[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
@anthropic-ai/sdk	^0.90.0 → ^0.137.0			devDependencies	minor
@changesets/changelog-github (source)	^0.6.0 → ^0.7.0			devDependencies	minor
@hono/node-server	1.19.11 → 1.19.17			dependencies	patch	1.19.18
@modelcontextprotocol/sdk (source)	1.28.0 → 1.32.2			devDependencies	minor
@react-three/drei	10.7.7 → 10.7.9			dependencies	patch
@react-three/fiber	9.5.0 → 9.8.2			dependencies	minor
@react-three/postprocessing	3.0.4 → 3.2.2			dependencies	minor
@types/node (source)	20.19.37 → 20.19.43			devDependencies	patch
@types/three (source)	^0.183.1 → ^0.187.0			dependencies	minor
actions/checkout	v6.0.2 → v6.1.0			action	minor
actions/setup-node	v6.4.0 → v6.5.0			action	minor
changesets/action	v1.7.0 → v1.9.0			action	minor
fuse.js (source)	7.1.0 → 7.5.0			dependencies	minor
hono (source)	4.12.9 → 4.13.16			dependencies	minor
pnpm (source)	10.12.4 → 10.34.9			packageManager	minor
tailwind-merge (source)	3.5.0 → 3.7.0			dependencies	minor
three (source)	^0.183.2 → ^0.187.0			dependencies	minor
troika-three-text (source)	^0.52.4 → ^0.53.0			dependencies	minor	0.53.1
vite (source)	6.4.1 → 6.4.5			devDependencies	patch
yaml (source)	2.8.2 → 2.9.1			dependencies	minor
zod (source)	4.3.6 → 4.6.7			devDependencies	minor

---

Release Notes

anthropics/anthropic-sdk-typescript (@​anthropic-ai/sdk)

v0.137.0

Features

• api: add org webhook endpoints and user profile enforcement events

Chores

• ci: run the changelog check on a standard runner
• tests: make credential tests independent of the caller's environment

v0.136.0

Features

• api: add data_refreshed_at and has_more to analytics report pages
• api: add workspace rate-limit updates to the Admin API
• api: make User Profiles generally available
• client: yield server-sent events with unrecognized event names
• tools: accept every tool definition field in the tool helpers

Bug Fixes

• client: treat x-amz-security-token as a sensitive header
• tools: keep $ sequences literal in memory tool str_replace

Chores

• ci: skip the changelog check on draft pull requests
• docs: add credential expiry descriptions to the Managed Agents API reference
• docs: add Messages API request descriptions
• docs: correct plugin manifest_version and reach descriptions
• docs: improve Managed Agents memory store descriptions
• docs: improve Managed Agents vault and credential descriptions
• internal: bump playwright-core in the browser ecosystem tests
• tests: cover OpenTelemetry failures, propagation and environment variables

v0.135.0

Features

• api: add between_tools to thinking types in model capabilities
• api: add the speed parameter and usage.speed to Messages
• api: return a Console organization's usage-tier spend cap as a read-only spend limit

Bug Fixes

• client: close streams dropped without being read to the end
• client: keep an unread JSONL response open while it is held

Chores

• ci: speed up breaking change detection
• docs: describe headers on Managed Agents and telemetry endpoints

Documentation

• api: note that some models need a beta header to use speed

v0.134.0

Features

• api: add execution_identity to Managed Agents agents

• api: add organization_type_not_supported error to spend limit lists

• api: add telemetry destination test endpoint

• api: add telemetry destinations to the Admin API

• client: add native support for OpenTelemetry tracing

  If your app registers a global tracer provider, the SDK will create spans with it after upgrading, and they'll be exported with the rest of your traces. Requests will also get trace context headers from the global propagator. To disable, pass openTelemetry: false to the client or set ANTHROPIC_OPEN_TELEMETRY=false. Learn more in the documentation.

Bug Fixes

• api: rename telemetry destination test response model
• client: close an unread stream that was dropped while tracing is on
• client: don't follow redirects on token requests
• client: treat proxy-authorization as a sensitive header

Bug Fixes

• streaming: tolerate unknown event types in MessageStream and BetaMessageStream
• streaming: stop throwing "Unexpected event order" for an event before message_start
• streaming: yield events that arrive before message_start when iterating MessageStream and BetaMessageStream

Chores

• docs: correct prefill, thinking, fallback and model descriptions
• docs: document the scope required to assign the managed role
• docs: update model examples
• include the license files in the published packages
• internal: narrow the tripwire test rule in the contributor guides
• internal: remove @internal tag from a type that public types reference
• internal: remove file-level @internal tags from toolset modules
• internal: strip @internal declarations from published types
• internal: type-check the built declarations in lint

Documentation

• api: clarify when custom tool results can be sent
• api: say is_enabled is always true for user spend limits
• move more shared rules into the shared part of CLAUDE.md
• show examples of streaming-only methods iterating the stream

v0.133.0

Features

• api: add types for the Chat and Cowork unified analytics metrics
• api: add workflows, multiagent configuration and thread status filtering to Managed Agents

Chores

• internal: remove the next branch rule from CLAUDE.md

v0.132.1

Bug Fixes

• client: throw before sending a request with an empty path parameter

Chores

• ci: check that pull requests update the changelog
• ci: publish every package from the publish workflow
• docs: note that listing Claude Console spend limits is in early access

Documentation

• split CLAUDE.md into shared, TypeScript, and repository rules

v0.132.0

Full Changelog: sdk-v0.131.0...sdk-v0.132.0

Features

• api: add claude-haiku-5-5 and typed computer and browser toolset tool calls (1fd8261)
• api: add disabled to thinking types in model capabilities (2b75b49)
• api: add display_name to RBAC roles and deprecate name (7735ac3)
• api: add include_default parameter to list workspaces (c4019df)
• api: add lifecycle stage fields and filter to /v1/models (fe8a762)
• api: add line to model objects (018aed4)
• api: add url_sources to the Managed Agents web_fetch tool config (2b75b49)
• api: add web search and code execution support to model capabilities (2b75b49)

Bug Fixes

• api: send the beta header by default when listing spend limits (8f58ca4)
• client: throw when a JSONL stream is iterated twice (a34266c)
• tools: keep a local edit made after a memory upload whose response was lost (#​893) (2b75b49)

Chores

• api: mark the Text Completions API as deprecated (2b75b49)
• docs: correct example groups in rate limit list description (f0e6394)
• docs: correct when usage and cost report data becomes final (2b75b49)
• docs: describe a federation rule's target by its type (2b75b49)
• docs: fix example IDs in sessions, agents and vault credentials (2b75b49)
• docs: update Managed Agents multiagent and thread descriptions (2b75b49)
• docs: update the activity summaries endpoint description (24f13f2)
• docs: update the description of the Model line field (e3bfc76)
• internal: add REVIEW.md with review instructions (2b75b49)
• internal: refactor deprecated models (5927033)
• tests: run tests skipped for a query param bug that is now fixed (4c74721)
• tests: run tests that an older mock server could not serve (8100a49)
• tests: run the skipped MCP resource upload test (#​888) (2b75b49)

Documentation

• api: state the agent tools limit as 256 (7d2a9ef)
• examples: show initial_events when creating a Managed Agents session (2b75b49)

v0.131.0

Full Changelog: sdk-v0.130.0...sdk-v0.131.0

Features

• api: add list spend limits endpoint (cfb78c8)

Chores

• client: deprecate sonnet 4.5 (d72cfaf)

v0.130.0

Full Changelog: sdk-v0.129.0...sdk-v0.130.0

Features

• api: add a refusal stop reason and stop_details to Managed Agents session idle events (5cd6910)
• api: add Claude Enterprise analytics, spend limits, and RBAC groups and roles to the Admin API (109c766)
• api: add per-user usage and cost reports to the Admin API analytics (0a74a28)
• api: add Plugins and Plugin Marketplaces to the Admin API (40c2160)
• api: add repository error types to Managed Agents session errors (6735615)
• api: allow removing a plugin's org-wide installation setting (c7d120f)
• api: MCP tunnels beta: add read-only transport object to Tunnel and return the one-time relay token in the create response (b0e57ce)
• api: Organization API endpoints are now GA (1a1fd8f)

Bug Fixes

• api: make memory store description, metadata, archived_at required (ed68900)
• api: type admin plugin preference and marketplace fields as enums (942ae01)
• pagination: auto-paging continues past an empty page while next_page is set (2d75266)
• tool-runner: only send API fields for runnable tools (#​404) (a62c2a2)
• tools: stop the session tool runner after any idle that ends the turn (#​878) (cab32f8)

Chores

• api: update MCP Tunnels types and descriptions (394d60c)
• docs: remove placeholder enum descriptions (04f0812)
• tests: fixture update (#​381) (9cfe4d4)

v0.129.0

Full Changelog: sdk-v0.128.0...sdk-v0.129.0

Features

• api: add between_tools thinking type (ab51075)
• api: add claude-sonnet-5-5 (4e77366)
• api: add ClientToolUnion type for client-executed tools (2c1d2d7)
• api: add include_inherited and source to workspace rate limits (66e925e)
• api: add typed event type values to the Managed Agents events list filter (8ac4a26)
• api: cache diagnostics GA — diagnostics on Message / MessageCreateParams (5ba5f29)
• tools: optionally start tool calls while the reply streams (083969b)

Bug Fixes

• client: also send X-Stainless-Timeout for client-level timeouts (b84783b)
• client: send upload filenames as given, with no placeholder (f9d3e98)
• helpers: degrade between_tools thinking to disabled on fallback hops (#​841) (edbbf05)
• internal: let bundlers drop unused classes with more than ten private-member assignments (67c7adb)
• streaming: show every complete array item and hold back unfinished numbers in partial tool input (#​781) (5806588)

Performance Improvements

• streaming: drop the redundant iterSSEChunks layer (0357f81)
• streaming: take each string token as one slice in the partial JSON tokenizer (#​255) (cdfb1e5)

Chores

• api: deprecate the betas param on GA models and completions methods (5c74e45)
• api: list the known model ids first in the Model types (9452822)
• ci: choose the CI runner by repository (33db1ec)
• docs: clarify that stream: true returns the raw event stream (4286c22)
• docs: make Managed Agents actor descriptions resource-neutral (15733f9)
• docs: restore the research-preview notice on the Dream type (b32f8ba)
• internal: move old constants around (0cd8edf)
• tests: add diagnostics to the parser test's Message fixtures (eb5ca58)
• tools: remove client-side compaction control (#​802) (9c3e8a5)

Documentation

• api: prefer each field's own description over its shared type's (5193478)
• expand CLAUDE.md into a full contributor guide (98d2ddb)

v0.128.0

Full Changelog: sdk-v0.127.0...sdk-v0.128.0

Features

• api: add support for claude-opus-5-5, inline tool definitions and MCP tool-list pinning (beta) (eff2748)

Bug Fixes

• api: share one evaluated_permission enum across Managed Agents events (0c1cc0f)
• tools: addTools() takes effect straight away (#​773) (1ccdad0)
• tools: leave reply-only params off the tool runner's compaction request (#​769) (8afc336)

Chores

• docs: add descriptions to the Dreams API reference (ea4ddd1)
• docs: add descriptions to the User Profiles API reference (ea4ddd1)
• docs: add memory store descriptions to the Managed Agents API reference (ea4ddd1)
• docs: improve descriptions in the Dreams API reference (971c54a)
• docs: simplify the session thread agent type description (ccf71a2)
• docs: update diagnostics field descriptions on beta messages (c0b8746)
• internal: add property-based tests for partial JSON parsing (#​776) (3ffac09)

v0.127.0

Full Changelog: sdk-v0.126.0...sdk-v0.127.0

Features

• api: add group with display_name to rate limits, deprecate group_type (2575d97)
• tools: add compactBeforeNextTurn() to the tool runner (#​682) (9f75ca6)

Bug Fixes

• BetaMessageStream: stop coercing a null compaction_delta content into "null" (#​655) (dbd6845)
• client: don't retry requests whose body is a stream or iterator (eebc1b9)
• client: join multiple anthropic-beta values with a comma and no space (#​638) (e0cb1ff)
• client: make pagination exports on the client namespace type-only (5adea1f)
• internal: drop jest from tsconfig types (60588af)
• middleware: echo a streamed compaction summary in the fallback continuation (#​657) (2e0f004)
• tools: keep $defs when transformJSONSchema root is a $ref (#​687) (57a9f30)

Performance Improvements

• client: skip formatting request details when debug logging is off (2b29ed2)

Chores

• ci: publish releases from Node 24 with its bundled npm (6b3c6f5)
• docs: add descriptions for enum values and path parameters (cb254c4)
• docs: clarify the compaction tool_changes and tool change descriptions (5a695eb)
• internal: build the sub-packages with TypeScript 6.0.3 (8a69ff5)
• internal: build with TypeScript 6.0.3 and typescript-eslint 8.58.0 (01f3ee6)
• internal: keep lib/internal out of the published exports map (763fb43)
• internal: re-export pagination classes with a plain export list (c77bdc3)
• internal: share a single Simplify type util (31d5e75)
• internal: switch unit tests from jest to vitest (110542d, 788c9c6)

v0.126.0

Full Changelog: sdk-v0.125.0...sdk-v0.126.0

Features

• api: add auto mode tool permissions for Managed Agents (7829b43)
• api: add compaction parameter and signed compaction blocks (beta) (05fd878)
• api: add enum types for workspace data-residency geo fields (89c5920)
• api: add thinking_mismatch_allowed entries to input_transformations (beta) (1f32871)
• api: add url_sources to the web fetch tool (ee23dd2)
• api: add workspace_id parameter to user profiles methods (f5b9fb7)

Bug Fixes

• api: mark usage iteration model as nullable (bec3bec)
• api: use one input transformation type for message and delta event (e016d25)
• client: ignore invalid Retry-After values and validate maxRetries (7829b43)
• client: retry connection errors in the async client and stop blocking in the coroutine retry loop (7829b43)
• client: stop waiting for a retry as soon as the request is aborted (941aaea)
• client: use the default backoff when Retry-After is out of range (1090c44)
• internal: stop a declaration file using a type that needs TypeScript 5.7 (e32a956)

Performance Improvements

• add "sideEffects": false so bundlers can drop unused modules (f804366)
• mark classes as pure so bundlers can drop unused ones (f804366)

Chores

• docs: clarify that session_thread_id on tool use events is informational (a07ecf3)
• docs: correct the compaction beta's parameter descriptions (eb9abd2)
• internal: move the sub-packages off ts-node and modernise their tsconfig (1d7cd91)
• internal: move tsconfig off settings deprecated in TypeScript 6 (e0d58f6)
• internal: pin the pnpm version with an integrity hash (f804366)
• internal: root package drops ts-node; repo root becomes ESM (3f371a1)
• internal: stop using ts-node for the publish script and the ecosystem test runner (2e589c8)
• tests: stop the mock server without failing a passing test run (a364c12)

Documentation

• api: clarify usage.iterations entry typing under server-side fallback (c5f0ef3)
• api: compaction instructions replace the server's summarization prompt (941aaea)
• api: fix typo in temperature deprecation message (4a8b49b)
• stop documenting unions with their first variant's description (fa06caf)

v0.125.0

Full Changelog: sdk-v0.124.0...sdk-v0.125.0

Features

• api: add auto mode tool permissions for Managed Agents (7f5e2c6)
• api: add content_too_large web_fetch tool error code (f06416e)
• api: add the user-profiles-2026-09-04 beta value and external_user_details to user profiles (318d42d)
• api: support mounting public GitHub repositories without an authorization_token in Managed Agents sessions (9e2d945)

Chores

• client: clean up the unused idempotency request option (4ce2772)
• docs: correct the environment scope field description (835c677)
• internal: restore package version (b43a7f6)
• internal: stop stamping the package version into generated files (80ace5e)
• tests: restore empty test package marker files (4f27519)

v0.124.0

Full Changelog: sdk-v0.123.0...sdk-v0.124.0

Features

• api: add Claude Tag category and user breakdowns to usage reports (669ff22)
• api: add named types for organization compliance settings state (54be8da)
• api: add support for sending a workspace ID on more endpoints (a11e6f1)

Bug Fixes

• repair custom-code merge in messages resources (#​455) (7ac43b9)
• tools: create agent-toolset files and directories owner-only (#​485) (a9c2298)

Chores

• internal: bundle the mock server spec and update breaking-change detection (8752d02)
• internal: codegen related update (a63afbc)
• tests: reword the skip reason on the path-level query param tests (999bee5)

Documentation

• api: update a few doc strings (2ef3d59)

v0.123.0

Full Changelog: sdk-v0.122.0...sdk-v0.123.0

Features

• api: beta user profiles: add external_user_onboarded_at, remove relationship in favor of access_type (3efb1a1)
• api: manual updates (c6f0bda)
• api: organization compliance settings, user-profile order_by, memory-store and toolset schema updates (8e2f0c2)

Bug Fixes

• keep credential file access out of non-Node bundles (ab6a4b2)

Chores

• internal: codegen related update (788ea8b)

Documentation

• changelog: detail the beta files/skills GA-shape change (#​1175) (4951de0)

v0.122.0

Full Changelog: sdk-v0.121.0...sdk-v0.122.0

Features

• api: beta files/skills namespaces use GA shapes; drop dated beta header pins (45d693a)

  The beta Files and Skills namespaces (client.beta.files, client.beta.skills) no longer send the files-api-2025-04-14 / skills-2025-10-02 headers and return the same shapes as client.files / client.skills (with Beta-prefixed type names). Requests that still send those headers on raw HTTP keep receiving the beta shapes.

  Changes in the beta namespaces:

  • client.beta.skills.delete() now deletes a Skill together with all of its versions (previously refused while any version existed). It returns BetaDeletedSkill (was SkillDeleteResponse).
  • Beta Messages type BetaSkill (the {type, skill_id, version} entry in BetaContainer.skills) is renamed BetaContainerSkill; the request-side BetaSkillParams keeps its name. BetaSkill now names the Skill object returned by client.beta.skills.create() / retrieve() / list() (replacing SkillCreateResponse / SkillRetrieveResponse / SkillListResponse), and skill versions are BetaSkillVersion / BetaDeletedSkillVersion (replacing Version*Response).
  • client.beta.files.list() returns a BetaFileMetadataPageCursor (PageCursor<BetaFileMetadata> with data / next_page) and FileListParams paginates with page / ids (was BetaFileMetadataPage, a Page<BetaFileMetadata> with data, has_more, first_id, last_id and before_id / after_id); for await auto-pagination is unchanged. BetaSkill uses display_name (was display_title, also in SkillCreateParams) and latest_version_id (was latest_version), and BetaSkillVersion is addressed by its skver_… id (the Unix-timestamp version field is gone).

  Migration guides: Migrate from files-api-2025-04-14 · Migrate from skills-2025-10-02

Bug Fixes

• client: classify cross-realm DOMException abort/timeout errors correctly (1bd6395)
• client: use configured logger for SSE parse errors (80eeaf7)
• sessions: make event accumulator forward-compatible with new event types (#​410) (2d084fd)
• tools: let read return a view_range of a file over the size cap (#​427) (56b3260)
• uploads: default bare Blob filename on skills endpoints (#​422) (e111649)
• webhooks: require headers to be passed to unwrap() (3230804)

Chores

• internal: codegen related update (c2f327a)

Documentation

• api: clarify pagination on the organization rate-limit list endpoints (d6015b9)
• document TypeScript 5.0 as the minimum supported version (788e721)

v0.121.0

Full Changelog: sdk-v0.120.0...sdk-v0.121.0

Features

• api: add updates thinking display mode (beta) (22274ea)
• api: add missing anthropic-beta values (0779f02)
• api: add support for Organization API endpoints (8b61e7a)
• helpers: support Standard Schema for structured outputs and tools (7880078)

Bug Fixes

• tools: keep the tool runner going on pause_turn (#​288) (f040dc9)
• types: don't reference NodeJS.ProcessEnv from published types (#​367) (fd38dfd)

Chores

• docs: clarify skill version latest support and memory version retention (7405a69)
• examples: remove redundant main().catch boilerplate (154ace7)
• internal: cancel superseded CI runs (0532c98)
• internal: codegen related update (228ff1e)
• internal: minor workflow reformat (41b6c31)
• internal: tighten publint and attw lint checks (e3fbd62)

Documentation

• api: clarify session thread agent and usage.iterations compaction descriptions (beta) (6e852a7)
• examples: use adaptive thinking in thinking examples (3dd7699)

v0.120.0

Full Changelog: sdk-v0.119.0...sdk-v0.120.0

Features

• api: managed agents web search config and self hosted sandbox memory (ba8ec50)

Chores

• internal: use a single pnpm workspace lockfile (#​359) (3c32145)

[

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: src/dev/ui/package-lock.json

npm warn Unknown env config "store". This will error in a future major version of npm. See `npm help npmrc` for supported config options.
npm error code ERESOLVE
npm error ERESOLVE unable to resolve dependency tree
npm error
npm error While resolving: madrigal-dev-ui@undefined
npm error Found: three@0.187.0
npm error node_modules/three
npm error   three@"^0.187.0" from the root project
npm error   peer three@">= 0.156.0" from @react-three/postprocessing@3.2.2
npm error   node_modules/@react-three/postprocessing
npm error     @react-three/postprocessing@"^3.0.4" from the root project
npm error   1 more (@react-three/fiber)
npm error
npm error Could not resolve dependency:
npm error peer three@">= 0.168.0 < 0.187.0" from postprocessing@6.39.5
npm error node_modules/postprocessing
npm error   peer postprocessing@"^6.36.0" from @react-three/postprocessing@3.2.2
npm error   node_modules/@react-three/postprocessing
npm error     @react-three/postprocessing@"^3.0.4" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry this command with --force or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-11-03T08_08_42_908Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-11-03T08_08_42_908Z-debug-0.log