Skip to content

chore(deps): bump bundled agents to latest#940

Merged
natllian merged 3 commits into
mainfrom
automation/bump-bundled-vendors
Jul 24, 2026
Merged

chore(deps): bump bundled agents to latest#940
natllian merged 3 commits into
mainfrom
automation/bump-bundled-vendors

Conversation

@dohooo

@dohooo dohooo commented Jul 19, 2026

Copy link
Copy Markdown
Owner

Automated daily bundled-agent version sweep. Bumps the in-scope bundled coding agents to their latest stable upstream releases. Kept as a single long-lived PR on automation/bump-bundled-vendors.

Version changes (current on main → target)

Vendor Current (main) Target Notes
@anthropic-ai/claude-agent-sdk 0.3.212 0.3.217 lockstep with claude-code
@anthropic-ai/claude-code 2.1.212 2.1.217 lockstep (X=217); SHA256 arm64+x64 added
@openai/codex 0.144.5 0.145.0 minor bump; SHA256 arm64+x64 added; layoutVersion still 1 (no staging change)
@cursor/sdk 1.0.23 1.0.24 Node engines floor still >=22.13, satisfied by bundled Node 24.17.0
@opencode-ai/sdk + opencode-ai 1.18.3 1.18.4 SDK↔CLI lockstep; SHA256 arm64+x64 added
Kimi 0.21.0 deferred — see below

History: this branch first pinned Claude 2.1.214, then 2.1.215; upstream has since promoted 2.1.217/0.3.217 to npm latest, and Codex/Cursor/OpenCode also shipped newer stable releases — all now folded into this single PR (latest push 2026-07-22).

Lockstep verification

node_modules/@anthropic-ai/claude-agent-sdk/package.json carries claudeCodeVersion: "2.1.217" — SDK↔CLI patch matched. ✅

Kimi deferred (needs manual follow-up)

Kimi's binaries are downloaded from github.com/MoonshotAI/kimi-code releases, and this automation sandbox has GitHub access scoped to dohooo/helmor only — all github.com / api.github.com requests to the Kimi repo return 403. The cross-arch release-zip SHA256 (mandatory, build hard-fails on mismatch) cannot be computed or verified here, so Kimi is intentionally left at 0.21.0 rather than pinned with an unverified SHA. Kimi patch bumps are frequently TUI/web-only; apply manually when GitHub asset access is available.

Local verification gates (all passed at the current targets)

Gate Result
bun install ✅ resolved 0.3.217 / 2.1.217 / 0.145.0 / 1.0.24 / 1.18.4; lockfile clean
bun run typecheck ✅ no errors — no SDK export/type breaks
bun test ✅ 418 pass, 1 skip, 0 fail
cargo test --test pipeline_scenarios --test pipeline_fixtures --test pipeline_streams ✅ 119 + 2 + 1 pass, 0 fail — stdout event-shape contract intact

The full bun run build (heavy staging + compile + SHA256 verification) is left to CI.

Breaking-change assessment

All bumps are additive within their stable lines. Codex 0.144→0.145 is a minor bump but its layout descriptor (codex-package.json) is unchanged (layoutVersion: 1, same fields), so stage-vendor.ts needs no change. typecheck confirms no SDK API surface change; the Rust pipeline snapshot suites confirm no stored event-shape regression. No breaking changes identified for Helmor.

Changeset

Single maintained changeset .changeset/bump-bundled-agents.md (helmor: patch), no in-app announcement (routine maintenance).

https://claude.ai/code/session_01WVRQmJFzv52KPzrLJKXKwV

Bump Claude Code + claude-agent-sdk (lockstep) to 2.1.214/0.3.214 and
Codex to 0.144.6. Kimi 0.21.0 -> 0.27.0 deferred (GitHub release asset
SHA256 unreachable from this sandbox).

Claude-Session: https://claude.ai/code/session_016Lkwh74TzLcEnLwHx6jT24
@vercel

vercel Bot commented Jul 19, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment
Project Deployment Actions Updated (UTC)
helmor-marketing Ignored Ignored Preview Jul 22, 2026 2:16am

Request Review

claude added 2 commits July 19, 2026 04:16
Newer stable patch promoted to npm latest since the initial 2.1.214 bump.
Lockstep verified (agent-sdk 0.3.215 carries claudeCodeVersion 2.1.215).
claude-code 2.1.215 SHA256 (arm64+x64) added to CLAUDE_CODE_SHA256.

Claude-Session: https://claude.ai/code/session_01YYuBaqMbHRhpquFm4ED8Qr
…ode 1.18.4

Additional bumps on top of the pending vendor-refresh PR. Upstream promoted
newer stable releases since the branch was last pushed:

- @anthropic-ai/claude-agent-sdk + claude-code: 2.1.215 -> 2.1.217 (lockstep, claudeCodeVersion verified)
- @openai/codex: 0.144.6 -> 0.145.0 (layoutVersion still 1, no staging change)
- @cursor/sdk: 1.0.23 -> 1.0.24 (Node >=22.13 floor unchanged, satisfied by Node 24.17.0)
- @opencode-ai/sdk + opencode-ai: 1.18.3 -> 1.18.4 (lockstep)

Gates: bun install, typecheck, bun test (418 pass), cargo pipeline (119+2+1) all pass.

Claude-Session: https://claude.ai/code/session_01WVRQmJFzv52KPzrLJKXKwV
@natllian
natllian merged commit c76cba7 into main Jul 24, 2026
15 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants