chore(deps): Bump @mastra/core from 1.4.0 to 1.5.0

[dependabot]

Bumps @mastra/core from 1.4.0 to 1.5.0.

Release notes

Sourced from @​mastra/core's releases.

February 19, 2026

Highlights

Core Harness: A Reusable Orchestration Layer for Agent Apps

A new generic Harness in @mastra/core provides a foundation for building agent-powered applications with modes, state management, built-in tools (ask_user, submit_plan), subagent support, Observational Memory integration, model discovery, permission-aware tool approval, and event-driven/thread/heartbeat management.

Workspace Capability Upgrades (Security, Discovery, and Search)

Workspaces gain least-privilege filesystem access via LocalFilesystem.allowedPaths (plus runtime updates with setAllowedPaths()), expanded glob-based configuration for file listing/indexing/skill discovery, and a new regex search tool mastra_workspace_grep to complement semantic search.

Better Tool I/O and Streaming Behavior in the Agent Loop

Tools can now define toModelOutput to transform tool results into model-friendly content while preserving raw outputs in storage, and workspace tools now return raw text (moving structured metadata to data-workspace-metadata stream chunks) to reduce token usage. Streaming reliability also improves (correct chunk types for tool errors, onChunk receives raw Mastra chunks, agent loop continues after tool errors).

Changelog

@​mastra/core@​1.5.0

Minor Changes

• Added allowedPaths option to LocalFilesystem for granting agents access to specific directories outside basePath without disabling containment. (#13054)

  const workspace = new Workspace({
    filesystem: new LocalFilesystem({
      basePath: './workspace',
      allowedPaths: ['/home/user/.config', '/home/user/documents'],
    }),
  });

  Allowed paths can be updated at runtime using setAllowedPaths():

  workspace.filesystem.setAllowedPaths(prev => [...prev, '/home/user/new-dir']);

  This is the recommended approach for least-privilege access — agents can only reach the specific directories you allow, while containment stays enabled for everything else.

• Added generic Harness class for orchestrating agents with modes, state management, built-in tools (ask_user, submit_plan), subagent support, Observational Memory integration, model discovery, and permission-aware tool approval. The Harness provides a reusable foundation for building agent-powered applications with features like thread management, heartbeat monitoring, and event-driven architecture. (#13245)

• Added glob pattern support for workspace configuration. The list_files tool now accepts a pattern parameter for filtering files (e.g., **/*.ts, src/**/*.test.ts). autoIndexPaths accepts glob patterns like ./docs/**/*.md to selectively index files for BM25 search. Skills paths support globs like ./**/skills to discover skill directories at any depth, including dot-directories like .agents/skills. (#13023)

  list_files tool with pattern:

  // Agent can now use glob patterns to filter files
  const result = await workspace.tools.workspace_list_files({
    path: '/',

... (truncated)

Changelog

Sourced from @​mastra/core's changelog.

1.5.0

Minor Changes

• Added allowedPaths option to LocalFilesystem for granting agents access to specific directories outside basePath without disabling containment. (#13054)

  const workspace = new Workspace({
    filesystem: new LocalFilesystem({
      basePath: './workspace',
      allowedPaths: ['/home/user/.config', '/home/user/documents'],
    }),
  });

  Allowed paths can be updated at runtime using setAllowedPaths():

  workspace.filesystem.setAllowedPaths(prev => [...prev, '/home/user/new-dir']);

  This is the recommended approach for least-privilege access — agents can only reach the specific directories you allow, while containment stays enabled for everything else.

• Added generic Harness class to @​mastra/core for orchestrating agents with modes, state management, built-in tools (ask_user, submit_plan), subagent support, Observational Memory integration, model discovery, and permission-aware tool approval. The Harness provides a reusable foundation for building agent-powered applications with features like thread management, heartbeat monitoring, and event-driven architecture. (#13245)

• Added glob pattern support for workspace configuration. The list_files tool now accepts a pattern parameter for filtering files (e.g., **/*.ts, src/**/*.test.ts). autoIndexPaths accepts glob patterns like ./docs/**/*.md to selectively index files for BM25 search. Skills paths support globs like ./**/skills to discover skill directories at any depth, including dot-directories like .agents/skills. (#13023)

  list_files tool with pattern:

  // Agent can now use glob patterns to filter files
  const result = await workspace.tools.workspace_list_files({
    path: '/',
    pattern: '**/*.test.ts',
  });

  autoIndexPaths with globs:

  const workspace = new Workspace({
    filesystem: new LocalFilesystem({ basePath: './project' }),
    bm25: true,
    // Only index markdown files under ./docs
    autoIndexPaths: ['./docs/**/*.md'],
  });

  Skills paths with globs:

... (truncated)

Commits

• b260123 fix(memory): improve OM activation chunk selection and safeguards (#13305)
• 940163f feat(core): add workspace AST edit tool (COR-523) (#13233)
• d84e52d fix(editor): agent publish flow and recursive processor graph schema (#13292)
• 5caa13d chore(core): remove redundant vercel PROVIDER_OVERRIDES entry (#13291)
• 47892c8 fix(core): stop overriding Vercel AI Gateway base URL in model router (#13287)
• 0d9efb4 feat(editor): processor providers and stored processor graphs (#13219)
• dff79a4 feat(workflows): shared test suite for workflow engines (#12568)
• 4ada5f9 test(core): move real-API tests to e2e files and fix failing unit tests (#13193)
• 355b9ae chore: version - exit prerelease mode
• f090302 chore: version packages (alpha) (#13252)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
ozskr	Ready	Preview, Comment	Mar 7, 2026 0:39am