chore(deps): update all dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence	Type	Update
@anthropic-ai/claude-agent-sdk	0.2.126 → 0.3.143					peerDependencies	minor
@anthropic-ai/claude-agent-sdk	^0.2.132 → ^0.3.0					devDependencies	minor
@openai/codex-sdk (source)	0.130.0 → 0.131.0					peerDependencies	minor
@openai/codex-sdk (source)	0.130.0 → 0.131.0					devDependencies	minor
actions/dependency-review-action	v4 → v5.0.0					action	major

---

Release Notes

anthropics/claude-agent-sdk-typescript (@​anthropic-ai/claude-agent-sdk)

v0.3.143

Compare Source

• @anthropic-ai/sdk and @modelcontextprotocol/sdk are now peerDependencies instead of dependencies. Runtime is unaffected (both are bundled); npm/bun/pnpm auto-install them. yarn classic users should add them explicitly for full TypeScript type resolution

v0.3.142

Compare Source

• Breaking: Removed the v2 session API (unstable_v2_createSession, unstable_v2_resumeSession, unstable_v2_prompt, SDKSession, SDKSessionOptions), deprecated since 0.2.133. Use query() — pass an AsyncIterable<SDKUserMessage> for multi-turn, or options.resume to continue a session.
• Breaking: MCP servers now connect in the background by default; sessions start immediately and slow servers report status: "pending" in init until ready. Set MCP_CONNECTION_NONBLOCKING=0 to restore the old behavior of waiting up to 5s before the first query, or mark a server alwaysLoad: true to require it in turn 1.
• Breaking: Headless and SDK sessions now use Task tools (TaskCreate / TaskUpdate / TaskGet / TaskList) instead of TodoWrite, deprecated since 0.2.136. Tool consumers should accumulate by task ID instead of replacing a snapshot list.
• Surfaced request_id, subagent_type, and task_description on SDK message types and task system events
• Headless --sdk-url sessions now exit non-zero with a stderr diagnostic when the remote transport closes permanently (401/403/404 or WS permanent close), instead of silently exiting 0

v0.2.141

Compare Source

• TaskCreateInput, TaskCreateOutput, TaskGetInput, TaskGetOutput, TaskUpdateInput, TaskUpdateOutput, TaskListInput, and TaskListOutput types are now exported from @anthropic-ai/claude-agent-sdk/sdk-tools and included in the ToolInputSchemas/ToolOutputSchemas unions
• Aligned @anthropic-ai/sdk dependency to ^0.93.0

v0.2.140

Compare Source

• Updated to parity with Claude Code v2.1.140

v0.2.139

Compare Source

• Updated to parity with Claude Code v2.1.139

v0.2.138

Compare Source

• Updated to parity with Claude Code v2.1.138

v0.2.137

Compare Source

• Updated to parity with Claude Code v2.1.137

v0.2.136

Compare Source

• Added resolveSettings() (alpha) to inspect effective merged settings without spawning the Claude CLI; reads MDM (plist/HKLM/HKCU) for parity with CLI startup
• Deprecated TodoWrite tool — future versions will switch to Task tools (TaskCreate, TaskGet, TaskUpdate, TaskList)

v0.2.133

Compare Source

• Deprecated the unstable V2 session API (unstable_v2_createSession / unstable_v2_resumeSession / unstable_v2_prompt) — use query() instead
• Deprecated passing 'Skill' in allowedTools — use the skills option instead
• Updated to parity with Claude Code v2.1.133

v0.2.132

Compare Source

• Documented applyFlagSettings() in the TypeScript Agent SDK reference and added support for null on top-level keys to clear flag-settings overrides
• Updated to parity with Claude Code v2.1.132

v0.2.131

Compare Source

• Updated to parity with Claude Code v2.1.131

v0.2.129

Compare Source

• Updated to parity with Claude Code v2.1.129

v0.2.128

Compare Source

• Updated to parity with Claude Code v2.1.128

actions/dependency-review-action (actions/dependency-review-action)

v5.0.0: 5.0.0

Compare Source

This is a new major version of the Dependency Review Action which updates the runtime to node24. This requires a minimum Actions Runner version v2.327.1 to run.

What's Changed

• Add .github/copilot-instructions.md for Copilot coding agent by @​ahpook in #​1067
• Update Node.js runtime from 20 to 24 by @​scottschreckengaust in #​1084
• Bump spdx-license-ids from 3.0.20 to 3.0.23 by @​mongolyy in #​1091
• docs: bump actions/checkout from v4 to v6 in workflow examples by @​Marukome0743 in #​1077
• fix: patched version display for advisories with non-strict semver ranges (e.g. Maven beta versions) by @​tspascoal in #​1076
• Resolve security findings by @​AshelyTC in #​1094
• v5.0.0 release branch by @​ahpook in #​1098

New Contributors

• @​scottschreckengaust made their first contribution in #​1084
• @​mongolyy made their first contribution in #​1091
• @​Marukome0743 made their first contribution in #​1077

Full Changelog: actions/dependency-review-action@v4.9.0...v5.0.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​anthropic-ai/​claude-agent-sdk@​0.2.126 ⏵ 0.3.143	-2		+1
	@​openai/​codex-sdk@​0.130.0 ⏵ 0.131.0	+1		+1	+1

View full report

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report