What changed in Anthropic on May 5, 2026?

All five Anthropic SDKs landed Workload Identity Federation and interactive OAuth in a coordinated push , while the orjson fork restores the upstream 1024-depth recursion limit as a configurable guard against stack overflow .

What should Anthropic teams do about it?

Pull C# and Java SDK updates to unlock Workload Identity Federation and OAuth support in your deployment. • Review orjson's max_depth parameter if your JSON payloads exceed 1024 levels of nesting; otherwise, the new default is safe. • Explore the vulnerability detection agent cookbook for threat modeling patterns compatible with claude-agent-sdk.

Which Anthropic repositories shipped on May 5, 2026?

anthropics/anthropic-sdk-csharp, anthropics/anthropic-sdk-java, anthropics/orjson, anthropics/claude-cookbooks, anthropics/buffa

C# AND JAVA SDKS SHIP AUTH OVERHAUL; ORJSON FORK REINS IN RECURSION

By RepoJournal · Filed 06:02 UTC on May 5, 2026 · About Anthropic

All five Anthropic SDKs landed Workload Identity Federation and interactive OAuth in a coordinated push [ref:10][ref:11][ref:12][ref:13][ref:14][ref:15], while the orjson fork restores the upstream 1024-depth recursion limit as a configurable guard against stack overflow [ref:1][ref:2].

The C# SDKs—Aws, Vertex, Bedrock, Foundry, and the core Anthropic client [1][2][3][4][5]—all crossed the finish line yesterday with v0.3.0 through v12.18.0, shipping Workload Identity Federation, interactive OAuth, and auth profiles across the board [1]. Java sdk-java v2.28.0 [6] lands the same auth suite plus improved Managed Agents APIs [15]—the ability to filter sessions by memory_store_id, nullable handling fixes, and max_tokens:0 support. On the core side, orjson's fork had removed yyjson's recursion limit entirely to allow arbitrarily deep JSON nesting, but that left the C stack vulnerable [7]. The new max_depth kwarg defaults to 1024 (matching upstream) while letting callers opt into deeper parsing by passing max_depth=None or a higher integer [8]—nesting past the limit now raises JSONDecodeError instead of crashing. Separately, orjson's publish-internal pipeline is being hardened: the PEP-440 wheel filename normalization caused check-pypi to fail (hyphen vs. dot), so the fix replaces filename validation with a version-only check [9][10][11]. The vulnerability detection agent cookbook landed in claude-cookbooks [12], bringing threat-model-to-report workflows into the public repo using claude-agent-sdk's built-in Code tools. One final hygiene win: buffa's CLA check now retries transient 5xx errors instead of failing immediately [13][14].

FAQ

What changed in Anthropic on May 5, 2026?: All five Anthropic SDKs landed Workload Identity Federation and interactive OAuth in a coordinated push , while the orjson fork restores the upstream 1024-depth recursion limit as a configurable guard against stack overflow .
What should Anthropic teams do about it?: Pull C# and Java SDK updates to unlock Workload Identity Federation and OAuth support in your deployment. • Review orjson's max_depth parameter if your JSON payloads exceed 1024 levels of nesting; otherwise, the new default is safe. • Explore the vulnerability detection agent cookbook for threat modeling patterns compatible with claude-agent-sdk.
Which Anthropic repositories shipped on May 5, 2026?: anthropics/anthropic-sdk-csharp, anthropics/anthropic-sdk-java, anthropics/orjson, anthropics/claude-cookbooks, anthropics/buffa

@anthropics

C# AND JAVA SDKS SHIP AUTH OVERHAUL; ORJSON FORK REINS IN RECURSION

The showcase is a teaser.
Your wire is the product.

C# AND JAVA SDKS SHIP AUTH OVERHAUL; ORJSON FORK REINS IN RECURSION

The showcase is a teaser. Your wire is the product.

The showcase is a teaser.
Your wire is the product.