actions bot commented Jan 8, 2026

- Replace raw HTTP examples with TypeScript and Python SDK examples
- Add CodeBlocks with tabs for both SDKs
- Add 'Update Scopes for Default Auth Configs' example
- Migration guide now uses SDK syntax
- Tested on staging: all PATCH operations work correctly

PLEN-1078
@github-actions
Copy link
Contributor

github-actions bot commented Jan 8, 2026

- Fix TS SDK to make credentials optional for custom type updates
- Add proxyConfig and sharedCredentials support to TS SDK update method
- Fix changelog package name from composio-core to @composio/core
- Simplify changelog examples

TypeScript SDK changes:
- authConfigs.types.ts: Make credentials optional, add proxyConfig and sharedCredentials
- AuthConfigs.ts: Update method to handle new optional fields

Tested on staging:
- Python SDK: 12/12 tests passed
- TypeScript SDK: 10/10 tests passed

PLEN-1078
@github-actions
Copy link
Contributor

github-actions bot commented Jan 8, 2026

⚠️ Security Audit Warning

The pnpm audit --prod check found security vulnerabilities in production dependencies.

Please review and fix the vulnerabilities. You can try running:

pnpm audit --fix --prod
Audit output
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ LangChain serialization injection vulnerability        │
│                     │ enables secret extraction                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ langchain                                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=1.0.0 <1.2.3                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=1.2.3                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ ts__examples__langchain>langchain                      │
│                     │                                                        │
│                     │ ts__examples__tool-router>langchain                    │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-r399-636x-v7f6      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ LangChain serialization injection vulnerability        │
│                     │ enables secret extraction                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ @langchain/core                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=1.0.0 <1.1.8                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=1.1.8                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ ts__examples__langchain>@langchain/core                │
│                     │                                                        │
│                     │ ts__examples__tool-router>@langchain/                  │
│                     │ anthropic>@langchain/core                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-r399-636x-v7f6      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ qs's arrayLimit bypass in its bracket notation allows  │
│                     │ DoS via memory exhaustion                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ qs                                                     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <6.14.1                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=6.14.1                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ fern>supergateway>@modelcontextprotocol/sdk>express>qs │
│                     │                                                        │
│                     │ fern>supergateway>body-parser>qs                       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-6rw7-vpxm-498p      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ Anthropic's MCP TypeScript SDK has a ReDoS             │
│                     │ vulnerability                                          │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ @modelcontextprotocol/sdk                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <1.25.2                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=1.25.2                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ fern>supergateway>@modelcontextprotocol/sdk            │
│                     │                                                        │
│                     │ ts__examples__google>@modelcontextprotocol/sdk         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-8r9q-7v3j-jr4g      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ pnpm v10+ Bypass "Dependency lifecycle scripts         │
│                     │ execution disabled by default"                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ pnpm                                                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=10.0.0 <10.26.0                                      │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=10.26.0                                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ ts__examples__tool-router>pnpm                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-379q-355j-w6rj      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ pnpm Has Lockfile Integrity Bypass that Allows Remote  │
│                     │ Dynamic Dependencies                                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ pnpm                                                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <10.26.0                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=10.26.0                                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ ts__examples__tool-router>pnpm                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-7vhp-vf5g-r2fw      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ pnpm vulnerable to Command Injection via environment   │
│                     │ variable substitution                                  │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ pnpm                                                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=6.25.0 <10.27.0                                      │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=10.27.0                                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ ts__examples__tool-router>pnpm                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-2phv-j68v-wwqx      │
└─────────────────────┴────────────────────────────────────────────────────────┘
11 vulnerabilities found
Severity: 11 high

@github-actions
Copy link
Contributor

github-actions bot commented Jan 8, 2026

@github-actions
Copy link
Contributor

github-actions bot commented Jan 8, 2026

@github-actions
Copy link
Contributor

github-actions bot commented Jan 8, 2026

Remove SDK-specific examples since current SDKs don't support all PATCH
capabilities (proxy_config, shared_credentials, optional credentials).
Added note about future SDK updates.

Tested all examples on staging - 11/11 tests passed.

PLEN-1078
@github-actions
Copy link
Contributor

github-actions bot commented Jan 8, 2026

@github-actions
Copy link
Contributor

github-actions bot commented Jan 8, 2026

- Python SDK examples as primary
- TypeScript SDK examples with note about credentials requirement
- Raw HTTP API examples moved to end
- All examples tested and verified on staging

PLEN-1078
@github-actions
Copy link
Contributor

github-actions bot commented Jan 8, 2026

@github-actions
Copy link
Contributor

github-actions bot commented Jan 8, 2026

@github-actions
Copy link
Contributor

github-actions bot commented Jan 9, 2026

await composio.authConfigs.update("ac_yourAuthConfigId", {
type: "custom",
credentials: {
// Include existing credentials when using TS SDK
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What does this mean?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants