Who contributed to Anthropic on July 14, 2026?

5 developers shipped this update, including Qing Wang, github-actions[bot], syf2211, GitHub Actions, and ashwin-ant.

What were the notable Anthropic updates?

Escape untrusted issue fields in the Slack notification workflow (#1116), v0.2.117, and fix(sdk): fail step when result has is_error:true despite success subtype.

@anthropics

Claude SDKs and developer tooling

github ↗

Pick a date

Topics: AI / ML Full archive →

The Wire · Showcase

SLACK NOTIFICATION INJECTION PATCHED ACROSS SDK STACK

By RepoJournal · Filed 06:57 UTC on July 14, 2026 · About Anthropic

5 people shipped this

ashwin-ant @ashwin-ant 3 cited

Qing Wang @qing-ant 1 cited

github-actions[bot] @github-actions[bot] 1 cited

syf2211 @syf2211 1 cited

GitHub Actions @actions-user

A JSON injection vulnerability in the Slack issue notification workflow has been fixed, and all three SDK implementations now carry the security patch plus critical bug fixes for false-positive CI success states.

The Python SDK shipped v0.2.117 [2] with an escape of untrusted issue fields in the Slack notification workflow, preventing attackers from injecting malformed JSON or mrkdwn code through specially crafted issue titles or usernames [1]. The TypeScript SDK and Code Action both follow with updates that fix a separate but equally important issue: builds now fail correctly when the Agent SDK returns `is_error: true` despite a success subtype, preventing misleading green checks on code review runs that never actually executed [3]. v0.2.118 for Python and v0.3.209 for TypeScript [5] bump the bundled Claude CLI to 2.1.209 [4], which unblocks the /model dialog in background agent sessions. The TypeScript SDK v0.3.208 [6] also patches two resource leaks and fixes a timeout handler that was killing queries instead of gracefully blocking prompts.

Action items

→ Upgrade claude-agent-sdk-python to 0.2.118 anthropics/claude-agent-sdk-python [immediate]
→ Upgrade @anthropic-ai/claude-agent-sdk to 0.3.209 anthropics/claude-agent-sdk-typescript [immediate]
→ Upgrade claude-code-action to v1.0.173 anthropics/claude-code-action [plan]

References

[1] Escape untrusted issue fields in the Slack notification workflow (#1116) anthropics/claude-agent-sdk-python
[2] v0.2.117 ↗ anthropics/claude-agent-sdk-python
[3] fix(sdk): fail step when result has is_error:true despite success subtype ↗ anthropics/claude-code-action
[4] v2.1.209 ↗ anthropics/claude-code
[5] v0.3.209 ↗ anthropics/claude-agent-sdk-typescript
[6] v0.3.208 ↗ anthropics/claude-agent-sdk-typescript

Quick answers

What shipped in Anthropic on July 14, 2026?: A JSON injection vulnerability in the Slack issue notification workflow has been fixed, and all three SDK implementations now carry the security patch plus critical bug fixes for false-positive CI success states. In total, 15 commits, 2 pull requests, and 8 releases landed.
Who contributed to Anthropic on July 14, 2026?: 5 developers shipped this update, including Qing Wang, github-actions[bot], syf2211, GitHub Actions, and ashwin-ant.
What were the notable Anthropic updates?: Escape untrusted issue fields in the Slack notification workflow (#1116), v0.2.117, and fix(sdk): fail step when result has is_error:true despite success subtype.

BUFFA CLOSES 2 GIB MESSAGE BOMB, PLUGIN ECOSYSTEM ADVANCES

Buffa now rejects protobuf messages over 2 GiB instead of silently corrupting them, closing a gap where encoders would succeed while every decoder downstream failed.

ai 50 shipped 1-min read

@anthropics 2 days ago

CYBER RUNBOOK TRAFFIC NOW TRACEABLE IN TELEMETRY

Pipeline agents and interactive sessions in defending-code now send attributable usage markers so runbook traffic is visible across your request logs.

ai 45 shipped 1-min read

@anthropics 3 days ago

CLAUDE CODE AUTO MODE SHIPS LIVE, SDK FIXES TOOL VALIDATION BUG

Claude Code 2.1.207 kills the feature flag for auto mode across Bedrock, Vertex, and Foundry while the TypeScript SDK patches a critical tool contract violation that was silently accepting invalid inputs.

ai 10 shipped 1-min read

@anthropics 4 days ago

CLAUDE SDK PINS CLI 2.1.206, BUFFA LANDS ZERO-COPY BYTES OPTIMIZATION

The agent SDK shipped with the latest Claude CLI bundled in, while buffa's remote-derive macro now lets you avoid the copy path for bytes newtypes that wrap heap-allocated buffers.

ai 53 shipped 1-min read

— or follow the whole beat:

Elsewhere on the wire

@cachyos about 4 hours ago

CACHYOS LINUX 7.2-RC3 SHIPS WITH HARDWARE FIXES AND EXPANDED LANGUAGE SUPPORT

CachyOS Linux 7.2-rc3-1 is live with Razer Blade speaker fixes and v4l2loopback updates, while the package installer now speaks Turkish and Azerbaijani.

infra 63 shipped 1-min read

Elixir & Phoenix about 4 hours ago

PHOENIX LIVE VIEW PATCHES SCHEME VALIDATION BYPASS

Phoenix LiveView 1.2.7 ships an emergency security fix for a scheme validation bypass that could let attackers inject malicious URLs into your application.

elixir 6 shipped 1-min read

@dotnet about 4 hours ago

RUNTIME FIXES DECIMAL AND BIGINTEGER ROUNDING BUGS THAT LOST PRECISION

Three critical numeric conversion bugs that silently corrupted precision in decimal, BigInteger, and floating-point math are now fixed across the stack.

dotnet 122 shipped 1-min read

@spring-projects about 4 hours ago

SPRING BOOT PLUGS FILE HANDLE LEAK IN IMAGE BUILDPACK

Spring Boot's image buildpack was leaking file handles and orphaning temp files when resolving missing builder images, but a fix just landed to clean up both the streams and the intermediate artifacts.

java 16 shipped 1-min read