RepoJournal
Anthropic @anthropics
123 wires and counting

$ follow Anthropic

Keep up with Anthropic in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-07-14
stories 25
GitHub RSS Archive Reviews Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

SLACK NOTIFICATION INJECTION PATCHED ACROSS SDK STACK

By RepoJournal · Filed · About Anthropic · Composed from the cited sources · methodology

ashwin-ant Qing Wang github-actions[bot] syf2211 GitHub Actions
5 people shipped this
ashwin-ant @ashwin-ant 3 cited Qing Wang @qing-ant 1 cited github-actions[bot] @github-actions[bot] 1 cited syf2211 @syf2211 1 cited GitHub Actions @actions-user

A JSON injection vulnerability in the Slack issue notification workflow has been fixed, and all three SDK implementations now carry the security patch plus critical bug fixes for false-positive CI success states.

The Python SDK shipped v0.2.117 [2] with an escape of untrusted issue fields in the Slack notification workflow, preventing attackers from injecting malformed JSON or mrkdwn code through specially crafted issue titles or usernames [1]. The TypeScript SDK and Code Action both follow with updates that fix a separate but equally important issue: builds now fail correctly when the Agent SDK returns `is_error: true` despite a success subtype, preventing misleading green checks on code review runs that never actually executed [3]. v0.2.118 for Python and v0.3.209 for TypeScript [5] bump the bundled Claude CLI to 2.1.209 [4], which unblocks the /model dialog in background agent sessions. The TypeScript SDK v0.3.208 [6] also patches two resource leaks and fixes a timeout handler that was killing queries instead of gracefully blocking prompts.

Action items

References

  1. [1] Escape untrusted issue fields in the Slack notification workflow (#1116) ↗ anthropics/claude-agent-sdk-python
  2. [2] v0.2.117 ↗ anthropics/claude-agent-sdk-python
  3. [3] fix(sdk): fail step when result has is_error:true despite success subtype ↗ anthropics/claude-code-action
  4. [4] v2.1.209 ↗ anthropics/claude-code
  5. [5] v0.3.209 ↗ anthropics/claude-agent-sdk-typescript
  6. [6] v0.3.208 ↗ anthropics/claude-agent-sdk-typescript

$ ls anthropics/reviews/ # the step-back reads

the week in review Claude Code 2.1.277 adds AGENTS.md support the month in review Claude Code sync stabilizes, Anthropic SDKs hit 1.0, plugins roll at scale
Topics: AI / ML Full archive → Weekly reviews →

Quick answers

What shipped in Anthropic on July 14, 2026?
A JSON injection vulnerability in the Slack issue notification workflow has been fixed, and all three SDK implementations now carry the security patch plus critical bug fixes for false-positive CI success states. In total, 15 commits, 2 pull requests, and 8 releases landed.
Who contributed to Anthropic on July 14, 2026?
5 developers shipped this update, including Qing Wang, github-actions[bot], syf2211, GitHub Actions, and ashwin-ant.
What were the notable Anthropic updates?
Escape untrusted issue fields in the Slack notification workflow (#1116), v0.2.117, and fix(sdk): fail step when result has is_error:true despite success subtype.
♥

$ log @anthropics --recent

Verbatim prompt mode closes an @-path file read in the Python SDK 2 shipped Claude Code 2.1.277 reads AGENTS.md, agent-sdk ships the AGENTS.md mod 23 shipped Sandbox-runtime closes a silent deny-glob hole and two Linux startup failures 80 shipped Sales plugin declares Salesforce and Microsoft 365 connectors, plugin directory adds six integrations 67 shipped

$ log --all # elsewhere on the wire

@openclaw Cold-start Gateway diagnostics stop crying wolf, doctor repairs plugin drift Agentic Coding Cline desktop bundles shrink, goose unblocks its own clicks

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux OpenAI

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.