[dependabot]

Bumps the harness group with 7 updates in the /skill-harness directory:

Package	From	To
@anthropic-ai/sdk	0.91.1	1.7.0
js-yaml	4.3.2	5.5.0
zod	4.3.6	4.6.7
@biomejs/biome	2.4.13	2.6.6
@types/node	25.6.0	26.6.6
tsx	4.21.0	4.23.15
typescript	5.9.3	7.0.2

Updates @anthropic-ai/sdk from 0.91.1 to 1.7.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk-v1.7.0

Features

• api: accept user_profile.program_status_updated on organization webhook endpoints
• api: add claude-fable-5-2 and claude-mythos-5-2
• api: add parent organization filtering and grouping to the usage and cost reports
• api: add the sandbox_egress_restricted error to Admin API write methods
• api: add the user_profile.program_status_updated webhook event

Bug Fixes

• client: include the body of a failed response in debug logs
• helpers: keep const and enum in structured output schemas

Chores

• api: remove some error detail types and update descriptions
• docs: say when a work heartbeat does not compare its value
• internal: add this repository's review rules

Documentation

• client: list error code types in api.md
• client: say where the default logger writes and how to log to stderr
• helpers: import from zod/v4 in the examples, for Zod 3.25 users

Refactors

• client: declare the name of every AnthropicError subclass the same way

sdk-v1.6.0

Features

• api: add error code for ramp limit errors
• api: add error codes for External Key validation failures
• api: add support for signing organization members out everywhere

Bug Fixes

• client: set the name of each error to its class name
• client: set the name of WorkloadIdentityError

Chores

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

1.7.0 (2026-11-09)

Features

• api: accept user_profile.program_status_updated on organization webhook endpoints
• api: add claude-fable-5-2 and claude-mythos-5-2
• api: add parent organization filtering and grouping to the usage and cost reports
• api: add the sandbox_egress_restricted error to Admin API write methods
• api: add the user_profile.program_status_updated webhook event

Bug Fixes

• client: include the body of a failed response in debug logs
• helpers: keep const and enum in structured output schemas

Chores

• api: remove some error detail types and update descriptions
• docs: say when a work heartbeat does not compare its value
• internal: add this repository's review rules

Documentation

• client: list error code types in api.md
• client: say where the default logger writes and how to log to stderr
• helpers: import from zod/v4 in the examples, for Zod 3.25 users

Refactors

• client: declare the name of every AnthropicError subclass the same way

1.6.0 (2026-11-05)

Features

• api: add error code for ramp limit errors
• api: add error codes for External Key validation failures
• api: add support for signing organization members out everywhere

Bug Fixes

• client: set the name of each error to its class name
• client: set the name of WorkloadIdentityError

... (truncated)

Commits

• e820c14 release: 1.7.0
• 299dfc5 Merge pull request #1030 from anthropics/synced/published
• e7ae8fb codegen metadata
• 5b5ffe3 feat(api): add claude-fable-5-2 and claude-mythos-5-2
• af8aee7 feat(api): add parent organization filtering and grouping to the usage and co...
• da39712 feat(api): add the sandbox_egress_restricted error to Admin API write methods
• 3abd460 fix(helpers): keep const and enum in structured output schemas (#887)
• c00964e codegen metadata
• 3e3e363 codegen metadata
• 74264f7 docs(helpers): import from zod/v4 in the examples, for Zod 3.25 users
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​anthropic-ai/sdk since your current version.

Updates js-yaml from 4.3.2 to 5.5.0

Changelog

Sourced from js-yaml's changelog.

[5.5.0] - 2026-10-16

Changed

• Updated argparse to v3.
• Updated development dependencies.

Fixed

• Correct percent-encoding of shorthand and verbatim tags.
• Reject ,, ], and } at the start of block plain scalars, #801.
• Report the exact position of non-printable characters in errors, #801.

[5.4.3] - 2026-10-06

Fixed

• Fixed loading a whitespace-only block scalar followed by a less indented line, #802.

[5.4.2] - 2026-09-13

Fixed

• forceQuotes no longer quotes non-string scalars, #798.

[5.4.1] - 2026-08-26

Changed

• Hard-limit merge sequence size to 100.

Security

• Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

[5.4.0] - 2026-08-25

Added

• Added the scalarStyleRules dumper option to customize string formatting. See Scalar styling for details.

Changed

• [breaking] Flattened the low-level AST node style representation. Scalar and collection nodes now use SCALAR_STYLE and COLLECTION_STYLE values; explicit tags use the separate tagged property. Alias nodes now contain only kind and anchor. This only affects code that directly constructs or edits AST nodes.
• [breaking] The sortKeys option was rewritten using AST mutation to avoid side effects.
• Reworked scalar style selection. This can change formatting without changing

... (truncated)

Commits

• cb62b2d 5.5.0 released
• 87aed90 Deps bump
• 3aec511 Fix error positions for non-printable characters, #801
• 11aa483 Reject flow indicators at the start of block plain scalars, #801
• 339d8e0 Refactor tag encoder and decoder to match the YAML specification
• 7832624 5.4.3 released
• 0cbb471 Fix whitespace-only block scalar followed by a less indented line, close #802
• 30108cc Parse the first block mapping key once (#800)
• 494400b 5.4.2 released
• 6d8adb4 Fix forceQuotes quoting non-string scalars, #798
• Additional commits viewable in compare view

Updates zod from 4.3.6 to 4.6.7

Release notes

Sourced from zod's releases.

v4.6.7

Commits:

• b500a2ee95134f81d74da7911d7378dd2853d042 4.6.7

v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.

Commits:

• 0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini
• 9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from zod/locales, not z.locales
• 34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales tree-shaking note
• 74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions instead of publishing them (#6622)
• b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to bronze sponsors
• 8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for Japan logo and list it first in bronze
• bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for Japan logo to match the other bronze tiles
• c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on the release-approval environment until the staged versions are approved (#6638)
• a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record output and input as members, not base type arguments (#6645)
• a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set and map size bounds before parsing elements (#6652)
• 529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6
• 9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a failed OIDC token exchange says why

v4.6.5

Commits:

• d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch highlights to the 4.6 post
• f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
• de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties section with the check and add a Zod Mini tab (#6598)
• 56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the .properties() shape off the instance type (#6600)
• ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"
• cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""
• 0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5
• 59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

A patch on top of 4.6.3.

• d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)
• ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)
• 2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
• f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

• 413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged
• 75d63ee1 docs: show only the .properties() method form in the 4.6 post
• 46da9572 docs: match the error-message examples to what the parsers emit

... (truncated)

Commits

• b500a2e 4.6.7
• 9c21983 ci: stage at verbose so a failed OIDC token exchange says why
• 529f78d 4.6.6
• a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#6652)
• a2ba4a6 fix(types): declare record output and input as members, not base type argumen...
• c42596b release: hold the run on the release-approval environment until the staged ve...
• bacad51 docs: square the Code for Japan logo to match the other bronze tiles
• 8fb2faf docs: crop the Code for Japan logo and list it first in bronze
• b2ef983 docs: add Code for Japan to bronze sponsors
• 74304ce release: stage npm versions instead of publishing them (#6622)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for zod since your current version.

Updates @biomejs/biome from 2.4.13 to 2.6.6

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.6.6

2.6.6

Patch Changes

• #12887 da0422e Thanks @​dyc3! - Added the new nursery rule noArrayMethodsOnArguments. It reports calls to array methods on the arguments object, which isn't an array, so these calls throw a TypeError when the code runs.

  function sum() {
    return arguments.reduce((total, value) => total + value, 0);
  }

• #12877 cd9e10f Thanks @​dyc3! - Added the nursery rule noConstantComparisons, which reports && and || conditions that can never be true, are always true, or contain a check with no effect.

  if (statusCode <= 400 && statusCode > 500) {}

• #12876 a7c9586 Thanks @​dyc3! - Added the nursery rule noErasingOperation, which disallows operations with 0 that always result in zero: multiplying by 0, a bitwise AND with 0, and dividing 0 by a number. The other value in these operations has no effect on the result, which usually means the code has a mistake.

  const total = price * 0;

• #12841 e954f55 Thanks @​dyc3! - Added the nursery rule noNegatedArrayPredicate, which reports negated calls to Array#some() and Array#every() and suggests moving the negation into the callback function.

  // Invalid: use `array.every((item) => !isUnicorn(item))` instead.
  const isMissing = !array.some((item) => isUnicorn(item));

• #12888 15039f7 Thanks @​dyc3! - Added the new nursery rule noNumberArgumentOutOfRange, which reports number literal arguments of toString(), toFixed(), toExponential() and toPrecision() that are outside the range the method accepts. These calls throw a RangeError at runtime.

  value.toString(64);

• #12889 1cd7520 Thanks @​dyc3! - Added the nursery rule noSharedBranchCode, which reports code that is repeated at the start or end of every branch of an if statement. That code runs no matter which branch is taken, so it can be moved before or after the if statement.

  if (condition) {
    doSomething();
    cleanup();
  } else {
    doSomethingElse();
    cleanup();
  }

... (truncated)

Commits

• 09ee04d ci: release (#12938)
• 191111d feat(lint): add usePackageJsonEngines (#12310)
• 0538e30 feat(lint): add usePackageJsonCpu (#12309)
• 6b73fcf feat(lint): add noUninvokedArrayCallback (#12890)
• 1cd7520 feat(lint): add noSharedBranchCode (#12889)
• 15039f7 feat(lint): add noNumberArgumentOutOfRange (#12888)
• da0422e feat(lint): add noArrayMethodsOnArguments (#12887)
• 3bb18d8 feat(lint): add useNextScriptForGoogleAnalytics (#12886)
• cd9e10f feat(lint): add noConstantComparisons (#12877)
• a7c9586 feat(lint): add noErasingOperation (#12876)
• Additional commits viewable in compare view

Updates @types/node from 25.6.0 to 26.6.6

Commits

• See full diff in compare view

Updates tsx from 4.21.0 to 4.23.15

Release notes

Sourced from tsx's releases.

v4.23.15

4.23.15 (2026-09-20)

Bug Fixes

• exclude bare builtins from namespace inheritance (38e1588)
• expose require.cache and require.extensions to tsImport CommonJS modules (2da3407)
• make namespaced register() overloads portable for declaration emit (562c434)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.14

4.23.14 (2026-09-20)

Bug Fixes

• restore the CJS bridge namespace for Node 24 require(esm) under tsImport() (#802) (6e5236b)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.13

4.23.13 (2026-08-30)

Bug Fixes

• cache: bound shared transform cache memory (#835) (28e1f12)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

• shim import.meta when tokens are split by comments or newlines (#829) (ed9d330), closes #828

---

This release is also available on:

• npm package (@​latest dist-tag)

... (truncated)

Commits

• ca66105 test: fix drive-less file URLs in ESM resolver fixtures
• 2da3407 fix: expose require.cache and require.extensions to tsImport CommonJS modules
• 38e1588 fix: exclude bare builtins from namespace inheritance
• 562c434 fix: make namespaced register() overloads portable for declaration emit
• edfb1f0 build: upgrade pkgroll and externalize CJS loader reference
• 70e7828 test: upgrade tinyspy for disposable API
• 9ed2022 ci: avoid duplicate release notifications
• 872e77f refactor: use disposables for cleanup
• 6e5236b fix: restore the CJS bridge namespace for Node 24 require(esm) under tsImport...
• 28e1f12 fix(cache): bound shared transform cache memory (#835)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for tsx since your current version.

Updates typescript from 5.9.3 to 7.0.2

Release notes

Sourced from typescript's releases.

TypeScript 7.0.2

https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/

This tag was originally released at: https://github.com/microsoft/typescript-go/releases/tag/typescript%2Fv7.0.2

TypeScript 6.0.3

For release notes, check out the release announcement blog post.

• fixed issues query for TypeScript 6.0.0 (Beta).
• fixed issues query for TypeScript 6.0.1 (RC).
• fixed issues query for TypeScript 6.0.2 (Stable).
• fixed issues query for TypeScript 6.0.3 (Stable).

Downloads are available on:

• npm

TypeScript 6.0

For release notes, check out the release announcement blog post.

• fixed issues query for TypeScript 6.0.0 (Beta).
• fixed issues query for TypeScript 6.0.1 (RC).
• fixed issues query for TypeScript 6.0.2 (Stable).

Downloads are available on:

• npm

TypeScript 6.0.1 RC

For release notes, check out the release announcement blog post.

• fixed issues query for TypeScript 6.0.0 (Beta).
• fixed issues query for TypeScript 6.0.1 (RC).

Downloads are available on:

• npm

TypeScript 6.0 Beta

For release notes, check out the release announcement.

• fixed issues query for Typescript 6.0.0 (Beta).

Downloads are available on:

• npm

Commits

• 1e4744d Merge branch 'main' into ts7-release
• a5a219cmicrosoft/typescript-go#4558
• ecfe30d Update status localization
• 5de25b5 Hide executable name in TypeScript status
• d7ce74a Show bundled TypeScript version for packaged servers
• 29be66a Correct TS 7 release version to 7.0.2
• ed2bd1b Merge branch 'main' into ts7-release
• 8873075 Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...
• 9427131 Set up stable / nightly extension split, other prep (microsoft/typescript-go#...
• d4eaca5microsoft/typescript-go#4549
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.