[SamuelIVX]

This PR contains the following updates:

Package	Change	Age	Confidence
@anthropic-ai/sdk	^0.133.0 → ^0.134.0

---

Release Notes

anthropics/anthropic-sdk-typescript (@​anthropic-ai/sdk)

v0.134.0

Features

• api: add execution_identity to Managed Agents agents
• api: add organization_type_not_supported error to spend limit lists
• api: add telemetry destination test endpoint
• api: add telemetry destinations to the Admin API
• client: emit OpenTelemetry spans for API calls, streams and tool runs. They are on by default and need no setup in the SDK: the spans appear once the application has registered a tracer provider with the OpenTelemetry API, and there are none without one. Requests carry the trace context in traceparent, and in the other headers that the registered propagator writes. This adds a dependency on @opentelemetry/api (^1.4.1). openTelemetry: false or ANTHROPIC_OPEN_TELEMETRY=false turns all of it off; openTelemetry: { propagation: false } or ANTHROPIC_OPEN_TELEMETRY_PROPAGATION=false keeps the spans and sends no trace headers; the variables apply only to a client that is given no openTelemetry option

Bug Fixes

• api: rename telemetry destination test response model
• client: close an unread stream that was dropped while tracing is on
• client: don't follow redirects on token requests
• client: treat proxy-authorization as a sensitive header

Bug Fixes

• streaming: tolerate unknown event types in MessageStream and BetaMessageStream
• streaming: stop throwing "Unexpected event order" for an event before message_start
• streaming: yield events that arrive before message_start when iterating MessageStream and BetaMessageStream

Chores

• docs: correct prefill, thinking, fallback and model descriptions
• docs: document the scope required to assign the managed role
• docs: update model examples
• include the license files in the published packages
• internal: narrow the tripwire test rule in the contributor guides
• internal: remove @internal tag from a type that public types reference
• internal: remove file-level @internal tags from toolset modules
• internal: strip @internal declarations from published types
• internal: type-check the built declarations in lint

Documentation

• api: clarify when custom tool results can be sent
• api: say is_enabled is always true for user spend limits
• move more shared rules into the shared part of CLAUDE.md
• show examples of streaming-only methods iterating the stream

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • "every weekday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[coderabbitai]

Important

Review skipped

Ignore keyword(s) in the title.

⛔ Ignored keywords: 4

• chore(deps)
• fix(deps)
• chore(deps-dev)
• fix(deps-dev)

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 09e7cfee-9849-4589-bcd4-95582eb38fa5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/@anthropic-ai/sdk	0.134.0	Unknown	Unknown
npm/@opentelemetry/api	1.9.1	🟢 7.3	Details Check Score Reason Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Dependency-Update-Tool 🟢 10 update tool detected Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 License 🟢 10 license file detected Branch-Protection 🟢 4 branch protection is not maximal on development and all release branches Vulnerabilities ⚠️ 1 9 existing vulnerabilities detected Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. SAST 🟢 10 SAST tool is run on all commits Security-Policy 🟢 10 security policy file detected Fuzzing ⚠️ 0 project is not fuzzed CI-Tests 🟢 10 30 out of 30 merged PRs checked by a CI test -- score normalized to 10 Contributors 🟢 10 project has 40 contributing companies or organizations

Scanned Files

• package-lock.json