The Wire · Showcase
CLAUDE CODE PATCHES STALLED LOG FETCH, SECURITY WILDCARD WARNINGS
By RepoJournal · Filed · About Anthropic
The Claude Code ecosystem shipped fixes overnight that close a hang in log fetching and warn on risky Bash allow rules, with the CLI bumping to v2.1.246 across the stack.
The big one: claude-code-action finally bounds download_job_log against stalled fetches. The MCP tool called downloadJobLogsForWorkflowRun() with no timeout and no AbortController, and since \"@octokit/rest@21 runs on Node's native fetch, which has no default timeout,\" an unresponsive log blob could hang the tool forever [1]. This tool is always enabled in tag mode, so any stalled log breaks a full pipeline [2]. Claude Code v2.1.246 adds a startup warning for Bash allow rules with wildcards before the subcommand, catching patterns like `Bash(git * main)` that inadvertently match options inserted before the command [3]. The Python SDK and base action both sync to the new CLI: the SDK bundles Claude CLI 2.1.246 in v0.2.144 [4], and claude-code-base-action pulled in the same version plus Agent SDK 0.3.246 [5]. The action also fixed branch-name handling: parentheses are now accepted while preserving security checks [6], and branch names in GitHub links are properly URL-encoded [7]. Finally, the tag-mode delete_files prompt corrected its example from `files` to `paths`, preventing a Zod validation failure on the first signed-commit delete [8].
One email a day. Unsubscribe in one click.
Keep up with Anthropic in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
One email a day. Unsubscribe in one click. Read a past issue →
Action items
- → Update claude-code-action to latest to get the download_job_log timeout fix and branch-name improvements anthropics/claude-code-action [immediate]
- → Review Bash allow rules for wildcards before subcommands and adjust after upgrading Claude Code to v2.1.246 anthropics/claude-code [plan]
- → Update claude-agent-sdk-python to v0.2.144 to bundle CLI 2.1.246 anthropics/claude-agent-sdk-python [plan]
- → Verify any workflows using delete_files still pass after the prompt example fix anthropics/claude-code-action [monitor]
References
- [1] fix: bound download_job_log against a stalled log fetch ↗ anthropics/claude-code-action
- [2] fix: bound download_job_log against a stalled log fetch (#1719) anthropics/claude-code-action
- [3] v2.1.246 ↗ anthropics/claude-code
- [4] v0.2.144 ↗ anthropics/claude-agent-sdk-python
- [5] Sync from claude-code-action base-action@1f291e1 anthropics/claude-code-base-action
- [6] fix: allow parentheses in valid branch names (#1710) anthropics/claude-code-action
- [7] fix: encode branch names in GitHub links (#1713) anthropics/claude-code-action
- [8] fix: use paths in delete_files prompt example ↗ anthropics/claude-code-action