v0.2.125

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.217

---

PyPI: https://pypi.org/project/claude-agent-sdk/0.2.125/

pip install claude-agent-sdk==0.2.125

v0.2.124

Bug Fixes

• Refused batch script CLI spawning on Windows: Blocked spawning .bat/.cmd CLI scripts (including npm's claude.cmd shim) on Windows to prevent command injection via cmd.exe metacharacter re-parsing (BatBadBut / CVE-2024-27980 class). Windows users relying on the npm shim should switch to the native installer, an explicit claude.exe path, or a platform wheel that bundles the CLI (#1127)
• Windows cmd.exe metacharacter rejection: resume and session_id values containing cmd.exe metacharacters (& | < > ^ % ! ") or newlines now raise ValueError on Windows, preventing injection even if a cmd.exe hop is reintroduced. POSIX behavior is unchanged (#1127)
• Dash-prefixed extra_args value binding: extra_args now uses --flag=value form when the value starts with -, preventing a dash-leading value from being misinterpreted as a separate CLI flag (#1127)

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.216

---

PyPI: https://pypi.org/project/claude-agent-sdk/0.2.124/

pip install claude-agent-sdk==0.2.124

v0.2.123

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.215

---

PyPI: https://pypi.org/project/claude-agent-sdk/0.2.123/

pip install claude-agent-sdk==0.2.123

v0.2.122

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.214

---

PyPI: https://pypi.org/project/claude-agent-sdk/0.2.122/

pip install claude-agent-sdk==0.2.122

v0.2.121

Bug Fixes

• Fixed argv flag injection via resume and session_id options: --resume and --session-id are now passed as single =-joined argv tokens (e.g. --resume=<value>) so that a dash-prefixed value is never misinterpreted as an independent CLI flag (#1123)

Internal/Other Changes

• Hardened build scripts against command injection via CLAUDE_CLI_VERSION: Added version validation (_cli_version_validation.py) and eliminated shell interpolation in download_cli.py and update_cli_version.py so that a malformed version string cannot inject shell or Python code during builds (#1117)
• CI now lints and typechecks scripts/ alongside src/ and tests/
• CI CLI install steps now fail properly when curl errors (added shell: bash for pipefail)
• Updated bundled Claude CLI to version 2.1.212

---

PyPI: https://pypi.org/project/claude-agent-sdk/0.2.121/

pip install claude-agent-sdk==0.2.121

v0.2.120

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.211

---

PyPI: https://pypi.org/project/claude-agent-sdk/0.2.120/

pip install claude-agent-sdk==0.2.120

v0.2.119

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.210

---

PyPI: https://pypi.org/project/claude-agent-sdk/0.2.119/

pip install claude-agent-sdk==0.2.119

v0.2.118

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.209

---

PyPI: https://pypi.org/project/claude-agent-sdk/0.2.118/

pip install claude-agent-sdk==0.2.118

v0.2.117

Bug Fixes

• Escaped untrusted fields in Slack issue notification workflow: Fixed the Slack notification workflow to properly escape issue titles and usernames using jq instead of bash substitution, preventing malformed JSON payloads and mrkdwn injection from specially crafted issue titles (#1116)

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.208

---

PyPI: https://pypi.org/project/claude-agent-sdk/0.2.117/

pip install claude-agent-sdk==0.2.117

v0.2.116

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.207
• Fixed CI workspace trust so Claude Code honors project-scoped permission grants in checkout directories (#1085)

---

PyPI: https://pypi.org/project/claude-agent-sdk/0.2.116/

pip install claude-agent-sdk==0.2.116