Skip to content

chore(deps): bump the agent-sdks group across 1 directory with 9 updates - #3058

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/agent-sdks-675340767a
Open

chore(deps): bump the agent-sdks group across 1 directory with 9 updates#3058
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/agent-sdks-675340767a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the agent-sdks group with 9 updates in the / directory:

Package From To
@modelcontextprotocol/core 2.0.0 2.3.1
@modelcontextprotocol/node 2.0.0 2.1.1
@modelcontextprotocol/sdk 1.30.0 1.32.1
@modelcontextprotocol/server 2.0.0 2.3.1
@anthropic-ai/claude-agent-sdk 0.3.293 0.3.296
@anthropic-ai/sdk 0.125.0 0.133.0
@opencode-ai/sdk 1.18.31 1.19.0
@openai/codex-sdk 0.160.0 0.162.1
@google/gemini-cli-core 0.61.0 0.63.0

Updates @modelcontextprotocol/core from 2.0.0 to 2.3.1

Release notes

Sourced from @​modelcontextprotocol/core's releases.

@​modelcontextprotocol/core@​2.3.1

No release notes provided.

@​modelcontextprotocol/core@​2.3.0

Patch Changes

  • #2908 633dd3e Thanks @​claude! - The license field of the package manifests is now Apache-2.0; the LICENSE file shipped in each package carries the full terms, including the MIT text for earlier contributions. No code change.

@​modelcontextprotocol/core@​2.2.0

Minor Changes

  • #2887 edd12e2 Thanks @​maxisbey! - Constructing ClientCredentialsProvider, PrivateKeyJwtProvider, StaticPrivateKeyJwtProvider or CrossAppAccessProvider without expectedIssuer is deprecated: the constructor logs one console.warn and that call signature is marked @deprecated. Behaviour is otherwise unchanged. Pass the issuer of the authorization server the credentials were registered with.

    fetchToken() throws AuthorizationServerMismatchError, before sending anything, when the provider's client information is bound to a different authorization server than the one it is called with. The AuthorizationServerMismatchError message no longer assumes the authorization-code callback; its fields are unchanged.

    OAuthTokensSchema and OAuthClientInformationSchema accept the optional issuer stamp, so a provider that reads storage back through them keeps it. auth() overwrites it on every save.

@​modelcontextprotocol/core@​2.1.0

Minor Changes

  • #2629 dcc0102 Thanks @​gbshankar! - Add DPoP (RFC 9449 / SEP-1932) sender-constrained access token support to the client.
    • Opt in by implementing OAuthClientProvider.dpop() returning a DpopSession (new, along with generateDpopKeyPair, accessTokenHash, isDpopNonceChallenge). auth() / exchangeAuthorization / refreshAuthorization / fetchToken then sign a DPoP proof into token requests (retrying once on an authorization-server use_dpop_nonce challenge, with client authentication re-applied per attempt), and StreamableHTTPClientTransport, SSEClientTransport and withOAuth present a token_type: "DPoP" access token as Authorization: DPoP <token> plus a fresh per-request proof, retry a resource-server use_dpop_nonce challenge once, and pick up a DPoP-Nonce delivered on any response. Tokens the AS issued as Bearer are still presented as Bearer.
    • DPoP is applied at the fetch layer: the transports wrap their resource-server fetch (including a caller-supplied fetch / eventSourceInit.fetch) with the new withDpopFromProvider(provider) middleware, so proofs are always bound to the request actually sent. withDpop(session, getToken) is exported for callers that manage tokens themselves (e.g. alongside a minimal AuthProvider); the AuthProvider interface itself is unchanged.
    • auth() now recovers from invalid_dpop_proof on refresh (e.g. a refresh token bound to a key that is no longer held) by discarding the tokens and re-authorizing, like invalid_grant. OAuthErrorCode gains InvalidDpopProof and UseDpopNonce; extractWWWAuthenticateParams recognizes the DPoP challenge scheme; OAuthMetadataSchema gains dpop_signing_alg_values_supported.
Commits
  • fcef852 Version Packages (#2953)
  • e8b7f05 docs: one opening note in the server and client package READMEs (#2955)
  • 5a18673 feat(server-legacy): add expectedResource to requireBearerAuth (#2952)
  • 3ab61c6 docs: update the README banners (#2940)
  • 8aabbdc test(e2e): expect SdkHttpError after a second 401 from onUnauthorized (#2936)
  • 33fecfb test(e2e): cover tools/call without arguments (#2933)
  • 818f782 docs: state the principles in CLAUDE.md and shorten REVIEW.md (#2938)
  • a202a36 Version Packages (#2896)
  • 2d731fa fix(client): refresh again when an SSE retry failed for a reason other than 4...
  • b6e5c55 test(e2e): cover prompts/get without arguments for prompts with a schema (#2928)
  • Additional commits viewable in compare view

Updates @modelcontextprotocol/node from 2.0.0 to 2.1.1

Release notes

Sourced from @​modelcontextprotocol/node's releases.

@​modelcontextprotocol/node@​2.1.1

Patch Changes

  • #2897 7f4c12a Thanks @​claude! - hono is now a regular dependency of @modelcontextprotocol/node, so installs with strict peer-dependency checking no longer fail on the hono peer that @hono/node-server requires. No runtime change.

  • #2918 84804c2 Thanks @​claude! - A Server or McpServer now serves one connection at a time, and a Streamable HTTP server transport without sessions (sessionIdGenerator: undefined) serves one request. An app that uses one server object, or one stateless transport, for every HTTP request fails on the second request after this upgrade. Build the server and the transport per request instead.

    What keeps working without a change:

    • createMcpHandler(buildServer) and serveStdio(buildServer), where buildServer returns a new server on every call.
    • A handler that builds a new server and a new stateless transport for each request.
    • One server and one transport per session (a transport with a sessionIdGenerator).
    • Connecting a server again after close().
    • Client.

    What fails now, how it shows, and what to change:

    • One server object with a new stateless transport per request (const server = new McpServer(...) outside the handler, await server.connect(transport) inside it): the second HTTP request the process receives fails, and so does every later one. connect() rejects with an SdkError of code ALREADY_CONNECTED. If the handler closes the transport when the response ends, requests that arrive one after the other still work and a request that overlaps another one fails. Change: move new McpServer(...) and its registrations into the handler.
    • One stateless transport for every request (a transport built once with sessionIdGenerator: undefined): the second HTTP request fails. WebStandardStreamableHTTPServerTransport.handleRequest() rejects with Stateless transport cannot be reused across requests. Create a new transport per request., and NodeStreamableHTTPServerTransport.handleRequest() answers 500. Change: build the server and the transport inside the handler and connect them there.
    • createMcpHandler(() => server) with a server built once: a request that arrives after the previous response has been read to its end still works. A request that arrives while another one is being served is answered 500 with the JSON-RPC error -32603 (Internal server error); the reason is reported only through the onerror option. Change: pass a function that builds the server, as in createMcpHandler(buildServer).
    • One server object for every session: the initialize request of the second session fails with ALREADY_CONNECTED. Change: build a server per session.

    What the caller sees when connect() or handleRequest() rejects depends on the host. Express 5, Fastify and Hono answer 500. A plain node:http listener without its own error handling gets an unhandled rejection, which ends the process.

    The README examples of @modelcontextprotocol/express, @modelcontextprotocol/fastify, @modelcontextprotocol/hono and @modelcontextprotocol/node, and the handler examples in the JSDoc of WebStandardStreamableHTTPServerTransport and NodeStreamableHTTPServerTransport, now build a server and a transport per request.

  • #2908 633dd3e Thanks @​claude! - The license field of the package manifests is now Apache-2.0; the LICENSE file shipped in each package carries the full terms, including the MIT text for earlier contributions. No code change.

  • Updated dependencies [40f8f4e, 6d8dbc6, 5238fba, 2fc49ea, 4d94e7b, 84804c2, e55f9ac, 633dd3e, 2237555]:

    • @​modelcontextprotocol/server@​2.3.0

@​modelcontextprotocol/node@​2.1.0

Minor Changes

  • #1624 6032170 Thanks @​SamMorrowDrums! - Add request-time OAuth scope challenges for tools, resources, resource templates, and prompts. Each primitive's scopeChallenge callback receives the parsed request and verified authentication info, then either continues or returns the exact scope set for an insufficient_scope response. requireScopes provides a small helper for static all-of checks.

    createMcpHandler and Streamable HTTP transports return HTTP 403 with an insufficient_scope challenge before handler execution or SSE setup. The preflight is active whenever a registered primitive carries a scopeChallenge callback — there is no handler- or transport-level configuration. The challenge's WWW-Authenticate header is built by the same formatter as the bearer-auth 401/403 answers, and its resource_metadata parameter is derived from the verified AuthInfo: requireBearerAuth / verifyBearerToken now stamp their configured resourceMetadataUrl onto the AuthInfo they return (new optional AuthInfo.resourceMetadataUrl field), with a fallback to the well-known location for an HTTP(S) RFC 8707 resource identifier; the parameter is omitted when neither is available.

... (truncated)

Commits
  • a202a36 Version Packages (#2896)
  • 2d731fa fix(client): refresh again when an SSE retry failed for a reason other than 4...
  • b6e5c55 test(e2e): cover prompts/get without arguments for prompts with a schema (#2928)
  • 40f8f4e feat(server): add expectedResource to the bearer-token check (#2929)
  • 6d8dbc6 feat(server): add maxToolInputElements option to limit the number of elements...
  • 2fc49ea fix(server): accept prompts/get requests that omit arguments (#2107)
  • 63c0fca fix(client): update eventsource-parser for large SSE responses (#2846)
  • 84804c2 fix(server): refuse a second connect and stateless transport reuse (#2918)
  • e16d277 docs: close idle sessions and cap the session map in the sessions guide and e...
  • 433eb41 fix(client): follow redirects only within the origin of the request (#2901)
  • Additional commits viewable in compare view

Updates @modelcontextprotocol/sdk from 1.30.0 to 1.32.1

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.32.1

What's Changed

Full Changelog: modelcontextprotocol/typescript-sdk@1.32.0...1.32.1

1.32.0

Upgrade notes

  • Redirects: the HTTP client transports now follow a redirect only when it stays on the same origin (same scheme, host and port; http to https on the same host is allowed). A deployment whose endpoint redirects to another host or port either configures the final URL or sets redirectPolicy: 'follow' on StreamableHTTPClientTransport or SSEClientTransport. In browsers, a redirected request fails unless that option is set.
  • New options, both off unless you set them: maxToolInputElements on McpServer limits the number of array elements and object members in a tool call's arguments. expectedResource on requireBearerAuth accepts only tokens issued for this server (the token's audience).

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@1.31.0...1.32.0

1.31.0

Upgrade notes

  • Stored OAuth tokens and client information now include an issuer field. Storage that rejects unknown fields needs to allow it.
  • Pass expectedIssuer when constructing ClientCredentialsProvider, PrivateKeyJwtProvider or StaticPrivateKeyJwtProvider. Constructing them without it is deprecated.

What's Changed

Full Changelog: modelcontextprotocol/typescript-sdk@1.30.1...1.31.0

1.30.1

What's Changed

New Contributors

... (truncated)

Commits
  • ff07b00 chore: bump version to 1.32.1 (#2954)
  • 8a74d50 [v1.x] docs: point the README at v2 and say what v1.x supports (#2942)
  • a8cf503 [v1.x] docs: state the principles in CLAUDE.md (#2939)
  • 32549b0 chore: bump version to 1.32.0 (#2935)
  • 588d51d [v1.x] test(e2e): cover tools/call and prompts/get without arguments (#2931)
  • 5a0724d [v1.x] feat(auth): add expectedResource to requireBearerAuth (#2930)
  • 0ca0b62 [v1.x] fix(server): accept tools/call and prompts/get requests that omit argu...
  • fd26801 [v1.x] feat(server): add maxToolInputElements option to limit the number of e...
  • 727075b [v1.x] fix(tasks): keep tasks of the in-memory task store within the session ...
  • 0ff6377 [v1.x] examples: close idle sessions and cap the session map (#2914)
  • Additional commits viewable in compare view

Updates @modelcontextprotocol/server from 2.0.0 to 2.3.1

Release notes

Sourced from @​modelcontextprotocol/server's releases.

@​modelcontextprotocol/server-legacy@​2.3.1

Patch Changes

  • #2952 5a18673 Thanks @​claude! - requireBearerAuth in @modelcontextprotocol/server-legacy takes the optional expectedResource that @modelcontextprotocol/server 2.3.0 and @modelcontextprotocol/sdk 1.32.0 added: the resource the token must be issued for (its audience), usually the server's URL. When it is set, a token is accepted only if the verifier reports that value in AuthInfo.resource; the two are compared as strings, ignoring a fragment and one trailing slash. A token reported for another value, or for none, is answered 401 invalid_token with the usual WWW-Authenticate challenge. When it is not set, nothing changes. The package stays frozen otherwise; this option is added so that its requireBearerAuth matches the 1.x middleware it is a copy of.

  • Updated dependencies []:

    • @​modelcontextprotocol/core@​2.3.1

@​modelcontextprotocol/server@​2.3.1

Patch Changes

  • Updated dependencies []:
    • @​modelcontextprotocol/core@​2.3.1

@​modelcontextprotocol/server-legacy@​2.3.0

Patch Changes

  • #2908 633dd3e Thanks @​claude! - The license field of the package manifests is now Apache-2.0; the LICENSE file shipped in each package carries the full terms, including the MIT text for earlier contributions. No code change.

  • Updated dependencies [633dd3e]:

    • @​modelcontextprotocol/core@​2.3.0

@​modelcontextprotocol/server@​2.3.0

Minor Changes

  • #2929 40f8f4e Thanks @​claude! - requireBearerAuth and verifyBearerToken take a new optional expectedResource, which makes them accept only tokens issued for this resource (the token's audience). Set it to the value your authorization server puts into tokens meant for this server, usually the server's URL. When it is set, a token is accepted only if the verifier reports that value in AuthInfo.resource; the two are compared as strings, ignoring a fragment and one trailing slash. A token reported for another value, or for none, is answered 401 invalid_token with the usual WWW-Authenticate challenge. When it is not set, nothing changes. To use it, pass expectedResource and have verifyAccessToken fill AuthInfo.resource, for example from the aud claim. The option is declared on a new exported type, VerifyBearerTokenOptions, which extends BearerAuthOptions; BearerAuthOptions itself is unchanged. The Express requireBearerAuth passes the option through. With Express, @modelcontextprotocol/express has to be upgraded to this release as well: 2.0.1 does not pass the option on, so nothing is compared. Its options type does not have the option, so TypeScript reports an expectedResource written in a call to the 2.0.1 requireBearerAuth as an error.

  • #2926 6d8dbc6 Thanks @​claude! - McpServer now accepts a maxToolInputElements option that limits the number of elements in tool-call arguments: the largest combined number of array elements and object members a single tools/call arguments payload may contain. It is off by default, so behavior is unchanged unless you set it. When it is set and a call exceeds it, that call is answered with an isError: true tool result that names the limit, before the input schema runs, and the server keeps serving. Set it above the largest arguments your tools legitimately accept; maxRequestBodySize remains the primary limit on request size. The value must be a number of at least 1, or Infinity for no limit; any other value is rejected at construction. The options type is exported as McpServerOptions.

  • #2918 84804c2 Thanks @​claude! - A Server or McpServer now serves one connection at a time, and a Streamable HTTP server transport without sessions (sessionIdGenerator: undefined) serves one request. An app that uses one server object, or one stateless transport, for every HTTP request fails on the second request after this upgrade. Build the server and the transport per request instead.

    What keeps working without a change:

    • createMcpHandler(buildServer) and serveStdio(buildServer), where buildServer returns a new server on every call.
    • A handler that builds a new server and a new stateless transport for each request.
    • One server and one transport per session (a transport with a sessionIdGenerator).
    • Connecting a server again after close().
    • Client.

    What fails now, how it shows, and what to change:

    • One server object with a new stateless transport per request (const server = new McpServer(...) outside the handler, await server.connect(transport) inside it): the second HTTP request the process receives fails, and so does every later one. connect() rejects with an SdkError of code ALREADY_CONNECTED. If the handler closes the transport when the response ends, requests that arrive one after the other still work and a request that overlaps another one fails. Change: move new McpServer(...) and its registrations into the handler.
    • One stateless transport for every request (a transport built once with sessionIdGenerator: undefined): the second HTTP request fails. WebStandardStreamableHTTPServerTransport.handleRequest() rejects with Stateless transport cannot be reused across requests. Create a new transport per request., and NodeStreamableHTTPServerTransport.handleRequest() answers 500. Change: build the server and the transport inside the handler and connect them there.
    • createMcpHandler(() => server) with a server built once: a request that arrives after the previous response has been read to its end still works. A request that arrives while another one is being served is answered 500 with the JSON-RPC error -32603 (Internal server error); the reason is reported only through the onerror option. Change: pass a function that builds the server, as in createMcpHandler(buildServer).
    • One server object for every session: the initialize request of the second session fails with ALREADY_CONNECTED. Change: build a server per session.

    What the caller sees when connect() or handleRequest() rejects depends on the host. Express 5, Fastify and Hono answer 500. A plain node:http listener without its own error handling gets an unhandled rejection, which ends the process.

    The README examples of @modelcontextprotocol/express, @modelcontextprotocol/fastify, @modelcontextprotocol/hono and @modelcontextprotocol/node, and the handler examples in the JSDoc of WebStandardStreamableHTTPServerTransport and NodeStreamableHTTPServerTransport, now build a server and a transport per request.

  • #2907 e55f9ac Thanks @​claude! - allowedOrigins and validateOriginHeader accept lowercase entries of the form <scheme>://*, such as moz-extension://* or chrome-extension://*, which admit every origin of that scheme. This lets a server admit MCP clients that run as a browser extension when the extension ID cannot be listed, as on Firefox, where it differs on every install. http://* and https://* are not honoured, and the defaults are unchanged.

... (truncated)

Commits
  • fcef852 Version Packages (#2953)
  • e8b7f05 docs: one opening note in the server and client package READMEs (#2955)
  • 5a18673 feat(server-legacy): add expectedResource to requireBearerAuth (#2952)
  • 3ab61c6 docs: update the README banners (#2940)
  • 8aabbdc test(e2e): expect SdkHttpError after a second 401 from onUnauthorized (#2936)
  • 33fecfb test(e2e): cover tools/call without arguments (#2933)
  • 818f782 docs: state the principles in CLAUDE.md and shorten REVIEW.md (#2938)
  • a202a36 Version Packages (#2896)
  • 2d731fa fix(client): refresh again when an SSE retry failed for a reason other than 4...
  • b6e5c55 test(e2e): cover prompts/get without arguments for prompts with a schema (#2928)
  • Additional commits viewable in compare view

Updates @anthropic-ai/claude-agent-sdk from 0.3.293 to 0.3.296

Release notes

Sourced from @​anthropic-ai/claude-agent-sdk's releases.

v0.3.296

What's changed

  • Added claude_code_version to the initialize control response so clients know the CLI version before the first turn
  • Added autoCompactWindow to AgentDefinition, so a subagent can auto-compact earlier than the main conversation's window
  • Fixed the sandbox option discarding an inline settings.sandbox block: the two now merge, the option's values win, and deny and credential lists from both sides are combined
  • Changed the default limit on MCP tool descriptions sent up front and on MCP server instructions, in-process SDK servers included, from 2,048 to 4,096 characters
  • Changed permission answers that arrive after a restart to be parsed like live ones: over 4,096 updatedPermissions entries count as a denial, and a malformed list is ignored as a whole
  • Updated to parity with Claude Code v2.1.296

Update

npm install @anthropic-ai/claude-agent-sdk@0.3.296
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.296
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.296
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.296

v0.3.295

What's changed

  • Added overageEnabled to SDKRateLimitInfo: on usage-limit warnings, whether the account has extra usage turned on
  • Fixed an MCP server added with mcp_set_servers sometimes keeping an outdated tool list when another server in the same request connected later
  • Fixed assistant text blocks losing their citations in streamed responses
  • Fixed Claude being told "disabled by the user" about an in-process MCP server that was switched off with toggleMcpServer()
  • Fixed rate_limit_event with status allowed_warning omitting overageStatus, overageResetsAt and overageDisabledReason, which allowed and rejected events already carry
  • Changed MCP tool descriptions the model loads through tool search, including those from in-process SDK servers, to be cut at 16,384 characters instead of 2,048
  • Changed a permission answer whose updatedPermissions holds over 4,096 updates, rules and directories to count as a denial
  • Changed tool_result_meta[].non_execution_kind to be absent when a mod withheld the result of a tool that ran without error; it was permission-rule
  • Changed pasted_content on user messages to be ignored when it holds over 1,000 entries and blocks in all
  • Changed how the SDK passes option values to Claude Code: the values of its named options are now sent in the same argument as their flag (--flag=value)
  • Changed tool_use_result for MCP Apps tools: structuredContent or _meta over 8,388,608 JSON characters is left off, and _meta.ui with no ui:// resource no longer lifts the ordinary caps
  • Changed tool_use_result for MCP tools: when a long result is saved to a file, or cut because it could not be, the text kept past 500,000 characters is dropped, with a note of how much
  • Changed tool_use_result for MCP tools: a result _meta over 1,048,576 JSON characters is left off, except for SDK-server tools; so is text blocks' _meta that totals over 65,536
  • Updated to parity with Claude Code v2.1.295

Update

npm install @anthropic-ai/claude-agent-sdk@0.3.295
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.295
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.295
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.295
</tr></table>

... (truncated)

Changelog

Sourced from @​anthropic-ai/claude-agent-sdk's changelog.

0.3.296

  • Added claude_code_version to the initialize control response so clients know the CLI version before the first turn
  • Added autoCompactWindow to AgentDefinition, so a subagent can auto-compact earlier than the main conversation's window
  • Fixed the sandbox option discarding an inline settings.sandbox block: the two now merge, the option's values win, and deny and credential lists from both sides are combined
  • Changed the default limit on MCP tool descriptions sent up front and on MCP server instructions, in-process SDK servers included, from 2,048 to 4,096 characters
  • Changed permission answers that arrive after a restart to be parsed like live ones: over 4,096 updatedPermissions entries count as a denial, and a malformed list is ignored as a whole
  • Updated to parity with Claude Code v2.1.296

0.3.295

  • Added overageEnabled to SDKRateLimitInfo: on usage-limit warnings, whether the account has extra usage turned on
  • Fixed an MCP server added with mcp_set_servers sometimes keeping an outdated tool list when another server in the same request connected later
  • Fixed assistant text blocks losing their citations in streamed responses
  • Fixed Claude being told "disabled by the user" about an in-process MCP server that was switched off with toggleMcpServer()
  • Fixed rate_limit_event with status allowed_warning omitting overageStatus, overageResetsAt and overageDisabledReason, which allowed and rejected events already carry
  • Changed MCP tool descriptions the model loads through tool search, including those from in-process SDK servers, to be cut at 16,384 characters instead of 2,048
  • Changed a permission answer whose updatedPermissions holds over 4,096 updates, rules and directories to count as a denial
  • Changed tool_result_meta[].non_execution_kind to be absent when a mod withheld the result of a tool that ran without error; it was permission-rule
  • Changed pasted_content on user messages to be ignored when it holds over 1,000 entries and blocks in all
  • Changed how the SDK passes option values to Claude Code: the values of its named options are now sent in the same argument as their flag (--flag=value)
  • Changed tool_use_result for MCP Apps tools: structuredContent or _meta over 8,388,608 JSON characters is left off, and _meta.ui with no ui:// resource no longer lifts the ordinary caps
  • Changed tool_use_result for MCP tools: when a long result is saved to a file, or cut because it could not be, the text kept past 500,000 characters is dropped, with a note of how much
  • Changed tool_use_result for MCP tools: a result _meta over 1,048,576 JSON characters is left off, except for SDK-server tools; so is text blocks' _meta that totals over 65,536
  • Updated to parity with Claude Code v2.1.295

0.3.294

  • Updated to parity with Claude Code v2.1.294
Commits

Updates @anthropic-ai/sdk from 0.125.0 to 0.133.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk-v0.133.0

Features

  • api: add types for the Chat and Cowork unified analytics metrics
  • api: add workflows, multiagent configuration and thread status filtering to Managed Agents

Chores

  • internal: remove the next branch rule from CLAUDE.md

sdk-v0.132.1

Bug Fixes

  • client: throw before sending a request with an empty path parameter

Chores

  • ci: check that pull requests update the changelog
  • ci: publish every package from the publish workflow
  • docs: note that listing Claude Console spend limits is in early access

Documentation

  • split CLAUDE.md into shared, TypeScript, and repository rules

sdk: v0.132.0

0.132.0 (2026-10-07)

Full Changelog: sdk-v0.131.0...sdk-v0.132.0

Features

  • api: add claude-haiku-5-5 and typed computer and browser toolset tool calls (1fd8261)
  • api: add disabled to thinking types in model capabilities (2b75b49)
  • api: add display_name to RBAC roles and deprecate name (7735ac3)
  • api: add include_default parameter to list workspaces (c4019df)
  • api: add lifecycle stage fields and filter to /v1/models (fe8a762)
  • api: add line to model objects (018aed4)
  • api: add url_sources to the Managed Agents web_fetch tool config (2b75b49)
  • api: add web search and code execution support to model capabilities (2b75b49)

Bug Fixes

  • api: send the beta header by default when listing spend limits (8f58ca4)
  • client: throw when a JSONL stream is iterated twice (a34266c)
  • tools: keep a local edit made after a memory upload whose response was lost (#893) (2b75b49)

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.133.0 (2026-10-09)

Features

  • api: add types for the Chat and Cowork unified analytics metrics
  • api: add workflows, multiagent configuration and thread status filtering to Managed Agents

Chores

  • internal: remove the next branch rule from CLAUDE.md

0.132.1 (2026-10-08)

Bug Fixes

  • client: throw before sending a request with an empty path parameter

Chores

  • ci: check that pull requests update the changelog
  • ci: publish every package from the publish workflow
  • docs: note that listing Claude Console spend limits is in early access

Documentation

  • split CLAUDE.md into shared, TypeScript, and repository rules

0.132.0 (2026-10-07)

Full Changelog: sdk-v0.131.0...sdk-v0.132.0

Features

  • api: add claude-haiku-5-5 and typed computer and browser toolset tool calls (1fd8261)
  • api: add disabled to thinking types in model capabilities (2b75b49)
  • api: add display_name to RBAC roles and deprecate name (7735ac3)
  • api: add include_default parameter to list workspaces (c4019df)
  • api: add lifecycle stage fields and filter to /v1/models (fe8a762)
  • api: add line to model objects (018aed4)
  • api: add url_sources to the Managed Agents web_fetch tool config (2b75b49)
  • api: add web search and code execution support to model capabilities (2b75b49)

Bug Fixes

  • api: send the beta header by default when listing spend limits (8f58ca4)
  • client: throw when a JSONL stream is iterated twice (a34266c)

... (truncated)

Commits
  • 2979ed5 release: . 0.133.0
  • 8486d9b Merge pull request #908 from anthropics/synced/published
  • e0995e4 feat(api): add workflows, multiagent configuration and thread status filterin...
  • 31eb3be codegen metadata
  • 5127b32 codegen metadata
  • f702a46 codegen metadata
  • d64e976 codegen metadata
  • 9f75465 codegen metadata
  • 6ec2ea1 chore(internal): remove the next branch rule from CLAUDE.md
  • 373c33d codegen metadata
  • Additional commits viewable in compare view

Updates @opencode-ai/sdk from 1.18.31 to 1.19.0

Commits

Updates @openai/codex-sdk from 0.160.0 to 0.162.1
Updates @google/gemini-cli-core from 0.61.0 to 0.63.0

Release notes

Sourced from @​google/gemini-cli-core's releases.

Release v0.63.0

What's Changed

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 9, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/agent-sdks-675340767a branch 3 times, most recently from c9f44d4 to 64c41ec Compare October 16, 2026 12:33
@dependabot
chore(deps): bump the agent-sdks group across 1 directory with 9 updates
16f2ee5 
---
updated-dependencies:
- dependency-name: "@anthropic-ai/claude-agent-sdk"
  dependency-version: 0.3.291
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: agent-sdks
- dependency-name: "@anthropic-ai/sdk"
  dependency-version: 0.131.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: agent-sdks
- dependency-name: "@google/gemini-cli-core"
  dependency-version: 0.62.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: agent-sdks
- dependency-name: "@modelcontextprotocol/core"
  dependency-version: 2.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: agent-sdks
- dependency-name: "@modelcontextprotocol/node"
  dependency-version: 2.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: agent-sdks
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.32.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: agent-sdks
- dependency-name: "@modelcontextprotocol/server"
  dependency-version: 2.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: agent-sdks
- dependency-name: "@openai/codex-sdk"
  dependency-version: 0.160.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: agent-sdks
- dependency-name: "@opencode-ai/sdk"
  dependency-version: 1.18.34
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: agent-sdks
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/agent-sdks-675340767a branch from 64c41ec to 16f2ee5 Compare October 16, 2026 12:50

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants