$ cat anthropics/week/2026-10-26.log
the week in review · Oct 26 – Nov 1, 2026
OSS Scanner enrollment wave takes in curl, starlette and Bitcoin
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
Projects gained per-severity report routing this week while Claude Code 2.1.316 added pooled group budgets and a switch to disable ultrathink.
Let projects choose where reports go by severity anthropics/oss-scanner
Projects can now set the lowest severity sent to email and to GitHub private vulnerability reporting, with defaults of low and high respectively. The new optional output_format field is a breaking change to the scanner's delivery contract, so maintainers routing reports by channel should pin their expectations before the defaults apply to them.
v2.1.316 anthropics/claude-code
The Claude apps gateway now supports one monthly budget shared across a group's members, layered on top of each member's own limit and set via pooled_budget on the spend limits admin API. A new CLAUDE_CODE_DISABLE_ULTRATHINK variable turns off the ultrathink keyword for teams that want it gone.
State that pgp only applies to email reports anthropics/oss-scanner
Because GitHub private vulnerability reporting does not use a project's key, the docs no longer promise every report is encrypted. If your disclosure process assumes end-to-end encryption, that assumption holds only for email.
Enroll curl in OSS Scanner anthropics/oss-scanner
curl, the project tier of this week's enrollment run, joined OSS Scanner alongside starlette, gopacket, gofiber/contrib and python-discovery. Enrollment means these projects accept the scanner's terms and enter its pipeline; it does not by itself change what they ship.
Install marketplace plugins from claude-plugins-official anthropics/claude-code
The claude-code-plugins marketplace now installs every plugin from claude-plugins-official, which the changelog notes had to land after the code-review port and plugin version bumps. Merging in the wrong order would have left users on the older code-review with no-op updates.
Send gopacket reports through GitHub only anthropics/oss-scanner
gopacket's reports now travel only through private GitHub Security Advisories, at low severity and above, with email dropped as a channel. The same switch to GitHub-only delivery landed for opentelemetry-dotnet and Homebrew, the latter enabling high-severity reports.
Add eth: paper and Lean 4 formalization of "A 2^o(n) Time Algorithm for 3-SAT" anthropics/formal-math
A new self-contained Lake project under eth/ (Lean v4.33.1, Mathlib v4.33.1) formalizes the paper's two propositions on Mathlib's Turing machines. The paper ships as eth/paper.pdf alongside MainResults.lean.
Update mcp-builder skill: teach v2 of the MCP TypeScript SDK anthropics/skills
The mcp-builder skill now points new TypeScript servers at the v2 packages while keeping the v1 guide for existing servers. Alongside: sandbox-runtime corrected its Windows npx command to npx @anthropic-ai/sandbox-runtime, claude-agent-sdk-python raised its PyPI pre-flight guard from 50 GiB to 150 GiB, and computer-use-demo now reads the system's CA store instead of loading its own distrust list.
$ ls anthropics/week/ # the briefings behind this review
Keep up with Anthropic in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.