fix(deps): update minor and patch updates by renovate[bot] · Pull Request #194 · workos/cli

renovate · 2026-07-15T00:49:02Z

This PR contains the following updates:

Package	Change	Age	Confidence
@anthropic-ai/claude-agent-sdk	`0.3.201` → `0.3.210`
@anthropic-ai/sdk	`^0.106.0` → `^0.111.0`
@clack/prompts (source)	`1.6.0` → `1.7.0`
@types/node (source)	`22.20.0` → `22.20.1`
@workos/emulate	`^0.1.0` → `^0.2.0`
@workos/openapi-spec	`^0.14.0` → `^0.32.0`
oxfmt (source)	`^0.56.0` → `^0.59.0`
oxlint (source)	`1.72.0` → `1.74.0`
pnpm (source)	`10.34.4` → `10.34.5`
tsx (source)	`4.23.0` → `4.23.1`
xstate (source)	`5.32.4` → `5.32.5`

Release Notes

anthropics/claude-agent-sdk-typescript (@anthropic-ai/claude-agent-sdk)

`v0.3.210`

Compare Source

Added timedOutAfterMs to BashToolOutput, set when a command is auto-backgrounded on timeout

`v0.3.209`

Compare Source

Updated to parity with Claude Code v2.1.209

`v0.3.208`

Compare Source

Fixed a caller abort during a pending SDK hook callback being converted into hook success, which let PreToolUse-gated tools execute after the abort
Fixed a per-query resource leak in the SDK's process tracking when spawning the CLI fails (nonexistent or inaccessible executable path)
Fixed an SDK UserPromptSubmit hook callback exceeding its timeout killing the entire query with an empty error; it now blocks the prompt with a clear timeout message and the session continues
Fixed extraArgs values that look like flags (e.g. resume: '--version') being parsed as their own CLI flags; dash-leading values are now bound with equals-form argv
Fixed an abort-listener leak: streaming queries sharing one AbortController no longer accumulate abort listeners on its signal after each completed query
Fixed createSdkMcpServer docs pointing at a nonexistent env var; the MCP tool-call timeout knob is MCP_TOOL_TIMEOUT
Fixed an uncaught exception when writing to stdin after the Claude Code subprocess has exited

`v0.3.207`

Compare Source

Fixed canUseTool returning {behavior: 'allow'} without updatedInput being rejected as a deny with a raw ZodError message; the tool now runs with the original input per the documented contract
The Agent tool's structured result now has a published SDK type (AgentToolCompletedOutput) that matches the emitted object exactly

`v0.3.206`

Compare Source

Added command_lifecycle frames to stream-json and SDK sessions, reporting each uuid-stamped message's terminal state (queued/started/completed/cancelled/discarded); zero-API results no longer report stale duration_api_ms

`v0.3.205`

Compare Source

Interrupt control responses now include still_queued (UUIDs of queued async messages that will still run), Query.interrupt() returns the typed receipt, and system/init advertises an interrupt_receipt_v1 capability for feature detection
Added structured name and body fields to peer-message session events, exposing the sender display name and decoded message body

`v0.3.204`

Compare Source

Added terminal_reason values tool_deferred_unavailable (deferred tool resume found the tool gone — previously an is_error result with no reason, read as a clean completion by lifecycle sweeps) and turn_setup_failed (the turn-input builder threw before the turn started). Both classify as dead turns, so commands consumed by them report command_lifecycle state cancelled
Fixed the post-merge cancel backstop cancelling every member of a coalesced prompt batch when a cancel named only one: uncancelled siblings now re-merge and run (previously they were reported cancelled — on remote transports that acknowledged them as processed, silently dropping messages nobody cancelled)
Added terminal_reason values api_error, malformed_tool_use_exhausted, budget_exhausted, and structured_output_retry_exhausted. Turns that die on an exhausted-API-retry or malformed-tool-use give-up previously reported completed; budget and structured-output exhaustion results previously omitted terminal_reason. Commands consumed by such turns now report command_lifecycle state cancelled instead of completed (dup-over-loss)
Updated to parity with Claude Code v2.1.204

`v0.3.203`

Compare Source

Added a background_tasks_changed system message with the full set of live background tasks on every membership change, so consumers can track background activity as a level instead of pairing task_started/task_notification edges
Fixed stable releases shipping a sdk.d.ts with unresolved type references that broke consumer typechecking with skipLibCheck disabled

`v0.3.202`

Compare Source

Added parent_agent_id field to subagent session messages for building depth-2+ agent trees from disk-persisted metadata
Fixed apply_flag_settings with a non-object settings value crashing the session instead of returning a control error

anthropics/anthropic-sdk-typescript (@anthropic-ai/sdk)

`v0.111.0`

Compare Source

Full Changelog: sdk-v0.110.0...sdk-v0.111.0

Features

api: add support for dreaming (77b28a6)
tools: gate session tool calls on evaluated_permission; bound idle by server stop_reason (68a6d7b)

Chores

docs: small updates to field descriptions (e25b885)
docs: update model example (a33f3f0)
docs: updates to descriptions and examples (eac4bac)

`v0.110.0`

Compare Source

Full Changelog: sdk-v0.109.1...sdk-v0.110.0

Features

api: add agent-memory-2026-07-22 beta header (a470e10)

`v0.109.1`

Compare Source

Full Changelog: sdk-v0.109.0...sdk-v0.109.1

Chores

api: remove some nonfunctional types from the SDKs (cc4dd4e)

`v0.109.0`

Compare Source

Full Changelog: sdk-v0.108.0...sdk-v0.109.0

Features

api: add support for Managed Agents event delta streaming, agent overrides, reverse pagination, vault credential injection scoping, and agent and deployment webhook events (7f3211b)

`v0.108.0`

Compare Source

Full Changelog: sdk-v0.107.0...sdk-v0.108.0

Features

api: add support for claude-sonnet-5 (4588db0)

Bug Fixes

agent-toolset: allow absolute paths that resolve inside workdir (#112) (e951fb2)

Chores

format README.md (#176) (98dcff7)

`v0.107.0`

Compare Source

Full Changelog: sdk-v0.106.0...sdk-v0.107.0

Features

api: add support for 2026031 web fetch and support tools (d7057ea)

Bug Fixes

agent-toolset: bound canonicalize symlink hops; resolve glob matches before confinement check (#142) (277be80)
types: restore BatchCreateParams.Request.params dropped by codegen merge (#165) (c6b68d2)

Chores

api: accept user profile ID's when counting tokens (6cda67e)
docs: updates to descriptions and example values (51a5f81)

Documentation

update readme requirements to match anthropic docs (#146) (3818412)

bombshell-dev/clack (@clack/prompts)

`v1.7.0`

Compare Source

Minor Changes

#574 8f1c380 Thanks @dreyfus92! - Add showInstructions option to select, multiselect, and groupMultiselect. Keyboard hints remain shown by default; pass showInstructions: false to hide them.

Patch Changes

#582 4b24953 Thanks @43081j! - Handle empty arrays in various prompts and utilities.
Updated dependencies [4b24953]:
- @clack/core@1.4.3

workos/emulate (@workos/emulate)

`v0.2.1`

Compare Source

Bug Fixes

auth: Echo original session method on refresh_token (#14) (97fb951)
auth: Emit spec-valid authentication_method (#12) (3066f71)

`v0.2.0`

Compare Source

Features

add response-shape conformance codegen and test (#9) (358773b)
provide an end-to-end login flow story with spec-accurate webhooks (#2) (fa39dfe)
seed M2M apps and API keys (#10) (f761419)

workos/openapi-spec (@workos/openapi-spec)

oxc-project/oxc (oxfmt)

`v0.59.0`

Compare Source

🐛 Bug Fixes

415fe1e oxfmt: Error on ignorePatterns that cannot match files outside the config directory (#24286) (leaysgur)

`v0.58.0`

Compare Source

`v0.57.0`

Compare Source

oxc-project/oxc (oxlint)

`v1.74.0`

Compare Source

🚀 Features

0433a83 linter/eslint/no-inner-declarations: Add namespaces option (#24044) (Boshen)

🐛 Bug Fixes

8337835 linter: Error on ignorePatterns that cannot match files aoutside the config directory (#24341) (leaysgur)
2ce5a33 linter: Resolve ignorePatterns relative to the config dir (#24339) (leaysgur)

⚡ Performance

7f80cac linter/vue/prop-name-casing: Precompile ignoreProps regex pattern (#24413) (connorshea)
6272051 linter/typescript/no-require-imports: Compile allow patterns once (#24417) (connorshea)
33805b9 linter/jsdoc/require-param: Compile checkTypesPattern regex once (#24420) (connorshea)

`v1.73.0`

Compare Source

🚀 Features

a2c97f3 linter/unicorn: Implement explicit-timer-delay rule (#23612) (Mikhail Baev)
85735cb linter/unicorn: Implement no-confusing-array-with rule (#23638) (Shekhu☺️)
cb4fbb9 linter/eslint: Implement no-unreachable-loop rule (#23975) (Todor Andonov)
dc32112 linter/eslint/no-constant-binary-expression: Check relational comparisons (#24088) (camc314)
d963967 linter/unicorn/no-array-sort: Add allowAfterSpread option (#24043) (Boshen)
0a75682 linter: Add per-rule timings for type-aware linting (#22488) (camchenry)
743e222 linter/react: Add disallowedValues option for forbid-dom-props rule (#23970) (Mikhail Baev)

🐛 Bug Fixes

bdb51c7 linter/jest/prefer-ending-with-an-expect: Validate config patterns (#24122) (camc314)
45d607d linter/react/forbid-component-props: Make allow/disallow lists optional in schema (#24024) (Boshen)

pnpm/pnpm (pnpm)

`v10.34.5`: pnpm 10.34.5

Compare Source

Patch Changes

78e29fe: Prevent a crafted pnpm-lock.yaml from writing package content outside the virtual store. A dependency path key whose name reconstructs to a path-traversal sequence (e.g. ../../../tmp/x@1.0.0) is now rejected by the isolated (virtual-store) linker and the Plug'n'Play resolver map, matching the containment already applied to the hoisted linker. Under the global virtual store, a traversal in the version-derived path segment (e.g. a snapshot version: "../../x") is now rejected at iterateHashedGraphNodes, the single point every global-virtual-store slot path funnels through.
78e29fe: Fixed a path traversal vulnerability where a dependency whose manifest name was a scoped path traversal (e.g. @x/../../../<path>) could be written outside node_modules to an attacker-controlled location during pnpm install, even with --ignore-scripts. The isolated linker now validates the package name before using it as a directory name, matching the existing protection in the hoisted linker.
47ef6f0: Fixed switching to and self-updating to pnpm v12. pnpm v12 (the Rust port) ships as the pnpm and @pnpm/exe npm packages whose bins are placeholders replaced at install time by the host's native binary from a @pnpm/exe.<platform>-<arch>[-musl] optional dependency. Because pnpm installs its own engine with --ignore-scripts, that relinking never ran, leaving a non-executable placeholder. pnpm now relinks the native binary itself for v12 (recognizing the new platform-package naming scheme and the native pnpm package), and verifies the native binary's npm registry signature before running it.
36928be: ${...} environment-variable placeholders in the httpProxy, httpsProxy, noProxy, proxy, and noproxy settings are no longer expanded when these settings come from a project's pnpm-workspace.yaml. They now receive the same protection already applied to registry.

Platinum Sponsors

Gold Sponsors

privatenumber/tsx (tsx)

`v4.23.1`

Compare Source

Bug Fixes

support tsImport after global preload (8d4ffc2)
watch: avoid clearing piped output (95d0672)
watch: treat script and dependency paths literally (79fddde)

Performance Improvements

index transform cache lazily (e818ad6)
load esbuild lazily in CLI (d067938)
map Node TypeScript formats directly (cdcc623)
use sync module hooks on Node v22.22.3+ (f8992f1)

This release is also available on:

npm package (@latest dist-tag)

statelyai/xstate (xstate)

`v5.32.5`

Compare Source

Patch Changes

#5603 345e04c Thanks @xianjianlf2! - Sending an event to a stopped actor no longer throws when the event contains unserializable data (e.g. circular references). Previously, the development-only warning that an event was sent to a stopped actor used JSON.stringify on the event, which could throw and mask the intended warning. The warning is now emitted safely regardless of the event's contents.

Configuration

📅 Schedule: (in timezone UTC)

Branch creation
- "on the 15th day of the month before 12pm"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

greptile-apps · 2026-07-15T00:52:13Z

Greptile Summary

Routine Renovate dependency update bumping 11 packages across runtime dependencies, dev tools, and the package manager itself. No source files changed — only package.json and pnpm-lock.yaml are modified.

@workos/openapi-spec jumps from ^0.14.0 to ^0.32.0 (18 minor versions in a 0.x package, where each minor may carry breaking changes); since it's an internal WorkOS package, any breakage would surface as TypeScript compile errors rather than silent runtime failures.
pnpm@10.34.5 patches two path-traversal security vulnerabilities in the package manager's lock-file and virtual-store linker — this is a good security hygiene pick-up.
All other bumps (@anthropic-ai/sdk, @clack/prompts, @workos/emulate, oxfmt, oxlint, tsx, xstate, @types/node) are straightforward minor/patch updates with no API breakage noted in their changelogs.

Confidence Score: 5/5

Safe to merge — only lock file and version ranges changed, with no application logic modified

All changes are automated dependency bumps. The largest jump is @workos/openapi-spec (0.14 → 0.32), an internal WorkOS package where any incompatibility would be caught by TypeScript at build time. The pnpm bump carries security fixes but does not affect runtime behaviour. No source files were modified.

No files require special attention; the build/type-check pipeline will catch any breakage from the @workos/openapi-spec range expansion if it occurs

Important Files Changed

Filename	Overview
package.json	Dependency version ranges updated for 6 packages; no logic changes
pnpm-lock.yaml	Lock file regenerated to match updated version ranges; all resolutions are consistent with package.json specifiers

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[package.json] --> B[Runtime Deps Updated]
    A --> C[Dev Deps Updated]
    A --> D[packageManager Updated]

    B --> B1["@anthropic-ai/sdk\n0.106.0 → 0.111.0"]
    B --> B2["@clack/prompts\n1.6.0 → 1.7.0"]
    B --> B3["@workos/emulate\n^0.1.0 → ^0.2.0"]
    B --> B4["@workos/openapi-spec\n^0.14.0 → ^0.32.0"]

    C --> C1["oxfmt\n^0.56.0 → ^0.59.0"]
    C --> C2["oxlint\n1.72.0 → 1.74.0 (lock)"]
    C --> C3["tsx\n4.23.0 → 4.23.1 (lock)"]
    C --> C4["xstate\n5.32.4 → 5.32.5 (lock)"]
    C --> C5["@types/node\n22.20.0 → 22.20.1 (lock)"]

    D --> D1["pnpm 10.34.4 → 10.34.5\n🔒 Security: path-traversal fix"]

    A --> E[pnpm-lock.yaml regenerated]

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A[package.json] --> B[Runtime Deps Updated]
    A --> C[Dev Deps Updated]
    A --> D[packageManager Updated]

    B --> B1["@anthropic-ai/sdk\n0.106.0 → 0.111.0"]
    B --> B2["@clack/prompts\n1.6.0 → 1.7.0"]
    B --> B3["@workos/emulate\n^0.1.0 → ^0.2.0"]
    B --> B4["@workos/openapi-spec\n^0.14.0 → ^0.32.0"]

    C --> C1["oxfmt\n^0.56.0 → ^0.59.0"]
    C --> C2["oxlint\n1.72.0 → 1.74.0 (lock)"]
    C --> C3["tsx\n4.23.0 → 4.23.1 (lock)"]
    C --> C4["xstate\n5.32.4 → 5.32.5 (lock)"]
    C --> C5["@types/node\n22.20.0 → 22.20.1 (lock)"]

    D --> D1["pnpm 10.34.4 → 10.34.5\n🔒 Security: path-traversal fix"]

    A --> E[pnpm-lock.yaml regenerated]

_{Reviews (18): Last reviewed commit: "fix(deps): update minor and patch update..." | Re-trigger Greptile}

renovate Bot added the renovate/patch label Jul 15, 2026

renovate-approve Bot approved these changes Jul 15, 2026

View reviewed changes

renovate Bot force-pushed the renovate/minor-and-patch-updates branch 11 times, most recently from 00210ca to 179f058 Compare July 19, 2026 22:50

greptile-apps Bot reviewed Jul 19, 2026

View reviewed changes

Comment thread package.json

renovate Bot force-pushed the renovate/minor-and-patch-updates branch 5 times, most recently from 7ad6a12 to 75babed Compare July 21, 2026 12:59

fix(deps): update minor and patch updates

a3e13f8

renovate Bot force-pushed the renovate/minor-and-patch-updates branch from 75babed to a3e13f8 Compare July 21, 2026 21:16

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(deps): update minor and patch updates#194

fix(deps): update minor and patch updates#194
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/minor-and-patch-updates

renovate Bot commented Jul 15, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented Jul 15, 2026 •

edited

Loading

Flowchart

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Features

Chores

Features

Chores

Features

Features

Bug Fixes

Chores

Features

Bug Fixes

Chores

Documentation

Minor Changes

Patch Changes

Bug Fixes

Features

🐛 Bug Fixes

🚀 Features

🐛 Bug Fixes

⚡ Performance

🚀 Features

🐛 Bug Fixes

v10.34.5: pnpm 10.34.5

Patch Changes

Platinum Sponsors

Gold Sponsors

Bug Fixes

Performance Improvements

Patch Changes

Configuration

Uh oh!

greptile-apps Bot commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Flowchart

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Jul 15, 2026 •

edited

Loading

`v10.34.5`: pnpm 10.34.5

greptile-apps Bot commented Jul 15, 2026 •

edited

Loading