RepoJournal
Anthropic

@anthropics

Claude SDKs and developer tooling

Keep up with Anthropic in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

One email a day. Unsubscribe in one click.

Pick a date

  1. Sat 18 jul
  2. Sun 19 jul
  3. Mon 20 jul
  4. Tue 21 jul
  5. Wed 22 jul
  6. Thu 23 jul
  7. Fri 24 jul
  8. Sat 25 jul
  9. Sun 26 jul
  10. Mon 27 jul
  11. Tue 28 jul
  12. Wed 29 jul
  13. Thu 30 jul
  14. Fri 31 jul
  15. Sat 1 aug
  16. Sun 2 aug
  17. Mon 3 aug
  18. Tue 4 aug
  19. Wed 5 aug
  20. Thu 6 aug
  21. Fri 7 aug
  22. Sat 8 aug
  23. Sun 9 aug
  24. Mon 10 aug
  25. Tue 11 aug
  26. Wed 12 aug
  27. Thu 13 aug
  28. Fri 14 aug
  29. Sat 15 aug
  30. Today 16 aug
Topics: AI / ML Full archive →

The Wire · Showcase

SHELL-QUOTE CRITICAL VULNERABILITY PATCHED, AWS PLUGIN DELISTED, PR REVIEW CONTEXT FIXED

By RepoJournal · Filed · About Anthropic

github-actions winklemad Bryan Thompson Dhaval Doshi abhinavkr26104 rishavnaskar GitHub Actions
7 people shipped this
github-actions @github-actions 9 cited winklemad @winklemad 2 cited Bryan Thompson @bryan-anthropic 1 cited Dhaval Doshi @doshidhaval 1 cited abhinavkr26104 @abhinavkr26104 1 cited rishavnaskar @rishavnaskar 1 cited GitHub Actions @actions-user 1 cited

Anthropic patched a critical shell-quote vulnerability across the action stack while shipping major improvements to PR review accuracy and image handling.

Shell-quote 1.84 lands immediately across claude-code-action and syncs to the base-action repository, closing CVE-2026-9277 [1] [2]. This is a forced upgrade. The AWS dev toolkit has been removed from the official plugins registry [3], resolving a previously flagged delisting. On the code-action front, PR review comments now include the actual diff context Claude was reviewing against [4], fixing a long-standing gap where comments arrived with only line numbers and no surrounding code. Image downloads now timeout after 30 seconds [5], preventing stalled fetches from blocking the entire context window. A critical git history bug affecting shallow clones has been fixed [6] [7], where depth-limited fetches were truncating already-present history and losing the merge base with the PR base branch. Across both official and knowledge-work plugin suites, 5 automated SHA bumps hit validation gates [8] [9] [10] [11] [12] [13] [14] [15] [16], all passing `claude plugin validate` before PR creation.

One email a day. Unsubscribe in one click.

Action items

References

  1. [1] fix: bump shell-quote to 1.8.4 to remediate CVE-2026-9277 (#1557) anthropics/claude-code-action
  2. [2] Sync from claude-code-action base-action@5da4c76 anthropics/claude-code-base-action
  3. [3] Remove aws-dev-toolkit official plugin (#5357) anthropics/claude-plugins-official
  4. [4] feat(context): include diffHunk in PR review comment context ↗ anthropics/claude-code-action
  5. [5] fix(images): bound attachment downloads ↗ anthropics/claude-code-action
  6. [6] Only limit fetch depth when the checkout is already shallow ↗ anthropics/claude-code-action
  7. [7] fix: only limit fetch depth when the checkout is already shallow (#1647) anthropics/claude-code-action
  8. [8] bump(carta-investors): 4fda2e0c → e9bb21cb ↗ anthropics/claude-plugins-official
  9. [9] bump(pinecone): d4b0ef62 → c48ac3f6 ↗ anthropics/claude-plugins-official
  10. [10] bump(sonarqube): acaa5772 → e596969a ↗ anthropics/claude-plugins-official
  11. [11] bump(spanner): 1a92c0f2 → 290f70f1 ↗ anthropics/claude-plugins-official
  12. [12] bump(carta-investors): dd0c286b → e9bb21cb ↗ anthropics/knowledge-work-plugins
  13. [13] bump(carta-investors): adba7884 → dd0c286b ↗ anthropics/knowledge-work-plugins
  14. [14] bump(carta-cap-table): 820f497a → adba7884 ↗ anthropics/knowledge-work-plugins
  15. [15] bump(carta-investors): fa90aeae → adba7884 ↗ anthropics/knowledge-work-plugins
  16. [16] bump(carta-investors): 820f497a → fa90aeae ↗ anthropics/knowledge-work-plugins

Quick answers

What shipped in Anthropic on August 15, 2026?
Anthropic patched a critical shell-quote vulnerability across the action stack while shipping major improvements to PR review accuracy and image handling. In total, 12 commits, 50 pull requests, and 1 releases landed.
Who contributed to Anthropic on August 15, 2026?
7 developers shipped this update, including Bryan Thompson, github-actions, Dhaval Doshi, abhinavkr26104, rishavnaskar, winklemad, and GitHub Actions.
What were the notable Anthropic updates?
fix: bump shell-quote to 1.8.4 to remediate CVE-2026-9277 (#1557), Sync from claude-code-action base-action@5da4c76, and Remove aws-dev-toolkit official plugin (#5357).

More from @anthropics

Anthropic @anthropics

FOUR PLUGIN BUMPS QUEUED FOR REVIEW ACROSS OFFICIAL CATALOG

Mattpocock-skills, sumup, stripe, and superdesign all shipped validated updates overnight and are waiting for merge approval.

github-actions
ai 4 shipped
Anthropic @anthropics

CLAUDE CODE ACTION FIXES BINARY DETECTION, PLUGIN BUMPS ROLL STEADY

Claude Code Action v1.0.192 shipped three critical fixes for MCP integration, GitHub Actions pagination, and binary file detection that improve reliability across the agent ecosystem.

Bryan Thompson github-actions github-actions[bot] GitHub Actions
ai 65 shipped
Anthropic @anthropics

MACOS PYTHON 3.9 HITTING 13.6% OF SESSIONS, SECURITY PATCH SHIPS

Claude's plugin infrastructure is bleeding users on macOS because Apple's bundled Python 3.9 can't run the agentic reviewer, and a fix just landed.

Mohamed Hegazy Noah Zweben github-actions github-actions[bot] +1
ai 76 shipped
Anthropic @anthropics

CLAUDE CODE ACTION FIXES SILENT DATA CORRUPTION IN BINARY FILE COMMITS

A critical fix in claude-code-action detects binary files by content instead of a hardcoded extension list, preventing silent corruption of .sqlite, .docx, .wasm, and dozens of other formats.

github-actions Bryan Thompson henriquepe Neal Daftary +1
ai 127 shipped

Daily updates, in your inbox

Follow Anthropic

Keep up with Anthropic in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

One email a day. Unsubscribe in one click. Read a past issue →

Elsewhere on the wire

AI Agents AI Agents

OPENHANDS PINS CLIENT DEPENDENCY, ADDS STRUCTURED ERROR HANDLING

OpenHands locked its TypeScript client to exact version 1.37.0 and merged canvas error outcome improvements in a single commit cycle.

neubig
ai-agents 2 shipped
Local LLMs Local LLMs

LLAMA.CPP OVERHAULS INFERENCE FLAGS, VLLM PATCHES DEEPSEEK SPARSE MLA

llama.cpp deprecates mmap flags in favor of unified load-mode, while vllm fixes critical issues blocking DeepSeek-V4-Flash across all decode paths.

github-actions[bot] dhiltgen Fathi Boudra Eric Zhang +11
llms 136 shipped
CachyOS @CachyOS

DASHBOARD SEO OVERHAUL SHIPS AS PACKAGE TRAIN ROLLS FORWARD

CachyOS public-dashboard refactored routes with canonical metadata and improved crawler visibility [ref:18] while 61 commits across five repos kept the AUR pipeline humming.

github-actions witchlliee Jinra azdanov +1
infra 72 shipped
Elixir & Phoenix Elixir & Phoenix

ELIXIR CORE CUTS ALLOCATIONS ACROSS STRING AND AST OPERATIONS

Thomas Cioppettini landed four performance wins overnight that eliminate unnecessary allocations in List.myers_difference, String case conversion, and Macro tree walkers.

Thomas Cioppettini LostKobrakai
elixir 17 shipped
Want every project, not just this one?