Claude Code 2.1.234: NT-Namespace (`\??\`) Path Rejection Extended to Remote Reads, Session Restore, CLAUDE.md Includes, Workflow Scripts and Uploads; MCP Diagnostics Stop Printing Resolved Secrets; Auto-Continue at Usage-Limit Reset; claude-api Skill Load Cut From ~200k to ~25k Tokens
The August 17 v2.1.234 release completes the previous release's NTLM credential-leak hardening by rejecting Windows NT-namespace (`\??\`) paths across the remaining pre-approval file accesses — remote file reads, session restore, CLAUDE.md includes, workflow scripts, and file uploads. On MCP it stops diagnostics from printing resolved secrets — scope-conflict warnings now show the configured `${VAR}` form and connection-failure details show only the server origin — and fixes `strictKnownMarketplaces` allowlists accepting SCP-style git marketplace sources whose host differs from the one git would actually connect to. It also fixes credential masking on relayed permission previews that had hidden commands, paths, or destinations from the approver, provider API tokens not masking when directly followed by shell delimiters, and session-scoped permission denies being dropped when answering background-subagent tool prompts; it cuts the built-in `claude-api` skill's context cost from ~200k+ to ~25k tokens by loading reference docs on demand, and adds an opt-out setting that continues a session automatically when a claude.ai usage limit resets.
JingLabs read
Take the path-hardening and MCP secret-redaction fixes promptly on any shared, logged, or Windows runner: `\??\` device-namespace paths could still reach the pre-approval file accesses this release closes, and MCP diagnostics previously printed resolved secret values into scope-conflict warnings and connection errors — both real exposure paths, and together with 2.1.233 they finish closing the NTLM vector. The relayed-preview credential-masking and token-before-shell-delimiter fixes matter specifically for cross-session and Remote Control setups where an approver only sees a masked preview; the `claude-api` skill's ~200k→~25k context reduction is a straightforward saving if your agents load it, and treat auto-continue-at-usage-limit as a convenience to leave off for unattended runs you want to stop at the cap.
Google ADK for Python v1.39.0 and v2.7.1: Resumable Live Sessions via RunConfig.session_resumption.handle, audio_stream_end for Realtime Input, Background Tool Tasks Stopped When a Live Run Ends, OpenTelemetry 1.42.1 Ceiling Restored
Google shipped two ADK-for-Python lines on August 17. The v1.x line's v1.39.0 uses `RunConfig.session_resumption.handle` when opening a live (bidirectional-streaming) session so a dropped live session can resume from a handle rather than restart, adds `audio_stream_end` support for realtime input, fixes a leak where background tool tasks kept running after a live agent run ended, and validates session-initialization events. The v2.x line's v2.7.1 is a maintenance patch that restores the OpenTelemetry `<=1.42.1` dependency ceiling — averting breakage from newer OTel releases — and adds the same session-initialization-event validation.
JingLabs read
The background-tool-task fix in v1.39.0 is the one to take if you run live, streaming, or voice agents on ADK: tasks that outlived their run were a real resource leak on long-lived sessions, and live-session resumption via a handle makes a dropped realtime connection recoverable rather than a full restart — worth testing for voice or streaming workloads. The v2.7.1 OpenTelemetry ceiling is a defensive dependency pin rather than a feature, so pick it up if a newer OTel release was breaking your ADK install; otherwise both are routine maintenance on an actively dual-maintained SDK.
OpenAI Agents SDK 0.21.1 (Python) and 0.16.1 (JS): Model-Call Timeouts, Run-Scoped Sandbox Working Directories, Docker Sandbox Network-Disable and Modal Resource Options
The August 16 patch releases — Python v0.21.1 and its JavaScript/TypeScript twin v0.16.1 — add the same operational controls to both language SDKs: timeouts on model calls, sandbox working directories scoped to an individual run, an option to disable networking for Docker sandboxes, and configurable Modal sandbox resource options. The fixes tighten reliability and accounting: `MultiProvider` now closes all children after a failure, Responses requests that arrive without usage data are counted correctly, SQLite sessions include compaction usage in their totals and avoid structure-table conflicts in advanced mode, Chat Completions reasoning-model replay is corrected, real-time audio no longer truncates at zero elapsed time, and model paths/patches are kept POSIX-normalized. Sandbox `view_image` raster content is now validated and exact call-approval decisions are handled correctly.
JingLabs read
The model-call timeout is the change to adopt for unattended runs: a hung provider call could previously stall a whole run, and a bounded timeout is a direct blast-radius guard. Run-scoped sandbox working directories and the Docker network-disable option are worth taking wherever you execute untrusted or model-generated code — per-run isolation and a no-egress sandbox reduce what one turn can reach or leak, which matters for GDPR-aware client work. The SQLite compaction-usage-in-totals fix is worth picking up if you budget or bill from session usage, since totals were previously understated; the rest is routine reliability maintenance on the most active agent SDK line, and the Python/JS parity means teams on either stack get the same controls.
Google ADK for Python v2.7.0: Model-Declared Capabilities Replace Model-ID Inference, Tool Responses Can Return Images and Media Across Gemini/Anthropic/LiteLLM, Optional Jinja2 Instruction Templating, pyarrow Moved to a bigquery-analytics Extra
The August 13 v2.7.0 release makes models declare their own capabilities directly rather than having ADK infer support from model IDs, which the notes say improves pairing of tools with output schemas, and lets a tool's function response carry images and other media straight back to the model on Gemini, Anthropic, LiteLLM, Apigee, and OCI. It fixes conversation-history round-trips so thought signatures, server-side tool-call parts, and parallel function-call results persist correctly, adds optional Jinja2 templating for instructions via `use_jinja2=True` with an `{{ artifact("name") }}` helper (regex remains the default engine), and speeds startup by cutting import work and removing quadratic streaming accumulation in the LiteLLM adapters. Its one breaking change moves `pyarrow` out of the `gcp` extra into a new `bigquery-analytics` extra, so `BigQueryAgentAnalyticsPlugin` users must install `google-adk[bigquery-analytics]`.
JingLabs read
For teams on Google's stack, tool responses returning media is the substantive capability: a tool can hand an image or other media back to the model without a separate upload step, which simplifies document, screenshot, and chart workflows — worth testing if you build multimodal tools. Model-declared capabilities remove a class of silent tool-pairing errors that came from guessing support off a model ID, and the conversation-history round-trip fixes matter if you rely on parallel tool calls or reasoning traces surviving a turn. Note the breaking `pyarrow` relocation before upgrading if you use the BigQuery analytics plugin, and treat Jinja2 instruction templating as an opt-in convenience rather than a reason to upgrade.
Microsoft Agent Framework python-1.14.0: Opt-In AGENT-HOOKS-0.1 Enforcement Middleware, Native Mistral Chat Client, AG-UI Workflow Checkpoint Create/Resume, Foundry State Stores for Sessions/Checkpoints/Approvals
The August 14 python-1.14.0 release adds a native Mistral chat client (chat, streaming, tools, structured output, and embeddings), an experimental AGENT-HOOKS-0.1 enforcement middleware behind an opt-in `agent-hooks` extra, request-preparation and response-parsing hooks on `OpenAIChatCompletionClient`, workflow checkpoint creation and resume for AG-UI runs, a `BackgroundAgentsProvider.release_session()` call that cancels work and releases per-session runtime state, and provider-based Foundry state stores for agent sessions, checkpoints, and function approvals. It surfaces Gemini thought summaries as reasoning content, makes encrypted reasoning opt-in for Foundry chat requests, moves the Durable Task and Azure Functions integrations to a separate extension repository, and now requires functional workflow definitions to be built into stateful instances before execution. Fixes bound tool-result compaction summaries before provider calls, stop streaming-transcript duplication when messages are injected, preserve approval-resume semantics and conversation correlation across AG-UI runs, and fix Claude SDK client reuse across distinct sessions.
JingLabs read
The AG-UI workflow checkpoint create/resume plus `release_session()` are the substantive parts for durable, human-in-the-loop workflows on this framework: deterministic resume and explicit per-session teardown matter for unattended runs that pause for approval and must not leak runtime state. Treat the experimental AGENT-HOOKS-0.1 enforcement middleware as a policy lever to test rather than adopt while the spec sits at 0.1. Note the two behaviour changes before upgrading — functional workflow definitions must now be built into stateful instances, and the Durable Task / Azure Functions integrations moved to a separate repo, so pinned imports will break. The native Mistral client is a straightforward add if you want a European-hosted model in your provider matrix.
Pydantic AI v2.31.0: UIEventStream Can Be Built Without a run_input, AGUIEventStream Gets Its Own thread_id/run_id, Failed FallbackModel Spans Attributed to the Failing Model
The August 14 v2.31.0 release lets a `UIEventStream` be built without a `run_input` and gives `AGUIEventStream` its own `thread_id`/`run_id`, decoupling the event stream from a specific run input. It corrects observability attribution so a failed `FallbackModel` span is charged to the model that actually failed rather than to the `fallback:` wrapper, and passes the `openai` package through Temporal workflow sandboxes so OpenAI-backed agents run inside Temporal durable workflows. The release documents no security fixes.
JingLabs read
A small, low-risk maintenance release. The `FallbackModel` span-attribution fix is the one worth having if you run a fallback chain and rely on traces to see which provider degraded — previously the failure was hidden behind the wrapper, obscuring which model to investigate. The `openai`-through-Temporal fix matters only if you run OpenAI-backed Pydantic AI agents inside Temporal durable workflows, and the AG-UI event-stream changes are relevant if you build custom UI streams on this SDK; otherwise nothing here forces an upgrade.
Vercel AI SDK ai@7.0.66: Chat Status Held at “submitted” Until Response Content Begins Streaming
ai@7.0.66, released August 14, keeps a chat's status at `submitted` until response content actually begins streaming rather than flipping earlier, so a `useChat` UI reflects the pending state accurately during the gap before the first token; it also fixes TypeScript declaration emit for exported values that infer an `Output` type. The same chat-status fix shipped on the 6.x line as ai@6.0.255. Separately, `@ai-sdk/xai@4.0.40` (August 15) added speech timestamps, pronunciation replacements, and character-level alignment metadata to the xAI provider.
JingLabs read
A minor patch, but the chat-status fix is directly relevant to the streaming chatbot pattern this kind of Next.js marketing site is built on: holding `submitted` until the first token lets you show an accurate “thinking” state instead of a premature “streaming” one, which is exactly the moment a visitor decides whether the assistant is responsive. Low-risk to pick up on your pinned major line (5.x/6.x/7.x); the xAI speech metadata is only relevant if you use xAI voice output.
Claude Code 2.1.233: NTLM Credential-Leak Vector Closed by NT `\??\` Device-Prefix UNC Validation, MCP v2 subscriptions/listen Serverless-Timeout Reopen Loop Fixed, Last Week's Cygwin-Symlink and Bash Input-Redirection Hardening Reverted After a Windows Auto-Mode Regression
The August 14 v2.1.233 release pairs a Windows security fix with MCP and reliability work and rolls back part of the previous release's Bash hardening. It closes an NTLM credential-leak vector where Windows paths written with the NT `\??\` device prefix bypassed UNC path validation, and fixes MCP v2 connections that endlessly reopened the `subscriptions/listen` stream against servers — such as serverless hosts — that terminate long-held streams on a fixed timeout. It reverts the 2.1.232 Bash permission changes for Cygwin-style symlinks and input redirections (`< file`), which had made auto mode repeatedly stop for approval on ordinary `cd <dir> && <command> > file` commands on Windows, with a narrower version promised later. It also adds opt-in memory-cgroup limits for Bash commands on Linux (`CLAUDE_CODE_TOOL_MEMORY_LIMIT`) so a runaway build cannot stall the session, a configurable WebFetch cache TTL (`CLAUDE_CODE_WEBFETCH_CACHE_TTL_MS`), GitLab merge-request URL support in `--worktree` and the `claude agents` view, and an opt-in `forward_user_identity` apps-gateway setting for per-user spend attribution; the todo/task-tracking tools are now off by default on Opus 4.8, Sonnet 5, Fable 5, Mythos 5, and newer models (`CLAUDE_CODE_ENABLE_TODO_TOOLS=1` restores them).
JingLabs read
Take the NTLM credential-leak fix promptly on any Windows runner — the `\??\` device-prefix path could bypass UNC validation, a real credential-exposure vector. The MCP v2 `subscriptions/listen` fix matters directly if you connect to serverless or edge MCP servers, which the new stateless spec encourages: without it, connections to hosts that time out long-held streams churned endlessly. Note the revert — last week's Cygwin-symlink and Bash input-redirection hardening is rolled back after it broke auto mode on ordinary Windows commands, so do not rely on that specific gate until the narrower version ships. The Linux memory-cgroup limit is worth setting on unattended CI where a runaway build could otherwise stall a session.
OpenAI Agents SDK for Python 0.21.0: Provider-Neutral Testing Utilities for Deterministic Runs, OpenAI Python v3 Compatibility (openai>=3.0.0,<4), Hardened Interruption Snapshots and MCP Lifecycle Isolation
Version 0.21.0, released August 15, adds provider-neutral testing utilities — `agents.testing`, `agents.realtime.testing`, and `agents.voice.testing` — that let you exercise agent, realtime, and voice workflows deterministically without issuing provider requests. It updates compatibility to `openai>=3.0.0,<4` with HTTPX2-aware handling, hardens `RunState` interruption snapshots and recursive agent-tool approvals, isolates MCP lifecycle snapshots and adds configurable retry-backoff ceilings, adds existing-secret support and tighter view-image path grants in the sandbox, and tightens voice validation for invalid channels, frame rates, and incomplete multichannel frames. The release documents no security fixes among its 30-plus merged changes, though it also tightens sensitive-error redaction and streaming cleanup.
JingLabs read
The provider-neutral testing utilities are the change to adopt: deterministic tests that never hit the provider make CI cheaper and let you catch agent-behaviour regressions without spending tokens or depending on model availability — useful for any team maintaining an agent in production. The `openai>=3.0.0,<4` bump is a dependency major-version move to schedule deliberately if you pin the OpenAI SDK elsewhere in your stack. The MCP lifecycle-isolation and configurable retry-backoff work continues this ecosystem's steady MCP hardening; the sandbox existing-secret support is a small convenience for unattended runs that reuse a provisioned secret.
Claude Code 2.1.227–232: Subagent Forking On by Default and @-Mention Cross-Session Messaging, GitLab Token-Family Redaction, PowerShell and Git Bash Symlink Permission-Bypass Fixes, Linux Sandbox Protected-Path Bypass and Bash Input-Redirection Gaps Closed
The August 10–13 releases pair new agent-orchestration features with further permission hardening. v2.1.232 (Aug 13) turns subagent forking on by default — a `subagent_type: "fork"` subagent inherits the full conversation and prompt cache — and adds cross-session messaging: typing `@` mentions another live Claude session by name and `SendMessage` delivers to it directly, with `/config` rows to accept, hold, or refuse inbound messages and hardening of the shared-`/tmp` messaging socket against pre-planted symlinks. On security it adds redaction for GitLab token families (`glrt-`, `gloas-`, `glptt-`, and others) with full redaction of routable `glpat-`/`gldt-` tokens, fixes a PowerShell permission bypass where variable-writing parameters could overwrite `$PSDefaultParameterValues` to redirect later commands' file access, fixes Git Bash following Cygwin-style symlinks that path validation treated as regular files, requires each nested git repository to confirm its own trust rather than inheriting a parent's, and hardens the Linux filesystem sandbox against a protected-path bypass while restricting `sandbox.ripgrep` to user, managed, and `--settings` scopes. Earlier releases in the range add plugin-marketplace `command` sources (v2.1.229), permission-check Bash input redirections (`< file`) on all platforms (v2.1.228), and IPv6-literal bracketing in sandbox network domain lists (v2.1.229).
JingLabs read
Take the v2.1.228–232 security fixes promptly on any unattended, shared, or web-triggered runner: the PowerShell `$PSDefaultParameterValues` and Git Bash symlink fixes both close paths where a command could redirect file access past the permission gate, the Linux sandbox protected-path fix and the newly permission-checked Bash input redirection close real sandbox gaps, and the GitLab token redaction matters wherever logs or screens are shared. Cross-session messaging and default subagent forking are the notable new capabilities — useful for orchestrating parallel work — but treat inbound cross-session messages as a new trust surface and set the `/config` accept/hold/refuse policy deliberately rather than leaving it open. The nested-git-repo trust fix is worth noting if you work across monorepos with vendored sub-repositories.
OpenAI Agents SDK for Python 0.20.0: MCP Python SDK v1 and v2 Supported Across stdio/SSE/Streamable-HTTP, Durable Pending Input on RunState, Default Model Moves to gpt-5.6-luna
Version 0.20.0, released August 11, adds support for both MCP Python SDK v1 and v2 across the stdio, SSE, and Streamable-HTTP transports, so the same agent code can target either major MCP SDK generation — though applications with custom MCP HTTP authentication or client factories must align with their installed MCP major version or pin `mcp<2`. It adds durable pending input via `RunState.add_input()`, which stages user input before a resumed model call with guardrail, persistence, and serialization support, and moves the implicit default model to `gpt-5.6-luna` (explicit models, run-level overrides, and `OPENAI_DEFAULT_MODEL` still take precedence). The release also promotes GA transcription settings for the realtime transcription models and lands fixes across sandbox mount validation, session persistence, and voice handling.
JingLabs read
The MCP SDK v1-and-v2 support is the piece to note: the MCP Python SDK's v2 major version is now landing in a mainstream agent SDK, so if you standardize servers or clients on it you can migrate without rewriting agent code — but read the caveat, since custom HTTP auth or client factories force you to align with one major version or pin `mcp<2`, and a silent version mismatch will break connections. Durable pending input is genuinely useful for human-in-the-loop workflows where an unattended run must pause and resume with staged input. The default-model change is low-risk given explicit overrides still win, but pin the model explicitly in production so a default shift never moves your cost or behaviour silently.
Pydantic AI 2.27.1–2.30.0: DNS-Rebinding and CORS Fixes Harden the Local Web Chat UI, allowed_hosts Opt-In, FastMCP 4 and MCP SDK v2 Compatibility
The August 10–14 releases concentrate on securing the local development web chat UI and on MCP compatibility. v2.30.0 (Aug 14) fixes a DNS-rebinding vulnerability where `Agent.to_web()` and `clai web` did not validate the `Host` header, so DNS rebinding from a visited website could reach the local UI and run the served agent with the local process's tools and credentials; the fix validates the Host against localhost/loopback/LAN addresses by default and requires a new `allowed_hosts` setting to opt in real hostnames. v2.28.0 (Aug 11) patched a related high-severity issue where the chat endpoint accepted cross-origin requests without CORS-preflight checks and now requires `Content-Type: application/json`, and v2.27.1 (Aug 10) fixed retry-prompt content bypassing redaction settings. v2.29.0 (Aug 12) adds FastMCP 4 and MCP SDK v2 compatibility. A v1.107.5 backport applies the same `Host`-validation fix to the v1 line.
JingLabs read
Take the web-UI fixes promptly if anyone on the team uses `Agent.to_web()` or `clai web`: the DNS-rebinding and CORS gaps let a web page you merely visit reach a locally served agent that holds your tools and credentials — a real local-to-remote exposure, not a theoretical one — and the fix is on by default while real-hostname deployments must opt in via `allowed_hosts`. Upgrade the v1 line too via the 1.107.5 backport if you have not migrated. The FastMCP 4 and MCP SDK v2 compatibility is the same ecosystem signal visible in the OpenAI Agents SDK this week: the MCP v2 SDK generation is now landing across the major Python agent frameworks, so plan a tested migration rather than an in-place jump.
Claude Code 2.1.222–224: Worktree Isolation Extended to File Edits and Bash, a Bash Permission-Bypass and Tab/Invisible-Unicode Command-Hiding Fixed, Workflow-Sandbox import() Escape Closed, Self-Hosted Runners and JWT/AWS-SigV4 Credential-Masking
The August 4–7 releases continue Claude Code's permission and isolation hardening. v2.1.222 (Aug 4) makes worktree isolation apply to file edits and Bash in every session type, closing a path where a worktree-isolated session or its subagents could run destructive git commands against the main checkout, and stops PreToolUse auto-allow hooks from bypassing tool restrictions in background agent tasks. v2.1.223 (Aug 6) fixes a Bash permission bypass where a crafted command could hide parts of itself from permission checks, stops commands padded with tabs or invisible Unicode from hiding text from the approval dialog, closes a path where a workflow script could use dynamic `import()` to run code outside the workflow sandbox, and fixes an agent definition's `bypassPermissions` mode ignoring the org bypass-permissions disable policy. v2.1.224 (Aug 7) adds self-hosted runners (`claude self-hosted-runner`, Team/Enterprise), an `archive` plugin source with optional SHA-256 pinning, and extends sandbox credential-masking with `extract` for structured values, `decode: "jwt"` with `maskClaims`, and `awsPairs`/`sigv4` AWS SigV4 re-signing (all requiring `network.tlsTerminate` and honored only from user, managed, or `--settings` scopes); it also fixes sandbox filesystem deny entries written with a trailing slash being silently bypassable. The Aug 8 v2.1.225/226 add gateway spend-limit usage warnings and a workspace-trust prompt for `claude agents`.
JingLabs read
Take the v2.1.222–223 fixes promptly on any unattended, shared, or web-triggered runner: the worktree-isolation fix now covers file edits and Bash rather than just git, the Bash permission-bypass and tab/invisible-Unicode fixes close cases where a crafted command could hide part of itself from the approval dialog, and the workflow `import()` fix closes a real sandbox escape where a workflow script could run arbitrary code. The extended credential-masking is worth adopting where a sandboxed command needs a secret's shape but not its value — JWT claim masking and AWS SigV4 re-signing are new levers — but it requires TLS termination and is honored only from trusted settings scopes, so it is a controlled egress feature rather than a default. Self-hosted runners are the notable capability for EU data-residency work, since they keep web, mobile, and desktop sessions on your own machines.
OpenAI Codex 0.147.0: Opt-In MCP 2026-07-28 Support (Paginated Discovery, Multi-Round Requests, Non-Blocking Startup), Secrets and Full Bearer Tokens Redacted from Displayed Commands and Replayed History, --approve-for-me Auto-Approvals
Codex 0.147.0, released August 7, adds opt-in support for the stateless MCP 2026-07-28 specification — paginated discovery, multi-round requests, and non-blocking server startup — implementing the sessionless transport revision in a major coding-agent CLI. It redacts secrets and complete bearer tokens from displayed commands and replayed conversation history, adds an `--approve-for-me` flag for automatically reviewed approvals, and imports Cursor-managed skills while syncing imported Claude and Cursor conversations without creating duplicates. It hardens plugin isolation (denying network access on a policy failure), requires explicit trust for unfamiliar local projects, and upgrades the bundled MCP SDK to 3.0.0, Ratatui to 0.30.2, and V8 to 150.4.0.
JingLabs read
The MCP 2026-07-28 support is the development to note: the stateless spec that dropped protocol-level sessions is now landing in tooling, so if you standardize MCP servers on that revision, Codex can negotiate paginated discovery and multi-round input requests natively — but test compatibility first, since the revision is breaking and support here is opt-in. Take the secret and bearer-token redaction promptly on any shared, logged, or screen-shared runner, since full tokens previously appeared in displayed commands and replayed history. Treat `--approve-for-me` as a convenience to gate deliberately: auto-approving reviews widens what an unattended run can do without a human in the loop.
RoMeRL: Reduced-Order Utility States to Counter the "Memory-Reward Trap" in Self-Evolving Agent Memory
The paper identifies a failure mode in reinforcement-learning-based memory for self-evolving LLM agents. Because utilities are indexed to trajectories, the state space grows with interaction history and disperses limited feedback ever more thinly, and because a trajectory's reward is jointly assigned to all co-retrieved memories, irrelevant experiences receive misleading utility updates — what the authors call the memory-reward trap. RoMeRL instead stores experiences against a fixed set of semantic coordinates whose contents are updated or replaced over time, concentrating feedback over a bounded utility support. Across the ALFWorld and LifelongAgentBench benchmarks the authors report improved task performance while reducing the Cold-Q ratio by 80.0%, increasing feedback density roughly sixfold, cutting maintained memory size by 84.4%, and reducing LLM calls by 21.1%.
JingLabs read
Relevant to any long-running or "self-improving" agent that accumulates a memory store from past runs — support assistants, workflow agents that learn from prior tasks. The transferable lesson is that a naively growing experience memory can degrade rather than help, because reward credit leaks to irrelevant retrieved items and feedback thins out as the store grows; a bounded, semantically-indexed memory is the more maintainable design. Treat it as watch-and-test rather than adopt — the results are on two academic benchmarks with a research prototype — but the bounded-memory principle and the large memory-size reduction are worth validating if you operate agents whose memory grows unbounded.
Claude Code 2.1.221: Two Permission-Check Bypasses Fixed (zsh [[ ]] Regex Conditionals, PowerShell Quoted Paths), Sandbox Credential Masking mode:"mask", Print-Mode --mcp-config Connect Fix
The August 4 v2.1.221 release fixes two permission-check bypasses in the Bash tool: commands hidden inside zsh `[[ ]]` regex conditionals could previously execute without prompting, and PowerShell permission checks mishandled Windows paths containing quote characters — both now prompt for approval. It adds a `mode: "mask"` option for sandbox credential files on Linux and WSL, where a sandboxed command reads a sentinel copy (the whole file, or only the spans captured by an `extract` regex) while the sandbox proxy substitutes the real value on egress (masking falls back to `deny` on macOS). It also fixes MCP servers passed via `--mcp-config` not connecting before the first turn in print mode (`-p`), which had made the model emit tool calls as literal text, reduces prompt-cache costs for auto-mode permission checks by reusing the cached conversation prefix, and adds a VS Code "Focus view" that collapses tool activity into per-turn summaries.
JingLabs read
Take the two permission-bypass fixes promptly on any auto-mode or unattended runner: a command tucked into a zsh `[[ ]]` conditional could previously run without triggering the Bash permission prompt, which defeats the gate entirely. The `mode: "mask"` sandbox credential option is worth adopting where a sandboxed command needs a secret's shape but not its value — the proxy substitutes the real credential only on egress — but note it degrades to `deny` on macOS, so it is a Linux/WSL control for now. The print-mode `--mcp-config` fix matters if you script `claude -p` against MCP servers, since tool calls previously leaked out as plain text instead of executing.
Claude Agent SDK for Python 0.2.129: Skill-Name Validation Closes an --allowedTools Permission-Rule Injection, Wildcard skills=["*"] Now Rejected in Favor of skills="all"
The August 4 v0.2.129 release closes a permission-injection path: skill names passed via `ClaudeAgentOptions(skills=[...])` are now validated before being placed into the CLI's `--allowedTools` value, so a crafted name can no longer inject extra permission rules through comma and space delimiters. As a breaking change, skill names containing parentheses, commas, control characters, wildcards (`*`, `:*`), a leading `/`, surrounding whitespace, or surrogate code points now raise `ValueError` at connect time, so `skills=["*"]` or `skills=["plugin:*"]` must become `skills="all"` or a `Skill(...)` rule in `allowed_tools`. The release also updates the bundled Claude CLI to 2.1.221.
JingLabs read
Take this promptly if you build agents on the Python SDK with dynamic or user-influenced skill lists: an unvalidated skill name could previously smuggle additional `--allowedTools` permission rules past your intended gating, a real privilege-widening path. The breaking validation will reject existing wildcard configs, so migrate `skills=["*"]` to `skills="all"` before upgrading. It pairs with the CLI 2.1.221 permission-bypass fixes it bundles — together they tighten the same permission boundary from both the SDK and the CLI side.
Pydantic AI v2.23.0: Monetary cost on RunUsage and cost_limit on UsageLimits, GoogleCloudProvider Credential-Scoping and Auth Env-Var Leak Fixes, Bedrock max_concurrency=0 Deadlock Fixed
v2.23.0, released August 4, adds a `cost` field to `RunUsage` and a `cost_limit` to `UsageLimits`, so a run can be capped by monetary spend rather than only token counts, and introduces a `ToolAvailabilityDeltaPart` that natively renders tools added mid-run. It fixes two credential issues in `GoogleCloudProvider` — tightening credential scoping and closing a path where authentication environment variables could leak — and stops Bedrock from deadlocking on a `bedrock_max_concurrency` of `0` by validating the value instead. It also adds `ModelSettings.extra_headers` support for Bedrock, restores stable Gateway aliases for the Gemini image models, corrects OpenAI streaming timestamp extraction, and closes async streams during teardown rather than at garbage collection.
JingLabs read
`cost_limit` is the change to adopt for unattended runs: capping a run by money spent is a more direct blast-radius guard than a token limit, since token counts translate unevenly to cost across models and providers. The two `GoogleCloudProvider` credential fixes — tighter scoping and closing an auth env-var leak — are worth taking if you route through Vertex, particularly for EU data-residency work where credential handling is audited. The Bedrock fix removes a hard hang from a misconfigured concurrency of `0`; the rest is routine maintenance.
Vercel AI SDK ai@7.0.50: Asynchronous Video Generation via doStart/doStatus/handleWebhookOption on VideoModelV4
ai@7.0.50, released August 3, adds asynchronous video generation to the SDK: the `VideoModelV4` interface can now implement `doStart`, `doStatus`, and `handleWebhookOption` — driving long-running generation through polling or webhooks — instead of, or in addition to, the synchronous `doGenerate`. Concurrent same-day patch releases across the maintained major lines (ai@7.0.49, ai@6.0.241, ai@5.0.226) updated gateway and provider dependencies only.
JingLabs read
Ignore this unless video generation is on your roadmap — for the typical European SMB agent, chatbot, or contact-form build it adds nothing. If you do generate video, the async `doStart`/`doStatus`/webhook path is the right primitive for jobs that outlast a single request, and the parallel patch releases across the 5/6/7 lines let you pick up the gateway dependency bumps without a major-version jump.
Pydantic AI v2.22.0: prefer_tasks to Skip Optional MCP Tasks, Default VALIDATED Tool Mode for Gemini, Native Mid-Conversation System Messages for Anthropic, and RunContext.is_tool_available
Released July 31, v2.22.0 adds a `prefer_tasks` option that lets `MCPToolset` clients skip optional MCP tasks, turns on `VALIDATED` tool mode by default for supported Gemini models, and improves the Anthropic integration so mid-conversation system prompts are sent as native system messages and deferred tools no longer advertise unnecessary tool-search. It adds a `RunContext.is_tool_available` method for checking tool availability during a run, and ships roughly 23 bug fixes covering event-loop handling in synchronous APIs, credential handling during safe downloads, Temporal workflow serialization and type preservation, OpenRouter models with extended thinking, and Python 3.10/3.11 compatibility. It now requires `genai-prices>=0.1.0` for detailed usage tracking and declares `anyio` as a direct dependency of `pydantic-ai-slim` and `pydantic-graph`.
JingLabs read
Take the safe-download credential-handling fix if you use Pydantic AI's file-download path, and the native mid-conversation system-message change if you steer Claude behaviour by injecting system prompts partway through a run — the previous encoding could weaken that steering. `prefer_tasks` is worth testing against MCP servers that expose the new task extension, since skipping optional tasks keeps a run leaner; otherwise this is a routine, low-risk upgrade on an actively maintained SDK.
OpenAI Agents SDK for TypeScript v0.14.0–0.14.2: Programmatic Tool Calling Comes to JavaScript, Sensitive-Data Logging Off by Default, AI SDK 7 LanguageModelV4 Support, and MCP Credential Redaction
v0.14.0 (July 28) brings programmatic tool calling to the TypeScript SDK — supported models generate hosted JavaScript to coordinate eligible tools and reduce intermediate results, persisting across streaming, sessions, and serialized run state — and changes defaults so model and tool data are no longer logged unless `setSensitiveDataLoggingEnabled(true)` is called, while task and turn tracing become enabled by default. It adds AI SDK 7 `LanguageModelV4` support (keeping v2/v3 compatibility), a `VercelCloudBucketMountStrategy` for mounting S3 in Vercel sandboxes, and fixes run-cancellation propagation to function and MCP tools. The August 1 v0.14.2 patch redacts endpoint credentials from MCP transport errors, removes MCP URL credentials from external metadata, cleans failed MCP servers before reconnecting, and rejects ephemeral paths during sandbox archive hydration.
JingLabs read
This mirrors the Python SDK's recent work for JavaScript/TypeScript teams: the v0.14.2 MCP credential-redaction fixes are the ones to take promptly if you run this SDK against remote MCP servers, since URL-embedded credentials previously reached error messages and tool metadata. The new sensitive-data-logging-off-by-default is a sensible GDPR-aligned default — confirm it before upgrading in case you relied on the old logging — and treat programmatic tool calling as a capability to test behind explicit gating rather than adopt blindly, since it lets the model emit JavaScript to orchestrate tools.
Google ADK for Python v2.6.0–2.6.1: Per-Invocation Auth Headers and Three-Legged OAuth Identity for Agent Cards, a Self-Healing ReflectAndRetry Model Plugin, and Telemetry Consent Checks
v2.6.0 (July 29) adds per-invocation auth headers for agent cards, OAuth2 nonce forwarding, and an agent-identity finalize endpoint for three-legged OAuth flows; a `ReflectAndRetryModelPlugin` that retries after reflecting on errors; telemetry consent checks with metric export for Agent Engine; new Eventarc Advanced and OCI Generative AI toolsets; and a fix that removes quadratic text/audio accumulation in streaming. v2.6.1 (July 31) adds parent-terminal grouping and TTL pruning to CLI telemetry and fixes tool confirmations being re-validated after they were already consumed. Both releases also address OAuth token refresh, prompt-cache invalidation with dynamic tools, and artifact namespace isolation.
JingLabs read
For teams on Google's stack the per-invocation auth-header and three-legged OAuth identity work is the substantive part — it lets agent-to-agent calls carry properly delegated credentials, which matters for EU deployments that need auditable, scoped access rather than shared service credentials. The telemetry consent checks are a welcome default for GDPR-aware operators; the `ReflectAndRetryModelPlugin` is worth testing for unattended runs where a transient model error would otherwise abort a task, and the streaming accumulation fix is a straightforward reason to upgrade if you stream long audio or text.
OpenAI Agents SDK Python 0.19.0–0.19.2: Programmatic Tool Calling (Model-Generated JavaScript to Coordinate Tools), @tool Decorator Alias, MCP Credential-Redaction and Session-Limit Hardening Pass
v0.19.0, released July 27, adds `ProgrammaticToolCallingTool`, which lets supported OpenAI Responses models generate JavaScript to coordinate eligible tools with per-tool `allowed_callers`, structured function-tool outputs, and integration with Runner streaming, guardrails, approvals, sessions, and `RunState`; it also adds a public `agents.decorators` module with a shorter `@tool` alias, async callable function tools, and hardened error/diagnostic logging to prevent sensitive-payload exposure. v0.19.1, released July 29, adds native host-path support in sandbox grants and WebSocket overload-retry handling and fixes guardrail and session-management issues. The August 1 v0.19.2 is a security and reliability pass: MCP prompt/resource transport errors are redacted, URL credentials are removed from SDK errors, tracing, and tool metadata, failed MCP servers are cleaned before reconnection, Modal rejects ephemeral paths during tar hydration, input-guardrail results are reported when a tripwire aborts a run, and session-item limit counting is corrected across the SQLAlchemy, MongoDB, Redis, Dapr, and SQLite backends.
JingLabs read
The MCP credential-redaction fixes in 0.19.2 are the ones to take promptly if you run this SDK against remote MCP servers — URL-embedded credentials previously leaked into error messages, traces, and tool metadata, a real exposure path anywhere those are logged or relayed. Treat programmatic tool calling as a capability to test rather than adopt blindly: letting the model emit JavaScript to orchestrate tools is powerful for multi-tool workflows but widens what one turn can do, so keep it behind `allowed_callers` and approvals, and pick up the session-limit counting fixes if you cap history on a database-backed session.
Microsoft Agent Framework python-1.13.0: Bounded In-Memory Archive Skill Discovery for MCP Sources, Fully Replayable Workflow Checkpoints, Reusable Foundry Session Stores
The July 30 python-1.13.0 release adds bounded, in-memory archive skill discovery for MCP sources with archive controls exposed through `FoundryToolbox`, reusable session stores that let a full Foundry Responses session persist, process-wide feature-usage telemetry with first-party User-Agent reporting, OpenAI cache-write token usage in observability data, per-request ephemeral instructions for the OpenAI Responses API, and asynchronous credential support in `FoundryToolbox`. Its one breaking change makes workflow checkpoints fully replayable from the initial input and human-in-the-loop responses, altering existing checkpoint behaviour. Bug fixes tighten unpickler security restrictions, correct MCP header application, fix streamed-token double-counting for Anthropic, sanitise message author names, and fix Windows junction handling in file stores.
JingLabs read
The replayable-checkpoint change is the substantive one for durable workflows on this framework: deriving state purely from the initial input plus recorded human-in-the-loop responses makes resumes deterministic, but it is a breaking change, so re-test existing checkpoints before upgrading. The Anthropic streamed-token double-counting fix is worth taking if you bill or budget from usage on this stack, and the tightened unpickler restrictions close a deserialisation-safety gap; treat archive skill discovery for MCP sources as useful when a large MCP catalogue is bloating your context.
MCP Specification 2026-07-28: Stateless Streamable-HTTP Core Drops Mcp-Session-Id, Required server/discover RPC and subscriptions/listen Stream, Tasks Moved to an Official Extension, Roots/Sampling/Logging Deprecated
The July 28 revision of the Model Context Protocol removes protocol-level sessions and the `Mcp-Session-Id` header from the Streamable HTTP transport, carrying the protocol version and client capabilities in per-request `_meta` fields instead of the `initialize`/`notifications/initialized` handshake, so servers can run on stateless serverless and edge infrastructure. It adds a required `server/discover` RPC for advertising supported protocol versions, capabilities, and identity; replaces the HTTP GET endpoint and `resources/subscribe`/`resources/unsubscribe` with a single long-lived `subscriptions/listen` POST-response stream; and introduces a Multi Round-Trip Requests pattern where a server returns an `InputRequiredResult` (`resultType: "input_required"`) and the client retries with `inputResponses`. Authorization is hardened around RFC 9207 — authorization servers SHOULD return the `iss` parameter and clients must validate the issuer and key persisted credentials by issuer identifier to prevent cross-server credential reuse. Experimental tasks move out of the core protocol into an official `io.modelcontextprotocol/tasks` extension that polls rather than blocks, and Roots, Sampling, and Logging are deprecated in favor of direct tool parameters and OpenTelemetry.
JingLabs read
This is a breaking spec revision to plan a migration around, not a drop-in upgrade: the stateless core removes `Mcp-Session-Id` and the initialize handshake, so any server or client you maintain that assumes a session needs reworking — but the payoff is concrete for SMB deployments, since stateless servers deploy cleanly on serverless and edge and cost less to keep running. Prioritise the authorization changes — issuer validation and per-issuer credential keying close a token-reuse path — and treat the deprecation of Roots, Sampling, and Logging as a signal to migrate those flows before they are removed; pin your servers to a spec revision and negotiate via `server/discover` rather than assuming the old handshake.
OpenAI Codex 0.146.0: Named and Pinned Sessions, Plugin Marketplaces for Amazon Bedrock and Claude Code, Thread Forking with Paginated History, Proxies Honored Across Auth/MCP/WebSockets
Codex 0.146.0, released July 29, stabilises session management — naming new sessions with `/new` or `/clear`, pinning important threads, and switching between side conversations without closing them — and adds Agent Plugins manifests, workspace plugin publishing, and additional plugin marketplaces for Amazon Bedrock and Claude Code. It adds thread forking with paginated history (including temporary forks that do not appear in thread listings), connecting the app-server to remote Code Mode hosts over WebSocket, standalone web search for compatible custom model providers, and discovery of executor-provided skills with secure reading of their resources. Bug fixes make Codex honour configured proxies across authentication, plugin downloads, MCP authorization, remote execution, WebSockets, redirects, and LM Studio connections; keep MCP connections current and reconnect closed servers when authentication or configuration changes; preserve submitted messages, final responses, failed-turn errors, and approval settings across interruptions; and retain more available skills under tight context budgets with a warning when the skill catalog must be truncated.
JingLabs read
The proxy fix is the one to take on any Codex runner behind a corporate egress boundary: earlier releases honoured proxies inconsistently, and 0.146.0 routes authentication, plugin downloads, MCP authorization, remote execution, and WebSocket traffic through the configured proxy — directly relevant for regulated EU networks. Review the new plugin marketplaces (including a Claude Code source) as added supply-chain surface before enabling them for a team, and treat session naming/pinning and thread forking as workflow conveniences rather than reasons to upgrade on their own.
Pydantic AI v2.19.0–2.21.0: Claude Opus 5 Support, Retryable ModelHTTPError with headers/retry_after, per_request_input_tokens_limit, Recoverable MCP Errors
v2.19.0, released July 27, adds `headers` and `retry_after` fields to `ModelHTTPError` across the provider SDKs so a rate-limited response exposes its `Retry-After` hint, resolves external-cancellation handling, and widens the FastMCP dependency range to `<4`. v2.20.0, released July 28, adds `claude-opus-5` model support and OpenAI Responses `reasoning.context` (default `all_turns`) for the GPT-5.4/5.5/5.6 families, captures Anthropic thinking tokens in usage details, makes a bare `McpError` from an MCP server recoverable rather than fatal, restores tool-search history replay across provider transitions, and fixes the `ALLOW_MODEL_REQUESTS` guard for embeddings. v2.21.0, released July 29, adds a `per_request_input_tokens_limit` usage control and corrects model-name recognition from Gateway probes and Google image IDs. None of the three releases documents a security fix.
JingLabs read
Two changes are worth adopting on this SDK: `retry_after`/`headers` on `ModelHTTPError` lets your retry logic honour a provider's `Retry-After` instead of guessing a backoff, and `per_request_input_tokens_limit` is a direct cost and blast-radius guard on a single call — both matter for unattended runs. The recoverable-`McpError` change removes a class of hard failures where one misbehaving MCP server aborted the whole run. Add `claude-opus-5` to your provider matrix if you are moving to Opus 5, but pin the model deliberately rather than inheriting it.
Claude Code 2.1.219–220: Claude Opus 5 Becomes the Default Opus (1M Context, $10/$50 Fast Mode), sandbox.network.strictAllowlist Denies Non-Allowlisted Hosts Without Prompting, Nested Subagents Back to Depth 3
The July 24 v2.1.219 release makes Claude Opus 5 (`claude-opus-5`) the new default Opus model, with a 1M-token context window and fast-mode pricing of $10/$50 per Mtok; it replaces Opus 4.7 in fast mode, so `/fast` now applies to Opus 5 and Opus 4.8, and the bundled claude-api skill defaults to Opus 5 with a migration path from Opus 4.8. It adds a `sandbox.network.strictAllowlist` setting that denies non-allowlisted hosts for sandboxed commands without prompting, raises the default subagent-nesting depth from 1 back to 3 (disable with `CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH=1`) and forwards depth-2+ nested-subagent text in stream-json keyed by the spawning Agent `tool_use` id, adds a `DirectoryAdded` hook that fires after `/add-dir` or an SDK `register_repo_root` request registers a new working directory mid-session, and defaults dynamic workflows to a medium size guideline (fewer than 15 agents) settable from any settings file via `workflowSizeGuideline`. It surfaces MCP configuration problems more loudly — `mcp_server_errors` in the headless stream-json init event listing `--mcp-config` entries skipped by validation, HTTP status and error text in `claude mcp list` and `/mcp` when a server fails to connect, and warnings for hidden leading/trailing whitespace in MCP config values — and fixes `claude -p` dropping already-produced text when a turn dies on a mid-stream API error. The July 25 v2.1.220 is a follow-up bug-fix and reliability release.
JingLabs read
The default-model change is the one to plan for: upgrading moves your default Opus to Opus 5 with a 1M context and a different fast-mode rate, so pin the model explicitly if you validated a pipeline against Opus 4.8 and re-budget for the new pricing. For unattended and CI runners `sandbox.network.strictAllowlist` is worth adopting — it turns egress control into a hard deny for non-allowlisted hosts rather than a prompt — but note the nested-subagent default now goes three levels deep again, reversing 2.1.217's default-off, so re-confirm your concurrency and dollar-budget ceilings still hold now that a single run can fan out further.
Pydantic AI v2.17.0–2.18.0: Cached OpenTelemetry Serialization Removes O(n²) Instrumentation Cost, AdvisorTool and external_web_access for OpenAI, BedrockMantleProvider and Google Cloud EU Multi-Region
v2.17.0, released July 23, caches per-message OpenTelemetry serialization to remove an O(n²) instrumentation overhead that grew with message count, lets `RequestUsage` and `RunUsage` carry arbitrary fields ahead of upcoming genai-prices, and fixes `ContentFilterError` handling for Google Model Armor blocks (`finishReason: MODEL_ARMOR`). The July 24 v2.18.0 adds `AdvisorTool` support across the Anthropic and OpenRouter providers, an `external_web_access` option on the OpenAI Responses `WebSearchTool`, a new `BedrockMantleProvider` with normalized response-scoped tool-call IDs, and `us`/`eu` multi-region location types for `GoogleCloudProvider`, and fixes deferred stream-error mapping in `GoogleModel`. Neither release documents any security fixes.
JingLabs read
The OpenTelemetry caching fix is the one to take if you instrument long multi-turn agents on this SDK: quadratic per-message serialization silently inflated latency and overhead as a conversation grew, and this removes it with no code change. For EU client work the `GoogleCloudProvider` `eu` multi-region option is a concrete data-residency lever worth using when you route through Vertex; otherwise treat `AdvisorTool`, `external_web_access`, and the Bedrock Mantle provider as adopt-if-you-use-that-path.
Claude Code 2.1.217: Concurrent-Subagent Cap and No Nested Subagents by Default, --max-budget-usd Halts Background Agents, Symlinked-Workdir Isolation Escape and Truncated-MCP-Output Memory Leak Fixed
The July 21 v2.1.217 release adds three controls on how far one message can fan out: a cap on concurrently-running subagents (default 20, override with CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS), subagents no longer spawning nested subagents by default (set CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH to allow deeper nesting), and --max-budget-usd now denying new spawns and halting running background subagents once the cap is reached. It fixes background-session isolation not canonicalizing symlinked working directories, which could let a session escape its workspace folder, and a memory leak where truncated MCP tool outputs kept the full untruncated result in memory for the rest of the session. Other fixes cover managed OTEL_EXPORTER_OTLP_ENDPOINT settings not governing all telemetry signals, corporate mTLS/TLS-verify/OAuth-scope/proxy settings being ignored in Claude Desktop sessions, Windows auto-update leaving claude.exe missing, auto-compact never triggering for Opus 4.8 on Bedrock, a brace-expansion OOM at startup from CLAUDE.md/SKILL.md paths frontmatter, and --resume/--continue crashing on a malformed transcript attachment; it also adds transcript-write and disabled-session-saving warnings and emoji shortcode autocomplete.
JingLabs read
For unattended and CI runners the fan-out controls are the piece to take promptly: capping concurrent subagents, disabling nested-subagent spawning by default, and making the dollar budget actually stop background agents together bound the cost and blast radius of a run that recursively fans out. The symlinked-workdir isolation fix closes another workspace-escape path in the same vein as recent worktree fixes, and the managed-OTEL and Desktop mTLS/proxy fixes matter if you enforce telemetry or egress policy centrally — before them, lower-scope overrides could redirect telemetry and Desktop could ignore corporate proxy settings.