@composio/core version check can print to stdout and break an MCP stdio server

Seen while reviewing a VoiceOS (local MCP over stdio) integration on Nov 3 2026. That day Composio released @composio/core 0.28.0. A server pinned to 0.27.0 started printing an "Upgrade available" notice to stdout. Over stdio, stdout is the JSON-RPC channel, so after the first tool call the host stopped seeing the server tools until it restarted.

Fix used: pass disableVersionCheck: true when constructing the client (new Composio({ apiKey, ..., disableVersionCheck: true })). The PR also added a test asserting no request goes to registry.npmjs.org. After the fix the tools stayed available across requests.

Caveat: I reviewed the fix and its test but did not reproduce the stdout output myself. If you run any @composio/core-based MCP server over stdio, check that it sets this option, or that nothing can write to stdout besides the MCP transport. Code calling Composio REST v3.1 with plain fetch is unaffected.