Skip to main content

​
1.5.0 (2026-08-19)

A security, packaging and behaviour-correction release. No public API changed; every 1.4.0 program compiles against 1.5.0 unmodified. Consumer dependency floors. If you depend on claude-code-sdk without importing a BOM, 1.4.0 resolves Jackson 2.21.2 and Jackson 3.0.3 — 23 known vulnerabilities, 8 of them HIGH. The project’s own build was clean, which is why this went unnoticed: POM flattening strips <dependencyManagement>, so the parent’s Jackson BOM imports never travelled to consumers. 1.5.0 declares the floors — Jackson 2.21.6 and Jackson 3.1.6 — directly on the published module, and the same no-BOM consumer resolves zero findings. Upgrading is the fix; nothing makes 1.4.0 safe retroactively. connect() no longer sends a synthetic "Hello". Both the sync and the async client used to substitute the literal string "Hello" when connect() was called with no initial prompt, and send it as a user message — contradicting the documented contract (“connects to the Claude CLI without an initial prompt”) and billing a model turn the caller never requested. connect() now starts and initialises the session and writes nothing to the CLI, matching the official Python SDK. connect(String) is unchanged and still sends exactly the prompt you pass; if you relied on the old behaviour, call connect("Hello") explicitly. Packaging. The binary, sources and Javadoc archives now embed the Apache 2.0 licence text. A CycloneDX 1.6 SBOM is published for the first time. The published POM resolves from Maven Central only. Hygiene. A hard-coded developer path shipped in ClaudeCliDiscovery since the first release; it is gone. Prompt text and the full CLI command line are no longer written to INFO logs.

​
1.4.0 (2026-06-15)

  • Bump MCP SDK 0.15.0 -> 2.0.0 (clears CVE-2026-35568; mcp-core 2.0.0)

​
1.3.0 (2026-06-06)

  • Allow manual CI runs via workflow_dispatch
  • Step 2.1-2.2: Retain raw JSON on RegularMessage; wire fixtures for CLI 2.1.162

​
1.2.0 (2026-05-29)

  • Fix ClaudeSyncClient hang when spawned after prior session hits max turns

​
1.1.0 (2026-05-15)

  • Add javadoc plugin to release profile, fix stale references
  • Fix 2 failing ITs: CLI flag parity and robust streaming NPE
  • Add distributionManagement for snapshot publishing
  • Skip tests on snapshot publish — CI handles test validation
  • Add agent-clis and API key secrets to CI and snapshot workflows
  • Migrate to markpollack org: package rename, standalone POM, build-tools workflows
  • Fix README install section: remove stale snapshot repo config
  • Update README: released version 1.0.0

​
1.0.0 (2026-03-05)

  • Initial release.