Snyk/apps

2026.08.28.2

Hardened codegen: instance names sanitized against path traversal; 429 rate-limit retry with Retry-After; string schema patterns emit regex validation; output schemas passthrough unknown fields.

2026.08.28.1

Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.

Upgrade note: License text only. No API, schema, or runtime behavior changed.

2026.08.26.2

Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry quality scorer can resolve dependencies and score the extension. An earlier release used a bare "zod" import-map specifier, which published but scored as unscored.

Changed: Retained explicit compilerOptions.strict in deno.json. No behavioral or schema changes.

2026.08.26.2

Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry quality scorer can resolve dependencies and score the extension. An earlier release used a bare "zod" import-map specifier, which published but scored as unscored.

Changed: Retained explicit compilerOptions.strict in deno.json. No behavioral or schema changes.

2026.08.25.1

Changed: Updated labels for improved extension discoverability. Added cross-cutting category labels (security, observability, finops, infrastructure, networking, compliance, devops, ai, incident-response) where applicable.

2026.08.24.1

Added: Output metadata attributes for observability.

• durationMs: Method execution duration in milliseconds.
• collectedBy: Extension name that produced the data.
• fetchedAt: ISO 8601 timestamp when data was fetched (added to resources that previously lacked it).

2026.08.21.2

Changed:

• Snyk API request failures now name the HTTP method and path that was attempted (e.g. Snyk API POST /orgs/{orgId}/apps/creations failed with HTTP 403: ...) instead of just the raw status and body. Network-level failures (DNS, timeout, connection reset) are also caught and re-raised with the same method/path context and the original error preserved as cause, rather than propagating an unlabeled fetch error.
• update_group_app_install_secret, create_manage_app_creation_secret, and update_org_app_install_secret now validate that secret is present when mode is "create" or "replace". Previously an omitted secret in those modes would fail deep inside the Snyk API call with a generic 4xx error instead of a clear local validation message.

Upgrade note: No changes to stored resource schemas. Existing instances need no migration.

2026.08.21.1

Changed: Schema tightening sweep — no behavioral changes.

• Added .min(1) to apiToken, orgId, and the client_id/client_secret pair on create_group_app_install/create_org_app_install resource schemas, matching the same fields elsewhere in this model that already required a non-empty string.
• Added .describe(...) to the previously undocumented org_public_id field (five occurrences) and the secret field used in app-secret rotation payloads.

2026.07.20.1

Fixed: Group-scoped methods (paths under /groups/{group_id}/...) dropped their group_id path parameter. The generated code referenced args.group_id, but the argument was never declared or forwarded, so requests went to /groups/undefined/... and returned HTTP 404. These methods now declare and forward group_id correctly.

Upgrade note: Group-scoped methods now take a required group_id argument. Calls that previously failed with a 404 succeed once group_id is supplied.

2026.07.19.1

Added: Initial code-generated release of @webframp/snyk/apps with 14 methods covering the Snyk apps API surface.