$ cat anthropics/week/2026-08-31.log
the week in review · Aug 31 – Sep 6, 2026
Buffa hardens encoding, OwnedView drops Drop
Claude Security Plugin v0.11.0 ships breaking changes; SDKs land compliance types; Claude Code bumps to 2.1.260/263.
What shipped: Buffa dominated the period with memory-safety and correctness work. OwnedView dropped its Drop impl in favor of MaybeDangling [1], Publish now writes Vec length only after wire bytes are copied [2], and ProtoJSON null is treated as unset [3]. Extension registry allocations were cut by avoiding lookup keys [16], and Any serialization now bounds expansion depth [5] as well as JSON nesting [6]. Repeated message values are merged within map entries [7], and well-known Api, Type, and SourceContext types were added [8]. Benchmarks were re-measured and v0.9.0 added [9]. Also: config. The buffa-build Config gains exclude_package knob [10], so check your build scripts.
Why it matters: The OwnedView and wire-bytes changes fix potential use-after-free and partial-read hazards in your Buffa code, so if you rely on OwnedView's lifetime guarantees, recompile and re-test. Treating ProtoJSON null as unset aligns decoding with proto3 semantics, which can silently change how you handle null fields. Bounds on Any nesting prevent stack overflows when processing untrusted protos, so deployment hardening is worthwhile. Claude Security Plugin v0.11.0 ships breaking changes [11][12], so update it deliberately, and the SDK changelogs detail the beta files/skills GA-shape change [13][14], so review that before you depend on it.
Also: Claude Code bumped to 2.1.258, then 2.1.260 and 2.1.263 across GitHub Actions and SDK packages [15][16][22], while claude-agent-sdk-python released v0.2.149, v0.2.150, and v0.2.151 [18][19][20], and Claude Code Action moved to v1.0.213 [21]. Claude Plugins updated the /frontend-design SKILL.md [22]. No other breaking changes.
References
- [1] view: drop OwnedView's Drop impl and store the view behind MaybeDangling ↗ anthropics/buffa
- [2] Publish Vec length only after the wire bytes are copied ↗ anthropics/buffa
- [3] extensions: treat ProtoJSON null as unset ↗ anthropics/buffa
- [4] perf: avoid allocating extension registry lookup keys ↗ anthropics/buffa
- [5] any: bound expansion depth when serializing nested Any ↗ anthropics/buffa
- [6] reflect: bound JSON serialization nesting through google.protobuf.Any ↗ anthropics/buffa
- [7] Merge repeated message values within one map entry in view and reflective decoders ↗ anthropics/buffa
- [8] types: add Api, Type, and SourceContext well-known types ↗ anthropics/buffa
- [9] benchmarks/history: re-measure the series 1-up and add v0.9.0 ↗ anthropics/buffa
- [10] buffa-build: add Config::exclude_package knob (#383) ↗ anthropics/buffa
- [11] Claude Security Plugin - v0.11.0 ↗ anthropics/claude-plugins-official
- [12] Merge pull request #5728 from anthropics/claude-security-v0.11.0 ↗ anthropics/claude-plugins-official
- [13] docs(changelog): detail the beta files/skills GA-shape change ↗ anthropics/anthropic-sdk-python
- [14] docs(changelog): detail the beta files/skills GA-shape change ↗ anthropics/anthropic-sdk-go
- [15] chore: bump Claude Code to 2.1.258 and Agent SDK to 0.3.258 ↗ anthropics/claude-code-action
- [16] perf: avoid allocating extension registry lookup keys ↗ anthropics/buffa
- [17] Update /frontend-design SKILL.md ↗ anthropics/claude-plugins-official
- [18] v0.2.149 ↗ anthropics/claude-agent-sdk-python
- [19] v0.2.150 ↗ anthropics/claude-agent-sdk-python
- [20] v0.2.151 ↗ anthropics/claude-agent-sdk-python
- [21] v1.0.213 ↗ anthropics/claude-code-action
- [22] Update /frontend-design SKILL.md ↗ anthropics/claude-plugins-official
$ ls anthropics/week/ # the briefings behind this review