每日趋势报告 · 2026-01-09

## What's changed - Added source path metadata to images dragged onto the terminal, helping Claude understand where images originated - Added clickable hyperlinks for file paths in tool output in terminals that support OSC 8 (like iTerm) - Added support for Windows Package Manager (winget) installations with automatic detection and update instructions - Added Shift+Tab keyboard shortcut in plan mode to quickly select "auto-accept edits" option - Added `FORCE_AUTOUPDATE_PLUGINS` environment variable to allow plugin autoupdate even when the main auto-updater is disabled - Added `agent_type` to SessionStart hook input, populated if `--agent` is specified - Fixed a command injection vulnerability in bash command processing where malformed input could execute arbitrary commands - Fixed a memory leak where tree-sitter parse trees were not being freed, causing WASM memory to grow unbounded over long sessions - Fixed binary files (images, PDFs, etc.) being accidentally included in memory when using `@include` directives in CLAUDE.md files - Fixed updates incorrectly claiming another installation is in progress - Fixed crash when socket files exist in watched directories (defense-in-depth for EOPNOTSUPP errors) - Fixed remote session URL and teleport being broken when using `/tasks` command - Fixed MCP tool names being exposed in analytics events by sanitizing user-specific server configurations - Improved Option-as-Meta hint on macOS to show terminal-specific instructions for native CSIu terminals like iTerm2, Kitty, and WezTerm - Improved error message when pasting images over SSH to suggest using `scp` instead of the unhelpful clipboard shortcut hint - Improved permission explainer to not flag routine dev workflows (git fetch/rebase, npm install, tests, PRs) as medium risk - Changed large bash command outputs to be saved to disk instead of truncated, allowing Claude to read the full content - Changed large tool outputs to be persisted to disk instead of truncated, providing full output access via file references - Changed `/plugins` installed tab to unify plugins and MCPs with scope-based grouping - Deprecated Windows managed settings path `C:\ProgramData\ClaudeCode\managed-settings.json` - administrators should migrate to `C:\Program Files\ClaudeCode\managed-settings.json` - [SDK] Changed minimum zod peer dependency to ^4.0.0 - [VSCode] Fixed usage display not updating after manual compact

## What's Changed * [Security] Fix HIGH vulnerability: CVE-2025-66414 by @orbisai0security in https://github.com/anthropics/claude-code-action/pull/792 * fix: use original title from webhook payload instead of fetched title by @ashwin-ant in https://github.com/anthropics/claude-code-action/pull/793 * feat: add path validation for commit_files MCP tool by @ddworken in https://github.com/anthropics/claude-code-action/pull/796 * feat: custom branch name templates by @dylancdavis in https://github.com/anthropics/claude-code-action/pull/571 * fix: add missing import and update tests for branch template feature by @ashwin-ant in https://github.com/anthropics/claude-code-action/pull/799 ## New Contributors * @orbisai0security made their first contribution in https://github.com/anthropics/claude-code-action/pull/792 * @dylancdavis made their first contribution in https://github.com/anthropics/claude-code-action/pull/571 **Full Changelog**: https://github.com/anthropics/claude-code-action/compare/v1...v1.0.29

# 🎉 Claude Code GitHub Action v1.0 - Now Generally Available! We're excited to announce the v1.0 release of Claude Code GitHub Action! This major release brings significant improvements in simplicity, flexibility, and power to AI-assisted development workflows. ## 🚀 What's New in v1.0 ### Simplified Configuration - **Automatic mode detection** - No more manual `mode` configuration. The action intelligently determines whether to run in interactive or automation mode based on your setup - **Unified interface** - All prompts now go through a single `prompt` input, and all CLI options through `claude_args` - **Better SDK alignment** - Closer integration with the Claude Code CLI for a consistent experience ### More Powerful & Flexible - Direct access to all Claude Code CLI capabilities through `claude_args` - Support for custom system prompts, tool configurations, and model selection - Enhanced compatibility with AWS Bedrock and Google Vertex AI ## ⚠️ Breaking Changes This release includes breaking changes from v0.x. Key deprecated inputs have been replaced with a cleaner, more intuitive API: - `mode`, `direct_prompt`, `override_prompt` → unified `prompt` input - `custom_instructions`, `model`, `allowed_tools`, `mcp_config` → `claude_args` with CLI format - Other deprecated: `disallowed_tools`, `anthropic_model`, `trigger_phrase`, `timeout_minutes` **📚 Please review our [Migration Guide](https://github.com/anthropics/claude-code-action/blob/main/docs/migration-guide.md) for detailed upgrade instructions and examples.** ## 💡 New Use Cases & Examples Explore the expanded possibilities with v1.0! We've created comprehensive examples showcasing various workflows: - **Automated PR Reviews** - Intelligent code review on every pull request - **CI Failure Fixes** - Automatically diagnose and fix failing tests - **Issue Triage** - Smart categorization and response to new issues - **Documentation Generation** - Keep docs in sync with code changes - **Security Scanning** - Proactive vulnerability detection - **And many more!** **🔧 Check out all examples at [github.com/anthropics/claude-code-action/tree/main/examples](https://github.com/anthropics/claude-code-action/tree/main/examples)** ## 🏃 Quick Start ```yaml # Interactive mode - responds to @claude mentions - uses: anthropics/claude-code-action@v1 with: anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} # Automation mode - runs immediately with prompt - uses: anthropics/claude-code-action@v1 with: prompt: "Review this PR for security issues" anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} claude_args: | --model claude-4-0-sonnet-20250805 --max-turns 10 ``` ## 📖 Resources - [Migration Guide](https://github.com/anthropics/claude-code-action/blob/main/docs/migration-guide.md) - Step-by-step upgrade instructions - [Examples](https://github.com/anthropics/claude-code-action/tree/main/examples) - Ready-to-use workflow templates - [Documentation](https://github.com/anthropics/claude-code-action#readme) - Complete setup and configuration guide ## 🙏 Thank You Thank you to our beta users for your invaluable feedback that shaped this release. We're excited to see what you'll build with Claude Code GitHub Action v1.0!

## Changes ### PR [#1925](https://github.com/danielmiessler/Fabric/pull/1925) by [ksylvan](https://github.com/ksylvan): docs: update README to document new AI providers and features - Docs: update README to document new AI providers and features - List supported native and OpenAI-compatible AI provider integrations - Document dry run mode for previewing prompt construction - Explain Ollama compatibility mode for exposing API endpoints - Detail available prompt strategies like chain-of-thought and reflexion ### PR [#1926](https://github.com/danielmiessler/Fabric/pull/1926) by [henricook](https://github.com/henricook) and [ksylvan](https://github.com/ksylvan): feat(vertexai): add dynamic model listing and multi-model support - Dynamic model listing from Vertex AI Model Garden API - Support for both Gemini (genai SDK) and Claude (Anthropic SDK) models - Curated Gemini model list with web search support for Gemini models - Thinking/extended thinking support for Gemini - TopP parameter support for Claude models

Changes since langchain==1.2.2 release(langchain): 1.2.3 (#34668) refactor(langchain): engage summarization based on reported `usage_metadata` (#34632) fix(langchain): keep tool call / `AIMessage` pairings when summarizing (#34609) test(langchain): cover chat model provider inference (#34657) fix(langchain): fix copy-paste error on azure_openai embedding provider map (#34655)

# Changelog ## Improvements: - **MongoDB connection handshake now includes Agno version metadata.** This enables better connection identification and log analysis for users hosting MongoDB clusters with multiple applications. - **Crawl4aiTools**: Add the `proxy_config` parameter, allowing further configuration of the Toolkit. - **Forbid tools to operate out of base directory**: Update `PythonTools` and `MLXTranscribeTools` to automatically disallow operating outside of the contextual base directory. Add the `restrict_to_base_dir` to opt out of this feature and allow operations outside of the base directory. - **MarkdownChunker:** Now support `split_on_headings` parameter to finely control how chunks are separated. - **Knowledge ContentsDB requirement:** Improved warning and log messages when contentsDB is not used with `Knowledge` . Improved filter handling for agentic search. ## Bug Fixes: - **Team session names**: Fix an issue when using `get_session_name` directly from Team instances. - **HITL consecutive user input**: Fix an issue on certain HITL flows when getting user input in multiple consecutive rounds. - **AgentOS Knowledge router:** Fix an issue where AsyncDB was not correctly routed to for content update operations ## What's Changed * fix: generating session name for Team by @kepler in https://github.com/agno-agi/agno/pull/5933 * Fix: active_requirements not populated for subsequent HITL round by @mishramonalisha76 in https://github.com/agno-agi/agno/pull/5926 * [chore] Include Agno version details in MongoDB handshake by @NoahStapp in https://github.com/agno-agi/agno/pull/5922 * fix: introduce proxy_config to the Crawl4aiTools toolkit by @aayush598 in https://github.com/agno-agi/agno/pull/5859 * fix: replace eval() with type mapping [SDK-417] by @harshsinha03 in https://github.com/agno-agi/agno/pull/5912 * feat: add restrict_to_base_dir param to PythonTools and MLXTranscribeTools by @manuhortet in https://github.com/agno-agi/agno/pull/5940 * fix: Knowledge apatch content support by @willemcdejongh in https://github.com/agno-agi/agno/pull/5942 * fix: AttributeError in get_session_name when run_input is a string by @pbassut in https://github.com/agno-agi/agno/pull/5869 * chore: Knowledge logging and filtering logic updates by @willemcdejongh in https://github.com/agno-agi/agno/pull/5927 * chore: v2.3.24 by @manuhortet in https://github.com/agno-agi/agno/pull/5949 ## New Contributors * @NoahStapp made their first contribution in https://github.com/agno-agi/agno/pull/5922 * @pbassut made their first contribution in https://github.com/agno-agi/agno/pull/5869 **Full Changelog**: https://github.com/agno-agi/agno/compare/v2.3.23...v2.3.24

Changes since deepagents==0.3.3 Minor release memory bump (#689) feat: update memory prompt to be more barebones (#685) improvements to README, reference docs (#688) update version bounds (#687)

Changes since deepagents==0.3.2 Deepagents release minor (#683) fix(deepagents): make memory permissive if AGENTS.md not found (#682)

Changes since deepagents==0.3.1 release(deepagents): release 0.3.2 (#680) chore(deepagents): make memory strict if AGENTS.md not found (#673) fix(deepagents): better async support in skills, and propagate runnable config (#672) chore: remove older integration tests for memory (#670) feature(deepagents): add memory (#646) feat(deepagents): add skills to sdk (#591) chore(deepagent): add docs to composite backend (#666) chore(deepagents): add more test coverage to composite backend (#660) fix(deepagents): composite backend grep implementation (#659) Fix CVE-2025-68664 (#636) make work with model string (#626)

## Core - Upgrade OpenTUI to v0.1.70 - Support multi-select questions - Document cargofmt in docs (@marc2332) ## TUI - Stop escape key propagation from dialogs - Use full file path for fuzzy matching in autocomplete (@bagatka) ## Desktop - Revert fix for opening external links in default browser - Cache session-scoped stores and add optional context gating - Incrementally render turns with markdown caching and lazy diff rendering - Gate hydration side-effects and handoff while stores load - Prefetch adjacent sessions in the app - Implement chunked message loading and lazy diff loading for improved performance - Fix project sidebar folder name display issue (@0xajka) **Thank you to 4 community contributors:** - @marc2332: - fix(docs): Document `cargofmt` (#7383) - @bagatka: - fix(ui): use full file path for fuzzy matching in autocomplete (#6705) - @0xajka: - Fix for #7229 Fix/project sidebar folder name (#7232) - @Anthuang: - feat(desktop): add Vesper theme (#7331)

## Core - Add kind, title, and rawInput fields to ACP tool_call_update events (@noamzbr) - Add help text to debug command and subcommands (@assagman) - Allow disabling .claude prompt and skills loading (@freespace8) - Add interactive question tool for gathering user preferences and clarifying instructions - Fix issue with normal transform options conflicting with small model options when generating title - Write truncated tool outputs to files - Simplify task tool subagent filtering (@malhashemi) - Improved title generation to avoid repetitive "Analyzing..." prefixes - Use correct authorization server URL for OAuth discovery in MCP (@rscarvalho) - Config precedence now correctly allows local config to override remote (@elithrar) - Update Homebrew formula for anomalyco tap ## TUI - Restore showDetails check removed in Permission rework (@ryanwyler) - Cleanly restore terminal state on fatal error exit (@itsrainingmani) - Improve responsive layout by hiding header and footer when sidebar is visible - Simplified session settings management (@maxstevens-nl) - Remove unused imports and variables from header component - Add overlay sidebar for narrow screens to improve mobile experience - Add expandable bash output for long commands to improve readability - Remove username visibility toggle and simplify user message metadata display in TUI - Improve indentation and label clarity for TUI answer options - Ensure forked message text is inserted in prompt when forking conversations (@ariane-emory) - Use selected foreground color for permission selection text (@ariane-emory) - Constrain autocomplete height to available screen space in TUI (@Raviguntakala) - Add selectedListItemText to orange themes for button text visibility (@ThanhNguyxn) ## Desktop - Show custom models without valid release_date in web UI model selector (@zerone0x) - Open external links in default browser on desktop (@athal7) **Thank you to 15 community contributors:** - @elithrar: - fix: config precedence now correctly allows local config to override remote (#7141) - @ThanhNguyxn: - fix(theme): add selectedListItemText to orng themes for button text visibility (#7169) - @rscarvalho: - fix(mcp): use correct authorization server URL for OAuth discovery (#7234) - @Raviguntakala: - fix(tui): constrain autocomplete height to available screen space (#7181) - @malhashemi: - refactor: simplify task tool subagent filtering (#7165) - @ariane-emory: - fix: use selectedForeground's computer colour (or theme's selectedForeground value) for the colour of text in permission selection (resolves #7246) (#7251) - fix(tui): ensure forked message text is inserted in prompt (resolves #7257) (#7259) - @athal7: - fix(desktop): open external links in default browser (#7221) - @freespace8: - feat(flags): allow disabling .claude prompt and skills loading (#7205) - @aaroniker: - feat: Polish dialog, popover shadows & borders, add missing provider logos (#7326) - @assagman: - fix(cli): add help text to debug command and subcommands (#7328) - @maxstevens-nl: - refactor: session settings simplification (#7342) - @noamzbr: - fix: Add kind, title, rawInput to ACP tool_call_update events (#7368) - @zerone0x: - fix(app): show custom models without valid release_date in web UI mod… (#7349) - @itsrainingmani: - fix: cleanly restore terminal state on fatal error exit (#7359) - @ryanwyler: - fix(tui): restore showDetails check removed in Permission rework (#7285)