RepoJournal
Anthropic

@anthropics

Claude SDKs and developer tooling

Pick a date

  1. Tue 9 jun
  2. Wed 10 jun
  3. Thu 11 jun
  4. Fri 12 jun
  5. Sat 13 jun
  6. Sun 14 jun
  7. Mon 15 jun
  8. Tue 16 jun
  9. Wed 17 jun
  10. Thu 18 jun
  11. Fri 19 jun
  12. Sat 27 jun
  13. Sun 28 jun
  14. Mon 29 jun
  15. Tue 30 jun
  16. Wed 1 jul
  17. Thu 2 jul
  18. Fri 3 jul
  19. Sat 4 jul
  20. Sun 5 jul
  21. Mon 6 jul
  22. Tue 7 jul
  23. Wed 8 jul
  24. Thu 9 jul
  25. Fri 10 jul
  26. Sat 11 jul
  27. Sun 12 jul
  28. Mon 13 jul
  29. Tue 14 jul
  30. Today 15 jul
Topics: AI / ML Full archive →

The Wire · Showcase

CLAUDE CODE ACTION PATCHES TOKEN LEAK, SDK VERSIONS BUMP ACROSS STACK

By RepoJournal · Filed · About Anthropic

github-actions github-actions[bot] NickNojiri GitHub Actions abibbs-ant
5 people shipped this
github-actions @github-actions 9 cited github-actions[bot] @github-actions[bot] 2 cited NickNojiri @NickNojiri 2 cited GitHub Actions @actions-user 1 cited abibbs-ant @abibbs-ant 1 cited

Claude Code Action 1.0.174 shipped an emergency fix for a token sanitizer gap that was leaving GitHub user-to-server credentials exposed in prompts.

The ghu_ token prefix, one of GitHub's documented authentication formats, was slipping past the redactGitHubTokens sanitizer in claude-code-action [1] [2]. This is the kind of credential leak you patch immediately. The fix mirrors existing token patterns and includes unit tests covering both standard and git-credential URL forms [3]. In parallel, the agent SDK bumped to 0.2.119 with an updated CLI version [4], and Claude Code itself moved to 2.1.210 [5]. The knowledge-work-plugins and claude-plugins-official repos are running through routine plugin validation bumps across Carta, Zapier, Monday.com, and ZoomInfo integrations [6] [7] [8] [9] [10] [11] [12] [13] [14]. The deprecated Shopify plugin has been removed from the official registry in favor of the Shopify AI Toolkit [15].

Action items

References

  1. [1] fix(sanitizer): redact GitHub user-to-server (ghu_) tokens (#1502) anthropics/claude-code-action
  2. [2] v1.0.174 ↗ anthropics/claude-code-action
  3. [3] fix(sanitizer): redact GitHub user-to-server (ghu_) tokens ↗ anthropics/claude-code-action
  4. [4] v0.2.119 ↗ anthropics/claude-agent-sdk-python
  5. [5] chore: bump Claude Code to 2.1.210 and Agent SDK to 0.3.210 anthropics/claude-code-action
  6. [6] bump(carta-cap-table): 6a67756e → 60f8c4e4 ↗ anthropics/knowledge-work-plugins
  7. [7] bump(carta-investors): fdc57d65 → 60f8c4e4 ↗ anthropics/knowledge-work-plugins
  8. [8] bump(zapier): 11bfb606 → 217d65a9 ↗ anthropics/knowledge-work-plugins
  9. [9] bump(monday-crm): 95500b9c → fc64cf88 ↗ anthropics/knowledge-work-plugins
  10. [10] bump(zoominfo): b836604c → 66eae634 ↗ anthropics/knowledge-work-plugins
  11. [11] bump(datarobot-agent-skills): c4a9729d → c6e70363 ↗ anthropics/claude-plugins-official
  12. [12] bump(migration-to-aws): f6f23f25 → 63f5d2c3 ↗ anthropics/claude-plugins-official
  13. [13] bump(carta-crm): d73a3615 → fdc57d65 ↗ anthropics/claude-plugins-official
  14. [14] bump(carta-investors): 6a67756e → fdc57d65 ↗ anthropics/claude-plugins-official
  15. [15] Remove deprecated shopify plugin (replaced by shopify-ai-toolkit) (#4070) anthropics/claude-plugins-official

Quick answers

What shipped in Anthropic on July 15, 2026?
Claude Code Action 1.0.174 shipped an emergency fix for a token sanitizer gap that was leaving GitHub user-to-server credentials exposed in prompts. In total, 6 commits, 54 pull requests, and 2 releases landed.
Who contributed to Anthropic on July 15, 2026?
5 developers shipped this update, including github-actions[bot], GitHub Actions, github-actions, abibbs-ant, and NickNojiri.
What were the notable Anthropic updates?
fix(sanitizer): redact GitHub user-to-server (ghu_) tokens (#1502), v1.0.174, and fix(sanitizer): redact GitHub user-to-server (ghu_) tokens.

More from @anthropics

Anthropic @anthropics

SLACK NOTIFICATION INJECTION PATCHED ACROSS SDK STACK

A JSON injection vulnerability in the Slack issue notification workflow has been fixed, and all three SDK implementations now carry the security patch plus critical bug fixes for false-positive CI success states.

Qing Wang github-actions[bot] syf2211 GitHub Actions +1
ai 25 shipped 1-min read
Anthropic @anthropics

BUFFA CLOSES 2 GIB MESSAGE BOMB, PLUGIN ECOSYSTEM ADVANCES

Buffa now rejects protobuf messages over 2 GiB instead of silently corrupting them, closing a gap where encoders would succeed while every decoder downstream failed.

github-actions healthcare-sync healthcare-sync[bot] rpb-ant
ai 50 shipped 1-min read
Anthropic @anthropics

CYBER RUNBOOK TRAFFIC NOW TRACEABLE IN TELEMETRY

Pipeline agents and interactive sessions in defending-code now send attributable usage markers so runbook traffic is visible across your request logs.

eugeneyan-ant github-actions
ai 45 shipped 1-min read
Anthropic @anthropics

CLAUDE CODE AUTO MODE SHIPS LIVE, SDK FIXES TOOL VALIDATION BUG

Claude Code 2.1.207 kills the feature flag for auto mode across Bedrock, Vertex, and Foundry while the TypeScript SDK patches a critical tool contract violation that was silently accepting invalid inputs.

github-actions[bot] GitHub Actions ashwin-ant
ai 10 shipped 1-min read

Daily updates, in your inbox

Follow Anthropic

Claude SDKs and developer tooling We'll email you a link to confirm first.

Free. Confirm via email. Unsubscribe in one click.

— or follow the whole beat:

Elsewhere on the wire

CachyOS @cachyos

CACHYOS MIRRORS HOLDING STEADY, AUR PACKAGES ROLLING UPDATES

All China mirrors are responding normally while the AUR-derived package queue processes five consecutive version bumps across developer tools.

Peter Jung Piotr Gorski Jinra github-actions
infra 44 shipped 1-min read
Elixir & Phoenix Elixir & Phoenix

ELIXIR FIXES ENUM SORTER BUG THAT BROKE CUSTOM COMPARATORS

Enum.min and Enum.max were silently returning wrong results when you passed a custom sorter on ranges, and the core team just caught it.

AlexGx pnezis
elixir 16 shipped 1-min read
.NET @dotnet

MATH.ROUND BUG CORRUPTS 5% OF INPUTS. EVENTPIPE LOSES HEAP DATA. SQLCLIENT GOES ASYNC

Runtime shipped a critical fix for Math.Round that was silently mangling roughly 5% of all rounding operations across the BCL, while EventPipe's data loss is finally getting a blocking mode to save your GC dumps.

tannergooding Pavel Savara mdh1418 steveisok +6
dotnet 78 shipped 1-min read
Spring @spring-projects

SPRING BOOT FIXES LAZY INITIALIZATION TRAP THAT BREAKS JPA APPS

Spring Boot patched a critical dependency loop where JPA configuration was forcing early instantiation of every AsyncTaskExecutor bean in your app, even when background bootstrapping wasn't enabled.

Ns Stéphane Nicoll dhruv-15-03 Jens Schauder +4
java 33 shipped 1-min read