fix(v2.9.6): SDK 0.1.81, urllib3/python-multipart sec fixes, dynamic models from upstream, SDK-drift auto-PR#17
Merged
Conversation
* feat: dynamically refresh Anthropic model list * fix: harden /v1/models cache and resolve default model live - Lock + double-check refresh path so concurrent requests at TTL expiry don't stampede the Anthropic Models API. - Use a short MODEL_LIST_ERROR_TTL_SECONDS (default 60s) for the fallback cache so transient outages don't suppress live discovery for a full hour. - Populate `created` (unix timestamp) on both live and fallback /v1/models entries to match OpenAI's model object schema. - Resolve DEFAULT_MODEL at startup by picking the latest Sonnet from the live Models API; honor explicit DEFAULT_MODEL env override. * docs: clarify ANTHROPIC_API_KEY is optional for live model discovery - README: expand env vars table with ANTHROPIC_API_KEY (optional), DEFAULT_MODEL, FAST_MODEL, CLAUDE_MODELS_OVERRIDE, and the model list cache/timeout knobs. Rewrite the Supported Models section to explain the live-vs-static behavior and refresh the catalog around Claude 4.6 family. Bump model examples to claude-sonnet-4-6. - .env.example: add a Model Discovery (optional) block documenting ANTHROPIC_API_KEY, CLAUDE_MODELS_OVERRIDE, and the cache TTLs; comment out DEFAULT_MODEL so live resolution drives it by default. - main.py: log a single explicit info line at startup when live discovery is disabled (no ANTHROPIC_API_KEY) so operators see whether the dynamic path activated. - tests: cover the new disabled-path log and update the env-key gate in the existing resolve_default_model test.
…DK-drift workflow auto-PR - claude-agent-sdk 0.1.68 -> 0.1.81 (13 patch releases since v2.9.5). - python-multipart ^0.0.26 -> ^0.0.27 (GHSA-pp6c-gr5w-3c5g, supersedes Dependabot PR #16). - urllib3 security floor >=2.6.3 -> >=2.7.0 (GHSA-qccp-gfcp-xxvc, GHSA-mf9v-mfxr-j63j). - check-sdk-version.yml opens a draft chore/sdk-bump-<latest> PR on drift instead of only writing to the run summary. Permissions widened to contents: write + pull-requests: write; idempotent by head branch; fallback summary still fires. Lockfile regenerated locally with Poetry 2.3.4. Full suite at 664 passed, 31 skipped (+14 from upstream test_dynamic_models.py picked up in the prior cherry-pick).
…tighten supported-models intro - Version 2.9.3 -> 2.9.6 in header and docker pin example - Test count 650 -> 664 in Status and Testing sections - Add 2.9.6 highlight bullet covering SDK 0.1.81, urllib3/python-multipart sec fixes, upstream PR RichardAtCT#46 dynamic-models sync, and check-sdk-version auto-PR - Add ANTHROPIC_MODELS_URL, ANTHROPIC_VERSION, ANTHROPIC_BETA/ANTHROPIC_BETA_HEADER rows to the env var table (advanced overrides for the new live-discovery path) - Tighten the Supported Models intro paragraph (was 3 dense sentences)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Single bundled v2.9.6 release addressing four concerns:
claude-agent-sdkbump0.1.68 -> 0.1.81(13 patch releases since v2.9.5).^0.0.26 -> ^0.0.27(GHSA-pp6c-gr5w-3c5g, DoS via unbounded multipart part headers) — supersedes chore(deps): bump python-multipart from 0.0.26 to 0.0.27 in the pip group across 1 directory #16, which carried Dependabot's Poetry 2.2.1 lockfile noise.>=2.6.3 -> >=2.7.0(GHSA-qccp-gfcp-xxvc + GHSA-mf9v-mfxr-j63j)./v1/models. New env vars:FAST_MODEL,CLAUDE_MODELS_OVERRIDE,MODEL_LIST_CACHE_TTL_SECONDS,MODEL_LIST_ERROR_TTL_SECONDS,MODEL_LIST_REQUEST_TIMEOUT_SECONDS,ANTHROPIC_MODELS_URL,ANTHROPIC_VERSION. WhenANTHROPIC_API_KEYis set,/v1/modelsreturns the live Anthropic catalog (cached 1h) and the wrapper resolves the latest Sonnet asDEFAULT_MODELat startup. Concurrent refreshes serialized via async lock + double-check; failures use a short TTL so transient outages don't suppress live discovery for the full hour. Note: our existingmodel_service(driving/v1/models/refreshand/v1/models/status) is left in place alongside the new in-line cache — consolidation is a follow-up.check-sdk-version.ymlreworked: on drift, opens a draftchore/sdk-bump-<latest>PR with the pin bump and regeneratedpoetry.lockinstead of only writing to the run summary. Permissions widened tocontents: write+pull-requests: write. Idempotent by head branch (won't re-open if a matching open PR already exists). The::warning::annotation and$GITHUB_STEP_SUMMARYfallback still fire so drift remains visible if PR creation can't run.Commits
dd9f0c7cherry-pick of upstream PR feat: dynamically refresh Anthropic model list RichardAtCT/claude-code-openai-wrapper#46 (conflict resolutions preserved our Opus 4.7 entries and pricing/fallback maps inconstants.py; kept HEAD's compact README sections and merged in upstream's live-discovery intro + new env-var table rows).4da2b8bthe v2.9.6 dep bumps, version bump, CHANGELOG entry, and workflow rewrite.Verification
.venv/bin/poetry lock --no-interactionregenerated against Poetry 2.3.4 (matches v2.9.5 lock header; no cosmetic drift like chore(deps): bump python-multipart from 0.0.26 to 0.0.27 in the pip group across 1 directory #16 had).claude_agent_sdk.__version__ == 0.1.81urllib3.__version__ == 2.7.0multipart.__version__ == 0.0.27tests/test_dynamic_models.py).Known limitations
GITHUB_TOKEN, which does not trigger downstreampull_requestworkflow runs by GitHub design. The auto-PR body documents this: reviewers push an empty commit to fire the test matrix. Not worth introducing a PAT secret for a weekly-cron workflow.Follow-ups (not in this PR)
model_serviceand the new in-lineget_available_models()cache.v2.9.6GitHub Release and run the existing/build-and-pushflow frommain.Test plan
check-sdk-version.ymlto confirm the up-to-date path still works (no PR created when pin matches latest)