Skip to content

Fix link check test#2691

Closed
rahulpinto19 wants to merge 28 commits intogoogleapis:fix-link-check-testfrom
rahulpinto19:fix-link-check-test
Closed

Fix link check test#2691
rahulpinto19 wants to merge 28 commits intogoogleapis:fix-link-check-testfrom
rahulpinto19:fix-link-check-test

Conversation

@rahulpinto19
Copy link
Copy Markdown
Contributor

Description

Should include a concise description of the changes (bug or feature), it's
impact, along with a summary of the solution

PR Checklist

Thank you for opening a Pull Request! Before submitting your PR, there are a
few things you can do to make sure it goes smoothly:

  • Make sure you reviewed
    CONTRIBUTING.md
  • Make sure to open an issue as a
    bug/issue
    before writing your code! That way we can discuss the change, evaluate
    designs, and agree on the general idea
  • Ensure the tests and linter pass
  • Code coverage does not decrease (if any source code was changed)
  • Appropriate docs were updated (if necessary)
  • Make sure to add ! if this involve a breaking change

🛠️ Fixes #<issue_number_goes_here>

duwenxin99 and others added 23 commits March 2, 2026 22:30
…is#2602)

- Make the DICOM stores test self-contained and not using prepopulated
test data
- Make sure the responses from list DICOM tool are status OK but do not
check for specific result due to pagination not supported. The list
result is limited to the first 100 items, so the wanted entry is not
guaranteed to be in the returned result.
🤖 I have created a release *beep* *boop*
---


##
[0.28.0](googleapis/mcp-toolbox@v0.27.0...v0.28.0)
(2026-03-02)


### Features

* Add polling system to dynamic reloading
([googleapis#2466](googleapis#2466))
([fcaac9b](googleapis@fcaac9b))
* Added basic template for sdks doc migrate
([googleapis#1961](googleapis#1961))
([87f2eaf](googleapis@87f2eaf))
* **dataproc:** Add dataproc source and list/get clusters/jobs tools
([googleapis#2407](googleapis#2407))
([cc05e57](googleapis@cc05e57))
* **sources/postgres:** Add configurable pgx query execution mode
([googleapis#2477](googleapis#2477))
([57b77bc](googleapis@57b77bc))
* **sources/redis:** Add TLS support for Redis connections
([googleapis#2432](googleapis#2432))
([d6af290](googleapis@d6af290))
* **tools/looker:** Enable Get All Lookml Tests, Run LookML Tests, and
Create View From Table tools for Looker
([googleapis#2522](googleapis#2522))
([e01139a](googleapis@e01139a))
* **tools/looker:** Tools to list/create/delete directories
([googleapis#2488](googleapis#2488))
([0036d8c](googleapis@0036d8c))
* **ui:** Make tool list panel resizable
([googleapis#2253](googleapis#2253))
([276cf60](googleapis@276cf60))


### Bug Fixes

* **ci:** Add path for forked PR unit test runs
([googleapis#2540](googleapis#2540))
([04dd2a7](googleapis@04dd2a7))
* Deflake alloydb omni
([googleapis#2431](googleapis#2431))
([62b8309](googleapis@62b8309))
* **docs/adk:** Resolve dependency duplication
([googleapis#2418](googleapis#2418))
([4d44abb](googleapis@4d44abb))
* **docs/langchain:** Fix core at 0.3.0 and align compatible
dependencies
([googleapis#2426](googleapis#2426))
([36edfd3](googleapis@36edfd3))
* Enforce required validation for explicit null parameter values
([googleapis#2519](googleapis#2519))
([d5e9512](googleapis@d5e9512))
* **oracle:** Enable DML operations and resolve incorrect array type
error ([googleapis#2323](googleapis#2323))
([72146a4](googleapis@72146a4))
* **server/mcp:** Guard nil dereference in sseManager.get
([googleapis#2557](googleapis#2557))
([e534196](googleapis@e534196)),
closes [googleapis#2548](googleapis#2548)
* **tests/postgres:** Implement uuid-based isolation and reliable
resource cleanup
([googleapis#2377](googleapis#2377))
([8a96fb1](googleapis@8a96fb1))
* **tests/postgres:** Restore list_schemas test and implement dynamic
owner ([googleapis#2521](googleapis#2521))
([7041e79](googleapis@7041e79))
* **tests:** Resolve LlamaIndex dependency conflict in JS quickstart
([googleapis#2597](googleapis#2597))
([ac11f5a](googleapis@ac11f5a))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>
Co-authored-by: Wenxin Du <117315983+duwenxin99@users.noreply.github.com>
…is#2558)

## Description

In `readInputStream()`, `defer span.End()` is called inside a `for`
loop. Since `defer` schedules execution when the enclosing **function**
returns (not the current loop iteration), all spans created per message
accumulate without ever being ended for the lifetime of the stdio
session.

For a long-lived stdio server, this means:
- **Memory leak**: span objects accumulate indefinitely
- **Incorrect traces**: spans are never properly closed, producing
misleading telemetry data

## Changes

Wrap the per-message processing logic in an immediately invoked function
expression (IIFE), so `defer span.End()` correctly fires at the end of
each iteration. This follows the same pattern already used in
`InitializeConfigs` (`server.go` lines 85-98) for scoping spans inside
loops.

## Test

All existing tests pass. The `TestStdioSession` test exercises
`readLine` and `write` on the stdio session. The `readInputStream` loop
is covered by the existing MCP endpoint tests that exercise the full
message processing pipeline.

Fixes googleapis#2549
…apis#2516)

Bumps
[filippo.io/edwards25519](https://github.com/FiloSottile/edwards25519)
from 1.1.0 to 1.1.1.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/FiloSottile/edwards25519/commit/d1c650afb95fad0742b98d95f2eb2cf031393abb"><code>d1c650a</code></a>
extra: initialize receiver in MultiScalarMult</li>
<li>See full diff in <a
href="https://github.com/FiloSottile/edwards25519/compare/v1.1.0...v1.1.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=filippo.io/edwards25519&package-manager=go_modules&previous-version=1.1.0&new-version=1.1.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/googleapis/genai-toolbox/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Averi Kitsch <akitsch@google.com>
Running tests in parallel consumes more GCE CPU quota, and we're
occasionally getting flakes due to exceeding the default. This still may
be the right tradeoff for speed of interactive development, but these
aren't (yet) the slowest integration tests, so running sequentially will
preserve quota without increasing CI walltime.

## Description

> Should include a concise description of the changes (bug or feature),
it's
> impact, along with a summary of the solution

## PR Checklist

> Thank you for opening a Pull Request! Before submitting your PR, there
are a
> few things you can do to make sure it goes smoothly:

- [ ] Make sure you reviewed

[CONTRIBUTING.md](https://github.com/googleapis/genai-toolbox/blob/main/CONTRIBUTING.md)
- [ ] Make sure to open an issue as a

[bug/issue](https://github.com/googleapis/genai-toolbox/issues/new/choose)
  before writing your code! That way we can discuss the change, evaluate
  designs, and agree on the general idea
- [ ] Ensure the tests and linter pass
- [ ] Code coverage does not decrease (if any source code was changed)
- [ ] Appropriate docs were updated (if necessary)
- [ ] Make sure to add `!` if this involve a breaking change

🛠️ Fixes #<issue_number_goes_here>
## Description

Adds commands for Serverless Spark sessions analogous to existing
list/get commands for batches.

Unlike batches, we don't plan to add create session commands, as these
are generally only created via the Jupyter protocol. Agents will need to
have other ways to create sessions, for example by interacting directly
with an IDE like Jupyter Lab or VS Code, but those won't be part of MCP
Toolbox.

## PR Checklist

> Thank you for opening a Pull Request! Before submitting your PR, there
are a
> few things you can do to make sure it goes smoothly:

- [ ] Make sure you reviewed

[CONTRIBUTING.md](https://github.com/googleapis/genai-toolbox/blob/main/CONTRIBUTING.md)
- [ ] Make sure to open an issue as a

[bug/issue](https://github.com/googleapis/genai-toolbox/issues/new/choose)
  before writing your code! That way we can discuss the change, evaluate
  designs, and agree on the general idea
- [ ] Ensure the tests and linter pass
- [ ] Code coverage does not decrease (if any source code was changed)
- [ ] Appropriate docs were updated (if necessary)
- [ ] Make sure to add `!` if this involve a breaking change

🛠️ Part of googleapis#2405

Co-authored-by: Wenxin Du <117315983+duwenxin99@users.noreply.github.com>
…nding (googleapis#2219)

## Summary

Adds MCP tool annotations (`readOnlyHint`, `destructiveHint`) to all 9
MongoDB tools to help LLMs better understand tool behavior and make
safer decisions.

## Changes

| Tool | Annotation |
|------|------------|
| mongodb-find | `readOnlyHint: true` |
| mongodb-find-one | `readOnlyHint: true` |
| mongodb-aggregate | `readOnlyHint: true` |
| mongodb-insert-one | `destructiveHint: true` |
| mongodb-insert-many | `destructiveHint: true` |
| mongodb-update-one | `destructiveHint: true` |
| mongodb-update-many | `destructiveHint: true` |
| mongodb-delete-one | `destructiveHint: true` |
| mongodb-delete-many | `destructiveHint: true` |

## Implementation

Each tool now:
1. Has an `Annotations` field in its Config struct for YAML
configurability
2. Provides default annotations if not explicitly configured
3. Passes annotations to `GetMcpManifest()` instead of `nil`

This follows the exact pattern established by the Looker tools (e.g.,
`lookergetconnectionschemas`, `lookerupdateprojectfile`).

## Why This Matters

- **Semantic metadata**: Annotations provide information beyond just the
tool description
- **Safety signals**: `readOnlyHint` tells LLMs a tool is safe to call
without side effects
- **Destructive awareness**: `destructiveHint` signals LLMs should be
more careful before executing
- **Better tool selection**: LLMs can prioritize read-only tools for
information gathering
- **MCP compliance**: Follows the [MCP tool annotations
specification](https://modelcontextprotocol.io/specification/2025-06-18/schema#toolannotations)

## Testing

- [ ] CI builds successfully
- [ ] `tools/list` returns annotations in MCP response

## Files Changed

- `internal/tools/mongodb/mongodbfind/mongodbfind.go`
- `internal/tools/mongodb/mongodbfindone/mongodbfindone.go`
- `internal/tools/mongodb/mongodbaggregate/mongodbaggregate.go`
- `internal/tools/mongodb/mongodbinsertone/mongodbinsertone.go`
- `internal/tools/mongodb/mongodbinsertmany/mongodbinsertmany.go`
- `internal/tools/mongodb/mongodbupdateone/mongodbupdateone.go`
- `internal/tools/mongodb/mongodbupdatemany/mongodbupdatemany.go`
- `internal/tools/mongodb/mongodbdeleteone/mongodbdeleteone.go`
- `internal/tools/mongodb/mongodbdeletemany/mongodbdeletemany.go`

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: triepod-ai <199543909+triepod-ai@users.noreply.github.com>
Co-authored-by: bryankthompson <199543909+bryankthompson@users.noreply.github.com>
Co-authored-by: Wenxin Du <117315983+duwenxin99@users.noreply.github.com>
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [actions/setup-go](https://github.com/actions/setup-go) |
action | minor | `v6.2.0` → `v6.3.0` |
|
[lycheeverse/lychee-action](https://github.com/lycheeverse/lychee-action)
([changelog](https://github.com/lycheeverse/lychee-action/compare/a8c4c7cb88f0c7386610c35eb25108e448569cb0..8646ba30535128ac92d33dfc9133794bfdd9b411))
| action | digest | `a8c4c7c` → `8646ba3` |

---

### Release Notes

<details>
<summary>actions/setup-go (actions/setup-go)</summary>

###
[`v6.3.0`](https://github.com/actions/setup-go/compare/v6.2.0...v6.3.0)

[Compare
Source](https://github.com/actions/setup-go/compare/v6.2.0...v6.3.0)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/googleapis/genai-toolbox).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4zMi4wIiwidXBkYXRlZEluVmVyIjoiNDMuNDMuMiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->

Co-authored-by: Wenxin Du <117315983+duwenxin99@users.noreply.github.com>
Co-authored-by: Averi Kitsch <akitsch@google.com>
…2628)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [actions/setup-node](https://github.com/actions/setup-node)
([changelog](https://github.com/actions/setup-node/compare/6044e13b5dc448c55e2357c09f80417699197238..53b83947a5a98c8d113130e565377fae1a50d02f))
| action | digest | `6044e13` → `53b8394` |

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/googleapis/genai-toolbox).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My40OC4xIiwidXBkYXRlZEluVmVyIjoiNDMuNDguMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->
…ted/quickstart/js/adk (googleapis#2630)

Bumps [hono](https://github.com/honojs/hono) from 4.12.2 to 4.12.5.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/hono/releases">hono's
releases</a>.</em></p>
<blockquote>
<h2>v4.12.5</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(request): return <code>string | undefined</code> from param()
when path type is any by <a
href="https://github.com/andrewdamelio"><code>@​andrewdamelio</code></a>
in <a
href="https://github.com/honojs/hono/pull/4723">honojs/hono#4723</a></li>
<li>fix(jwt): validate token format in decode and decodeHeader functions
by <a
href="https://github.com/otoneko1102"><code>@​otoneko1102</code></a> in
<a
href="https://github.com/honojs/hono/pull/4752">honojs/hono#4752</a></li>
<li>fix(jsx): Fix &quot;Invalid state: Controller is already
closed&quot; by <a
href="https://github.com/gaearon"><code>@​gaearon</code></a> in <a
href="https://github.com/honojs/hono/pull/4770">honojs/hono#4770</a></li>
<li>chore(eslint): upgrade <code>@hono/eslint-config</code> by <a
href="https://github.com/BarryThePenguin"><code>@​BarryThePenguin</code></a>
in <a
href="https://github.com/honojs/hono/pull/4781">honojs/hono#4781</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/andrewdamelio"><code>@​andrewdamelio</code></a>
made their first contribution in <a
href="https://github.com/honojs/hono/pull/4723">honojs/hono#4723</a></li>
<li><a
href="https://github.com/otoneko1102"><code>@​otoneko1102</code></a>
made their first contribution in <a
href="https://github.com/honojs/hono/pull/4752">honojs/hono#4752</a></li>
<li><a href="https://github.com/gaearon"><code>@​gaearon</code></a> made
their first contribution in <a
href="https://github.com/honojs/hono/pull/4770">honojs/hono#4770</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/hono/compare/v4.12.4...v4.12.5">https://github.com/honojs/hono/compare/v4.12.4...v4.12.5</a></p>
<h2>v4.12.4</h2>
<h2>Security fixes</h2>
<p>This release includes fixes for the following security issues:</p>
<h3>SSE Control Field Injection</h3>
<p>Affects: <code>streamSSE()</code> in Streaming Helper. Fixes
injection of unintended SSE fields by rejecting CR/LF characters in
<code>event</code>, <code>id</code>, and <code>retry</code>. <a
href="https://github.com/honojs/hono/security/advisories/GHSA-p6xx-57qc-3wxr">https://github.com/honojs/hono/security/advisories/GHSA-p6xx-57qc-3wxr</a></p>
<h3>Cookie Attribute Injection in <code>setCookie()</code></h3>
<p>Affects: <code>setCookie()</code> from <code>hono/cookie</code>.
Fixes cookie attribute manipulation by rejecting <code>;</code>,
<code>\r</code>, and <code>\n</code> in <code>domain</code> and
<code>path</code> options. <a
href="https://github.com/honojs/hono/security/advisories/GHSA-5pq2-9x2x-5p6w">https://github.com/honojs/hono/security/advisories/GHSA-5pq2-9x2x-5p6w</a></p>
<h3>Middleware Bypass in Serve Static</h3>
<p>Affects: Serve Static middleware. Fixes inconsistent URL decoding
that could allow protected static resources to be accessed without
triggering route-based middleware. <a
href="https://github.com/honojs/hono/security/advisories/GHSA-q5qw-h33p-qvwr">https://github.com/honojs/hono/security/advisories/GHSA-q5qw-h33p-qvwr</a></p>
<p>Users who uses Strreaming Helper, Cookie utility, and Serve Static
are strongly encouraged to upgrade to this version.</p>
<hr />
<h2>Other changes</h2>
<ul>
<li>fix(client): preserve route schema in ApplyGlobalResponse by <a
href="https://github.com/agumy"><code>@​agumy</code></a> in <a
href="https://github.com/honojs/hono/pull/4777">honojs/hono#4777</a></li>
<li>fix(utils/url): specify the return type of <code>tryDecodeURI</code>
by <a href="https://github.com/yusukebe"><code>@​yusukebe</code></a> in
<a
href="https://github.com/honojs/hono/pull/4779">honojs/hono#4779</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/agumy"><code>@​agumy</code></a> made
their first contribution in <a
href="https://github.com/honojs/hono/pull/4777">honojs/hono#4777</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/hono/compare/v4.12.3...v4.12.4">https://github.com/honojs/hono/compare/v4.12.3...v4.12.4</a></p>
<h2>v4.12.3</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(validator): prevent type diff bug in form data parsing by <a
href="https://github.com/EdamAme-x"><code>@​EdamAme-x</code></a> in <a
href="https://github.com/honojs/hono/pull/4753">honojs/hono#4753</a></li>
<li>fix(jwt): use <code>Math.floor</code> instead of bitwise OR for safe
timestamp by <a
href="https://github.com/EdamAme-x"><code>@​EdamAme-x</code></a> in <a
href="https://github.com/honojs/hono/pull/4754">honojs/hono#4754</a></li>
<li>fix(jwt): fix <code>JwtVariables</code> for
<code>ContextVariableMap</code> by <a
href="https://github.com/yusukebe"><code>@​yusukebe</code></a> in <a
href="https://github.com/honojs/hono/pull/4764">honojs/hono#4764</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/honojs/hono/commit/18cc595fc2a6a24c919bda8d733e7f95460eef4f"><code>18cc595</code></a>
4.12.5</li>
<li><a
href="https://github.com/honojs/hono/commit/5d59ac770b8adb10dc7b1b45be748dc4931fb3ca"><code>5d59ac7</code></a>
chore(eslint): upgrade <code>@hono/eslint-config</code> (<a
href="https://github.com/honojs/hono/issues/4781">#4781</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/b8cff189051d408c8c4cf57d24ca82ec8712e73d"><code>b8cff18</code></a>
fix(jsx): Fix &quot;Invalid state: Controller is already closed&quot;
(<a
href="https://github.com/honojs/hono/issues/4770">#4770</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/8c4d7f3d2feea19c726bcaf3b7d01b62215eae8b"><code>8c4d7f3</code></a>
fix(jwt): validate token format in decode and decodeHeader functions (<a
href="https://github.com/honojs/hono/issues/4752">#4752</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/0f499152ee20daf4f394d1f0ef5cc700ce7e2735"><code>0f49915</code></a>
fix(request): return <code>string | undefined</code> from param() when
path type is any ...</li>
<li><a
href="https://github.com/honojs/hono/commit/19d20d23a2921e26c3bbfdb5549fce98b4a39b28"><code>19d20d2</code></a>
4.12.4</li>
<li><a
href="https://github.com/honojs/hono/commit/44ae0c8cc4d5ab2bed529127a4ac72e1483ad073"><code>44ae0c8</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/hono/commit/f4123ed9ea3c7c52380cc99a079a4d773838846e"><code>f4123ed</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/hono/commit/80a9837904c346f264b57dbfd22822a46cc24b08"><code>80a9837</code></a>
fix(utils/url): specify the return type of <code>tryDecodeURI</code> (<a
href="https://github.com/honojs/hono/issues/4779">#4779</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/6a0607a929d888893f0c91d92dce2fcfdb3662a3"><code>6a0607a</code></a>
Merge commit from fork</li>
<li>Additional commits viewable in <a
href="https://github.com/honojs/hono/compare/v4.12.2...v4.12.5">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=hono&package-manager=npm_and_yarn&previous-version=4.12.2&new-version=4.12.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/googleapis/genai-toolbox/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Twisha Bansal <58483338+twishabansal@users.noreply.github.com>
…n/samples/pre_post_processing/js/adk (googleapis#2633)

Bumps [@hono/node-server](https://github.com/honojs/node-server) from
1.19.9 to 1.19.10.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/node-server/releases"><code>@​hono/node-server</code>'s
releases</a>.</em></p>
<blockquote>
<h2>v1.19.10</h2>
<h2>Security Fix</h2>
<p>Fixed an authorization bypass in Serve Static Middleware caused by
inconsistent URL decoding (<code>%2F</code> handling) between the router
and static file resolution. Users of Serve Static Middleware are
encouraged to upgrade to this version.</p>
<p>See GHSA-wc8c-qw6v-h7f6 for details.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/honojs/node-server/commit/2f8ca3665f5257305603783ec9999bd1a9bec0f2"><code>2f8ca36</code></a>
1.19.10</li>
<li><a
href="https://github.com/honojs/node-server/commit/455015be1697dd89974a68b70350ea7b2d126d2e"><code>455015b</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/node-server/commit/cc05c48d8eb34007d5d5ff3861ea554721387041"><code>cc05c48</code></a>
chore: add benchmark for comparing with npm and local (dev) (<a
href="https://github.com/honojs/node-server/issues/305">#305</a>)</li>
<li><a
href="https://github.com/honojs/node-server/commit/58c44121523b418578be5bd911f2b67d8ef73ceb"><code>58c4412</code></a>
chore: Adding LICENSE file with MIT license referenced in README.md (<a
href="https://github.com/honojs/node-server/issues/297">#297</a>)</li>
<li><a
href="https://github.com/honojs/node-server/commit/b1daa4cfb30ea58a926f3befed2fb883ae2fd9df"><code>b1daa4c</code></a>
docs(readme): add <a
href="https://github.com/usualoma"><code>@​usualoma</code></a> as an
author (<a
href="https://github.com/honojs/node-server/issues/300">#300</a>)</li>
<li>See full diff in <a
href="https://github.com/honojs/node-server/compare/v1.19.9...v1.19.10">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@hono/node-server&package-manager=npm_and_yarn&previous-version=1.19.9&new-version=1.19.10)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/googleapis/genai-toolbox/network/alerts).

</details>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Twisha Bansal <58483338+twishabansal@users.noreply.github.com>
Co-authored-by: Twisha Bansal <twishabansal07@gmail.com>
…n/getting-started/quickstart/js/adk (googleapis#2631)

Bumps [@hono/node-server](https://github.com/honojs/node-server) from
1.19.9 to 1.19.10.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/node-server/releases"><code>@​hono/node-server</code>'s
releases</a>.</em></p>
<blockquote>
<h2>v1.19.10</h2>
<h2>Security Fix</h2>
<p>Fixed an authorization bypass in Serve Static Middleware caused by
inconsistent URL decoding (<code>%2F</code> handling) between the router
and static file resolution. Users of Serve Static Middleware are
encouraged to upgrade to this version.</p>
<p>See GHSA-wc8c-qw6v-h7f6 for details.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/honojs/node-server/commit/2f8ca3665f5257305603783ec9999bd1a9bec0f2"><code>2f8ca36</code></a>
1.19.10</li>
<li><a
href="https://github.com/honojs/node-server/commit/455015be1697dd89974a68b70350ea7b2d126d2e"><code>455015b</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/node-server/commit/cc05c48d8eb34007d5d5ff3861ea554721387041"><code>cc05c48</code></a>
chore: add benchmark for comparing with npm and local (dev) (<a
href="https://github.com/honojs/node-server/issues/305">#305</a>)</li>
<li><a
href="https://github.com/honojs/node-server/commit/58c44121523b418578be5bd911f2b67d8ef73ceb"><code>58c4412</code></a>
chore: Adding LICENSE file with MIT license referenced in README.md (<a
href="https://github.com/honojs/node-server/issues/297">#297</a>)</li>
<li><a
href="https://github.com/honojs/node-server/commit/b1daa4cfb30ea58a926f3befed2fb883ae2fd9df"><code>b1daa4c</code></a>
docs(readme): add <a
href="https://github.com/usualoma"><code>@​usualoma</code></a> as an
author (<a
href="https://github.com/honojs/node-server/issues/300">#300</a>)</li>
<li>See full diff in <a
href="https://github.com/honojs/node-server/compare/v1.19.9...v1.19.10">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@hono/node-server&package-manager=npm_and_yarn&previous-version=1.19.9&new-version=1.19.10)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/googleapis/genai-toolbox/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Twisha Bansal <58483338+twishabansal@users.noreply.github.com>
…post_processing/js/adk (googleapis#2632)

Bumps [hono](https://github.com/honojs/hono) from 4.12.2 to 4.12.5.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/hono/releases">hono's
releases</a>.</em></p>
<blockquote>
<h2>v4.12.5</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(request): return <code>string | undefined</code> from param()
when path type is any by <a
href="https://github.com/andrewdamelio"><code>@​andrewdamelio</code></a>
in <a
href="https://github.com/honojs/hono/pull/4723">honojs/hono#4723</a></li>
<li>fix(jwt): validate token format in decode and decodeHeader functions
by <a
href="https://github.com/otoneko1102"><code>@​otoneko1102</code></a> in
<a
href="https://github.com/honojs/hono/pull/4752">honojs/hono#4752</a></li>
<li>fix(jsx): Fix &quot;Invalid state: Controller is already
closed&quot; by <a
href="https://github.com/gaearon"><code>@​gaearon</code></a> in <a
href="https://github.com/honojs/hono/pull/4770">honojs/hono#4770</a></li>
<li>chore(eslint): upgrade <code>@hono/eslint-config</code> by <a
href="https://github.com/BarryThePenguin"><code>@​BarryThePenguin</code></a>
in <a
href="https://github.com/honojs/hono/pull/4781">honojs/hono#4781</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/andrewdamelio"><code>@​andrewdamelio</code></a>
made their first contribution in <a
href="https://github.com/honojs/hono/pull/4723">honojs/hono#4723</a></li>
<li><a
href="https://github.com/otoneko1102"><code>@​otoneko1102</code></a>
made their first contribution in <a
href="https://github.com/honojs/hono/pull/4752">honojs/hono#4752</a></li>
<li><a href="https://github.com/gaearon"><code>@​gaearon</code></a> made
their first contribution in <a
href="https://github.com/honojs/hono/pull/4770">honojs/hono#4770</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/hono/compare/v4.12.4...v4.12.5">https://github.com/honojs/hono/compare/v4.12.4...v4.12.5</a></p>
<h2>v4.12.4</h2>
<h2>Security fixes</h2>
<p>This release includes fixes for the following security issues:</p>
<h3>SSE Control Field Injection</h3>
<p>Affects: <code>streamSSE()</code> in Streaming Helper. Fixes
injection of unintended SSE fields by rejecting CR/LF characters in
<code>event</code>, <code>id</code>, and <code>retry</code>. <a
href="https://github.com/honojs/hono/security/advisories/GHSA-p6xx-57qc-3wxr">https://github.com/honojs/hono/security/advisories/GHSA-p6xx-57qc-3wxr</a></p>
<h3>Cookie Attribute Injection in <code>setCookie()</code></h3>
<p>Affects: <code>setCookie()</code> from <code>hono/cookie</code>.
Fixes cookie attribute manipulation by rejecting <code>;</code>,
<code>\r</code>, and <code>\n</code> in <code>domain</code> and
<code>path</code> options. <a
href="https://github.com/honojs/hono/security/advisories/GHSA-5pq2-9x2x-5p6w">https://github.com/honojs/hono/security/advisories/GHSA-5pq2-9x2x-5p6w</a></p>
<h3>Middleware Bypass in Serve Static</h3>
<p>Affects: Serve Static middleware. Fixes inconsistent URL decoding
that could allow protected static resources to be accessed without
triggering route-based middleware. <a
href="https://github.com/honojs/hono/security/advisories/GHSA-q5qw-h33p-qvwr">https://github.com/honojs/hono/security/advisories/GHSA-q5qw-h33p-qvwr</a></p>
<p>Users who uses Strreaming Helper, Cookie utility, and Serve Static
are strongly encouraged to upgrade to this version.</p>
<hr />
<h2>Other changes</h2>
<ul>
<li>fix(client): preserve route schema in ApplyGlobalResponse by <a
href="https://github.com/agumy"><code>@​agumy</code></a> in <a
href="https://github.com/honojs/hono/pull/4777">honojs/hono#4777</a></li>
<li>fix(utils/url): specify the return type of <code>tryDecodeURI</code>
by <a href="https://github.com/yusukebe"><code>@​yusukebe</code></a> in
<a
href="https://github.com/honojs/hono/pull/4779">honojs/hono#4779</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/agumy"><code>@​agumy</code></a> made
their first contribution in <a
href="https://github.com/honojs/hono/pull/4777">honojs/hono#4777</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/hono/compare/v4.12.3...v4.12.4">https://github.com/honojs/hono/compare/v4.12.3...v4.12.4</a></p>
<h2>v4.12.3</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(validator): prevent type diff bug in form data parsing by <a
href="https://github.com/EdamAme-x"><code>@​EdamAme-x</code></a> in <a
href="https://github.com/honojs/hono/pull/4753">honojs/hono#4753</a></li>
<li>fix(jwt): use <code>Math.floor</code> instead of bitwise OR for safe
timestamp by <a
href="https://github.com/EdamAme-x"><code>@​EdamAme-x</code></a> in <a
href="https://github.com/honojs/hono/pull/4754">honojs/hono#4754</a></li>
<li>fix(jwt): fix <code>JwtVariables</code> for
<code>ContextVariableMap</code> by <a
href="https://github.com/yusukebe"><code>@​yusukebe</code></a> in <a
href="https://github.com/honojs/hono/pull/4764">honojs/hono#4764</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/honojs/hono/commit/18cc595fc2a6a24c919bda8d733e7f95460eef4f"><code>18cc595</code></a>
4.12.5</li>
<li><a
href="https://github.com/honojs/hono/commit/5d59ac770b8adb10dc7b1b45be748dc4931fb3ca"><code>5d59ac7</code></a>
chore(eslint): upgrade <code>@hono/eslint-config</code> (<a
href="https://github.com/honojs/hono/issues/4781">#4781</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/b8cff189051d408c8c4cf57d24ca82ec8712e73d"><code>b8cff18</code></a>
fix(jsx): Fix &quot;Invalid state: Controller is already closed&quot;
(<a
href="https://github.com/honojs/hono/issues/4770">#4770</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/8c4d7f3d2feea19c726bcaf3b7d01b62215eae8b"><code>8c4d7f3</code></a>
fix(jwt): validate token format in decode and decodeHeader functions (<a
href="https://github.com/honojs/hono/issues/4752">#4752</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/0f499152ee20daf4f394d1f0ef5cc700ce7e2735"><code>0f49915</code></a>
fix(request): return <code>string | undefined</code> from param() when
path type is any ...</li>
<li><a
href="https://github.com/honojs/hono/commit/19d20d23a2921e26c3bbfdb5549fce98b4a39b28"><code>19d20d2</code></a>
4.12.4</li>
<li><a
href="https://github.com/honojs/hono/commit/44ae0c8cc4d5ab2bed529127a4ac72e1483ad073"><code>44ae0c8</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/hono/commit/f4123ed9ea3c7c52380cc99a079a4d773838846e"><code>f4123ed</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/hono/commit/80a9837904c346f264b57dbfd22822a46cc24b08"><code>80a9837</code></a>
fix(utils/url): specify the return type of <code>tryDecodeURI</code> (<a
href="https://github.com/honojs/hono/issues/4779">#4779</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/6a0607a929d888893f0c91d92dce2fcfdb3662a3"><code>6a0607a</code></a>
Merge commit from fork</li>
<li>Additional commits viewable in <a
href="https://github.com/honojs/hono/compare/v4.12.2...v4.12.5">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=hono&package-manager=npm_and_yarn&previous-version=4.12.2&new-version=4.12.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/googleapis/genai-toolbox/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Twisha Bansal <58483338+twishabansal@users.noreply.github.com>
… signature (googleapis#2627)

## Description

This PR fixes a critical signature mismatch that caused all
`oracle-execute-sql` tool invocations to fail with an incompatible
source type error (`500` Internal Server Error).

In a previous PR
(googleapis#2323), the `RunSQL`
method in the Oracle Source was updated to include a `readOnly` bool
parameter to support DML operations for the `oracle-sql` tool:

However, the `oracle-execute-sql` tool's required interface
(`compatibleSource`) was inadvertently left unchanged, still expecting
the old 3-argument signature. Because Go interfaces are satisfied
implicitly, the updated Oracle source no longer implemented the
`oracle-execute-sql` tool's interface, causing
`tools.GetCompatibleSource` to reject it at runtime during invocation.

🛠️ Fixes googleapis#2614
…getting-started/quickstart/js/adk (googleapis#2657)

Bumps
[express-rate-limit](https://github.com/express-rate-limit/express-rate-limit)
from 8.2.1 to 8.3.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/express-rate-limit/express-rate-limit/releases">express-rate-limit's
releases</a>.</em></p>
<blockquote>
<h2>v8.3.0</h2>
<p>You can view the changelog <a
href="https://express-rate-limit.mintlify.app/reference/changelog">here</a>.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/express-rate-limit/express-rate-limit/commit/9c90752747e169904c44ea1b1bc61a636b9594db"><code>9c90752</code></a>
ci: setup oidc connect with npm for automatatic publish</li>
<li><a
href="https://github.com/express-rate-limit/express-rate-limit/commit/e4477fabff4030274bbad571be8e00d87879a663"><code>e4477fa</code></a>
8.3.0</li>
<li><a
href="https://github.com/express-rate-limit/express-rate-limit/commit/06d73405db2c00b22332c5ac278b6bd1c82ebfbc"><code>06d7340</code></a>
docs: add changelog for 8.3.0</li>
<li><a
href="https://github.com/express-rate-limit/express-rate-limit/commit/14e53888cdfd1b9798faf5b634c4206409e27fc4"><code>14e5388</code></a>
fix: handle ipv4 mapped to ipv6 (GHSA-46wh-pxpv-q5gq)</li>
<li><a
href="https://github.com/express-rate-limit/express-rate-limit/commit/2767a954932d5811a66c786824980b0075d6e27a"><code>2767a95</code></a>
chore(deps-dev): bump the development-dependencies group across 1
directory w...</li>
<li><a
href="https://github.com/express-rate-limit/express-rate-limit/commit/f400c7fdb73c217b791bf0c5da2f51a6cb6fc41b"><code>f400c7f</code></a>
chore(deps-dev): bump the development-dependencies group with 2 updates
(<a
href="https://github.com/express-rate-limit/express-rate-limit/issues/603">#603</a>)</li>
<li><a
href="https://github.com/express-rate-limit/express-rate-limit/commit/4e4884c45b41faf47f342234a44965cd5419eb4a"><code>4e4884c</code></a>
chore(deps-dev): bump the development-dependencies group across 1
directory w...</li>
<li><a
href="https://github.com/express-rate-limit/express-rate-limit/commit/fadbccbf3732ebc9e08056ddbad39530a6391345"><code>fadbccb</code></a>
formatting</li>
<li><a
href="https://github.com/express-rate-limit/express-rate-limit/commit/7b57b955990edbfcbfd28bb0db10510b0a32e947"><code>7b57b95</code></a>
biome migration</li>
<li><a
href="https://github.com/express-rate-limit/express-rate-limit/commit/88a1f7f7912b7883a20facab674d778c7d020fb9"><code>88a1f7f</code></a>
docs: typo fix</li>
<li>Additional commits viewable in <a
href="https://github.com/express-rate-limit/express-rate-limit/compare/v8.2.1...v8.3.0">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~gamemaker1">gamemaker1</a>, a new releaser
for express-rate-limit since your current version.</p>
</details>
<details>
<summary>Attestation changes</summary>
<p>This version has no provenance attestation, while the previous
version (8.2.1) was attested. Review the <a
href="https://www.npmjs.com/package/express-rate-limit?activeTab=versions">package
versions</a> before updating.</p>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=express-rate-limit&package-manager=npm_and_yarn&previous-version=8.2.1&new-version=8.3.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/googleapis/genai-toolbox/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Twisha Bansal <58483338+twishabansal@users.noreply.github.com>
…googleapis#2672)

This PR migrates the CockroachDB integration tests from relying on an
external persistent database instance to using local, ephemeral Docker
containers via `testcontainers-go/modules/cockroachdb`.
It will spin up an isolated `cockroachdb/cockroach:latest-v23.1`
container for each test run.
…oogleapis#2588)

Bumps
[go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go)
from 1.38.0 to 1.40.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md">go.opentelemetry.io/otel/sdk's
changelog</a>.</em></p>
<blockquote>
<h2>[1.40.0/0.62.0/0.16.0] 2026-02-02</h2>
<h3>Added</h3>
<ul>
<li>Add <code>AlwaysRecord</code> sampler in
<code>go.opentelemetry.io/otel/sdk/trace</code>. (<a
href="https://github.com/open-telemetry/opentelemetry-go/issues/7724">#7724</a>)</li>
<li>Add <code>Enabled</code> method to all synchronous instrument
interfaces (<code>Float64Counter</code>,
<code>Float64UpDownCounter</code>, <code>Float64Histogram</code>,
<code>Float64Gauge</code>, <code>Int64Counter</code>,
<code>Int64UpDownCounter</code>, <code>Int64Histogram</code>,
<code>Int64Gauge</code>,) in
<code>go.opentelemetry.io/otel/metric</code>.
This stabilizes the synchronous instrument enabled feature, allowing
users to check if an instrument will process measurements before
performing computationally expensive operations. (<a
href="https://github.com/open-telemetry/opentelemetry-go/issues/7763">#7763</a>)</li>
<li>Add <code>go.opentelemetry.io/otel/semconv/v1.39.0</code> package.
The package contains semantic conventions from the <code>v1.39.0</code>
version of the OpenTelemetry Semantic Conventions.
See the <a
href="https://github.com/open-telemetry/opentelemetry-go/blob/main/semconv/v1.39.0/MIGRATION.md">migration
documentation</a> for information on how to upgrade from
<code>go.opentelemetry.io/otel/semconv/v1.38.0.</code> (<a
href="https://github.com/open-telemetry/opentelemetry-go/issues/7783">#7783</a>,
<a
href="https://github.com/open-telemetry/opentelemetry-go/issues/7789">#7789</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Improve the concurrent performance of
<code>HistogramReservoir</code> in
<code>go.opentelemetry.io/otel/sdk/metric/exemplar</code> by 4x. (<a
href="https://github.com/open-telemetry/opentelemetry-go/issues/7443">#7443</a>)</li>
<li>Improve the concurrent performance of
<code>FixedSizeReservoir</code> in
<code>go.opentelemetry.io/otel/sdk/metric/exemplar</code>. (<a
href="https://github.com/open-telemetry/opentelemetry-go/issues/7447">#7447</a>)</li>
<li>Improve performance of concurrent histogram measurements in
<code>go.opentelemetry.io/otel/sdk/metric</code>. (<a
href="https://github.com/open-telemetry/opentelemetry-go/issues/7474">#7474</a>)</li>
<li>Improve performance of concurrent synchronous gauge measurements in
<code>go.opentelemetry.io/otel/sdk/metric</code>. (<a
href="https://github.com/open-telemetry/opentelemetry-go/issues/7478">#7478</a>)</li>
<li>Add experimental observability metrics in
<code>go.opentelemetry.io/otel/exporters/stdout/stdoutmetric</code>. (<a
href="https://github.com/open-telemetry/opentelemetry-go/issues/7492">#7492</a>)</li>
<li><code>Exporter</code> in
<code>go.opentelemetry.io/otel/exporters/prometheus</code> ignores
metrics with the scope
<code>go.opentelemetry.io/contrib/bridges/prometheus</code>.
This prevents scrape failures when the Prometheus exporter is
misconfigured to get data from the Prometheus bridge. (<a
href="https://github.com/open-telemetry/opentelemetry-go/issues/7688">#7688</a>)</li>
<li>Improve performance of concurrent exponential histogram measurements
in <code>go.opentelemetry.io/otel/sdk/metric</code>. (<a
href="https://github.com/open-telemetry/opentelemetry-go/issues/7702">#7702</a>)</li>
<li>The <code>rpc.grpc.status_code</code> attribute in the experimental
metrics emitted from
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc</code>
is replaced with the <code>rpc.response.status_code</code> attribute to
align with the semantic conventions. (<a
href="https://github.com/open-telemetry/opentelemetry-go/issues/7854">#7854</a>)</li>
<li>The <code>rpc.grpc.status_code</code> attribute in the experimental
metrics emitted from
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>
is replaced with the <code>rpc.response.status_code</code> attribute to
align with the semantic conventions. (<a
href="https://github.com/open-telemetry/opentelemetry-go/issues/7854">#7854</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix bad log message when key-value pairs are dropped because of key
duplication in <code>go.opentelemetry.io/otel/sdk/log</code>. (<a
href="https://github.com/open-telemetry/opentelemetry-go/issues/7662">#7662</a>)</li>
<li>Fix <code>DroppedAttributes</code> on <code>Record</code> in
<code>go.opentelemetry.io/otel/sdk/log</code> to not count the
non-attribute key-value pairs dropped because of key duplication. (<a
href="https://github.com/open-telemetry/opentelemetry-go/issues/7662">#7662</a>)</li>
<li>Fix <code>SetAttributes</code> on <code>Record</code> in
<code>go.opentelemetry.io/otel/sdk/log</code> to not log that attributes
are dropped when they are actually not dropped. (<a
href="https://github.com/open-telemetry/opentelemetry-go/issues/7662">#7662</a>)</li>
<li>Fix missing <code>request.GetBody</code> in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp</code>
to correctly handle HTTP/2 <code>GOAWAY</code> frame. (<a
href="https://github.com/open-telemetry/opentelemetry-go/issues/7794">#7794</a>)</li>
<li><code>WithHostID</code> detector in
<code>go.opentelemetry.io/otel/sdk/resource</code> to use full path for
<code>ioreg</code> command on Darwin (macOS). (<a
href="https://github.com/open-telemetry/opentelemetry-go/issues/7818">#7818</a>)</li>
</ul>
<h3>Deprecated</h3>
<ul>
<li>Deprecate <code>go.opentelemetry.io/otel/exporters/zipkin</code>.
For more information, see the <a
href="https://opentelemetry.io/blog/2025/deprecating-zipkin-exporters/">OTel
blog post deprecating the Zipkin exporter</a>. (<a
href="https://github.com/open-telemetry/opentelemetry-go/issues/7670">#7670</a>)</li>
</ul>
<h2>[1.39.0/0.61.0/0.15.0/0.0.14] 2025-12-05</h2>
<h3>Added</h3>
<ul>
<li>Greatly reduce the cost of recording metrics in
<code>go.opentelemetry.io/otel/sdk/metric</code> using hashing for map
keys. (<a
href="https://github.com/open-telemetry/opentelemetry-go/issues/7175">#7175</a>)</li>
<li>Add <code>WithInstrumentationAttributeSet</code> option to
<code>go.opentelemetry.io/otel/log</code>,
<code>go.opentelemetry.io/otel/metric</code>, and
<code>go.opentelemetry.io/otel/trace</code> packages.
This provides a concurrent-safe and performant alternative to
<code>WithInstrumentationAttributes</code> by accepting a
pre-constructed <code>attribute.Set</code>. (<a
href="https://github.com/open-telemetry/opentelemetry-go/issues/7287">#7287</a>)</li>
<li>Add experimental observability for the Prometheus exporter in
<code>go.opentelemetry.io/otel/exporters/prometheus</code>.
Check the
<code>go.opentelemetry.io/otel/exporters/prometheus/internal/x</code>
package documentation for more information. (<a
href="https://github.com/open-telemetry/opentelemetry-go/issues/7345">#7345</a>)</li>
<li>Add experimental observability metrics in
<code>go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc</code>.
(<a
href="https://github.com/open-telemetry/opentelemetry-go/issues/7353">#7353</a>)</li>
<li>Add temporality selector functions
<code>DeltaTemporalitySelector</code>,
<code>CumulativeTemporalitySelector</code>,
<code>LowMemoryTemporalitySelector</code> to
<code>go.opentelemetry.io/otel/sdk/metric</code>. (<a
href="https://github.com/open-telemetry/opentelemetry-go/issues/7434">#7434</a>)</li>
<li>Add experimental observability metrics for simple log processor in
<code>go.opentelemetry.io/otel/sdk/log</code>. (<a
href="https://github.com/open-telemetry/opentelemetry-go/issues/7548">#7548</a>)</li>
<li>Add experimental observability metrics in
<code>go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc</code>.
(<a
href="https://github.com/open-telemetry/opentelemetry-go/issues/7459">#7459</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go/commit/a3a5317c5caed1656fb5b301b66dfeb3c4c944e0"><code>a3a5317</code></a>
Release v1.40.0 (<a
href="https://github.com/open-telemetry/opentelemetry-go/issues/7859">#7859</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go/commit/77785da545d67b38774891cbdd334368bfacdfd8"><code>77785da</code></a>
chore(deps): update github/codeql-action action to v4.32.1 (<a
href="https://github.com/open-telemetry/opentelemetry-go/issues/7858">#7858</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go/commit/56fa1c297bf71f0ada3dbf4574a45d0607812cc0"><code>56fa1c2</code></a>
chore(deps): update module github.com/clipperhouse/uax29/v2 to v2.5.0
(<a
href="https://github.com/open-telemetry/opentelemetry-go/issues/7857">#7857</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go/commit/298cbedf256b7a9ab3c21e41fc5e3e6d6e4e94aa"><code>298cbed</code></a>
Upgrade semconv use to v1.39.0 (<a
href="https://github.com/open-telemetry/opentelemetry-go/issues/7854">#7854</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go/commit/3264bf171b1e6cd70f6be4a483f2bcb84eda6ccf"><code>3264bf1</code></a>
refactor: modernize code (<a
href="https://github.com/open-telemetry/opentelemetry-go/issues/7850">#7850</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go/commit/fd5d030c0aa8b5bfe786299047bc914b5714d642"><code>fd5d030</code></a>
chore(deps): update module github.com/grpc-ecosystem/grpc-gateway/v2 to
v2.27...</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go/commit/8d3b4cb2501dec9f1c5373123e425f109c43b8d2"><code>8d3b4cb</code></a>
chore(deps): update actions/cache action to v5.0.3 (<a
href="https://github.com/open-telemetry/opentelemetry-go/issues/7847">#7847</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go/commit/91f7cadfcac363d67030f6913687c6dbbe086823"><code>91f7cad</code></a>
chore(deps): update github.com/timakin/bodyclose digest to 73d1f95 (<a
href="https://github.com/open-telemetry/opentelemetry-go/issues/7845">#7845</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go/commit/fdad1eb7f350ee1f5fdb3d9a0c6855cc88ee9d75"><code>fdad1eb</code></a>
chore(deps): update module github.com/grpc-ecosystem/grpc-gateway/v2 to
v2.27...</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-go/commit/c46d3bac181ddaaa83286e9ccf2cd9f7705fd3d9"><code>c46d3ba</code></a>
chore(deps): update golang.org/x/telemetry digest to fcf36f6 (<a
href="https://github.com/open-telemetry/opentelemetry-go/issues/7843">#7843</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-go/compare/v1.38.0...v1.40.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=go.opentelemetry.io/otel/sdk&package-manager=go_modules&previous-version=1.38.0&new-version=1.40.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/googleapis/genai-toolbox/network/alerts).

</details>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Averi Kitsch <akitsch@google.com>
Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com>
Co-authored-by: Yuan Teoh <yuanteoh@google.com>
…oogleapis#2554)

## Description

Updated `toolset.name` attribute uniformly across metrics and spans.
Also, updated `session_id` to `mcp.session.id` attribute - as in the
semantic convention

## PR Checklist

> Thank you for opening a Pull Request! Before submitting your PR, there
are a
> few things you can do to make sure it goes smoothly:

- [x] Make sure you reviewed

[CONTRIBUTING.md](https://github.com/googleapis/genai-toolbox/blob/main/CONTRIBUTING.md)
- [x] Make sure to open an issue as a

[bug/issue](https://github.com/googleapis/genai-toolbox/issues/new/choose)
  before writing your code! That way we can discuss the change, evaluate
  designs, and agree on the general idea
- [x] Ensure the tests and linter pass
- [x] Code coverage does not decrease (if any source code was changed)
- [ ] Appropriate docs were updated (if necessary)
- [ ] Make sure to add `!` if this involve a breaking change

🛠️ Fixes googleapis#2222

Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com>
This PR refactors the tool file parsing logic by introducing a new
ToolsFileParser struct. This encapsulation allows for stateful parsing,
specifically enabling the tracking of resolved environment variables
during configuration loading. This is useful for skill generation, where
we can now identify and omit default values that correspond to
environment variables, ensuring more precise generated skill.
This PR refactors and improves the skill generation logic to make it
more configurable and also simplifies the generated skill.

- Shift from generating individual tool-specific YAML files to a more
centralized configuration approach using global toolbox flags.
- Add support for --license-header to prepend license information to
generated Node.js scripts.
- Refactored tool parameter documentation from a JSON schema format to a
more readable Markdown table.
- Update tool invocation log level to avoid unnecessary outputs.
- Make generated skill to be compatible with Gemini CLI's env variable.
Fixed broken links

---------

Co-authored-by: Twisha Bansal <58483338+twishabansal@users.noreply.github.com>
@google-cla
Copy link
Copy Markdown

google-cla bot commented Mar 10, 2026

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

@gemini-code-assist
Copy link
Copy Markdown
Contributor

Summary of Changes

Hello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces significant enhancements to the tool configuration and skill generation processes, alongside expanding Serverless Spark capabilities with new session management tools. It also includes various CI/CD improvements, dependency updates, and testing infrastructure refinements to improve stability and maintainability.

Highlights

  • CI/CD Configuration Updates: Modified integration.cloudbuild.yaml to gracefully handle BigQuery and Spanner integration test failures and removed unused environment variables for Healthcare and CockroachDB. The test_with_coverage.sh script was updated to support extra test arguments.
  • Enhanced Skill Generation: Refactored skill generation logic to improve flexibility in loading tool configurations (e.g., from files, folders, or prebuilt configs) and added support for custom license headers in generated Node.js scripts. The SKILL.md output now uses a Markdown table for parameters instead of JSON schema.
  • New Serverless Spark Session Tools: Introduced serverlesssparkgetsession and serverlesssparklistsessions tools, along with their respective documentation and prebuilt configurations, expanding Serverless Spark management capabilities.
  • Tool Annotation Support: Added ToolAnnotations to all MongoDB tools (aggregate, deleteMany, deleteOne, find, findOne, insertMany, insertOne, updateMany, updateOne) to provide semantic metadata like readOnlyHint and destructiveHint.
  • Oracle SQL ReadOnly Flag: Implemented a readOnly flag for the oracle-execute-sql tool to control SQL execution behavior, allowing explicit declaration of read-only operations.
  • Version Bump and Dependency Updates: Updated the project version from 0.27.0 to 0.28.0 across various configuration and documentation files. Go module dependencies, including OpenTelemetry and filippo.io/edwards25519, were updated, and testcontainers-go/modules/cockroachdb was added.
  • Improved Testing Infrastructure: Migrated CockroachDB integration tests to use testcontainers-go for better isolation, adjusted Healthcare DICOM store tests to use dynamically uploaded data, and added a cleanup mechanism for old Postgres test schemas.
Changelog
  • Bug Fixes
    • ci: Add path for forked PR unit test runs (#2540) (04dd2a7)
    • Deflake alloydb omni (#2431)
    • docs/adk: Resolve dependency duplication (#2418) (4d44abb)
    • docs/langchain: Fix core at 0.3.0 and align compatible dependencies (#2426) (36edfd3)
    • Enforce required validation for explicit null parameter values (#2519) (d5e9512)
    • oracle: Enable DML operations and resolve incorrect array type error (#2323) (72146a4)
    • server/mcp: Guard nil dereference in sseManager.get (#2557) (e534196), closes #2548
    • tests/postgres: Implement uuid-based isolation and reliable resource cleanup (#2377) (8a96fb1)
    • tests/postgres: Restore list_schemas test and implement dynamic owner (#2521) (7041e79)
    • tests: Resolve LlamaIndex dependency conflict in JS quickstart (#2597) (ac11f5a)
Ignored Files
  • Ignored by pattern: .github/workflows/** (7)
    • .github/workflows/deploy_dev_docs.yaml
    • .github/workflows/deploy_previous_version_docs.yaml
    • .github/workflows/deploy_versioned_docs.yaml
    • .github/workflows/docs_preview_deploy.yaml
    • .github/workflows/link_checker.yaml
    • .github/workflows/lint.yaml
    • .github/workflows/tests.yaml
  • Ignored by pattern: go.sum (1)
    • go.sum
Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution.

Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces a wide range of changes, including new features, significant refactoring, and various fixes. Key additions include the skills-generate command for creating agent skills, support for tool annotations to provide semantic metadata, and new Serverless Spark tools for session management. The PR also refactors the configuration file parsing into a dedicated ToolsFileParser and improves test reliability by using testcontainers for CockroachDB and making other tests self-contained.

My review focuses on the new skills-generate feature, where I've identified a potential regression in how the toolbox binary is located. I've provided a suggestion to address this. The other changes, such as using errors.Join for resource cleanup and updating telemetry attributes, are positive improvements that align with best practices.

Note: Security Review did not run due to the size of the PR.

Comment on lines 126 to 143
function getToolboxPath() {
if (process.env.GEMINI_CLI === '1') {
const localPath = path.resolve(__dirname, '../../../toolbox');
if (fs.existsSync(localPath)) {
return localPath;
}
}
try {
const checkCommand = process.platform === 'win32' ? 'where toolbox' : 'which toolbox';
const globalPath = execSync(checkCommand, { stdio: 'pipe', encoding: 'utf-8' }).trim();
if (globalPath) {
return globalPath.split('\n')[0].trim();
}
throw new Error("Toolbox binary not found");
} catch (e) {
// Ignore error;
}
const localPath = path.resolve(__dirname, '../../../toolbox');
if (fs.existsSync(localPath)) {
return localPath;
throw new Error("Toolbox binary not found");
}
throw new Error("Toolbox binary not found");
}
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The updated getToolboxPath function in the Node.js script template has a potential regression. It no longer attempts to find the toolbox binary in a local path (../../../toolbox) as a fallback if it's not found in the system's PATH (unless the GEMINI_CLI environment variable is set). The previous implementation handled this fallback gracefully.

This change could cause the generated skill scripts to fail in environments where toolbox is not in the PATH but is available locally relative to the project, which was a supported scenario.

I suggest restoring the fallback behavior to ensure the script is more robust.

function getToolboxPath() {
    if (process.env.GEMINI_CLI === '1') {
        const localPath = path.resolve(__dirname, '../../../toolbox');
        if (fs.existsSync(localPath)) {
            return localPath;
        }
    }
    try {
        const checkCommand = process.platform === 'win32' ? 'where toolbox' : 'which toolbox';
        const globalPath = execSync(checkCommand, { stdio: 'pipe', encoding: 'utf-8' }).trim();
        if (globalPath) {
            return globalPath.split('\n')[0].trim();
        }
    } catch (e) {
        // global path not found, fall back to local path
    }
    const localPath = path.resolve(__dirname, '../../../toolbox');
    if (fs.existsSync(localPath)) {
        return localPath;
    }
    throw new Error("Toolbox binary not found in PATH or locally");
}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.