fix(deps): update minor and patch updates by renovate[bot] · Pull Request #194 · workos/cli

renovate · 2026-07-15T00:49:02Z

This PR contains the following updates:

Package	Change	Age	Confidence
@anthropic-ai/claude-agent-sdk	`0.3.201` → `0.3.207`
@anthropic-ai/sdk	`^0.106.0` → `^0.111.0`
@clack/prompts (source)	`1.6.0` → `1.7.0`
@types/node (source)	`22.20.0` → `22.20.1`
@workos/emulate	`^0.1.0` → `^0.2.0`
@workos/openapi-spec	`^0.14.0` → `^0.32.0`
oxfmt (source)	`^0.56.0` → `^0.58.0`
oxlint (source)	`1.72.0` → `1.73.0`
pnpm (source)	`10.34.4` → `10.34.5`
tsx (source)	`4.23.0` → `4.23.1`

Release Notes

anthropics/claude-agent-sdk-typescript (@anthropic-ai/claude-agent-sdk)

`v0.3.207`

Compare Source

Fixed canUseTool returning {behavior: 'allow'} without updatedInput being rejected as a deny with a raw ZodError message; the tool now runs with the original input per the documented contract
The Agent tool's structured result now has a published SDK type (AgentToolCompletedOutput) that matches the emitted object exactly

`v0.3.206`

Compare Source

Added command_lifecycle frames to stream-json and SDK sessions, reporting each uuid-stamped message's terminal state (queued/started/completed/cancelled/discarded); zero-API results no longer report stale duration_api_ms

`v0.3.205`

Compare Source

Interrupt control responses now include still_queued (UUIDs of queued async messages that will still run), Query.interrupt() returns the typed receipt, and system/init advertises an interrupt_receipt_v1 capability for feature detection
Added structured name and body fields to peer-message session events, exposing the sender display name and decoded message body

`v0.3.204`

Compare Source

Added terminal_reason values tool_deferred_unavailable (deferred tool resume found the tool gone — previously an is_error result with no reason, read as a clean completion by lifecycle sweeps) and turn_setup_failed (the turn-input builder threw before the turn started). Both classify as dead turns, so commands consumed by them report command_lifecycle state cancelled
Fixed the post-merge cancel backstop cancelling every member of a coalesced prompt batch when a cancel named only one: uncancelled siblings now re-merge and run (previously they were reported cancelled — on remote transports that acknowledged them as processed, silently dropping messages nobody cancelled)
Added terminal_reason values api_error, malformed_tool_use_exhausted, budget_exhausted, and structured_output_retry_exhausted. Turns that die on an exhausted-API-retry or malformed-tool-use give-up previously reported completed; budget and structured-output exhaustion results previously omitted terminal_reason. Commands consumed by such turns now report command_lifecycle state cancelled instead of completed (dup-over-loss)
Updated to parity with Claude Code v2.1.204

`v0.3.203`

Compare Source

Added a background_tasks_changed system message with the full set of live background tasks on every membership change, so consumers can track background activity as a level instead of pairing task_started/task_notification edges
Fixed stable releases shipping a sdk.d.ts with unresolved type references that broke consumer typechecking with skipLibCheck disabled

`v0.3.202`

Compare Source

Added parent_agent_id field to subagent session messages for building depth-2+ agent trees from disk-persisted metadata
Fixed apply_flag_settings with a non-object settings value crashing the session instead of returning a control error

anthropics/anthropic-sdk-typescript (@anthropic-ai/sdk)

`v0.111.0`

Compare Source

Full Changelog: sdk-v0.110.0...sdk-v0.111.0

Features

api: add support for dreaming (77b28a6)
tools: gate session tool calls on evaluated_permission; bound idle by server stop_reason (68a6d7b)

Chores

docs: small updates to field descriptions (e25b885)
docs: update model example (a33f3f0)
docs: updates to descriptions and examples (eac4bac)

`v0.110.0`

Compare Source

Full Changelog: sdk-v0.109.1...sdk-v0.110.0

Features

api: add agent-memory-2026-07-22 beta header (a470e10)

`v0.109.1`

Compare Source

Full Changelog: sdk-v0.109.0...sdk-v0.109.1

Chores

api: remove some nonfunctional types from the SDKs (cc4dd4e)

`v0.109.0`

Compare Source

Full Changelog: sdk-v0.108.0...sdk-v0.109.0

Features

api: add support for Managed Agents event delta streaming, agent overrides, reverse pagination, vault credential injection scoping, and agent and deployment webhook events (7f3211b)

`v0.108.0`

Compare Source

Full Changelog: sdk-v0.107.0...sdk-v0.108.0

Features

api: add support for claude-sonnet-5 (4588db0)

Bug Fixes

agent-toolset: allow absolute paths that resolve inside workdir (#112) (e951fb2)

Chores

format README.md (#176) (98dcff7)

`v0.107.0`

Compare Source

Full Changelog: sdk-v0.106.0...sdk-v0.107.0

Features

api: add support for 2026031 web fetch and support tools (d7057ea)

Bug Fixes

agent-toolset: bound canonicalize symlink hops; resolve glob matches before confinement check (#142) (277be80)
types: restore BatchCreateParams.Request.params dropped by codegen merge (#165) (c6b68d2)

Chores

api: accept user profile ID's when counting tokens (6cda67e)
docs: updates to descriptions and example values (51a5f81)

Documentation

update readme requirements to match anthropic docs (#146) (3818412)

bombshell-dev/clack (@clack/prompts)

`v1.7.0`

Compare Source

Minor Changes

#574 8f1c380 Thanks @dreyfus92! - Add showInstructions option to select, multiselect, and groupMultiselect. Keyboard hints remain shown by default; pass showInstructions: false to hide them.

Patch Changes

#582 4b24953 Thanks @43081j! - Handle empty arrays in various prompts and utilities.
Updated dependencies [4b24953]:
- @clack/core@1.4.3

workos/emulate (@workos/emulate)

`v0.2.0`

Compare Source

Features

add response-shape conformance codegen and test (#9) (358773b)
provide an end-to-end login flow story with spec-accurate webhooks (#2) (fa39dfe)
seed M2M apps and API keys (#10) (f761419)

workos/openapi-spec (@workos/openapi-spec)

oxc-project/oxc (oxfmt)

`v0.58.0`

Compare Source

`v0.57.0`

Compare Source

oxc-project/oxc (oxlint)

`v1.73.0`

Compare Source

🚀 Features

a2c97f3 linter/unicorn: Implement explicit-timer-delay rule (#23612) (Mikhail Baev)
85735cb linter/unicorn: Implement no-confusing-array-with rule (#23638) (Shekhu☺️)
cb4fbb9 linter/eslint: Implement no-unreachable-loop rule (#23975) (Todor Andonov)
dc32112 linter/eslint/no-constant-binary-expression: Check relational comparisons (#24088) (camc314)
d963967 linter/unicorn/no-array-sort: Add allowAfterSpread option (#24043) (Boshen)
0a75682 linter: Add per-rule timings for type-aware linting (#22488) (camchenry)
743e222 linter/react: Add disallowedValues option for forbid-dom-props rule (#23970) (Mikhail Baev)

🐛 Bug Fixes

bdb51c7 linter/jest/prefer-ending-with-an-expect: Validate config patterns (#24122) (camc314)
45d607d linter/react/forbid-component-props: Make allow/disallow lists optional in schema (#24024) (Boshen)

pnpm/pnpm (pnpm)

`v10.34.5`: pnpm 10.34.5

Compare Source

Patch Changes

78e29fe: Prevent a crafted pnpm-lock.yaml from writing package content outside the virtual store. A dependency path key whose name reconstructs to a path-traversal sequence (e.g. ../../../tmp/x@1.0.0) is now rejected by the isolated (virtual-store) linker and the Plug'n'Play resolver map, matching the containment already applied to the hoisted linker. Under the global virtual store, a traversal in the version-derived path segment (e.g. a snapshot version: "../../x") is now rejected at iterateHashedGraphNodes, the single point every global-virtual-store slot path funnels through.
78e29fe: Fixed a path traversal vulnerability where a dependency whose manifest name was a scoped path traversal (e.g. @x/../../../<path>) could be written outside node_modules to an attacker-controlled location during pnpm install, even with --ignore-scripts. The isolated linker now validates the package name before using it as a directory name, matching the existing protection in the hoisted linker.
47ef6f0: Fixed switching to and self-updating to pnpm v12. pnpm v12 (the Rust port) ships as the pnpm and @pnpm/exe npm packages whose bins are placeholders replaced at install time by the host's native binary from a @pnpm/exe.<platform>-<arch>[-musl] optional dependency. Because pnpm installs its own engine with --ignore-scripts, that relinking never ran, leaving a non-executable placeholder. pnpm now relinks the native binary itself for v12 (recognizing the new platform-package naming scheme and the native pnpm package), and verifies the native binary's npm registry signature before running it.
36928be: ${...} environment-variable placeholders in the httpProxy, httpsProxy, noProxy, proxy, and noproxy settings are no longer expanded when these settings come from a project's pnpm-workspace.yaml. They now receive the same protection already applied to registry.

Platinum Sponsors

Gold Sponsors

privatenumber/tsx (tsx)

`v4.23.1`

Compare Source

Bug Fixes

support tsImport after global preload (8d4ffc2)
watch: avoid clearing piped output (95d0672)
watch: treat script and dependency paths literally (79fddde)

Performance Improvements

index transform cache lazily (e818ad6)
load esbuild lazily in CLI (d067938)
map Node TypeScript formats directly (cdcc623)
use sync module hooks on Node v22.22.3+ (f8992f1)

This release is also available on:

npm package (@latest dist-tag)

Configuration

📅 Schedule: (in timezone UTC)

Branch creation
- "on the 15th day of the month before 12pm"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

greptile-apps · 2026-07-15T00:52:13Z

Greptile Summary

Renovate-automated dependency update bumping 10 packages across runtime, dev, and tooling categories. The pnpm@10.34.5 upgrade is particularly notable as it contains security patches fixing path-traversal vulnerabilities in the isolated linker and hoisted linker.

@anthropic-ai/sdk advances five minor versions (0.106 → 0.111), picking up dreaming support, Managed Agents streaming, and a few nonfunctional-type removals; @anthropic-ai/claude-agent-sdk resolves to 0.3.207 within the existing ~0.3.0 pin.
@workos/openapi-spec makes a large leap (^0.14.0 → ^0.32.0, 18 minor versions in 0.x space); @workos/emulate advances one minor version (^0.1.0 → ^0.2.0) and adds end-to-end login flows, webhooks, and M2M seeding.
Tooling bumps (@clack/prompts 1.7.0, oxfmt ^0.58.0, oxlint resolves to 1.73.0, tsx 4.23.1) are routine minor/patch updates with no breaking changes.

Confidence Score: 5/5

Safe to merge — all changes are automated Renovate dependency bumps with no source code modifications.

Every change is confined to package.json version specifiers and the auto-generated lockfile. The pnpm upgrade brings security fixes, and the SDK/tooling bumps are minor or patch releases with well-documented changelogs. No application logic is touched.

No files require special attention.

Important Files Changed

Filename	Overview
package.json	Version specifiers updated for 6 packages; changes match the Renovate PR table. The @workos/openapi-spec range widens by 18 minor versions in 0.x space, which could include breaking changes but appears intentional.
pnpm-lock.yaml	Lockfile regenerated by pnpm to reflect resolved versions for all bumped packages; no manual edits detected.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    PR["Renovate PR 194"]
    PR --> RT
    PR --> DT
    PR --> PM

    subgraph RT["Runtime Dependencies"]
        A["@anthropic-ai/sdk 0.106.0 to 0.111.0"]
        B["@anthropic-ai/claude-agent-sdk 0.3.201 to 0.3.207"]
        C["@clack/prompts 1.6.0 to 1.7.0"]
        D["@workos/emulate 0.1.x to 0.2.x"]
        E["@workos/openapi-spec 0.14.x to 0.32.x"]
    end

    subgraph DT["Dev and Tooling"]
        F["oxfmt 0.56 to 0.58"]
        G["oxlint 1.72 to 1.73"]
        H["types/node 22.20.0 to 22.20.1"]
        I["tsx 4.23.0 to 4.23.1"]
    end

    subgraph PM["Package Manager"]
        J["pnpm 10.34.4 to 10.34.5 - security patches"]
    end

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    PR["Renovate PR 194"]
    PR --> RT
    PR --> DT
    PR --> PM

    subgraph RT["Runtime Dependencies"]
        A["@anthropic-ai/sdk 0.106.0 to 0.111.0"]
        B["@anthropic-ai/claude-agent-sdk 0.3.201 to 0.3.207"]
        C["@clack/prompts 1.6.0 to 1.7.0"]
        D["@workos/emulate 0.1.x to 0.2.x"]
        E["@workos/openapi-spec 0.14.x to 0.32.x"]
    end

    subgraph DT["Dev and Tooling"]
        F["oxfmt 0.56 to 0.58"]
        G["oxlint 1.72 to 1.73"]
        H["types/node 22.20.0 to 22.20.1"]
        I["tsx 4.23.0 to 4.23.1"]
    end

    subgraph PM["Package Manager"]
        J["pnpm 10.34.4 to 10.34.5 - security patches"]
    end

_{Reviews (13): Last reviewed commit: "fix(deps): update minor and patch update..." | Re-trigger Greptile}

greptile-apps · 2026-07-19T22:52:42Z

    "@napi-rs/keyring": "^1.2.0",
    "@workos-inc/node": "^8.7.0",
-    "@workos/emulate": "^0.1.0",
+    "@workos/emulate": "^0.2.0",


@workos/emulate bump missing from Renovate PR description

@workos/emulate is updated from ^0.1.0 to ^0.2.0 (resolving to 0.2.1) in the diff, but this package does not appear in Renovate's PR description table. Since this is a 0.x package, the semver spec permits breaking changes across minor versions. If this update was intentional and authored by a human on top of Renovate's changes, it warrants a separate review; if Renovate introduced it without listing it, the Renovate config should be checked to ensure the package is tracked correctly.

Prompt To Fix With AI

This is a comment left during a code review. Path: package.json Line: 50 Comment: **`@workos/emulate` bump missing from Renovate PR description** `@workos/emulate` is updated from `^0.1.0` to `^0.2.0` (resolving to `0.2.1`) in the diff, but this package does not appear in Renovate's PR description table. Since this is a `0.x` package, the semver spec permits breaking changes across minor versions. If this update was intentional and authored by a human on top of Renovate's changes, it warrants a separate review; if Renovate introduced it without listing it, the Renovate config should be checked to ensure the package is tracked correctly. How can I resolve this? If you propose a fix, please make it concise.

renovate Bot added the renovate/patch label Jul 15, 2026

renovate-approve Bot approved these changes Jul 15, 2026

View reviewed changes

renovate Bot force-pushed the renovate/minor-and-patch-updates branch 11 times, most recently from 00210ca to 179f058 Compare July 19, 2026 22:50

greptile-apps Bot reviewed Jul 19, 2026

View reviewed changes

fix(deps): update minor and patch updates

2228698

renovate Bot force-pushed the renovate/minor-and-patch-updates branch from 179f058 to 2228698 Compare July 20, 2026 05:09

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(deps): update minor and patch updates#194

fix(deps): update minor and patch updates#194
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/minor-and-patch-updates

renovate Bot commented Jul 15, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented Jul 15, 2026 •

edited

Loading

Flowchart

Uh oh!

greptile-apps Bot Jul 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Features

Chores

Features

Chores

Features

Features

Bug Fixes

Chores

Features

Bug Fixes

Chores

Documentation

Minor Changes

Patch Changes

Features

🚀 Features

🐛 Bug Fixes

v10.34.5: pnpm 10.34.5

Patch Changes

Platinum Sponsors

Gold Sponsors

Bug Fixes

Performance Improvements

Configuration

Uh oh!

greptile-apps Bot commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Flowchart

Uh oh!

greptile-apps Bot Jul 19, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Jul 15, 2026 •

edited

Loading

`v10.34.5`: pnpm 10.34.5

greptile-apps Bot commented Jul 15, 2026 •

edited

Loading