[dependabot]

Bumps the npm-minor-patch group with 1 update: @anthropic-ai/claude-code.

Updates @anthropic-ai/claude-code from 2.1.316 to 2.1.317

Release notes

Sourced from @​anthropic-ai/claude-code's releases.

v2.1.317

What's changed

• Added a warning to /schedule when a new cloud scheduled task gets connectors you did not ask for, with how to remove them
• Added a check that asks before a web or shell tool call sends your account email address to the network
• Added onFailure: "block" for Agent SDK hook callbacks, so a callback that fails blocks the action instead of letting it run
• Added a notice in Claude Desktop's Code tab when your organization's remote managed settings haven't loaded for the session, and another once they do
• Added a notice when auto mode's check has no answer for a subagent's tool call, which used to leave nothing in the main view
• Added anthropic.plan, anthropic.seat_type, anthropic.provider and anthropic.custom_base_url to OTel metrics, events and spans
• Added a cost report to the Claude apps gateway admin API, GET /v1/organizations/analytics/cost, for reading past spend over a date range in total, per developer, per day or per IdP group
• Added a daily record of each developer's IdP groups on Claude apps gateways with admin: set, kept for admin.identity_retention_days, which the cost report groups by
• Added CLAUDE_CODE_DISABLE_NESTED_SESSION_ID: set it to 1 on a self-hosted runner to have claude -p run inside a session use that session's ID and transcript, as in earlier versions
• Fixed project and local MCP servers disconnecting after the first turn in some Claude desktop sessions
• Fixed auto mode failing every turn when an LLM gateway set as the base URL answers 403 or 422 to its server-side safety check (a 403 with an apiKeyHelper is unchanged)
• Fixed claude auth status exiting before a slow token refresh was saved, which could sign you out on the next run
• Fixed a project's effortLevel setting being ignored by sessions that an app starts ahead of time and then opens in the project, such as new sessions in the desktop app's Code tab
• Fixed claude --from-pr reporting "No conversations found" in projects with many sessions when the linked session was older than the first page
• Fixed the second of two simultaneous permission prompts showing no file path or command on claude.ai and the mobile apps
• Fixed Remote Control and SDK hosts offering "don't ask again" on a mod's tool calls
• Fixed session titles being lost in cloud and SDK sessions when a new message or Stop arrived while the title was generating
• Fixed self-paced /loop wakeups sometimes not being scheduled when Claude left a field out of its request
• Fixed auto mode in cloud sessions stopping for approval when the Artifact tool uploaded, wrote to a database or saved a file through the outputs folder
• Fixed skills synced from claude.ai being lost or downloaded again every ten minutes when they can't be written to disk
• Fixed /schedule leaving a cloud scheduled task's next run time and link out of its results after creating or updating it
• Fixed screen readers speaking a running subagent's elapsed time and token count on every change in screen reader mode
• Fixed a region or network block (HTTP 403) being shown as a sign-in failure; the error now explains the block
• Fixed Claude saying a working claude.ai connector needed authorization or had failed in cloud sessions when a synced plugin included the same server
• Fixed claude -p exiting 0 when a full disk or quota lost its transcript or ~/.claude.json writes; it now prints an error and, in text and json output, exits 1. Full NFS exports may be missed
• Fixed edits to settings files made in the first second or so after launch not taking effect until a settings file changed again
• Fixed old transcripts not being cleaned up on machines where some runs skip cleanup, such as runs using --setting-sources
• Fixed deleted agent team inboxes being re-created by a teammate's late message
• Fixed a re-created agent teammate being removed from its team by an earlier shutdown approval
• Fixed stored scheduled tasks being impossible to list or delete after scheduled tasks were turned off
• Fixed Claude deleting your most recently updated /team-onboarding guide when asked to delete one without naming which
• Fixed Claude saying a /team-onboarding guide was deleted when the server refused the delete
• Fixed the Claude apps gateway hiding Amazon Bedrock's "Input is too long." error, which left sessions failing every turn with "upstream rejected the request" instead of compacting
• Fixed self-hosted runner sessions losing recent turns or the whole conversation when restarted while a plan waited for approval
• Fixed "Prompt is too long" after automatic compaction in sessions whose very large CLAUDE.md changed since it was last sent
• Fixed high memory use and slow startup in headless sessions with many plugins that register commands
• Fixed stdio MCP servers receiving an empty AWS_BEARER_TOKEN_BEDROCK when their env config sets it to empty; the variable is now unset, so the server can use the machine's own AWS credentials
• Fixed API requests failing with "unable to get local issuer certificate" behind some TLS-inspecting proxies after a root certificate renewal
• Fixed very long conversations losing their earlier summary when compaction had to shorten its own request
• Fixed a PDF's own metadata being able to make Read and @-mentions under-count its pages
• Fixed DISABLE_PROMPT_CACHING_OPUS and DISABLE_PROMPT_CACHING_SONNET having no effect on [1m], other-region and undated spellings of the default model
• Fixed /artifacts and the Artifact tool's shared list showing no shared artifacts when you have 200 or more of your own
• Fixed Claude treating partial Grep and Glob results as complete when a search hit its time limit
• Fixed OpenTelemetry exports to an https:// endpoint through a proxy never being sent when they started while another export was still in progress
• Fixed a flood of connection attempts to a proxy that blocks (HTTP 403) OpenTelemetry exports to an http:// endpoint
• Fixed OpenTelemetry exports hanging indefinitely behind a proxy that never answers; they now time out after 10 seconds, or OTEL_EXPORTER_OTLP_TIMEOUT up to 30 seconds
• Fixed resumed sessions telling Claude again about a file change it already knew about

... (truncated)

Commits

• 964d695 chore: Update CHANGELOG.md and feed.xml
• 1a0f9a9 Merge pull request #106583 from anthropics/claude/gh-triage-workflows-5-5-m7kir1
• f0b737f chore: Update mods/
• 08165a3 Move @​claude mentions to Claude Sonnet 5.5
• 0b5c91d Move issue triage and dedupe workflows to Claude Sonnet 5.5
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[melodic-automation-lanes]

The pr-unblock lane reviewed this Dependabot pull request at 46abe6340c7a693ca1035ed98ab3d3f4beabd21c: escalate.

Reasons:

The update moves @anthropic-ai/claude-code from 2.1.316 to 2.1.317 in package.json and package-lock.json. It is a review-only dependency (control docs/conventions/pr-pipeline/README.md#review-only-dependencies) because its postinstall runs in eval-browser-dispatch.yml, a job that holds the lane's OAuth token.
Provenance checks passed. Both versions were published by the GitHub Actions trusted publisher with the same oidcConfigId (ed8551cb... for the main package, b2f7583c... for the linux-x64 package) and the same registry signing keyid. The 15 maintainers are unchanged, and the lockfile integrity hashes match the registry dist values.
Install scripts are the same in both versions (prepare guard plus postinstall node install.cjs). Runtime dependencies are still empty. The optionalDependencies are the same 8 platform packages, now pinned to 2.1.317, so the release adds no new dependency.
Upstream notes list no breaking changes. One change touches this repo: claude -p now exits 1 when transcript writes fail. eval-browser-dispatch.yml:465-466 already ends its claude -p call with || true, so that change does not affect it.
Blocker: package.json:24-26 has an allowScripts entry that approves install scripts only for @anthropic-ai/claude-code@2.1.316. Dependabot did not update it. Under 2.1.317 the postinstall (install.cjs) may no longer be approved, so the claude CLI install in CI could break or silently skip its install step. Re-approving the script is a decision for a person.
Updating the allowScripts key is outside the fix rule, which allows only a dependency's version range in package.json and no install-script change, so I cannot make it here. A person should review whether to re-approve the 2.1.317 postinstall and update allowScripts.

Evidence:

package.json:11
package.json:25
.github/workflows/eval-browser-dispatch.yml:440
.github/workflows/eval-browser-dispatch.yml:465
docs/conventions/pr-pipeline/README.md#review-only-dependencies
https://registry.npmjs.org/@anthropic-ai/claude-code/2.1.317
https://registry.npmjs.org/@anthropic-ai/claude-code/2.1.316
https://registry.npmjs.org/@anthropic-ai/claude-code-linux-x64/2.1.317
https://registry.npmjs.org/@anthropic-ai/claude-code-linux-x64/2.1.316
https://github.com/anthropics/claude-code/releases/tag/v2.1.317

[melodic-automation-lanes]

The pr-unblock lane stopped on this pull request and needs a person: the dependency review found a risk the lane does not decide alone.

• Reason: dependency-escalate
• Resume key: 46abe6340c7a693ca1035ed98ab3d3f4beabd21c (the head the lane stopped on)

To resume, deal with the reason above, remove the needs-human label (and do-not-merge, if set), then dispatch the pr-unblock workflow with pr-number=12807 and activity=review-dependency:

gh workflow run pr-unblock.yml -R melodic-software/claude-code-plugins -f pr-number=12807 -f activity=review-dependency