Snyk/apps

2026.10.14.1

Added: The manifest now declares license: Apache-2.0 (SPDX). The registry quality rubric scores a declared license separately from the bundled LICENSE.md.

Upgrade note: Metadata only. No code, schema, or behavioral changes.

2026.10.07.1

Fixed: A request that never answers no longer hangs the method. Each attempt now has a 30-second deadline, and a timeout names the method and path. Rate limiting (HTTP 429) retries up to three times, waits at most 30 seconds between tries, and then reports the rate limit instead of failing with a consumed-body TypeError. An empty 2xx body (202, 204, or an empty 200) no longer fails JSON parsing. A malformed JSON body now reports the HTTP status and the request instead of a bare SyntaxError, and HTTP errors name the request too. Pagination follows a relative next link with or without the /rest prefix, and refuses a next link that leaves the Snyk API origin or the /rest path instead of sending the API token to it. A POST method named with a different verb wrote its result under a resource name the model never declared: update_group_app_install_secret now writes the declared group_app_install_secret resource; update_org_app_install_secret now writes the declared org_app_install_secret resource.

Changed: Response schemas now accept what the API returns. Enumerated response fields accept any value of their type, value constraints (min, max, pattern) are dropped, response properties may be missing or null, and nested objects keep fields the spec does not list, so one unexpected value no longer fails a whole page. Methods that read or create a single resource now fail when the API answers with an empty body where the spec promises content, instead of storing an empty resource. Operations the spec documents as returning no content (204) still succeed. Argument and field descriptions now end at a word boundary. Request arguments are unchanged, except the array-valued query parameters (expand), which now accept a string or a list of strings. A list joins with commas or repeats the key, as the API specifies for that parameter, and a plain string is sent unchanged.

Upgrade note: The loosened response schemas change validation behavior. Stored resources remain valid, and no data migration is needed. Anything that relied on a resource schema to reject an out-of-enum value or a missing field must now check the data itself.

2026.10.07.1

Fixed: A request that never answers no longer hangs the method. Each attempt now has a 30-second deadline, and a timeout names the method and path. Rate limiting (HTTP 429) retries up to three times, waits at most 30 seconds between tries, and then reports the rate limit instead of failing with a consumed-body TypeError. An empty 2xx body (202, 204, or an empty 200) no longer fails JSON parsing. A malformed JSON body now reports the HTTP status and the request instead of a bare SyntaxError, and HTTP errors name the request too. Pagination follows a relative next link with or without the /rest prefix, and refuses a next link that leaves the Snyk API origin or the /rest path instead of sending the API token to it. A POST method named with a different verb wrote its result under a resource name the model never declared: update_group_app_install_secret now writes the declared group_app_install_secret resource; update_org_app_install_secret now writes the declared org_app_install_secret resource.

Changed: Response schemas now accept what the API returns. Enumerated response fields accept any value of their type, value constraints (min, max, pattern) are dropped, response properties may be missing or null, and nested objects keep fields the spec does not list, so one unexpected value no longer fails a whole page. Methods that read or create a single resource now fail when the API answers with an empty body where the spec promises content, instead of storing an empty resource. Operations the spec documents as returning no content (204) still succeed. Argument and field descriptions now end at a word boundary. Request arguments are unchanged, except the array-valued query parameters (expand), which now accept a string or a list of strings. A list joins with commas or repeats the key, as the API specifies for that parameter, and a plain string is sent unchanged.

Upgrade note: The loosened response schemas change validation behavior. Stored resources remain valid, and no data migration is needed. Anything that relied on a resource schema to reject an out-of-enum value or a missing field must now check the data itself.

2026.09.27.1

Added: Initial code-generated release of @webframp/snyk/apps with 14 methods covering the Snyk apps API surface.

2026.09.18.1

Upgrade note: Normalized npm:zod dependency version to 4.6.5 across the repo. No behavioral changes in this extension.

2026.09.15.1

Changed: Bump zod 4.4.3 → 4.6.5

2026.09.08.1

Added: Initial code-generated release of @webframp/snyk/apps with 14 methods covering the Snyk apps API surface.

2026.09.08.1

Added: Initial code-generated release of @webframp/snyk/apps with 14 methods covering the Snyk apps API surface.

2026.08.28.2

Hardened codegen: instance names sanitized against path traversal; 429 rate-limit retry with Retry-After; string schema patterns emit regex validation; output schemas passthrough unknown fields.

2026.08.28.1

Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.

Upgrade note: License text only. No API, schema, or runtime behavior changed.

2026.08.26.2

Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry quality scorer can resolve dependencies and score the extension. An earlier release used a bare "zod" import-map specifier, which published but scored as unscored.

Changed: Retained explicit compilerOptions.strict in deno.json. No behavioral or schema changes.

2026.08.26.2

Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry quality scorer can resolve dependencies and score the extension. An earlier release used a bare "zod" import-map specifier, which published but scored as unscored.

Changed: Retained explicit compilerOptions.strict in deno.json. No behavioral or schema changes.

2026.08.25.1

Changed: Updated labels for improved extension discoverability. Added cross-cutting category labels (security, observability, finops, infrastructure, networking, compliance, devops, ai, incident-response) where applicable.

2026.08.24.1

Added: Output metadata attributes for observability.

• durationMs: Method execution duration in milliseconds.
• collectedBy: Extension name that produced the data.
• fetchedAt: ISO 8601 timestamp when data was fetched (added to resources that previously lacked it).

2026.08.21.2

Changed:

• Snyk API request failures now name the HTTP method and path that was attempted (e.g. Snyk API POST /orgs/{orgId}/apps/creations failed with HTTP 403: ...) instead of just the raw status and body. Network-level failures (DNS, timeout, connection reset) are also caught and re-raised with the same method/path context and the original error preserved as cause, rather than propagating an unlabeled fetch error.
• update_group_app_install_secret, create_manage_app_creation_secret, and update_org_app_install_secret now validate that secret is present when mode is "create" or "replace". Previously an omitted secret in those modes would fail deep inside the Snyk API call with a generic 4xx error instead of a clear local validation message.

Upgrade note: No changes to stored resource schemas. Existing instances need no migration.

2026.08.21.1

Changed: Schema tightening sweep — no behavioral changes.

• Added .min(1) to apiToken, orgId, and the client_id/client_secret pair on create_group_app_install/create_org_app_install resource schemas, matching the same fields elsewhere in this model that already required a non-empty string.
• Added .describe(...) to the previously undocumented org_public_id field (five occurrences) and the secret field used in app-secret rotation payloads.

2026.07.20.1

Fixed: Group-scoped methods (paths under /groups/{group_id}/...) dropped their group_id path parameter. The generated code referenced args.group_id, but the argument was never declared or forwarded, so requests went to /groups/undefined/... and returned HTTP 404. These methods now declare and forward group_id correctly.

Upgrade note: Group-scoped methods now take a required group_id argument. Calls that previously failed with a 404 succeed once group_id is supplied.

2026.07.19.1

Added: Initial code-generated release of @webframp/snyk/apps with 14 methods covering the Snyk apps API surface.