RepoJournal
Anthropic

@anthropics

Claude SDKs and developer tooling

Pick a date

  1. Thu 11 jun
  2. Fri 12 jun
  3. Sat 13 jun
  4. Sun 14 jun
  5. Mon 15 jun
  6. Tue 16 jun
  7. Wed 17 jun
  8. Thu 18 jun
  9. Fri 19 jun
  10. Sat 27 jun
  11. Sun 28 jun
  12. Mon 29 jun
  13. Tue 30 jun
  14. Wed 1 jul
  15. Thu 2 jul
  16. Fri 3 jul
  17. Sat 4 jul
  18. Sun 5 jul
  19. Mon 6 jul
  20. Tue 7 jul
  21. Wed 8 jul
  22. Thu 9 jul
  23. Fri 10 jul
  24. Sat 11 jul
  25. Sun 12 jul
  26. Mon 13 jul
  27. Tue 14 jul
  28. Wed 15 jul
  29. Thu 16 jul
  30. Today 17 jul
Topics: AI / ML Full archive →

The Wire · Showcase

BUFFA CLOSES CRITICAL DECODE GAPS WHILE PLUGIN ECOSYSTEM ROLLS ROUTINE BUMPS

By RepoJournal · Filed · About Anthropic

github-actions Bryan Thompson Iain McGinniss Minh Vu ogarciarevett peterlai-ant Tao Lin
7 people shipped this
github-actions @github-actions 13 cited Bryan Thompson @bryan-anthropic 2 cited Iain McGinniss @iainmcgin 1 cited Minh Vu @fallintoplace 1 cited ogarciarevett @ogarciarevett 1 cited peterlai-ant @peterlai-ant 1 cited Tao Lin @taoroalin

The protobuf decoder just fixed three silent data loss bugs in a single day, while 15 plugins across three registries validated new builds.

Buffa landed three critical safety improvements overnight. A new patch [1] preserves message values when decode errors occur, closing a data loss window where malformed payloads could silently drop already-parsed data. A second fix [2] enforces unknown-field limits on packed closed enums, preventing attackers from bypassing allocation guards. The codegen layer [3] now blocks proto comments with code fences from becoming doctests in consuming crates, eliminating a class of build-time surprises. These three patches restore owned/view decoder parity and tighten the contract around untrusted input. Meanwhile, the plugin ecosystem is in steady motion: AMD Skills joins the official registry [5], while Skills itself [4] adds template format support (.dotx, .potx, .xltx) and hardens ZIP extraction against symlink traversal. Across claude-plugins-official, knowledge-work-plugins, and claude-plugins-community, 15 automated SHA bumps [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] [17] [18] passed validation and await merge review. The tinyfish plugin [19] is incoming to knowledge-work-plugins.

Action items

References

  1. [1] descriptor: preserve existing message on decode errors (#299) anthropics/buffa
  2. [2] codegen: enforce closed-enum unknown-field limits ↗ anthropics/buffa
  3. [3] codegen: never let a proto comment's code fence become a doctest (#309) anthropics/buffa
  4. [4] Update docx, pptx, and xlsx skills ↗ anthropics/skills
  5. [5] Add amd-skills plugin (#4044) anthropics/claude-plugins-official
  6. [6] bump(hyperframes): b0bb4688 → 3bb26b0f ↗ anthropics/claude-plugins-official
  7. [7] bump(slack): 46f5c53b → e75b0cf1 ↗ anthropics/claude-plugins-official
  8. [8] bump(chrome-devtools-mcp): 9a7e04da → 77e1d3f9 ↗ anthropics/claude-plugins-official
  9. [9] bump(shopify-ai-toolkit): 6980909f → 556811e9 ↗ anthropics/claude-plugins-official
  10. [10] bump(carta-investors): 3c8a5d9f → 1f99da85 ↗ anthropics/knowledge-work-plugins
  11. [11] bump(qdrant-skills): 5ea598de → db1dde70 ↗ anthropics/knowledge-work-plugins
  12. [12] bump(carta-cap-table): 3c8a5d9f → 1f99da85 ↗ anthropics/knowledge-work-plugins
  13. [13] bump(signoz): 9c848a54 → 70746a27 ↗ anthropics/knowledge-work-plugins
  14. [14] bump(agented): 1490dd85 → 63443471 ↗ anthropics/claude-plugins-community
  15. [15] bump(ai-statusline): 801255a4 → b6cd0249 ↗ anthropics/claude-plugins-community
  16. [16] bump(altertable): d5431a87 → 35283b4e ↗ anthropics/claude-plugins-community
  17. [17] bump(artel): 7c91090f → 9afe73ac ↗ anthropics/claude-plugins-community
  18. [18] bump(astronomer): 6163ddc1 → 5432198c ↗ anthropics/claude-plugins-community
  19. [19] Add tinyfish plugin (#557) anthropics/knowledge-work-plugins

Quick answers

What shipped in Anthropic on July 17, 2026?
The protobuf decoder just fixed three silent data loss bugs in a single day, while 15 plugins across three registries validated new builds. In total, 19 commits and 106 pull requests landed.
Who contributed to Anthropic on July 17, 2026?
7 developers shipped this update, including Bryan Thompson, github-actions, Tao Lin, Iain McGinniss, Minh Vu, ogarciarevett, and peterlai-ant.
What were the notable Anthropic updates?
descriptor: preserve existing message on decode errors (#299), codegen: enforce closed-enum unknown-field limits, and codegen: never let a proto comment's code fence become a doctest (#309).

More from @anthropics

Anthropic @anthropics

CLAUDE CODE ACTION PATCHES NULL AUTHOR CRASH, HEALTHCARE PLUGIN SYNC GAINS PERMISSIONS GATE

Claude Code Action hit a production crash when processing comments from deleted GitHub accounts, but three fixes just shipped to harden validation, sanitization, and branch handling.

healthcare-sync john-michael healthcare-sync[bot] Riley Mete +6
ai 33 shipped 2-min read
Anthropic @anthropics

CLAUDE CODE ACTION PATCHES TOKEN LEAK, SDK VERSIONS BUMP ACROSS STACK

Claude Code Action 1.0.174 shipped an emergency fix for a token sanitizer gap that was leaving GitHub user-to-server credentials exposed in prompts.

github-actions[bot] GitHub Actions github-actions abibbs-ant +1
ai 62 shipped 1-min read
Anthropic @anthropics

SLACK NOTIFICATION INJECTION PATCHED ACROSS SDK STACK

A JSON injection vulnerability in the Slack issue notification workflow has been fixed, and all three SDK implementations now carry the security patch plus critical bug fixes for false-positive CI success states.

Qing Wang github-actions[bot] syf2211 GitHub Actions +1
ai 25 shipped 1-min read
Anthropic @anthropics

BUFFA CLOSES 2 GIB MESSAGE BOMB, PLUGIN ECOSYSTEM ADVANCES

Buffa now rejects protobuf messages over 2 GiB instead of silently corrupting them, closing a gap where encoders would succeed while every decoder downstream failed.

github-actions healthcare-sync healthcare-sync[bot] rpb-ant
ai 50 shipped 1-min read

Daily updates, in your inbox

Follow Anthropic

Claude SDKs and developer tooling We'll email you a link to confirm first.

Free. Confirm via email. Unsubscribe in one click.

— or follow the whole beat:

Elsewhere on the wire

CachyOS @cachyos

NOCTALIA HOTFIX LANDS, NVIDIA TWEAKS INCLUDED

CachyOS shipped v1.2.1 of its Hyprland config to fix breaking changes in noctalia beta3, then patched a typo hours later with v1.2.2.

Peter Jung Jinra lukaogadze NotMephisto +4
infra 62 shipped 1-min read
Hugging Face @huggingface

SENTENCE-TRANSFORMERS FIXES SILENT GRADIENT CORRUPTION ON GPU

A critical bug in cached losses was silently producing wrong gradients on GPU, and it's fixed now [ref:1].

tomaarsen Quentin Gallouédec albertvillanova Andrey Churkin +4
python 60 shipped 1-min read
Linux Linux

KERNEL 7.2-RC4 FLUSH: FILESYSTEM FIXES DOMINATE AS EROFS CATCHES CRITICAL CORRUPTION BUGS

erofs is patching false corruption reports in its tail packing logic while the kernel sweep catches 21 XFS bugs found by LLM analysis.

Linus Torvalds
infra 7 shipped 1-min read
Arch Linux @archlinux

EXTRA REPO ROLLS FIVE UPDATES OVERNIGHT

Strawberry music player, GNOME desktop extensions, and Google API tooling all landed in extra-x86_64 and extra-any within hours of each other.

Antonio Rojas Balló György
infra 50 shipped 1-min read