Skip to content

fix(parse-sdk-options): prevent shell-quote from collapsing unquoted Bash(X:*) rules to bare Bash#1350

Merged
ashwin-ant merged 2 commits into
anthropics:mainfrom
alexglynn:alexglynn/fix-shell-quote-bash-rule-collapse
Jun 14, 2026
Merged

fix(parse-sdk-options): prevent shell-quote from collapsing unquoted Bash(X:*) rules to bare Bash#1350
ashwin-ant merged 2 commits into
anthropics:mainfrom
alexglynn:alexglynn/fix-shell-quote-bash-rule-collapse

Conversation

@alexglynn

@alexglynn alexglynn commented May 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bug

parseClaudeArgsToExtraArgs uses shell-quote's parse() to tokenize the claude_args input, then filters to string entries only. But shell-quote is a full shell-command parser: unquoted ( / ) are returned as {op: '('} / {op: ')'} control-operator objects, and any bareword containing * is returned as {op: 'glob', pattern: '…'}. All of these were dropped by the string-only filter.

Result: an unquoted --allowedTools Bash(gh:*),Bash(cat:*) collapses to bare "Bash" — which Claude Code interprets as Bash(*), i.e. unrestricted shell.

Repro

import { parse } from "shell-quote";
parse("--allowedTools View,Bash(gh:*),Bash(cat:*)")
// → ["--allowedTools", "View,Bash", {op:"("}, {op:"glob",pattern:"gh:*"},
//    {op:")"}, ",Bash", {op:"("}, {op:"glob",pattern:"cat:*"}, {op:")"}]

After the existing .filter(typeof arg === "string") → ["--allowedTools", "View,Bash", ",Bash"] → split/dedup → ["View", "Bash"].

Before / after (parseSdkOptions)

Input (exact shape the action builds in tag mode — its own quoted --allowedTools + user's unquoted YAML claude_args):

--permission-mode acceptEdits --allowedTools "Glob,Grep,Read,Bash(git add:*),Bash(git commit:*)" --model claude-opus-4-7
--allowedTools View,Bash(gh:*),Bash(printf:*),Bash(cat:*)
sdkOptions.allowedTools
before […, "Bash(git add:*)", "Bash(git commit:*)", "View", "GlobTool", "GrepTool", "Bash"]
after […, "Bash(git add:*)", "Bash(git commit:*)", "View", "Bash(gh:*)", "Bash(printf:*)", "Bash(cat:*)"]

Security impact

This is silent permission widening. Any workflow that passes scoped Bash(X:*) / Read(X) / WebFetch(X) rules in claude_args without wrapping the value in quotes gets the tool-level wildcard instead of the scoped rule. Because Bash(*) subsumes every Bash(X:*), the session behaves as intended — the user never observes a denial that would reveal the scoping was lost.

Found via Claude Code session telemetry. The same collapse happens on --disallowedTools (scoped deny → blanket deny), which is a usability bug rather than a widening.

Fix

claude_args is a CLI argument string, not a shell command — we want shell-quote's quote/whitespace handling, not its operator/glob detection. shell-quote has no option to disable operator parsing, and it does not preserve adjacency (so post-hoc reconstruction of {op} runs is lossy). Instead:

  1. Before parse(), replace the seven shell control metachars ( ) | & ; < > with Unicode private-use codepoints (U+E000–U+E006). shell-quote then treats them as ordinary word characters and never splits on them.
  2. After parse(), map glob ops back to their .pattern (the verbatim token text) and restore the placeholders.

Quoted values, escaped values, whitespace tokenization, comment stripping, and --mcp-config JSON handling are all unchanged.

Tests

Six regression tests added to base-action/test/parse-sdk-options.test.ts covering:

  • unquoted comma-joined Bash(X:*) rules
  • unquoted space-separated Bash(X:*) rules
  • unquoted Tool(content) with no glob chars
  • quoted Bash(X:*) (no-regression)
  • the real-world tag-mode-quoted + user-unquoted mixed case
  • --disallowedTools path

All 5 applicable tests fail on main, pass with this change. Full suite: base-action 133 pass / 0 fail, root 706 pass / 0 fail, typecheck clean, prettier clean.

Note

bun install on main currently fails because @anthropic-ai/claude-agent-sdk@0.3.150 (pinned in 787c5a0) is not yet published to npm; I ran the suite locally against 0.3.149. Unrelated to this change.

🤖 Generated with Claude Code

@alexglynn @claude
fix(parse-sdk-options): prevent shell-quote from collapsing unquoted …
4f12760 
…Bash(X:*) rules to bare Bash

shell-quote's parse() tokenizes unquoted `(`, `)` as control operators
and barewords containing `*` as glob ops, all returned as non-string
objects. parseClaudeArgsToExtraArgs filtered those out, so an unquoted
`--allowedTools View,Bash(gh:*),Bash(cat:*)` collapsed to bare `Bash` —
silently widening scoped permission rules to unrestricted Bash(*).

Escape shell control metachars to Unicode private-use placeholders
before parse() and restore after; extract .pattern from glob ops.
Preserves existing quote/whitespace handling.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
@alexglynn alexglynn closed this May 24, 2026
@alexglynn alexglynn reopened this May 24, 2026
@alexglynn @claude
ci: retrigger
df7693f 
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
@ashwin-ant ashwin-ant enabled auto-merge (squash) June 14, 2026 05:45
@ashwin-ant ashwin-ant merged commit a5e5d3b into anthropics:main Jun 14, 2026
6 of 36 checks passed
mergify Bot added a commit to robfrank/linklift that referenced this pull request Jun 18, 2026
@mergify
chore(deps): bump the github-actions group with 4 updates [skip ci]
f5e5abf 
Bumps the github-actions group with 4 updates: [actions/setup-java](https://github.com/actions/setup-java), [graalvm/setup-graalvm](https://github.com/graalvm/setup-graalvm), [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) and [ruby/setup-ruby](https://github.com/ruby/setup-ruby).
Updates `actions/setup-java` from 5.2.0 to 5.3.0
Release notes

*Sourced from [actions/setup-java's releases](https://github.com/actions/setup-java/releases).*

> v5.3.0
> ------
>
> What's Changed
> --------------
>
> * chore: update Java version to 25 in setup examples by [`@​alaahong`](https://github.com/alaahong) in [actions/setup-java#969](https://redirect.github.com/actions/setup-java/pull/969)
> * Bump minimatch from 3.1.2 to 3.1.5 by [`@​dependabot`](https://github.com/dependabot)[bot] in [actions/setup-java#984](https://redirect.github.com/actions/setup-java/pull/984)
> * Refactor error handling and improve test logging for installers by [`@​chiranjib-swain`](https://github.com/chiranjib-swain) in [actions/setup-java#989](https://redirect.github.com/actions/setup-java/pull/989)
> * chore: upgrade dependencies (`@​actions/core`, cache, glob, http-client, tool-cache, xmlbuilder2) by [`@​Copilot`](https://github.com/Copilot) in [actions/setup-java#999](https://redirect.github.com/actions/setup-java/pull/999)
> * Add Oracle JDK 17 licensing limitation note by [`@​mahabaleshwars`](https://github.com/mahabaleshwars) in [actions/setup-java#1001](https://redirect.github.com/actions/setup-java/pull/1001)
> * Update readme for ubuntu sudo java\_home behavior by [`@​mahabaleshwars`](https://github.com/mahabaleshwars) in [actions/setup-java#1013](https://redirect.github.com/actions/setup-java/pull/1013)
> * temurin: add support for Alpine Linux by [`@​gdams`](https://github.com/gdams) in [actions/setup-java#674](https://redirect.github.com/actions/setup-java/pull/674)
> * fix: resolve npm audit vulnerabilities in fast-xml-builder and fast-xml-parser by [`@​gdams`](https://github.com/gdams) in [actions/setup-java#1015](https://redirect.github.com/actions/setup-java/pull/1015)
> * Bump `@​typescript-eslint/eslint-plugin` from 8.35.1 to 8.48.0 by [`@​dependabot`](https://github.com/dependabot)[bot] in [actions/setup-java#952](https://redirect.github.com/actions/setup-java/pull/952)
> * Bump eslint-config-prettier from 8.10.0 to 10.1.8 by [`@​dependabot`](https://github.com/dependabot)[bot] in [actions/setup-java#881](https://redirect.github.com/actions/setup-java/pull/881)
> * Bump picomatch, `@​types/jest`, jest, jest-circus and ts-jest by [`@​dependabot`](https://github.com/dependabot)[bot] in [actions/setup-java#1016](https://redirect.github.com/actions/setup-java/pull/1016)
> * Bump `@​types/node` from 24.1.0 to 25.9.3 by [`@​dependabot`](https://github.com/dependabot)[bot] in [actions/setup-java#950](https://redirect.github.com/actions/setup-java/pull/950)
> * Implement pagination with link headers for Adoptium based apis by [`@​johnoliver`](https://github.com/johnoliver) in [actions/setup-java#1014](https://redirect.github.com/actions/setup-java/pull/1014)
> * Make the Adoptopenjdk package type look at the Temurin repo first for latest assets by [`@​johnoliver`](https://github.com/johnoliver) in [actions/setup-java#522](https://redirect.github.com/actions/setup-java/pull/522)
> * Bump `@​vercel/ncc` from 0.38.1 to 0.44.0 by [`@​dependabot`](https://github.com/dependabot)[bot] in [actions/setup-java#1018](https://redirect.github.com/actions/setup-java/pull/1018)
>
> New Contributors
> ----------------
>
> * [`@​alaahong`](https://github.com/alaahong) made their first contribution in [actions/setup-java#969](https://redirect.github.com/actions/setup-java/pull/969)
> * [`@​Copilot`](https://github.com/Copilot) made their first contribution in [actions/setup-java#999](https://redirect.github.com/actions/setup-java/pull/999)
> * [`@​johnoliver`](https://github.com/johnoliver) made their first contribution in [actions/setup-java#1014](https://redirect.github.com/actions/setup-java/pull/1014)
>
> **Full Changelog**: <actions/setup-java@v5...v5.3.0>


Commits

* [`ad2b381`](actions/setup-java@ad2b381) Bump `@​vercel/ncc` from 0.38.1 to 0.44.0 ([#1018](https://redirect.github.com/actions/setup-java/issues/1018))
* [`b24df5b`](actions/setup-java@b24df5b) Make the Adoptopenjdk package type look at the Temurin repo first for latest ...
* [`43120bc`](actions/setup-java@43120bc) Implement pagination with link headers for Adoptium based apis ([#1014](https://redirect.github.com/actions/setup-java/issues/1014))
* [`ad9d6a6`](actions/setup-java@ad9d6a6) Bump `@​types/node` from 24.1.0 to 25.9.3 ([#950](https://redirect.github.com/actions/setup-java/issues/950))
* [`039af37`](actions/setup-java@039af37) Bump picomatch, `@​types/jest`, jest, jest-circus and ts-jest ([#1016](https://redirect.github.com/actions/setup-java/issues/1016))
* [`1756ab6`](actions/setup-java@1756ab6) Bump eslint-config-prettier from 8.10.0 to 10.1.8 ([#881](https://redirect.github.com/actions/setup-java/issues/881))
* [`662bb59`](actions/setup-java@662bb59) Bump `@​typescript-eslint/eslint-plugin` from 8.35.1 to 8.46.2 ([#952](https://redirect.github.com/actions/setup-java/issues/952))
* [`1071fc1`](actions/setup-java@1071fc1) fix: resolve npm audit vulnerabilities in fast-xml-builder and fast-xml-parse...
* [`576b821`](actions/setup-java@576b821) Merge pull request [#674](https://redirect.github.com/actions/setup-java/issues/674) from gdams/alpine
* [`307d3a2`](actions/setup-java@307d3a2) update readme for ubuntu sudo java\_home behavior ([#1013](https://redirect.github.com/actions/setup-java/issues/1013))
* Additional commits viewable in [compare view](actions/setup-java@be666c2...ad2b381)
  
Updates `graalvm/setup-graalvm` from 1.5.4 to 1.5.6
Release notes

*Sourced from [graalvm/setup-graalvm's releases](https://github.com/graalvm/setup-graalvm/releases).*

> v1.5.6
> ------
>
> What's Changed
> --------------
>
> * Always set up MSVC environment on Windows by [`@​gastaldi`](https://github.com/gastaldi) in [graalvm/setup-graalvm#221](https://redirect.github.com/graalvm/setup-graalvm/pull/221)
>
> **Full Changelog**: <graalvm/setup-graalvm@v1.5.5...v1.5.6>
>
> v1.5.5
> ------
>
> What's Changed
> --------------
>
> * Add Visual Studio 2026 to known installations by [`@​gastaldi`](https://github.com/gastaldi) in [graalvm/setup-graalvm#219](https://redirect.github.com/graalvm/setup-graalvm/pull/219)
>
> New Contributors
> ----------------
>
> * [`@​gastaldi`](https://github.com/gastaldi) made their first contribution in [graalvm/setup-graalvm#219](https://redirect.github.com/graalvm/setup-graalvm/pull/219)
>
> **Full Changelog**: <graalvm/setup-graalvm@v1.5.4...v1.5.5>


Commits

* [`6f3fa03`](graalvm/setup-graalvm@6f3fa03) Bump version to `1.5.6`.
* [`74ee89f`](graalvm/setup-graalvm@74ee89f) Run `npm audit fix`.
* [`0ad466a`](graalvm/setup-graalvm@0ad466a) Always set up MSVC environment on Windows
* [`809afe6`](graalvm/setup-graalvm@809afe6) Bump version to `1.5.5`.
* [`44ffb1c`](graalvm/setup-graalvm@44ffb1c) Fix VS 2026 installation path to use internal version number
* [`e1d3380`](graalvm/setup-graalvm@e1d3380) Add Visual Studio 2026 to known installations
* See full diff in [compare view](graalvm/setup-graalvm@329c42c...6f3fa03)
  
Updates `anthropics/claude-code-action` from 1.0.144 to 1.0.151
Release notes

*Sourced from [anthropics/claude-code-action's releases](https://github.com/anthropics/claude-code-action/releases).*

> v1.0.151
> --------
>
> What's Changed
> --------------
>
> * fix: skip workflow validation token exchange failures by [`@​Ryanoonan`](https://github.com/Ryanoonan) in [anthropics/claude-code-action#1417](https://redirect.github.com/anthropics/claude-code-action/pull/1417)
>
> New Contributors
> ----------------
>
> * [`@​Ryanoonan`](https://github.com/Ryanoonan) made their first contribution in [anthropics/claude-code-action#1417](https://redirect.github.com/anthropics/claude-code-action/pull/1417)
>
> **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.151>
>
> v1.0.150
> --------
>
> **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.150>
>
> v1.0.149
> --------
>
> What's Changed
> --------------
>
> * fix(parse-sdk-options): prevent shell-quote from collapsing unquoted Bash(X:\*) rules to bare Bash by [`@​alexglynn`](https://github.com/alexglynn) in [anthropics/claude-code-action#1350](https://redirect.github.com/anthropics/claude-code-action/pull/1350)
> * fix(mcp): align allowed-tools parser with SDK option parser by [`@​bymle`](https://github.com/bymle) in [anthropics/claude-code-action#1373](https://redirect.github.com/anthropics/claude-code-action/pull/1373)
>
> New Contributors
> ----------------
>
> * [`@​alexglynn`](https://github.com/alexglynn) made their first contribution in [anthropics/claude-code-action#1350](https://redirect.github.com/anthropics/claude-code-action/pull/1350)
>
> **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.149>
>
> v1.0.148
> --------
>
> **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.148>
>
> v1.0.147
> --------
>
> What's Changed
> --------------
>
> * Add pr-stamp-sweep review workflow by [`@​ashwin-ant`](https://github.com/ashwin-ant) in [anthropics/claude-code-action#1409](https://redirect.github.com/anthropics/claude-code-action/pull/1409)
>
> **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.147>
>
> v1.0.146
> --------
>
> What's Changed
> --------------
>
> * test: add unit tests for parseGitHubContext and context type guards by [`@​mateuscmtropical`](https://github.com/mateuscmtropical) in [anthropics/claude-code-action#1404](https://redirect.github.com/anthropics/claude-code-action/pull/1404)
> * docs(faq): correct rebase FAQ to match actual behavior by [`@​bymle`](https://github.com/bymle) in [anthropics/claude-code-action#1370](https://redirect.github.com/anthropics/claude-code-action/pull/1370)
> * fix: fall back to inherited env for auth when inputs are empty by [`@​kirsanium`](https://github.com/kirsanium) in [anthropics/claude-code-action#1342](https://redirect.github.com/anthropics/claude-code-action/pull/1342)
> * fix: break SDK iterator after result message to prevent hang in pull\_request runs by [`@​scobbe`](https://github.com/scobbe) in [anthropics/claude-code-action#1339](https://redirect.github.com/anthropics/claude-code-action/pull/1339)
> * Pin setup-bun binary for post-steps by [`@​kiwigitops`](https://github.com/kiwigitops) in [anthropics/claude-code-action#1365](https://redirect.github.com/anthropics/claude-code-action/pull/1365)
> * fix: clear stale claude-prompts dir before each write by [`@​kyungilpark`](https://github.com/kyungilpark) in [anthropics/claude-code-action#1288](https://redirect.github.com/anthropics/claude-code-action/pull/1288)
> * Include labels in formatContext() output for issues and PRs by [`@​joshpayne-joby`](https://github.com/joshpayne-joby) in [anthropics/claude-code-action#1298](https://redirect.github.com/anthropics/claude-code-action/pull/1298)
> * fix(sanitizer): match attribute quotes by type to avoid mangling content by [`@​bymle`](https://github.com/bymle) in [anthropics/claude-code-action#1371](https://redirect.github.com/anthropics/claude-code-action/pull/1371)
> * docs: fix execution file parsing example by [`@​looooown2006`](https://github.com/looooown2006) in [anthropics/claude-code-action#1297](https://redirect.github.com/anthropics/claude-code-action/pull/1297)
> * fix(image-downloader): detect image type from magic bytes, not URL extension by [`@​pmespresso`](https://github.com/pmespresso) in [anthropics/claude-code-action#1396](https://redirect.github.com/anthropics/claude-code-action/pull/1396)
>
> New Contributors
> ----------------
>
> * [`@​mateuscmtropical`](https://github.com/mateuscmtropical) made their first contribution in [anthropics/claude-code-action#1404](https://redirect.github.com/anthropics/claude-code-action/pull/1404)
> * [`@​bymle`](https://github.com/bymle) made their first contribution in [anthropics/claude-code-action#1370](https://redirect.github.com/anthropics/claude-code-action/pull/1370)
> * [`@​kirsanium`](https://github.com/kirsanium) made their first contribution in [anthropics/claude-code-action#1342](https://redirect.github.com/anthropics/claude-code-action/pull/1342)
> * [`@​scobbe`](https://github.com/scobbe) made their first contribution in [anthropics/claude-code-action#1339](https://redirect.github.com/anthropics/claude-code-action/pull/1339)

... (truncated)


Commits

* [`806af32`](anthropics/claude-code-action@806af32) chore: bump Claude Code to 2.1.181 and Agent SDK to 0.3.181
* [`0a08a86`](anthropics/claude-code-action@0a08a86) fix: skip workflow validation token exchange failures ([#1417](https://redirect.github.com/anthropics/claude-code-action/issues/1417))
* [`9dd8b95`](anthropics/claude-code-action@9dd8b95) chore: bump Claude Code to 2.1.179 and Agent SDK to 0.3.179
* [`4d7e1f0`](anthropics/claude-code-action@4d7e1f0) chore: bump Claude Code to 2.1.178 and Agent SDK to 0.3.178
* [`3d9f0dc`](anthropics/claude-code-action@3d9f0dc) fix(mcp): align allowed-tools parser with SDK option parser ([#1373](https://redirect.github.com/anthropics/claude-code-action/issues/1373))
* [`a5e5d3b`](anthropics/claude-code-action@a5e5d3b) fix(parse-sdk-options): prevent shell-quote from collapsing unquoted Bash(X:\*...
* [`d5726de`](anthropics/claude-code-action@d5726de) chore: bump Claude Code to 2.1.177 and Agent SDK to 0.3.177
* [`56fa348`](anthropics/claude-code-action@56fa348) chore: bump Claude Code to 2.1.176 and Agent SDK to 0.3.176
* [`82d95d4`](anthropics/claude-code-action@82d95d4) Add pr-stamp-sweep review workflow ([#1409](https://redirect.github.com/anthropics/claude-code-action/issues/1409))
* [`0cb4f3e`](anthropics/claude-code-action@0cb4f3e) chore: bump Claude Code to 2.1.175 and Agent SDK to 0.3.175
* Additional commits viewable in [compare view](anthropics/claude-code-action@0f97b95...806af32)
  
Updates `ruby/setup-ruby` from 1.312.0 to 1.313.0
Release notes

*Sourced from [ruby/setup-ruby's releases](https://github.com/ruby/setup-ruby/releases).*

> v1.313.0
> --------
>
> What's Changed
> --------------
>
> * Add jruby-10.0.6.0 by [`@​ruby-builder-bot`](https://github.com/ruby-builder-bot) in [ruby/setup-ruby#921](https://redirect.github.com/ruby/setup-ruby/pull/921)
>
> **Full Changelog**: <ruby/setup-ruby@v1.312.0...v1.313.0>


Commits

* [`89f9052`](ruby/setup-ruby@89f9052) Add jruby-10.0.6.0
* See full diff in [compare view](ruby/setup-ruby@12fd324...89f9052)
  
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
  
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show  ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore  major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore  minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore  ` will remove the ignore condition of the specified dependency and ignore conditions
This was referenced Jun 20, 2026
Merged
Merged
mergify Bot added a commit to ArcadeData/arcadedb that referenced this pull request Jun 21, 2026
@mergify
chore(deps): bump the github-actions group with 2 updates [skip ci]
56a8912 
Bumps the github-actions group with 2 updates: [actions/setup-java](https://github.com/actions/setup-java) and [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action).
Updates `actions/setup-java` from 5.2.0 to 5.3.0
Release notes

*Sourced from [actions/setup-java's releases](https://github.com/actions/setup-java/releases).*

> v5.3.0
> ------
>
> What's Changed
> --------------
>
> * chore: update Java version to 25 in setup examples by [`@​alaahong`](https://github.com/alaahong) in [actions/setup-java#969](https://redirect.github.com/actions/setup-java/pull/969)
> * Bump minimatch from 3.1.2 to 3.1.5 by [`@​dependabot`](https://github.com/dependabot)[bot] in [actions/setup-java#984](https://redirect.github.com/actions/setup-java/pull/984)
> * Refactor error handling and improve test logging for installers by [`@​chiranjib-swain`](https://github.com/chiranjib-swain) in [actions/setup-java#989](https://redirect.github.com/actions/setup-java/pull/989)
> * chore: upgrade dependencies (`@​actions/core`, cache, glob, http-client, tool-cache, xmlbuilder2) by [`@​Copilot`](https://github.com/Copilot) in [actions/setup-java#999](https://redirect.github.com/actions/setup-java/pull/999)
> * Add Oracle JDK 17 licensing limitation note by [`@​mahabaleshwars`](https://github.com/mahabaleshwars) in [actions/setup-java#1001](https://redirect.github.com/actions/setup-java/pull/1001)
> * Update readme for ubuntu sudo java\_home behavior by [`@​mahabaleshwars`](https://github.com/mahabaleshwars) in [actions/setup-java#1013](https://redirect.github.com/actions/setup-java/pull/1013)
> * temurin: add support for Alpine Linux by [`@​gdams`](https://github.com/gdams) in [actions/setup-java#674](https://redirect.github.com/actions/setup-java/pull/674)
> * fix: resolve npm audit vulnerabilities in fast-xml-builder and fast-xml-parser by [`@​gdams`](https://github.com/gdams) in [actions/setup-java#1015](https://redirect.github.com/actions/setup-java/pull/1015)
> * Bump `@​typescript-eslint/eslint-plugin` from 8.35.1 to 8.48.0 by [`@​dependabot`](https://github.com/dependabot)[bot] in [actions/setup-java#952](https://redirect.github.com/actions/setup-java/pull/952)
> * Bump eslint-config-prettier from 8.10.0 to 10.1.8 by [`@​dependabot`](https://github.com/dependabot)[bot] in [actions/setup-java#881](https://redirect.github.com/actions/setup-java/pull/881)
> * Bump picomatch, `@​types/jest`, jest, jest-circus and ts-jest by [`@​dependabot`](https://github.com/dependabot)[bot] in [actions/setup-java#1016](https://redirect.github.com/actions/setup-java/pull/1016)
> * Bump `@​types/node` from 24.1.0 to 25.9.3 by [`@​dependabot`](https://github.com/dependabot)[bot] in [actions/setup-java#950](https://redirect.github.com/actions/setup-java/pull/950)
> * Implement pagination with link headers for Adoptium based apis by [`@​johnoliver`](https://github.com/johnoliver) in [actions/setup-java#1014](https://redirect.github.com/actions/setup-java/pull/1014)
> * Make the Adoptopenjdk package type look at the Temurin repo first for latest assets by [`@​johnoliver`](https://github.com/johnoliver) in [actions/setup-java#522](https://redirect.github.com/actions/setup-java/pull/522)
> * Bump `@​vercel/ncc` from 0.38.1 to 0.44.0 by [`@​dependabot`](https://github.com/dependabot)[bot] in [actions/setup-java#1018](https://redirect.github.com/actions/setup-java/pull/1018)
>
> New Contributors
> ----------------
>
> * [`@​alaahong`](https://github.com/alaahong) made their first contribution in [actions/setup-java#969](https://redirect.github.com/actions/setup-java/pull/969)
> * [`@​Copilot`](https://github.com/Copilot) made their first contribution in [actions/setup-java#999](https://redirect.github.com/actions/setup-java/pull/999)
> * [`@​johnoliver`](https://github.com/johnoliver) made their first contribution in [actions/setup-java#1014](https://redirect.github.com/actions/setup-java/pull/1014)
>
> **Full Changelog**: <actions/setup-java@v5...v5.3.0>


Commits

* [`ad2b381`](actions/setup-java@ad2b381) Bump `@​vercel/ncc` from 0.38.1 to 0.44.0 ([#1018](https://redirect.github.com/actions/setup-java/issues/1018))
* [`b24df5b`](actions/setup-java@b24df5b) Make the Adoptopenjdk package type look at the Temurin repo first for latest ...
* [`43120bc`](actions/setup-java@43120bc) Implement pagination with link headers for Adoptium based apis ([#1014](https://redirect.github.com/actions/setup-java/issues/1014))
* [`ad9d6a6`](actions/setup-java@ad9d6a6) Bump `@​types/node` from 24.1.0 to 25.9.3 ([#950](https://redirect.github.com/actions/setup-java/issues/950))
* [`039af37`](actions/setup-java@039af37) Bump picomatch, `@​types/jest`, jest, jest-circus and ts-jest ([#1016](https://redirect.github.com/actions/setup-java/issues/1016))
* [`1756ab6`](actions/setup-java@1756ab6) Bump eslint-config-prettier from 8.10.0 to 10.1.8 ([#881](https://redirect.github.com/actions/setup-java/issues/881))
* [`662bb59`](actions/setup-java@662bb59) Bump `@​typescript-eslint/eslint-plugin` from 8.35.1 to 8.46.2 ([#952](https://redirect.github.com/actions/setup-java/issues/952))
* [`1071fc1`](actions/setup-java@1071fc1) fix: resolve npm audit vulnerabilities in fast-xml-builder and fast-xml-parse...
* [`576b821`](actions/setup-java@576b821) Merge pull request [#674](https://redirect.github.com/actions/setup-java/issues/674) from gdams/alpine
* [`307d3a2`](actions/setup-java@307d3a2) update readme for ubuntu sudo java\_home behavior ([#1013](https://redirect.github.com/actions/setup-java/issues/1013))
* Additional commits viewable in [compare view](actions/setup-java@be666c2...ad2b381)
  
Updates `anthropics/claude-code-action` from 1.0.148 to 1.0.153
Release notes

*Sourced from [anthropics/claude-code-action's releases](https://github.com/anthropics/claude-code-action/releases).*

> v1.0.153
> --------
>
> **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.153>
>
> v1.0.152
> --------
>
> **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.152>
>
> v1.0.151
> --------
>
> What's Changed
> --------------
>
> * fix: skip workflow validation token exchange failures by [`@​Ryanoonan`](https://github.com/Ryanoonan) in [anthropics/claude-code-action#1417](https://redirect.github.com/anthropics/claude-code-action/pull/1417)
>
> New Contributors
> ----------------
>
> * [`@​Ryanoonan`](https://github.com/Ryanoonan) made their first contribution in [anthropics/claude-code-action#1417](https://redirect.github.com/anthropics/claude-code-action/pull/1417)
>
> **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.151>
>
> v1.0.150
> --------
>
> **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.150>
>
> v1.0.149
> --------
>
> What's Changed
> --------------
>
> * fix(parse-sdk-options): prevent shell-quote from collapsing unquoted Bash(X:\*) rules to bare Bash by [`@​alexglynn`](https://github.com/alexglynn) in [anthropics/claude-code-action#1350](https://redirect.github.com/anthropics/claude-code-action/pull/1350)
> * fix(mcp): align allowed-tools parser with SDK option parser by [`@​bymle`](https://github.com/bymle) in [anthropics/claude-code-action#1373](https://redirect.github.com/anthropics/claude-code-action/pull/1373)
>
> New Contributors
> ----------------
>
> * [`@​alexglynn`](https://github.com/alexglynn) made their first contribution in [anthropics/claude-code-action#1350](https://redirect.github.com/anthropics/claude-code-action/pull/1350)
>
> **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.149>


Commits

* [`2fee155`](anthropics/claude-code-action@2fee155) chore: bump Claude Code to 2.1.185 and Agent SDK to 0.3.185
* [`51705da`](anthropics/claude-code-action@51705da) chore: bump Claude Code to 2.1.183 and Agent SDK to 0.3.183
* [`806af32`](anthropics/claude-code-action@806af32) chore: bump Claude Code to 2.1.181 and Agent SDK to 0.3.181
* [`0a08a86`](anthropics/claude-code-action@0a08a86) fix: skip workflow validation token exchange failures ([#1417](https://redirect.github.com/anthropics/claude-code-action/issues/1417))
* [`9dd8b95`](anthropics/claude-code-action@9dd8b95) chore: bump Claude Code to 2.1.179 and Agent SDK to 0.3.179
* [`4d7e1f0`](anthropics/claude-code-action@4d7e1f0) chore: bump Claude Code to 2.1.178 and Agent SDK to 0.3.178
* [`3d9f0dc`](anthropics/claude-code-action@3d9f0dc) fix(mcp): align allowed-tools parser with SDK option parser ([#1373](https://redirect.github.com/anthropics/claude-code-action/issues/1373))
* [`a5e5d3b`](anthropics/claude-code-action@a5e5d3b) fix(parse-sdk-options): prevent shell-quote from collapsing unquoted Bash(X:\*...
* See full diff in [compare view](anthropics/claude-code-action@d5726de...2fee155)
  
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
  
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show  ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore  major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore  minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore  ` will remove the ignore condition of the specified dependency and ignore conditions
@coderabbitai coderabbitai Bot mentioned this pull request Jun 23, 2026
Merged
@github-actions github-actions Bot mentioned this pull request Jun 23, 2026
Open
1 task
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ashwin-ant ashwin-ant ashwin-ant approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@alexglynn @ashwin-ant