RepoJournal
Anthropic

@anthropics

Claude SDKs and developer tooling

Keep up with Anthropic in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

One email a day. Unsubscribe in one click.

Pick a date

Topics: AI / ML Full archive →

The Wire · Showcase

CLAUDE CODE PATCHES STALLED LOG FETCH, SECURITY WILDCARD WARNINGS

By RepoJournal · Filed · About Anthropic

The Claude Code ecosystem shipped fixes overnight that close a hang in log fetching and warn on risky Bash allow rules, with the CLI bumping to v2.1.246 across the stack.

The big one: claude-code-action finally bounds download_job_log against stalled fetches. The MCP tool called downloadJobLogsForWorkflowRun() with no timeout and no AbortController, and since \"@octokit/rest@21 runs on Node's native fetch, which has no default timeout,\" an unresponsive log blob could hang the tool forever [1]. This tool is always enabled in tag mode, so any stalled log breaks a full pipeline [2]. Claude Code v2.1.246 adds a startup warning for Bash allow rules with wildcards before the subcommand, catching patterns like `Bash(git * main)` that inadvertently match options inserted before the command [3]. The Python SDK and base action both sync to the new CLI: the SDK bundles Claude CLI 2.1.246 in v0.2.144 [4], and claude-code-base-action pulled in the same version plus Agent SDK 0.3.246 [5]. The action also fixed branch-name handling: parentheses are now accepted while preserving security checks [6], and branch names in GitHub links are properly URL-encoded [7]. Finally, the tag-mode delete_files prompt corrected its example from `files` to `paths`, preventing a Zod validation failure on the first signed-commit delete [8].

One email a day. Unsubscribe in one click.

Action items

References

  1. [1] fix: bound download_job_log against a stalled log fetch ↗ anthropics/claude-code-action
  2. [2] fix: bound download_job_log against a stalled log fetch (#1719) anthropics/claude-code-action
  3. [3] v2.1.246 ↗ anthropics/claude-code
  4. [4] v0.2.144 ↗ anthropics/claude-agent-sdk-python
  5. [5] Sync from claude-code-action base-action@1f291e1 anthropics/claude-code-base-action
  6. [6] fix: allow parentheses in valid branch names (#1710) anthropics/claude-code-action
  7. [7] fix: encode branch names in GitHub links (#1713) anthropics/claude-code-action
  8. [8] fix: use paths in delete_files prompt example ↗ anthropics/claude-code-action

Quick answers

What shipped in Anthropic on August 26, 2026?
The Claude Code ecosystem shipped fixes overnight that close a hang in log fetching and warn on risky Bash allow rules, with the CLI bumping to v2.1.246 across the stack. In total, 10 commits, 5 pull requests, and 3 releases landed.
Who contributed to Anthropic on August 26, 2026?
7 developers shipped this update, including github-actions[bot], GitHub Actions, Yauheni Papovich, shoemoney, WeAreResilience, Muhammad Abdullah khan, and ashwin-ant.
What were the notable Anthropic updates?
fix: bound download_job_log against a stalled log fetch, fix: bound download_job_log against a stalled log fetch (#1719), and v2.1.246.

More from @anthropics

Daily updates, in your inbox

Follow Anthropic

Keep up with Anthropic in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

One email a day. Unsubscribe in one click. Read a past issue →

Elsewhere on the wire

Want every project, not just this one?