Skip to content

Conversation

@jkomyno
Copy link
Collaborator

@jkomyno jkomyno commented Dec 30, 2025

This PR:

  • closes PLEN-918
  • updates Composio to support ai v6 (https://vercel.com/blog/ai-sdk-6)
  • updates TypeScript examples to showcase how to use ai@6 + @composio/vercel
  • updates @composio/vercel's peerDependencies to support either ai@5 or ai@6
    • runtime functionality used by @composio/vercel remains the same, but types need to be updated accordingly

@github-actions
Copy link
Contributor

github-actions bot commented Dec 30, 2025

⚠️ Security Audit Warning

The pnpm audit --prod check found security vulnerabilities in production dependencies.

Please review and fix the vulnerabilities. You can try running:

pnpm audit --fix --prod
Audit output
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ critical            │ Next.js is vulnerable to RCE in React flight protocol  │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ next                                                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=16.0.0-canary.0 <16.0.7                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=16.0.7                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ ts__examples__llamaindex>@llamaindex/                  │
│                     │ workflow>@llamaindex/workflow-core>next                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-9qr9-h5gf-34mp      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ Next Vulnerable to Denial of Service with Server       │
│                     │ Components                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ next                                                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=16.0.0-beta.0 <16.0.9                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=16.0.9                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ ts__examples__llamaindex>@llamaindex/                  │
│                     │ workflow>@llamaindex/workflow-core>next                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-mwv6-3258-q52c      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ LangChain serialization injection vulnerability        │
│                     │ enables secret extraction                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ langchain                                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=1.0.0 <1.2.3                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=1.2.3                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ ts__examples__langchain>langchain                      │
│                     │                                                        │
│                     │ ts__examples__tool-router>langchain                    │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-r399-636x-v7f6      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ LangChain serialization injection vulnerability        │
│                     │ enables secret extraction                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ @langchain/core                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=1.0.0 <1.1.8                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=1.1.8                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ ts__examples__langchain>@langchain/core                │
│                     │                                                        │
│                     │ ts__examples__tool-router>@langchain/                  │
│                     │ anthropic>@langchain/core                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-r399-636x-v7f6      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ qs's arrayLimit bypass in its bracket notation allows  │
│                     │ DoS via memory exhaustion                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ qs                                                     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <6.14.1                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=6.14.1                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ fern>supergateway>@modelcontextprotocol/sdk>express>qs │
│                     │                                                        │
│                     │ fern>supergateway>body-parser>qs                       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-6rw7-vpxm-498p      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ Next Server Actions Source Code Exposure               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ next                                                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=16.0.0-beta.0 <16.0.9                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=16.0.9                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ ts__examples__llamaindex>@llamaindex/                  │
│                     │ workflow>@llamaindex/workflow-core>next                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-w37m-7fhw-fmv9      │
└─────────────────────┴────────────────────────────────────────────────────────┘
9 vulnerabilities found
Severity: 1 moderate | 7 high | 1 critical

@jkomyno jkomyno marked this pull request as ready for review December 30, 2025 02:41
@github-actions
Copy link
Contributor


// 4. Retrieve tools.
console.log(`🔄 Retrieving tools...`);
const tools = await session.tools();
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

While using MCP tools should be extracted from the MCP client and not from the session. Only during native tool use we should extract it from the session.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"@composio/core": "workspace:*",
"@composio/vercel": "workspace:*",
"ai": "catalog:"
"ai": "^6.0.3"
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If we are updating the core package, let's use catalog itself?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

const { text } = await generateText({
model: openai.responses('gpt-4.1'),
tools: tools,
model: openai('gpt-4o-mini'),
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Mini models doesn't perform well, can we use latest models?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure, that can be changed. I had used gpt-4o-mini because it was the one already introduced in src/stream.ts by 9e002c5#diff-534cbbffb3adc765fa52727a5fb7286ee4fbeb0a846af5aacf1de20b903a0d29 3 weeks ago.

Is gpt-5.2 ok?

@@ -0,0 +1,84 @@
import { openai } from '@ai-sdk/openai';
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For vercel ai sdk 6, the primary feature is their agents, can we have an example using their Agents feature?

import { ToolLoopAgent } from 'ai';
import { weatherTool } from '@/tools/weather';

export const weatherAgent = new ToolLoopAgent({
  model: 'anthropic/claude-sonnet-4.5',
  instructions: 'You are a helpful weather assistant.',
  tools: {
    weather: weatherTool,
  },
});

const result = await weatherAgent.generate({
  prompt: 'What is the weather in San Francisco?',
});

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@github-actions
Copy link
Contributor

import { VercelProvider } from '@composio/vercel';
import dotenv from 'dotenv';
import { MessageRoles } from './types';
dotenv.config();
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Environment variables not loaded after dotenv removal

The dotenv import and dotenv.config() call were removed from stream.ts, but the code still accesses process.env.COMPOSIO_API_KEY on line 10. Unlike other example files in the project (such as openai/src/chat-completions.ts) that properly call dotenv.config() before accessing environment variables, this file no longer loads the .env file. For users running this example with Node.js (rather than Bun, which auto-loads .env files), the COMPOSIO_API_KEY will be undefined, causing the example to fail.

Fix in Cursor Fix in Web

@github-actions
Copy link
Contributor

@vercel
Copy link

vercel bot commented Jan 5, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Review Updated (UTC)
fumadocs Error Error Jan 5, 2026 3:54pm


// 2. Create an MCP session
console.log('🔄 Creating toolrouter session...');
const session = await composio.create('jkomyno', {
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Developer username hardcoded in example files

The example files use the developer's personal username 'jkomyno' as the user identifier in composio.create() calls. Other examples like ai.ts consistently use the generic placeholder 'test-user-id'. Using a specific developer's username in documentation examples is inconsistent and may confuse users following the examples.

Additional Locations (1)

Fix in Cursor Fix in Web

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants