Skip to content

chore(deps): bump @anthropic-ai/sdk from 0.117.1 to 0.120.0 - #95

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/anthropic-ai/sdk-0.120.0
Open

chore(deps): bump @anthropic-ai/sdk from 0.117.1 to 0.120.0#95
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/anthropic-ai/sdk-0.120.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 24, 2026

Copy link
Copy Markdown
Contributor

Bumps @anthropic-ai/sdk from 0.117.1 to 0.120.0.

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk: v0.120.0

0.120.0 (2026-08-19)

Full Changelog: sdk-v0.119.0...sdk-v0.120.0

Features

  • api: managed agents web search config and self hosted sandbox memory (ba8ec50)

Chores

  • internal: use a single pnpm workspace lockfile (#359) (3c32145)

sdk: v0.119.0

0.119.0 (2026-08-19)

Full Changelog: sdk-v0.118.0...sdk-v0.119.0

Features

  • api: Files and Skills APIs are now GA; add computer use and browser use toolsets (ab41aa3)

sdk: v0.118.0

0.118.0 (2026-08-18)

Full Changelog: sdk-v0.117.1...sdk-v0.118.0

Features

  • api: additions to files and memory stores (fdc0379)
  • api: updates to skill, files, and user profiles (671e6b1)
  • client: add helpers for accessing the workspace ID in response headers (28aa5af)

Bug Fixes

  • api: remove unsupported mid_conv_system content block (ae6ca94)
  • session-runner: retry tool-result sends for at least the lease TTL (#339) (7dc6325)

Chores

  • internal: bump zod to 4.4.3 (#334) (faa5b7b)
  • internal: remove leftover prism references (a163b96)
  • stop shipping the v0.50 migration guide and migrate CLI (53992d7)

Documentation

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.120.0 (2026-08-19)

Full Changelog: sdk-v0.119.0...sdk-v0.120.0

Features

  • api: managed agents web search config and self hosted sandbox memory (ba8ec50)

Chores

  • internal: use a single pnpm workspace lockfile (#359) (3c32145)

0.119.0 (2026-08-19)

Full Changelog: sdk-v0.118.0...sdk-v0.119.0

Features

  • api: Files and Skills APIs are now GA; add computer use and browser use toolsets (ab41aa3)

0.118.0 (2026-08-18)

Full Changelog: sdk-v0.117.1...sdk-v0.118.0

Features

  • api: additions to files and memory stores (fdc0379)
  • api: updates to skill, files, and user profiles (671e6b1)
  • client: add helpers for accessing the workspace ID in response headers (28aa5af)

Bug Fixes

  • api: remove unsupported mid_conv_system content block (ae6ca94)
  • session-runner: retry tool-result sends for at least the lease TTL (#339) (7dc6325)

Chores

  • internal: bump zod to 4.4.3 (#334) (faa5b7b)
  • internal: remove leftover prism references (a163b96)
  • stop shipping the v0.50 migration guide and migrate CLI (53992d7)

Documentation

  • tools: warn that blocking tool bodies stall the worker heartbeat (#299) (908fdb5)
Commits
  • bfa9197 chore: release main
  • bc167f3 feat(api): managed agents web search config and self hosted sandbox memory
  • 83fd898 chore(internal): use a single pnpm workspace lockfile (#359)
  • 7fe6dd5 remove internal ticket references from changelog- #360
  • c67e4e2 chore: release main
  • 50fc0db feat(api): Files and Skills APIs are now GA; add computer use and browser use...
  • 18ea26d chore: release main
  • 6ed9ddd feat(api): updates to skill, files, and user profiles
  • 91921f5 fix(session-runner): retry tool-result sends for at least the lease TTL (#339)
  • 142adcc docs(tools): warn that blocking tool bodies stall the worker heartbeat (#299)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript) from 0.117.1 to 0.120.0.
- [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md)
- [Commits](anthropics/anthropic-sdk-typescript@sdk-v0.117.1...sdk-v0.120.0)

---
updated-dependencies:
- dependency-name: "@anthropic-ai/sdk"
  dependency-version: 0.120.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 24, 2026
@github-actions

Copy link
Copy Markdown

supply-chain-guard Scan Report

WARNING: Findings were detected.

Canonical JSON report: 3 reportable finding(s).

## 🛡️ supply-chain-guard Scan Report

| Property | Value |
|----------|-------|
| Target | `.` |
| Type | directory |
| Time | 2026-08-24T04:41:00.811Z |
| Duration | 860ms |
| **Risk Score** | **6/100** (LOW) |

### Summary

Scanned 67 of 72 files.

🔵 3 low

### Findings

#### 🔵 [LOW] Action "homeofe/supply-chain-guard&#64;v5" uses a version tag instead of a commit SHA. Tags can be force-pushed to point to different commits.

- **Rule:** `GHA_TAG_NOT_SHA`
- **File:** `.github/workflows/supply-chain-guard.yml:27`
- **Match:** `homeofe/supply-chain-guard&#64;v5`
- **Recommendation:** Consider pinning this action to a full commit SHA for maximum security. Tags can be moved to point to malicious code.

#### 🔵 [LOW] Action "homeofe/supply-chain-guard&#64;v5" is from third-party owner "homeofe". Third-party actions can be compromised.

- **Rule:** `GHA_THIRD_PARTY_ACTION`
- **File:** `.github/workflows/supply-chain-guard.yml:27`
- **Match:** `homeofe/supply-chain-guard&#64;v5`
- **Recommendation:** Pin "homeofe/supply-chain-guard&#64;v5" to a specific commit SHA and audit the action source code before use.

#### 🔵 [LOW] Build workflow found but no signed provenance or attestation detected &amp;#40;SLSA Level 1&amp;#41;. Artifacts cannot be cryptographically verified.

- **Rule:** `SLSA_NO_PROVENANCE`
- **Recommendation:** Add 'slsa-framework/slsa-github-generator' or 'actions/attest-build-provenance' to your release workflow to reach SLSA Level 2. Consider cosign for container signing.

### Recommendations

- Review the listed findings and assess whether they represent legitimate functionality or potential threats.

---
*Generated by [supply-chain-guard](https://github.com/homeofe/supply-chain-guard)*

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants