fix(deps): update anthropics/claude-code-action action to v1.0.72 by renovate[bot] · Pull Request #38 · koki-develop/claude-renovate-review

renovate · 2026-01-25T22:14:44Z

This PR contains the following updates:

Package	Type	Update	Change
anthropics/claude-code-action	action	patch	`v1.0.33` → `v1.0.72`

Release Notes

anthropics/claude-code-action (anthropics/claude-code-action)

`v1.0.72`

Compare Source

What's Changed

Harden tag mode tool permissions against prompt injection by @km-anthropic in #1002

Full Changelog: anthropics/claude-code-action@v1...v1.0.72

`v1.0.71`

Compare Source

What's Changed

docs: warn that allowed_bots can expose the action to external triggers by @an-dustin in #1039
feat(inline-comment): add confirmed param + probe-pattern safety net by @km-anthropic in #1048

New Contributors

@an-dustin made their first contribution in #1039

Full Changelog: anthropics/claude-code-action@v1...v1.0.71

What's Changed

Improve gh.sh wrapper: stricter validation and better error messages by @OctavianGuzu in #996

Full Changelog: anthropics/claude-code-action@v1...v1.0.67

`v1.0.66`

Compare Source

What's Changed

Only expose permission_denials count in sanitized output by @ddworken in #993

Full Changelog: anthropics/claude-code-action@v1...v1.0.66

`v1.0.65`

Compare Source

What's Changed

Change the default display_report option to false to restrict exposed data by @ddworken in #992

Full Changelog: anthropics/claude-code-action@v1...v1.0.65

`v1.0.64`

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.64

`v1.0.63`

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.63

`v1.0.62`

Compare Source

What's Changed

Add gh.sh wrapper for gh CLI commands in issue triage workflows by @OctavianGuzu in #975

Full Changelog: anthropics/claude-code-action@v1...v1.0.62

`v1.0.61`

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.61

`v1.0.60`

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.60

`v1.0.59`

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.59

`v1.0.58`

Compare Source

What's Changed

Add non-write users check workflow by @OctavianGuzu in #973

Full Changelog: anthropics/claude-code-action@v1...v1.0.58

`v1.0.57`

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.57

`v1.0.56`

Compare Source

What's Changed

Use wrapper script for label operations in issue triage by @OctavianGuzu in #968

Full Changelog: anthropics/claude-code-action@v1...v1.0.56

`v1.0.55`

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.55

`v1.0.54`

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.54

`v1.0.53`

Compare Source

What's Changed

fix: grant write permissions and use @main in claude workflow by @ashwin-ant in #950
feat: add display_report option to disable step summary by @ashwin-ant in #952

Full Changelog: anthropics/claude-code-action@v1...v1.0.53

`v1.0.52`

Compare Source

What's Changed

Fix stale claudeCodeVersion and update bump script to keep run.ts in sync by @ashwin-ant in #943
fix: revert to colon-based wildcard syntax for git permissions by @ashwin-ant in #949

Full Changelog: anthropics/claude-code-action@v1...v1.0.52

`v1.0.51`

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.51

`v1.0.50`

Compare Source

What's Changed

revert: undo PR checkout fork support and unique branch naming by @ashwin-ant in #937

Full Changelog: anthropics/claude-code-action@v1...v1.0.50

`v1.0.49`

Compare Source

What's Changed

fix: replace deprecated :* with modern * wildcard in git permissions by @Dave-London in #929
fix: skip CI MCP server installation when actions:read permission is missing by @OctavianGuzu in #933
Fix/PR checkout branch name conflicts by @kirisame-wang in #931

New Contributors

@OctavianGuzu made their first contribution in #933
@kirisame-wang made their first contribution in #931

Full Changelog: anthropics/claude-code-action@v1...v1.0.49

`v1.0.48`

Compare Source

What's Changed

Fix PR checkout to support fork PRs by @Tsuesun in #851

New Contributors

@Tsuesun made their first contribution in #851

Full Changelog: anthropics/claude-code-action@v1...v1.0.48

`v1.0.47`

Compare Source

What's Changed

Update claude-opus-4-5 to claude-opus-4-6 in workflow by @ashwin-ant in #909
fix: skip dev dependencies in CI install step by @Dave-London in #919

New Contributors

@Dave-London made their first contribution in #919

Full Changelog: anthropics/claude-code-action@v1...v1.0.47

`v1.0.46`

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.46

`v1.0.45`

Compare Source

What's Changed

fix: use original body from webhook payload for TOCTOU hardening by @ddworken in #904
refactor: simplify mode system by removing Mode interface and registry by @ashwin-ant in #899

Full Changelog: anthropics/claude-code-action@v1...v1.0.45

`v1.0.44`

Compare Source

What's Changed

refactor: unify action into single composite step with run.ts entrypoint by @ashwin-ant in #898

Full Changelog: anthropics/claude-code-action@v1...v1.0.44

`v1.0.43`

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.43

`v1.0.42`

Compare Source

What's Changed

fix: pass OpenTelemetry environment variables to Claude Code subprocess by @csy1204 in #886
fix: pass GitHub token to setup-bun to avoid rate limits by @peloyeje in #861

New Contributors

@csy1204 made their first contribution in #886
@peloyeje made their first contribution in #861

Full Changelog: anthropics/claude-code-action@v1...v1.0.42

`v1.0.41`

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.41

`v1.0.40`

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.40

`v1.0.39`

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.39

`v1.0.38`

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.38

`v1.0.37`

Compare Source

What's Changed

feat: add actor-based comment filtering to GitHub data fetching by @ranyhb in #812
Revert "Revert "feat: send additional_permissions in token exchange request"" by @ashwin-ant in #866
Revert "chore: bump Claude Code to 2.1.21 and Agent SDK to 0.2.21" by @ashwin-ant in #869

New Contributors

@ranyhb made their first contribution in #812

Full Changelog: anthropics/claude-code-action@v1...v1.0.37

`v1.0.36`

Compare Source

What's Changed

Revert "feat: send additional_permissions in token exchange request" by @ashwin-ant in #864

Full Changelog: anthropics/claude-code-action@v1...v1.0.36

`v1.0.35`

Compare Source

What's Changed

feat: send additional_permissions in token exchange request by @ashwin-ant in #859
chore: upgrade checkout-action to v6 by @arthur-mountain in #862

New Contributors

@arthur-mountain made their first contribution in #862

Full Changelog: anthropics/claude-code-action@v1...v1.0.35

`v1.0.34`

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.34

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2026-01-25T22:17:01Z

Renovate PR Review Results

⚖️ Safety Assessment: ✅ Safe

🔍 Release Content Analysis

This PR updates anthropics/claude-code-action from v1.0.33 to v1.0.72, spanning 39 versions and 70 commits over approximately 2 months of development (January-March 2026). Key changes include:

Security Improvements:

v1.0.72: Hardened tag mode tool permissions against prompt injection (PR #1002)
v1.0.71: Added inline-comment confirmed parameter with probe-pattern safety net (PR #1048)
v1.0.71: Documentation warning that allowed_bots can expose action to external triggers (PR #1039)
v1.0.66: Restricted permission_denials count exposure in sanitized output (PR #993)
v1.0.65: Changed display_report default from true to false to restrict exposed data (PR #992)

Feature Additions:

v1.0.67: Improved gh.sh wrapper with stricter validation and better error messages (PR #996)
v1.0.62: Added gh.sh wrapper for gh CLI commands in issue triage workflows (PR #975)
v1.0.58: Added non-write users check workflow (PR #973)
v1.0.56: Wrapper script for label operations in issue triage (PR #968)
v1.0.53: Added display_report option to disable step summary (PR #952)

Bug Fixes & Reverts:

v1.0.52: Reverted to colon-based wildcard syntax for git permissions (PR #949)
v1.0.50: Reverted PR checkout fork support and unique branch naming (PR #937)
v1.0.49: Replaced deprecated :* with modern * wildcard in git permissions (PR #929)
v1.0.49: Skip CI MCP server installation when actions:read permission missing (PR #933)
v1.0.48/v1.0.49/v1.0.31: Multiple attempts to fix PR checkout for fork PRs
v1.0.47: Skip dev dependencies in CI install step (PR #919)
v1.0.45: Use original body from webhook payload for TOCTOU hardening (PR #904)
v1.0.42: Pass OpenTelemetry environment variables to Claude Code subprocess (PR #886)
v1.0.42: Pass GitHub token to setup-bun to avoid rate limits (PR #861)

Architectural Changes:

v1.0.44: Unified action into single composite step with run.ts entrypoint (PR #898)
v1.0.45: Simplified mode system by removing Mode interface and registry (PR #899)

No Breaking Changes Affecting This Codebase:

The display_report default change (v1.0.65) does NOT affect this action because it uses structured_output instead of relying on display_report
All changes are backward compatible for the usage pattern in this repository

🎯 Impact Scope Investigation

Usage Location Identification:

Primary usage: action.yml:109 - Uses anthropics/claude-code-action/base-action@cd77b50d2b0808657f8e6774085c8bf54484351c
The action references the base-action with pinned commit SHA: cd77b50d2b0808657f8e6774085c8bf54484351c (v1.0.72)

Codebase Analysis:

This repository uses the base-action as a dependency to execute Claude Code
The action provides its own prompt and schema configuration
Uses structured_output from base-action (action.yml:189), which remains compatible
Does NOT use display_report parameter, so the default change has no impact
Authentication via anthropic_api_key or claude_code_oauth_token remains unchanged
Tool permissions (--allowedTools) remain compatible
JSON schema output mechanism (--json-schema) remains unchanged

Dependency Impact:

No other dependencies affected
No configuration file changes required
Current workflow in .github/workflows/claude-renovate-review.yml remains fully compatible

Security Benefits:

Enhanced protection against prompt injection attacks
Better tool permission controls
Improved data exposure restrictions
Hardened webhook payload handling (TOCTOU protection)

💡 Recommended Actions

Immediate Actions:

✅ Safe to merge immediately - No code changes required
✅ Approve and merge this PR to benefit from security improvements

Post-Merge Validation:

Monitor the next Renovate PR review to confirm the action continues functioning correctly
Verify that structured output is properly extracted from the updated base-action
Check that the safety assessment and report generation work as expected

No Migration Required:

No code modifications needed
No configuration changes required
No workflow adjustments necessary
The action's usage pattern is fully compatible with all changes from v1.0.33 to v1.0.72

🔗 Reference Links

Generated by koki-develop/claude-renovate-review

github-actions bot approved these changes Jan 25, 2026

View reviewed changes

github-actions bot approved these changes Jan 27, 2026

View reviewed changes

github-actions bot approved these changes Jan 28, 2026

View reviewed changes

renovate bot force-pushed the renovate/anthropics-claude-code-action-1.x branch from c19b46b to 5920814 Compare January 29, 2026 01:57

renovate bot changed the title ~~fix(deps): update anthropics/claude-code-action action to v1.0.34~~ fix(deps): update anthropics/claude-code-action action to v1.0.35 Jan 29, 2026

github-actions bot approved these changes Jan 29, 2026

View reviewed changes

renovate bot force-pushed the renovate/anthropics-claude-code-action-1.x branch from 5920814 to abdb689 Compare January 29, 2026 06:08

renovate bot changed the title ~~fix(deps): update anthropics/claude-code-action action to v1.0.35~~ fix(deps): update anthropics/claude-code-action action to v1.0.36 Jan 29, 2026

github-actions bot approved these changes Jan 29, 2026

View reviewed changes

renovate bot force-pushed the renovate/anthropics-claude-code-action-1.x branch from abdb689 to 363e62a Compare January 30, 2026 08:49

renovate bot changed the title ~~fix(deps): update anthropics/claude-code-action action to v1.0.36~~ fix(deps): update anthropics/claude-code-action action to v1.0.37 Jan 30, 2026

github-actions bot approved these changes Jan 30, 2026

View reviewed changes

renovate bot changed the title ~~fix(deps): update anthropics/claude-code-action action to v1.0.37~~ fix(deps): update anthropics/claude-code-action action to v1.0.38 Jan 31, 2026

renovate bot force-pushed the renovate/anthropics-claude-code-action-1.x branch from 363e62a to e2ac981 Compare January 31, 2026 04:38

github-actions bot approved these changes Jan 31, 2026

View reviewed changes

renovate bot force-pushed the renovate/anthropics-claude-code-action-1.x branch from e2ac981 to d838fa5 Compare January 31, 2026 21:13

renovate bot changed the title ~~fix(deps): update anthropics/claude-code-action action to v1.0.38~~ fix(deps): update anthropics/claude-code-action action to v1.0.39 Jan 31, 2026

github-actions bot approved these changes Jan 31, 2026

View reviewed changes

github-actions bot approved these changes Feb 1, 2026

View reviewed changes

renovate bot force-pushed the renovate/anthropics-claude-code-action-1.x branch from d838fa5 to 2dc923e Compare February 2, 2026 00:32

renovate bot changed the title ~~fix(deps): update anthropics/claude-code-action action to v1.0.39~~ fix(deps): update anthropics/claude-code-action action to v1.0.40 Feb 2, 2026

github-actions bot approved these changes Feb 2, 2026

View reviewed changes

renovate bot force-pushed the renovate/anthropics-claude-code-action-1.x branch from 2dc923e to e069455 Compare February 3, 2026 00:58

renovate bot changed the title ~~fix(deps): update anthropics/claude-code-action action to v1.0.40~~ fix(deps): update anthropics/claude-code-action action to v1.0.41 Feb 3, 2026

github-actions bot approved these changes Feb 3, 2026

View reviewed changes

github-actions bot approved these changes Feb 4, 2026

View reviewed changes

renovate bot force-pushed the renovate/anthropics-claude-code-action-1.x branch from 39ee94f to 83e83d0 Compare February 27, 2026 05:35

github-actions bot approved these changes Feb 27, 2026

View reviewed changes

renovate bot changed the title ~~fix(deps): update anthropics/claude-code-action action to v1.0.59~~ fix(deps): update anthropics/claude-code-action action to v1.0.60 Feb 27, 2026

renovate bot force-pushed the renovate/anthropics-claude-code-action-1.x branch from 83e83d0 to 43f030f Compare February 27, 2026 09:52

github-actions bot approved these changes Feb 27, 2026

View reviewed changes

renovate bot changed the title ~~fix(deps): update anthropics/claude-code-action action to v1.0.60~~ fix(deps): update anthropics/claude-code-action action to v1.0.61 Feb 27, 2026

renovate bot force-pushed the renovate/anthropics-claude-code-action-1.x branch from 43f030f to b36344b Compare February 27, 2026 20:59

github-actions bot approved these changes Feb 27, 2026

View reviewed changes

github-actions bot approved these changes Feb 28, 2026

View reviewed changes

renovate bot force-pushed the renovate/anthropics-claude-code-action-1.x branch from b36344b to bf6aa90 Compare February 28, 2026 06:01

renovate bot changed the title ~~fix(deps): update anthropics/claude-code-action action to v1.0.61~~ fix(deps): update anthropics/claude-code-action action to v1.0.62 Feb 28, 2026

github-actions bot approved these changes Feb 28, 2026

View reviewed changes

renovate bot changed the title ~~fix(deps): update anthropics/claude-code-action action to v1.0.62~~ fix(deps): update anthropics/claude-code-action action to v1.0.63 Mar 1, 2026

renovate bot force-pushed the renovate/anthropics-claude-code-action-1.x branch from bf6aa90 to 99fdc5a Compare March 1, 2026 01:32

renovate bot changed the title ~~fix(deps): update anthropics/claude-code-action action to v1.0.63~~ fix(deps): update anthropics/claude-code-action action to v1.0.64 Mar 2, 2026

renovate bot force-pushed the renovate/anthropics-claude-code-action-1.x branch from 99fdc5a to 92ac706 Compare March 2, 2026 10:13

github-actions bot approved these changes Mar 2, 2026

View reviewed changes

renovate bot changed the title ~~fix(deps): update anthropics/claude-code-action action to v1.0.64~~ fix(deps): update anthropics/claude-code-action action to v1.0.70 Mar 8, 2026

renovate bot force-pushed the renovate/anthropics-claude-code-action-1.x branch from 92ac706 to d7bb3eb Compare March 8, 2026 11:14

github-actions bot approved these changes Mar 8, 2026

View reviewed changes

github-actions bot approved these changes Mar 12, 2026

View reviewed changes

github-actions bot approved these changes Mar 14, 2026

View reviewed changes

renovate bot changed the title ~~fix(deps): update anthropics/claude-code-action action to v1.0.70~~ fix(deps): update anthropics/claude-code-action action to v1.0.71 Mar 15, 2026

renovate bot force-pushed the renovate/anthropics-claude-code-action-1.x branch from d7bb3eb to 999d724 Compare March 15, 2026 01:48

github-actions bot approved these changes Mar 15, 2026

View reviewed changes

fix(deps): update anthropics/claude-code-action action to v1.0.72

c5924e5

renovate bot changed the title ~~fix(deps): update anthropics/claude-code-action action to v1.0.71~~ fix(deps): update anthropics/claude-code-action action to v1.0.72 Mar 16, 2026

renovate bot force-pushed the renovate/anthropics-claude-code-action-1.x branch from 999d724 to c5924e5 Compare March 16, 2026 04:47

github-actions bot approved these changes Mar 16, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): update anthropics/claude-code-action action to v1.0.72#38

fix(deps): update anthropics/claude-code-action action to v1.0.72#38
renovate[bot] wants to merge 1 commit intomainfrom
renovate/anthropics-claude-code-action-1.x

renovate bot commented Jan 25, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Jan 25, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate bot commented Jan 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

What's Changed

New Contributors

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

Configuration

Uh oh!

github-actions bot commented Jan 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Renovate PR Review Results

⚖️ Safety Assessment: ✅ Safe

🔍 Release Content Analysis

🎯 Impact Scope Investigation

💡 Recommended Actions

🔗 Reference Links

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate bot commented Jan 25, 2026 •

edited

Loading

github-actions bot commented Jan 25, 2026 •

edited

Loading