chore(deps-dev): bump claude-agent-sdk from 0.2.128 to 0.2.129

[dependabot]

Bumps claude-agent-sdk from 0.2.128 to 0.2.129.

Release notes

Sourced from claude-agent-sdk's releases.

v0.2.129

Breaking Changes

• Skill name validation in ClaudeAgentOptions.skills: Skill names containing parentheses, commas, control characters, wildcards (*, :*), leading /, surrounding whitespace, or surrogate code points now raise ValueError at connect time. skills=["plugin:*"] and skills=["*"] should be replaced with skills="all" or a Skill(...) rule in allowed_tools. Names with leading whitespace or / previously built rules that could never match (silently disabling the skill) and now raise explicitly (#1145)

Bug Fixes

• Validated skill names to prevent --allowedTools injection: Skill names from ClaudeAgentOptions(skills=[...]) were passed unchecked into the CLI's --allowedTools value, which splits on commas and spaces. A crafted name could inject extra permission rules. The transport now validates each name and rejects delimiter-carrying or malformed values (#1145)

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.221

---

PyPI: https://pypi.org/project/claude-agent-sdk/0.2.129/

pip install claude-agent-sdk==0.2.129

Changelog

Sourced from claude-agent-sdk's changelog.

0.2.129

Breaking Changes

• Skill name validation in ClaudeAgentOptions.skills: Skill names containing parentheses, commas, control characters, wildcards (*, :*), leading /, surrounding whitespace, or surrogate code points now raise ValueError at connect time. skills=["plugin:*"] and skills=["*"] should be replaced with skills="all" or a Skill(...) rule in allowed_tools. Names with leading whitespace or / previously built rules that could never match (silently disabling the skill) and now raise explicitly (#1145)

Bug Fixes

• Validated skill names to prevent --allowedTools injection: Skill names from ClaudeAgentOptions(skills=[...]) were passed unchecked into the CLI's --allowedTools value, which splits on commas and spaces. A crafted name could inject extra permission rules. The transport now validates each name and rejects delimiter-carrying or malformed values (#1145)

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.221

Commits

• 60ecf63 docs: update changelog for v0.2.129
• 562dba6 chore: release v0.2.129
• 0fd46ab chore: bump bundled CLI version to 2.1.221
• cbed47d fix(transport): validate skill names in ClaudeAgentOptions.skills (#1145)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[amrit110]

Automated fix applied and PR merged

The agentic fix loop successfully fixed this PR and merged it.

✓ Successfully fixed merge_only failures - Modified 0 files - Executed 68 agent actions - (31 info, 19 tool_call, 1 error, 15 tool_result, 2 reasoning)

View detailed trace on dashboard | Raw trace

AI Engineering Maintenance Bot