feat(deps): Update to claude-agent-sdk 0.2.132 by dependabot[bot] · Pull Request #636 · agentclientprotocol/claude-agent-acp

dependabot · 2026-05-07T14:41:22Z

Bumps the minor group with 6 updates in the / directory:

Package	From	To
@anthropic-ai/claude-agent-sdk	`0.2.126`	`0.2.132`
@types/estree	`1.0.8`	`1.0.9`
express-rate-limit	`8.4.1`	`8.5.1`
fast-uri	`3.1.1`	`3.1.2`
hono	`4.12.16`	`4.12.18`
vite	`8.0.10`	`8.0.11`

Updates @anthropic-ai/claude-agent-sdk from 0.2.126 to 0.2.132

Release notes

Sourced from @anthropic-ai/claude-agent-sdk's releases.

v0.2.132

What's changed

Documented applyFlagSettings() in the TypeScript Agent SDK reference and added support for null on top-level keys to clear flag-settings overrides

Updated to parity with Claude Code v2.1.132

Update
npm install @anthropic-ai/claude-agent-sdk@0.2.132
# or
yarn add @anthropic-ai/claude-agent-sdk@0.2.132
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.2.132
# or
bun add @anthropic-ai/claude-agent-sdk@0.2.132
v0.2.131

What's changed

Updated to parity with Claude Code v2.1.131

Update
npm install @anthropic-ai/claude-agent-sdk@0.2.131
# or
yarn add @anthropic-ai/claude-agent-sdk@0.2.131
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.2.131
# or
bun add @anthropic-ai/claude-agent-sdk@0.2.131
v0.2.129

What's changed

Updated to parity with Claude Code v2.1.129

Update
npm install @anthropic-ai/claude-agent-sdk@0.2.129
# or
yarn add @anthropic-ai/claude-agent-sdk@0.2.129
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.2.129
# or
bun add @anthropic-ai/claude-agent-sdk@0.2.129
</tr></table> 

... (truncated)

Changelog

Sourced from @anthropic-ai/claude-agent-sdk's changelog.

0.2.132

Documented applyFlagSettings() in the TypeScript Agent SDK reference and added support for null on top-level keys to clear flag-settings overrides

Updated to parity with Claude Code v2.1.132

0.2.131

Updated to parity with Claude Code v2.1.131

0.2.130

Updated to parity with Claude Code v2.1.130

0.2.129

Updated to parity with Claude Code v2.1.129

0.2.128

Updated to parity with Claude Code v2.1.128

0.2.127

Updated to parity with Claude Code v2.1.127

Commits

82da44c chore: Update CHANGELOG.md
0fe2005 chore: Update CHANGELOG.md
7bc3bd7 chore: Update CHANGELOG.md
e76e325 chore: Update CHANGELOG.md
See full diff in compare view

Updates @anthropic-ai/claude-agent-sdk-darwin-arm64 from 0.2.126 to 0.2.132

Updates @anthropic-ai/claude-agent-sdk-darwin-x64 from 0.2.126 to 0.2.132

Updates @anthropic-ai/claude-agent-sdk-linux-arm64 from 0.2.126 to 0.2.132

Updates @anthropic-ai/claude-agent-sdk-linux-arm64-musl from 0.2.126 to 0.2.132

Updates @anthropic-ai/claude-agent-sdk-linux-x64 from 0.2.126 to 0.2.132

Updates @anthropic-ai/claude-agent-sdk-linux-x64-musl from 0.2.126 to 0.2.132

Updates @anthropic-ai/claude-agent-sdk-win32-arm64 from 0.2.126 to 0.2.132

Updates @anthropic-ai/claude-agent-sdk-win32-x64 from 0.2.126 to 0.2.132

Updates @types/estree from 1.0.8 to 1.0.9

Commits

See full diff in compare view

Updates express-rate-limit from 8.4.1 to 8.5.1

Release notes

Sourced from express-rate-limit's releases.

v8.5.1

You can view the changelog here.

v8.5.0

You can view the changelog here.

Commits

50cc3f6 8.5.1
92c8e3e chore: bump ip-address library to latest (#626)
807e383 8.5.0
b844137 v8.5.0 changelog
ceaffab feat: async store init (#621)
See full diff in compare view

Updates fast-uri from 3.1.1 to 3.1.2

Release notes

Sourced from fast-uri's releases.

v3.1.2

⚠️ Security Release

Fix for GHSA-v39h-62p7-jpjc

What's Changed

Handle malformed fragment decoding as a parse error by @mcollina in fastify/fast-uri#171

Full Changelog: fastify/fast-uri@v3.1.1...v3.1.2

Commits

919dd8e Bumped v3.1.2
c65ba57 fixup: linting
6c86c17 Merge commit from fork
a95158a Handle malformed fragment decoding without throwing (#171)
See full diff in compare view

Updates hono from 4.12.16 to 4.12.18

Release notes

Sourced from hono's releases.

v4.12.18

Security fixes

This release includes fixes for the following security issues:

Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage

Affects: Cache Middleware. Fixes missing cache-skip handling for Vary: Authorization and Vary: Cookie, where a response cached for one authenticated user could be served to other users. GHSA-p77w-8qqv-26rm

CSS Declaration Injection via Style Object Values in JSX SSR

Affects: hono/jsx. Fixes a missing CSS-context escape for style object values and property names, where untrusted input could inject additional CSS declarations. The impact is limited to CSS and does not allow JavaScript execution. GHSA-qp7p-654g-cw7p

Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()

Affects: hono/utils/jwt. Fixes improper validation of exp, nbf, and iat claims, where falsy, non-finite, or non-numeric values could silently bypass time-based checks instead of being rejected per RFC 7519. GHSA-hm8q-7f3q-5f36

Users who use the JWT helper, hono/jsx, or the Cache middleware are strongly encouraged to upgrade to this version.

v4.12.17

What's Changed

fix(jsx): normalize SVG attributes on the root element by @kfly8 in honojs/hono#4893

fix(ssg): add atom+xml and rss+xml to defaultExtensionMap by @yuintei in honojs/hono#4899

fix(cors): make origin optional in CORSOptions by @truffle-dev in honojs/hono#4905

fix(types): propagate middleware response types to app.on overloads by @T4ko0522 in honojs/hono#4906

New Contributors

@kfly8 made their first contribution in honojs/hono#4893

@truffle-dev made their first contribution in honojs/hono#4905

Full Changelog: honojs/hono@v4.12.16...v4.12.17

Commits

f10dee8 4.12.18
a5bd9eb Merge commit from fork
58d3d3a Merge commit from fork
568c2ec Merge commit from fork
ff2b3d3 4.12.17
52aaaf9 fix(types): propagate middleware response types to app.on overloads (#4906)
76d5589 fix(cors): make origin optional in CORSOptions (#4905)
8f027e5 fix(ssg): add atom+xml and rss+xml to defaultExtensionMap (#4899)
bfba97c fix(jsx): normalize SVG attributes on the <svg> root element (#4893)
See full diff in compare view

Updates ip-address from 10.1.0 to 10.2.0

Commits

See full diff in compare view

Updates vite from 8.0.10 to 8.0.11

Release notes

Sourced from vite's releases.

v8.0.11

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.0.11 (2026-05-07)

Features

update rolldown to 1.0.0-rc.18 (#22360) (3f80524)

Bug Fixes

deps: update all non-major dependencies (#22334) (672c962)

deps: update all non-major dependencies (#22382) (5c0cfcb)

glob: align hmr matcher options with glob enumeration (#22306) (30028f9)

make separate object instance for each environment (#22276) (7c2aa3b)

Documentation

create-vite: list react-compiler templates in README (#22347) (7c3a61f)

explain mergeConfig skips null/undefined (#22325) (2151f70)

mention native config loader in CLI options (#22348) (0420c5d)

update evan's x handle (640202a)

Miscellaneous Chores

deps: update dependency tsdown to ^0.21.10 (#22333) (3b51e05)

deps: update rolldown-related dependencies (#22383) (555ff36)

deps: update transitive packages to fix npm audit alerts (#22316) (86aee62)

Code Refactoring

devtools integration (#22312) (3c8bf06)

remove unnecessary async (#22296) (b31fd35)

show direct path type in bad character warning (#22339) (0c162e9)

Tests

create-vite: use short help alias (#22389) (994ab66)

Commits

66f3194 release: v8.0.11
5c0cfcb fix(deps): update all non-major dependencies (#22382)
555ff36 chore(deps): update rolldown-related dependencies (#22383)
b31fd35 refactor: remove unnecessary async (#22296)
3c8bf06 refactor: devtools integration (#22312)
7c2aa3b fix: make separate object instance for each environment (#22276)
3f80524 feat: update rolldown to 1.0.0-rc.18 (#22360)
0c162e9 refactor: show direct path type in bad character warning (#22339)
672c962 fix(deps): update all non-major dependencies (#22334)
30028f9 fix(glob): align hmr matcher options with glob enumeration (#22306)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the minor group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@anthropic-ai/claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-typescript) | `0.2.126` | `0.2.132` | | [@types/estree](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/estree) | `1.0.8` | `1.0.9` | | [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `8.4.1` | `8.5.1` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.1` | `3.1.2` | | [hono](https://github.com/honojs/hono) | `4.12.16` | `4.12.18` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.0.10` | `8.0.11` | Updates `@anthropic-ai/claude-agent-sdk` from 0.2.126 to 0.2.132 - [Release notes](https://github.com/anthropics/claude-agent-sdk-typescript/releases) - [Changelog](https://github.com/anthropics/claude-agent-sdk-typescript/blob/main/CHANGELOG.md) - [Commits](anthropics/claude-agent-sdk-typescript@v0.2.126...v0.2.132) Updates `@anthropic-ai/claude-agent-sdk-darwin-arm64` from 0.2.126 to 0.2.132 Updates `@anthropic-ai/claude-agent-sdk-darwin-x64` from 0.2.126 to 0.2.132 Updates `@anthropic-ai/claude-agent-sdk-linux-arm64` from 0.2.126 to 0.2.132 Updates `@anthropic-ai/claude-agent-sdk-linux-arm64-musl` from 0.2.126 to 0.2.132 Updates `@anthropic-ai/claude-agent-sdk-linux-x64` from 0.2.126 to 0.2.132 Updates `@anthropic-ai/claude-agent-sdk-linux-x64-musl` from 0.2.126 to 0.2.132 Updates `@anthropic-ai/claude-agent-sdk-win32-arm64` from 0.2.126 to 0.2.132 Updates `@anthropic-ai/claude-agent-sdk-win32-x64` from 0.2.126 to 0.2.132 Updates `@types/estree` from 1.0.8 to 1.0.9 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/estree) Updates `express-rate-limit` from 8.4.1 to 8.5.1 - [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases) - [Commits](express-rate-limit/express-rate-limit@v8.4.1...v8.5.1) Updates `fast-uri` from 3.1.1 to 3.1.2 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.1...v3.1.2) Updates `hono` from 4.12.16 to 4.12.18 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.16...v4.12.18) Updates `ip-address` from 10.1.0 to 10.2.0 - [Commits](https://github.com/beaugunderson/ip-address/commits) Updates `vite` from 8.0.10 to 8.0.11 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.0.11/packages/vite) --- updated-dependencies: - dependency-name: "@anthropic-ai/claude-agent-sdk" dependency-version: 0.2.132 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor - dependency-name: "@anthropic-ai/claude-agent-sdk-darwin-arm64" dependency-version: 0.2.132 dependency-type: indirect update-type: version-update:semver-patch dependency-group: minor - dependency-name: "@anthropic-ai/claude-agent-sdk-darwin-x64" dependency-version: 0.2.132 dependency-type: indirect update-type: version-update:semver-patch dependency-group: minor - dependency-name: "@anthropic-ai/claude-agent-sdk-linux-arm64" dependency-version: 0.2.132 dependency-type: indirect update-type: version-update:semver-patch dependency-group: minor - dependency-name: "@anthropic-ai/claude-agent-sdk-linux-arm64-musl" dependency-version: 0.2.132 dependency-type: indirect update-type: version-update:semver-patch dependency-group: minor - dependency-name: "@anthropic-ai/claude-agent-sdk-linux-x64" dependency-version: 0.2.132 dependency-type: indirect update-type: version-update:semver-patch dependency-group: minor - dependency-name: "@anthropic-ai/claude-agent-sdk-linux-x64-musl" dependency-version: 0.2.132 dependency-type: indirect update-type: version-update:semver-patch dependency-group: minor - dependency-name: "@anthropic-ai/claude-agent-sdk-win32-arm64" dependency-version: 0.2.132 dependency-type: indirect update-type: version-update:semver-patch dependency-group: minor - dependency-name: "@anthropic-ai/claude-agent-sdk-win32-x64" dependency-version: 0.2.132 dependency-type: indirect update-type: version-update:semver-patch dependency-group: minor - dependency-name: "@types/estree" dependency-version: 1.0.9 dependency-type: indirect update-type: version-update:semver-patch dependency-group: minor - dependency-name: express-rate-limit dependency-version: 8.5.1 dependency-type: indirect update-type: version-update:semver-minor dependency-group: minor - dependency-name: fast-uri dependency-version: 3.1.2 dependency-type: indirect update-type: version-update:semver-patch dependency-group: minor - dependency-name: hono dependency-version: 4.12.18 dependency-type: indirect update-type: version-update:semver-patch dependency-group: minor - dependency-name: ip-address dependency-version: 10.2.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: minor - dependency-name: vite dependency-version: 8.0.11 dependency-type: indirect update-type: version-update:semver-patch dependency-group: minor ... Signed-off-by: dependabot[bot] <support@github.com>

🤖 I have created a release *beep* *boop* --- ## [0.33.0](v0.32.0...v0.33.0) (2026-05-07) ### Features * **deps:** bump the minor group with 14 updates ([#631](#631)) ([8b43ee8](8b43ee8)) * **deps:** Update to claude-agent-sdk 0.2.132 ([#636](#636)) ([0c8ff27](0c8ff27)) ### Bug Fixes * Handle result origins in ACP agent ([#627](#627)) ([dba1998](dba1998)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: acp-release-bot[bot] <246668977+acp-release-bot[bot]@users.noreply.github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 7, 2026

benbrandt changed the title ~~feat(deps): bump the minor group across 1 directory with 15 updates~~ feat(deps): Update to claude-agent-sdk 0.2.132 May 7, 2026

benbrandt merged commit 0c8ff27 into main May 7, 2026
2 checks passed

benbrandt deleted the dependabot/npm_and_yarn/minor-82834ecc45 branch May 7, 2026 20:21

acp-release-bot Bot mentioned this pull request May 4, 2026

chore(main): release 0.33.0 #628

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(deps): Update to claude-agent-sdk 0.2.132#636

feat(deps): Update to claude-agent-sdk 0.2.132#636
benbrandt merged 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-82834ecc45

dependabot Bot commented on behalf of github May 7, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github May 7, 2026

v0.2.132

What's changed

Update

v0.2.131

What's changed

Update

v0.2.129

What's changed

Update

0.2.132

0.2.131

0.2.130

0.2.129

0.2.128

0.2.127

v8.5.1

v8.5.0

v3.1.2

⚠️ Security Release

What's Changed

v4.12.18

Security fixes

Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage

CSS Declaration Injection via Style Object Values in JSX SSR

Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()

v4.12.17

What's Changed

New Contributors

v8.0.11

8.0.11 (2026-05-07)

Features

Bug Fixes

Documentation

Miscellaneous Chores

Code Refactoring

Tests

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant