Who contributed to Anthropic on August 5, 2026?

6 developers shipped this update, including Bryan Thompson, github-actions, ashwin-ant, github-actions[bot], GitHub Actions, and abelribbink.

What were the notable Anthropic updates?

Check collaborator permissions for workflow_run events, Match downloaded images to their source URLs by asset identifier, and Pin bun config for MCP server processes.

@anthropics

Claude SDKs and developer tooling

github ↗

Pick a date

Topics: AI / ML Full archive →

The Wire · Showcase

CLAUDE CODE ACTION LOCKS DOWN WORKFLOW PERMISSIONS AND IMAGE PAIRING

By RepoJournal · Filed 06:58 UTC on August 5, 2026 · About Anthropic

6 people shipped this

ashwin-ant @ashwin-ant 3 cited

Bryan Thompson @bryan-anthropic 2 cited

abelribbink @abelribbink 1 cited

github-actions @github-actions

github-actions[bot] @github-actions[bot]

GitHub Actions @actions-user

The code action now enforces collaborator checks on workflow_run events and pairs downloaded images correctly by asset identifier instead of array position.

Claude Code Action v1.0.185 shipped with two critical security and reliability fixes [1] [2]. The write-permission check for collaborator access previously skipped workflow_run-triggered runs entirely, sending them straight into agent mode without validation; the fix applies the same permission gate that entity events (issues, PRs, comments) already enforce, checking both the workflow actor and the upstream run's actor when they differ [1]. Separately, downloadCommentImages now matches image URLs to their signed download URLs by asset identifier instead of array position, fixing a pairing bug that shifted alignments when markdown and HTML representations contained images in different orders [2]. A third PR pinned the bun configuration for MCP server processes so they resolve from the action directory rather than the caller's working directory [3]. Plugin bumping across the ecosystem continues: claude-plugins-official enrolled CrowdStrike entries in release-tag tracking [4], while claude-plugins-community merged the underlying feature that lets plugins track published releases instead of main HEAD [5]. The defending-code-reference-harness added fast-fail for container deaths, so OOM-killed or removed agent containers fail immediately with the cause instead of burning the full 68-minute backoff budget [6].

Action items

→ Merge pending image-pairing and permissions-check PRs in claude-code-action before next release deploy anthropics/claude-code-action [immediate]
→ Review and merge 4 plugin SHA bumps across claude-plugins-official once scan jobs pass anthropics/claude-plugins-official [plan]
→ Merge container-inspection fixes in defending-code-reference-harness to reduce agent failure troubleshooting overhead anthropics/defending-code-reference-harness [plan]

References

[1] Check collaborator permissions for workflow_run events ↗ anthropics/claude-code-action
[2] Match downloaded images to their source URLs by asset identifier ↗ anthropics/claude-code-action
[3] Pin bun config for MCP server processes ↗ anthropics/claude-code-action
[4] bump tracking: pin action to community 9247660a + releases-only for CrowdStrike entries (#4879) anthropics/claude-plugins-official
[5] feat(bump-plugin-shas): releases-only (release-tag) tracking via optional tracking-config input ↗ anthropics/claude-plugins-community
[6] Fail fast when the agent container dies mid-run ↗ anthropics/defending-code-reference-harness

Quick answers

What shipped in Anthropic on August 5, 2026?: The code action now enforces collaborator checks on workflow_run events and pairs downloaded images correctly by asset identifier instead of array position. In total, 10 commits, 96 pull requests, and 1 releases landed.
Who contributed to Anthropic on August 5, 2026?: 6 developers shipped this update, including Bryan Thompson, github-actions, ashwin-ant, github-actions[bot], GitHub Actions, and abelribbink.
What were the notable Anthropic updates?: Check collaborator permissions for workflow_run events, Match downloaded images to their source URLs by asset identifier, and Pin bun config for MCP server processes.

CLAUDE SDK ROLLS OVERLOAD DETECTION AND SESSION RESUME CONTROLS

TypeScript Agent SDK v0.3.223 ships structural 529 overload detection and a new resumeDropsTurn safety valve for session truncation, while the Python SDK and Code Action synced their bundled CLI versions overnight.

ai 10 shipped

@anthropics Aug 4

CLAUDE CODE AGENT SDK TIGHTENS SKILL VALIDATION, FIXES EVENT FILTERING

The Python agent SDK now rejects malformed skill names that could silently disable tools, while the code action fixes inconsistent timestamp handling across GitHub event types.

ai 19 shipped

@anthropics Aug 3

PLUGIN ECOSYSTEM ROLLS OUT VALIDATED UPDATES ACROSS THREE REPOS

Thirteen automated dependency bumps swept through the plugin pipeline overnight, each validated before merge across official, community, and knowledge-work repositories.

ai 41 shipped

@anthropics Aug 2

PLUGIN ECOSYSTEM ROLLS FORWARD WITH 46 VALIDATED UPDATES ACROSS THREE REPOS

The plugin validation pipeline ran full cycle overnight, pushing dependency updates through knowledge-work, official, and community registries with every bump pre-validated before merge.

ai 46 shipped

Elsewhere on the wire

AI Agents Aug 6

LANGCHAIN HARDENS ANTHROPIC TOOL CALLING AND GIT CREDENTIALS AS OPENHANDS SHIPS 1.10.0

LangChain fixed a critical credential leak in evaluation runs while Anthropic tool schemas get proper fallback handling, as three major agent frameworks push releases across the ecosystem.

ai-agents 54 shipped

Local LLMs Aug 6

OLLAMA FIXES KV CACHE CORRUPTION, LLAMA.CPP HARDENS FILE SEARCH, VLLM KILLS MOE LEGACY CODE

Ollama patched a critical cache corruption bug that corrupts lazy snapshots during multi-request prefills, while llama.cpp hardened Windows junction traversal and vLLM removed 14 hardcoded MoE shards across quantization methods.