chore(deps): update all dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence	Type	Update
@anthropic-ai/claude-agent-sdk	0.3.185 → 0.3.241					peerDependencies	patch
@openai/codex-sdk (source)	0.141.0 → 0.149.1					peerDependencies	minor
@openai/codex-sdk (source)	0.142.5 → 0.149.1					devDependencies	minor
actions/checkout	v7.0.0 → v7.0.1					action	patch
actions/setup-node	v6 → v7					action	major
typescript (source)	^6.0.3 → ^7.0.0					devDependencies	major

---

Release Notes

anthropics/claude-agent-sdk-typescript (@​anthropic-ai/claude-agent-sdk)

v0.3.241

Compare Source

• Updated to parity with Claude Code v2.1.241

v0.3.240

Compare Source

• Updated to parity with Claude Code v2.1.240

v0.3.239

Compare Source

• total_cost_usd / modelUsage.costUSD now include the 1.1× US-only-inference (data residency) multiplier when the response reports inference_geo: "us"
• A result held back for background subagents in one-shot mode now reports total_cost_usd, duration_api_ms and modelUsage as of its release, not the turn-end snapshot
• Fixed SYSTEM_PROMPT_DYNAMIC_BOUNDARY in an array systemPrompt being sent to the model as literal text on Bedrock, Vertex, Foundry, and gateway providers
• A repeated initialize on a running process is now followed by a background_tasks_changed snapshot of the live background tasks, so reconnecting hosts see work that is still running

v0.3.238

Compare Source

• Added is_backgrounded and spawn_depth to task_started events for subagent tasks (is_backgrounded also on background Bash tasks)
• Added suppressOriginalPrompt to UserPromptExpansion hook output, matching UserPromptSubmit
• Added command_lifecycle state refused: a cross-session peer message the session's receive-side policy declines now reports this terminal state instead of producing no lifecycle frames
• Fixed SDK hook callbacks silently not applying after a host re-sends initialize to an already-running CLI; the response now reports hooks_applied
• Fixed CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION=true not keeping prompt_suggestion messages on when the account is near, but not over, its usage limit
• Changed vcs_state_changed push events to emit one event per pushed branch

v0.3.237

Compare Source

• Updated to parity with Claude Code v2.1.237

v0.3.236

Compare Source

• PostToolUse hooks can return hookSpecificOutput.classifierContext, a short host-asserted note about a tool call's result that the auto mode permission classifier reads alongside that result

v0.3.235

Compare Source

• Updated to parity with Claude Code v2.1.235

v0.3.234

Compare Source

• Removed unused bypass_permissions_disabled from ExitReason type; the value was never emitted — TypeScript consumers with an explicit case branch get a compile error on upgrade (runtime unaffected)
• Updated the ApiKeySource type to include the values system/init actually reports (ANTHROPIC_API_KEY, apiKeyHelper, /login managed key, none)
• vcs_state_changed events report the directory the shell finished in (an inner cd is reflected)
• A peer origin injected by the host may declare the sending session's permission class (fromMode) so a same-class message is delivered to a recipient that runs without asking
• SDKSystemMessage (system/init) gains an optional effort field: the session's applied effort level, or null when none is sent. Set on Remote Control bridge init frames

v0.3.233

Compare Source

• Notification hooks now fire for pending permission prompts on the SDK path, matching the interactive REPL behavior
• Todo/task-tracking tools (TaskCreate/TaskGet/TaskUpdate/TaskList, TodoWrite) are no longer in the default tool surface on Opus 4.8, Sonnet 5, Fable 5, Mythos 5, and newer models; name them in the tools option or reference them in allowedTools (or set CLAUDE_CODE_ENABLE_TODO_TOOLS=1) to keep them

v0.3.232

Compare Source

• Subagent MCP tool_result frames whose result carries _meta now emit tool_use_result as { content, _meta } (matching main-loop frames) instead of a bare value
• /context result messages now carry a structured context_usage payload (new SDKContextUsage type), so consumers can render the context-usage card without parsing the markdown table
• vcs_state_changed events now populate the branch field for push operations, sourced from the pushed ref

v0.3.231

Compare Source

• Updated to parity with Claude Code v2.1.231

v0.3.229

Compare Source

• Added terminal_slash_commands to the system init message so Remote Control clients can hide terminal-oriented commands
• Changed conversations whose messages alone exceed the API's 32 MB limit to end the turn with terminal_reason "api_error" instead of "image_error"; StopFailure error_details is "request_body_over_limit: …"

v0.3.228

Compare Source

• Agent tool results (AgentOutput): usage.output_tokens_details is now carried through

v0.3.227

Compare Source

• Updated to parity with Claude Code v2.1.227

v0.3.226

Compare Source

• Updated to parity with Claude Code v2.1.226

v0.3.225

Compare Source

• Fixed background subagents in headless/SDK sessions never resuming when a background shell command or Monitor they left running completed, so the subagent never saw the result

v0.3.224

Compare Source

• Added crossSessionInbound and dialogExpiry settings: cross-session messages sent to a session running with bypassed permissions are held for your approval, and messages to other sessions auto-deliver
• Added subkind: 'peer-send-message' to the task-notification member of SDKMessageOrigin, marking a notification raised by a cross-session SendMessage
• Added source: 'archive' plugin config variant to Settings, with url and optional sha256, for installing plugins from a zip over HTTPS
• Added sandbox credential-masking fields to Settings: decode: 'jwt' with maskClaims, extract/onExtractNoMatch on envVars, and awsPairs/sigv4 for AWS SigV4 re-signing
• Fixed long (>200 char) project paths resolving to another project's session directory under a shared sanitized prefix; session list/get/rename/tag/fork/delete and /resume no longer cross projects

v0.3.223

Compare Source

• Added resumeDropsTurn option: with resumeSessionAt, declares the turn a truncating resume intends to drop; the CLI refuses the resume if anything else would be discarded
• Result messages for repeated 529 overload failures now include api_error_status: 529, so SDK consumers can detect overload terminations structurally instead of matching message text
• Bare headless (-p / SDK query() without canUseTool) now emits system/permission_denied stream events when a tool call is auto-denied
• Documented usage vs modelUsage on stream-json results: usage is main-loop-only and per-turn; modelUsage is cumulative, covers all query-pipeline calls, and is the field for cost accounting

v0.3.222

Compare Source

• Fixed query({ sessionStore, resume }) not carrying user settings.json (apiKeyHelper, env, hooks, permissions) into the resumed subprocess

v0.3.221

Compare Source

• Improved skills option validation: malformed names (delimiters or control characters) and wildcard-form names are rejected with a clear error; use skills: 'all' to enable every skill
• Fixed external MCP servers passed via the mcpServers option not being connected before the first turn, which caused the model to emit tool calls as literal text

v0.3.220

Compare Source

• Updated to parity with Claude Code v2.1.220

v0.3.219

Compare Source

• Added opt-in cancel_queued to the interrupt control request (capability interrupt_cancel_queued_v1): cancels queued and pending-dispatch messages alongside the abort
• Added fast_mode_disabled_reason to result and init messages so SDK hosts can explain why fast mode is off
• Added DirectoryAdded lifecycle hook event to the control protocol, fired when a new working directory is registered mid-session
• Fixed the initialize response reporting fast_mode_state from the spawn-time model after a model switch
• Added sandbox.network.strictAllowlist to SDK settings types for deterministically denying non-allowlisted hosts in sandboxed commands
• Added workflowSizeGuideline to SDK settings types for setting the advisory dynamic-workflow size guideline

v0.3.218

Compare Source

• SkillToolOutput now reports background: true when a forked skill was dispatched as a detached background agent
• Fixed the result event's api_error_status reporting null for rate-limit and overloaded errors delivered mid-stream; it now reports 429/529
• Added canonicalModel and provider to each modelUsage entry in result messages so downstream billing can look up the correct rate table for costUSD

v0.3.217

Compare Source

• Changed subagents to no longer spawn nested subagents by default (depth cap lowered from 5 to 1); set CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH to allow deeper nesting
• Added a cap on concurrently-running subagents (default 20, override with CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS)
• Fixed Remote Control sessions not re-sending pending permission prompts to clients that connect after the prompt appeared

v0.3.216

Compare Source

• Added optional skippedLinks count to rewindFiles responses for paths the rewind safety guards refused to restore or delete
• Added tool_result_meta sidecar to user messages (non_execution_kind, user_feedback) so consumers can classify denied, interrupted, or cancelled tool calls without string-matching result prose
• Added optional user_message_uuid and request_sent_wall_ms fields to the success result message for cross-host request-latency correlation

v0.3.215

Compare Source

• Updated to parity with Claude Code v2.1.215

v0.3.214

• set_permission_mode now rejects unrecognized permission modes with an error instead of silently adopting them; the 'manual' alias is accepted at every ingress
• Added optional subkind: 'scheduled-trigger' to the task-notification member of SDKMessageOrigin, marking deliveries that are the fired prompt of a user-configured scheduled task
• applyFlagSettings({effortLevel}) now accepts 'max' in its TypeScript type (runtime already supported it)
• Assistant messages truncated by interrupt() now carry aborted: true, so consumers can distinguish a mid-stream partial from a completed message
• Added optional subagent_type and subagent_retry fields to tool_progress messages so clients can show a subagent waiting out an API rate-limit retry
• The system/init message's plugins entries and the reload_plugins response now include each plugin's manifest version
• SessionStart hooks now report source "fork" instead of "resume" when the session begins as a fork

v0.3.213

• Updated to parity with Claude Code v2.1.213

v0.3.212

Compare Source

• Fixed dash-leading resumeSessionAt and sessionId values being passed to the CLI as separate argv tokens; both now use equals-form (--flag=value)
• Agent tool output now includes the resolved model when a mid-turn model swap changed the subagent's model

v0.3.211

Compare Source

• Fixed --replay-user-messages with --include-partial-messages emitting the turn-start user replay after the first content block instead of before the turn's content events
• Added SDKAssistantMessage.timestamp (ISO-8601) to the live stream, matching SDKUserMessage; older emitters omit it, consumers should fall back to receive time
• Added rate-limit message prefix buckets (USAGE_LIMIT_ERROR_PREFIXES and siblings) as @alpha exports for classifying rate-limit messages without hand-mirrored lists
• Improved process-exit errors to include the CLI's stderr output, so a failed child reports its actual cause instead of only an exit code

v0.3.210

Compare Source

• Added timedOutAfterMs to BashToolOutput, set when a command is auto-backgrounded on timeout

v0.3.209

Compare Source

• Updated to parity with Claude Code v2.1.209

v0.3.208

Compare Source

• Fixed a caller abort during a pending SDK hook callback being converted into hook success, which let PreToolUse-gated tools execute after the abort
• Fixed a per-query resource leak in the SDK's process tracking when spawning the CLI fails (nonexistent or inaccessible executable path)
• Fixed an SDK UserPromptSubmit hook callback exceeding its timeout killing the entire query with an empty error; it now blocks the prompt with a clear timeout message and the session continues
• Fixed extraArgs values that look like flags (e.g. resume: '--version') being parsed as their own CLI flags; dash-leading values are now bound with equals-form argv
• Fixed an abort-listener leak: streaming queries sharing one AbortController no longer accumulate abort listeners on its signal after each completed query
• Fixed createSdkMcpServer docs pointing at a nonexistent env var; the MCP tool-call timeout knob is MCP_TOOL_TIMEOUT
• Fixed an uncaught exception when writing to stdin after the Claude Code subprocess has exited

v0.3.207

Compare Source

• Fixed canUseTool returning {behavior: 'allow'} without updatedInput being rejected as a deny with a raw ZodError message; the tool now runs with the original input per the documented contract
• The Agent tool's structured result now has a published SDK type (AgentToolCompletedOutput) that matches the emitted object exactly

v0.3.206

Compare Source

• Added command_lifecycle frames to stream-json and SDK sessions, reporting each uuid-stamped message's terminal state (queued/started/completed/cancelled/discarded); zero-API results no longer report stale duration_api_ms

v0.3.205

Compare Source

• Interrupt control responses now include still_queued (UUIDs of queued async messages that will still run), Query.interrupt() returns the typed receipt, and system/init advertises an interrupt_receipt_v1 capability for feature detection
• Added structured name and body fields to peer-message session events, exposing the sender display name and decoded message body

v0.3.204

Compare Source

• Added terminal_reason values tool_deferred_unavailable (deferred tool resume found the tool gone — previously an is_error result with no reason, read as a clean completion by lifecycle sweeps) and turn_setup_failed (the turn-input builder threw before the turn started). Both classify as dead turns, so commands consumed by them report command_lifecycle state cancelled
• Fixed the post-merge cancel backstop cancelling every member of a coalesced prompt batch when a cancel named only one: uncancelled siblings now re-merge and run (previously they were reported cancelled — on remote transports that acknowledged them as processed, silently dropping messages nobody cancelled)
• Added terminal_reason values api_error, malformed_tool_use_exhausted, budget_exhausted, and structured_output_retry_exhausted. Turns that die on an exhausted-API-retry or malformed-tool-use give-up previously reported completed; budget and structured-output exhaustion results previously omitted terminal_reason. Commands consumed by such turns now report command_lifecycle state cancelled instead of completed (dup-over-loss)
• Updated to parity with Claude Code v2.1.204

v0.3.203

Compare Source

• Added a background_tasks_changed system message with the full set of live background tasks on every membership change, so consumers can track background activity as a level instead of pairing task_started/task_notification edges
• Fixed stable releases shipping a sdk.d.ts with unresolved type references that broke consumer typechecking with skipLibCheck disabled

v0.3.202

Compare Source

• Added parent_agent_id field to subagent session messages for building depth-2+ agent trees from disk-persisted metadata
• Fixed apply_flag_settings with a non-object settings value crashing the session instead of returning a control error

v0.3.201

Compare Source

• Updated to parity with Claude Code v2.1.201

v0.3.200

Compare Source

• Added 'manual' as an accepted alias for the 'default' permission mode in SDK inputs
• Fixed onSetPermissionMode callback not firing for SDK-hosted Remote Control sessions
• Fixed set_model control request accepting unrecognized model strings; invalid models are now rejected before latching

v0.3.199

Compare Source

• Added requestId to canUseTool callback options for correlating out-of-band permission responses, and support for returning null to suppress the SDK's automatic control response
• Added blocked field to workflow_agent progress events indicating when an agent was blocked by the auto-mode safety classifier
• Added mode:"mask" and per-credential injectHosts to sandbox.credentials settings types for injecting masked credentials into sandboxed commands

v0.3.198

Compare Source

• Added a runtime warning when canUseTool is configured alongside allowedTools or bypassPermissions, which shadow the callback
• Added per-server request_timeout_ms option to mcp_set_servers control request
• Fixed SDKUserMessage.isSynthetic not being mapped to isMeta on ingestion, which could cause synthetic messages to be treated as real user messages
• Fixed workflow progress events silently dropping earliest agents from the list while the phase counter remained correct

v0.3.197

Compare Source

• Updated to parity with Claude Code v2.1.197

v0.3.196

Compare Source

• Added prompt_id field to hook input payloads for correlating hook events with OpenTelemetry prompt-level events
• Fixed control protocol deduplication dropping tool-use IDs after 1000 resolutions, which could cause duplicate tool_result deliveries in long-running sessions

v0.3.195

Compare Source

• Added Query.reinitialize() to re-send the initialize control request and redeliver pending permission/dialog prompts after a transport gap
• Fixed commands_changed event not being emitted for synced skills when the skill list resolves before the change-detector subscribes

v0.3.193

Compare Source

• Added promptSuggestions option to Browser SDK query() to opt the remote CLI into emitting follow-up suggestions
• Fixed brief console window flashes on Windows when spawning CLI subprocesses

v0.3.191

Compare Source

• Added old_source field to NotebookEdit tool results for replace and delete operations, enabling inline diffs
• Added seven_day_overage_included to SDKRateLimitInfo.rateLimitType for per-model weekly usage limits
• Added model_scoped array to usage response for per-model weekly limit windows with utilization and reset times
• Fixed fast mode reverting to standard after the first turn when settingSources includes user/project settings

v0.3.190

Compare Source

• Updated to parity with Claude Code v2.1.190

v0.3.187

Compare Source

• Added sandbox.credentials to SDK settings types for configuring credential file and environment variable denial in sandboxed commands

v0.3.186

Compare Source

• Added agent_id field to can_use_tool control requests — background agents now forward permission prompts to canUseTool instead of auto-denying, and stdin stays open while background tasks are running
• Added ReadMcpResourceDirTool tool type to SDK schemas — MCP resource directory listing is now a dedicated tool instead of a fallback inside ReadMcpResourceTool
• Added rewind_conversation control request for rewinding a conversation to a previous point with durable resume anchor support

actions/checkout (actions/checkout)

v7.0.1

Compare Source

• Bump github/codeql-action from 3 to 4 by @​dependabot[bot] in #​2475
• Bump actions/setup-node from 4 to 6 by @​dependabot[bot] in #​2477
• Bump docker/build-push-action from 6.5.0 to 7.2.0 by @​dependabot[bot] in #​2478
• Bump docker/login-action from 3.3.0 to 4.2.0 by @​dependabot[bot] in #​2479
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​2488
• Bump actions/upload-artifact from 4 to 7 by @​dependabot[bot] in #​2476
• eslint 9 by @​dependabot[bot] in #​2474
• Bump the minor-actions-dependencies group with 2 updates by @​dependabot[bot] in #​2499
• skip running unsafe pr check if input is default by @​aiqiaoy in #​2518
• trim only ascii whitespace for branch by @​aiqiaoy in #​2521
• escape values passed to --unset by @​aiqiaoy in #​2530

actions/setup-node (actions/setup-node)

v7.0.0

Compare Source

What's Changed

Enhancements:

• Add cache-primary-key and cache-matched-key as outputs by @​gowridurgad in #​1577
• Migrate to ESM and upgrade dependencies by @​gowridurgad in #​1574

Bug fixes:

• Remove dummy NODE_AUTH_TOKEN export by @​gowridurgad in #​1558
• Only use mirrorToken in getManifest if it's provided by @​deiga in #​1548

Documentation updates:

• Add documentation for publishing to npm with Trusted Publisher (OIDC) by @​chiranjib-swain in #​1536
• docs: Update restore-only cache documentation by @​priya-kinthali in #​1550
• docs: Update caching recommendations to mitigate cache poisoning risks by @​chiranjib-swain in #​1567

Dependency update:

• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in #​1569

New Contributors

• @​chiranjib-swain made their first contribution in #​1536
• @​deiga made their first contribution in #​1548
• @​jasongin made their first contribution in #​1569

Full Changelog: actions/setup-node@v6...v7.0.0

v7

Compare Source

microsoft/TypeScript (typescript)

v7.0.2

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	typescript@​6.0.3 ⏵ 7.0.2			-1		+10
	@​openai/​codex-sdk@​0.142.5 ⏵ 0.149.1	+26		+1	+1

View full report