chore(deps): update all dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@anthropic-ai/claude-agent-sdk	0.3.185 → 0.3.206
@openai/codex-sdk (source)	0.141.0 → 0.144.1
@openai/codex-sdk (source)	0.142.5 → 0.144.1
typescript (source)	^6.0.3 → ^7.0.0

---

Release Notes

anthropics/claude-agent-sdk-typescript (@​anthropic-ai/claude-agent-sdk)

v0.3.206

Compare Source

• Added command_lifecycle frames to stream-json and SDK sessions, reporting each uuid-stamped message's terminal state (queued/started/completed/cancelled/discarded); zero-API results no longer report stale duration_api_ms

v0.3.205

Compare Source

• Interrupt control responses now include still_queued (UUIDs of queued async messages that will still run), Query.interrupt() returns the typed receipt, and system/init advertises an interrupt_receipt_v1 capability for feature detection
• Added structured name and body fields to peer-message session events, exposing the sender display name and decoded message body

v0.3.204

Compare Source

• Added terminal_reason values tool_deferred_unavailable (deferred tool resume found the tool gone — previously an is_error result with no reason, read as a clean completion by lifecycle sweeps) and turn_setup_failed (the turn-input builder threw before the turn started). Both classify as dead turns, so commands consumed by them report command_lifecycle state cancelled
• Fixed the post-merge cancel backstop cancelling every member of a coalesced prompt batch when a cancel named only one: uncancelled siblings now re-merge and run (previously they were reported cancelled — on remote transports that acknowledged them as processed, silently dropping messages nobody cancelled)
• Added terminal_reason values api_error, malformed_tool_use_exhausted, budget_exhausted, and structured_output_retry_exhausted. Turns that die on an exhausted-API-retry or malformed-tool-use give-up previously reported completed; budget and structured-output exhaustion results previously omitted terminal_reason. Commands consumed by such turns now report command_lifecycle state cancelled instead of completed (dup-over-loss)
• Updated to parity with Claude Code v2.1.204

v0.3.203

Compare Source

• Added a background_tasks_changed system message with the full set of live background tasks on every membership change, so consumers can track background activity as a level instead of pairing task_started/task_notification edges
• Fixed stable releases shipping a sdk.d.ts with unresolved type references that broke consumer typechecking with skipLibCheck disabled

v0.3.202

Compare Source

• Added parent_agent_id field to subagent session messages for building depth-2+ agent trees from disk-persisted metadata
• Fixed apply_flag_settings with a non-object settings value crashing the session instead of returning a control error

v0.3.201

Compare Source

• Updated to parity with Claude Code v2.1.201

v0.3.200

Compare Source

• Added 'manual' as an accepted alias for the 'default' permission mode in SDK inputs
• Fixed onSetPermissionMode callback not firing for SDK-hosted Remote Control sessions
• Fixed set_model control request accepting unrecognized model strings; invalid models are now rejected before latching

v0.3.199

Compare Source

• Added requestId to canUseTool callback options for correlating out-of-band permission responses, and support for returning null to suppress the SDK's automatic control response
• Added blocked field to workflow_agent progress events indicating when an agent was blocked by the auto-mode safety classifier
• Added mode:"mask" and per-credential injectHosts to sandbox.credentials settings types for injecting masked credentials into sandboxed commands

v0.3.198

Compare Source

• Added a runtime warning when canUseTool is configured alongside allowedTools or bypassPermissions, which shadow the callback
• Added per-server request_timeout_ms option to mcp_set_servers control request
• Fixed SDKUserMessage.isSynthetic not being mapped to isMeta on ingestion, which could cause synthetic messages to be treated as real user messages
• Fixed workflow progress events silently dropping earliest agents from the list while the phase counter remained correct

v0.3.197

Compare Source

• Updated to parity with Claude Code v2.1.197

v0.3.196

Compare Source

• Added prompt_id field to hook input payloads for correlating hook events with OpenTelemetry prompt-level events
• Fixed control protocol deduplication dropping tool-use IDs after 1000 resolutions, which could cause duplicate tool_result deliveries in long-running sessions

v0.3.195

Compare Source

• Added Query.reinitialize() to re-send the initialize control request and redeliver pending permission/dialog prompts after a transport gap
• Fixed commands_changed event not being emitted for synced skills when the skill list resolves before the change-detector subscribes

v0.3.193

Compare Source

• Added promptSuggestions option to Browser SDK query() to opt the remote CLI into emitting follow-up suggestions
• Fixed brief console window flashes on Windows when spawning CLI subprocesses

v0.3.191

Compare Source

• Added old_source field to NotebookEdit tool results for replace and delete operations, enabling inline diffs
• Added seven_day_overage_included to SDKRateLimitInfo.rateLimitType for per-model weekly usage limits
• Added model_scoped array to usage response for per-model weekly limit windows with utilization and reset times
• Fixed fast mode reverting to standard after the first turn when settingSources includes user/project settings

v0.3.190

Compare Source

• Updated to parity with Claude Code v2.1.190

v0.3.187

Compare Source

• Added sandbox.credentials to SDK settings types for configuring credential file and environment variable denial in sandboxed commands

v0.3.186

Compare Source

• Added agent_id field to can_use_tool control requests — background agents now forward permission prompts to canUseTool instead of auto-denying, and stdin stays open while background tasks are running
• Added ReadMcpResourceDirTool tool type to SDK schemas — MCP resource directory listing is now a dedicated tool instead of a fallback inside ReadMcpResourceTool
• Added rewind_conversation control request for rewinding a conversation to a previous point with durable resume anchor support

microsoft/TypeScript (typescript)

v7.0.2

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​openai/​codex-sdk@​0.142.5 ⏵ 0.144.1
	typescript@​6.0.3 ⏵ 7.0.2	-6		-1		+10

View full report