Who contributed to Anthropic on July 22, 2026?

6 developers shipped this update, including Bryan Thompson, iainmcgin, ogarciarevett, fallintoplace, stainless-app, and stainless-app[bot].

What were the notable Anthropic updates?

Stop applying the untrusted-input element bound to our own descriptors, fix(freeze): un-freeze entries whose upstream manifest is now valid (#774), and Add stackhawk-hawkscan plugin (#4288).

BUFFA FIXES V0.9.0 REGRESSION, CLAUDE PLUGINS ECOSYSTEM GAINS 9 NEW INTEGRATIONS

Buffa's codegen was silently rejecting moderately large schemas due to a memory bound meant only for untrusted input, but a fix shipped overnight restores throughput and clears the path for googleapis-scale proto sets.

The buffa regression [1] involved the element-memory bound from untrusted wire input also governing descriptor decoding in buffa's own tooling. Descriptor types are wide structs running 6.3x the encoded size, so the 32 MiB default balloons to 5 MB of descriptors - enough to break on real schemas. This fix decouples the bounds and restores functionality. In parallel, buffa's performance work [12] and [13] landed optimizations for view decoding: AnalyticsEvent benchmarking variants using SmolStr and SmallVec, plus moving UnknownFieldsView state behind a pointer so non-carrying views stay null and avoid memcpy on decode. Fuzzing infrastructure also hardened [14] to propagate target failures from fuzz-all and catch crashes cleanly. On the plugins side, claude-plugins-community fixed a critical freeze issue [2] by unfreezing 7 entries whose upstream manifests are now valid, and the ecosystem gained 9 new plugins across official and community registries: stackhawk-hawkscan, modern-web-guidance, browser-use, gitkraken, and azure-sql-developer in official [3] [4] [5] [6] [7], plus carbone-skill, stackhawk-api, and growthbook in knowledge-work [8] [9] [10]. The PHP SDK shipped v0.37.1 [11] with a new refusal category in the API contract.