$ cat anthropics/week/2026-11-02.log
the week in review · Nov 2 – Nov 8, 2026
PHP SDK 1.5.0 ships typed exceptions; self-hosted sandboxes land
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
Agent SDK hooks can now block a crashed PreToolUse guard, and oss-scanner enrolled FFmpeg, Tesseract, Lustre, BIND 9, scilab and fasthttp.
v1.5.0 anthropics/anthropic-sdk-php
APIStatusException now exposes getType(), getAPIMessage(), getErrorCode() and getDetails(), with exception classes per HTTP status and API error code, so callers can branch on the error code instead of parsing message strings. The release also adds an ids filter to list workspaces and API error detail types.
Add on_failure to HookMatcher anthropics/claude-agent-sdk-python
HookMatcher(on_failure="block") sends onFailure in initialize, so a Python hook callback that raises now stops the tool call instead of being read as no decision. Before this, a PreToolUse guard that crashed let the tool run.
v2.7.0 anthropics/anthropic-cli
Adds signing organization members out everywhere, plus an apply fix so deployments, environments, vaults, memory stores and agents are no longer reported as changed outside a config while their updated_at has not moved.
sandboxes-v0.1.0 anthropics/anthropic-cli
The sandboxes work ships a Helm chart, dispatcher and sandbox image for running Claude Managed Agents on your own Kubernetes clusters, published to Google Artifact Registry along with the sandbox source. It is the first cut, tagged v0.1.0.
Add FFmpeg anthropics/oss-scanner
FFmpeg master is enrolled with reports going to the ffmpeg-security address listed on ffmpeg.org. The Dockerfile makes three clang-19 ASan+UBSan builds of one checkout: tools and libraries without assembly, the same with assembly in build-asm, and an --enable variant, so sanitizer coverage reaches both the default and the hand-written assembly paths.
Tag the pull request opener in the triage comment when their setup needs attention anthropics/oss-scanner
Triage comments now tag the pull request opener directly when SECURITY.md gives a different email than primary_contact, when GitHub security advisories are enabled and oss-scanner needs adding as a trusted reporter, or when SECURITY.md mentions something else the setup requires.
Enrol Lustre (lustre/lustre-release) anthropics/oss-scanner
Lustre joins alongside Tesseract, Signal-Android and scilab this period, and AutoGPT's enrollment was tightened so every report of every severity files as a GitHub private vulnerability report. The release notes for security-guidance say the commit reviewer now stops on refused credentials and "end hung reviews in time".
$ ls anthropics/week/ # the briefings behind this review
Keep up with Anthropic in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.