[dependabot]

Bumps claude-agent-sdk from 0.2.110 to 0.2.121.

Release notes

Sourced from claude-agent-sdk's releases.

v0.2.121

Bug Fixes

• Fixed argv flag injection via resume and session_id options: --resume and --session-id are now passed as single =-joined argv tokens (e.g. --resume=<value>) so that a dash-prefixed value is never misinterpreted as an independent CLI flag (#1123)

Internal/Other Changes

• Hardened build scripts against command injection via CLAUDE_CLI_VERSION: Added version validation (_cli_version_validation.py) and eliminated shell interpolation in download_cli.py and update_cli_version.py so that a malformed version string cannot inject shell or Python code during builds (#1117)
• CI now lints and typechecks scripts/ alongside src/ and tests/
• CI CLI install steps now fail properly when curl errors (added shell: bash for pipefail)
• Updated bundled Claude CLI to version 2.1.212

---

PyPI: https://pypi.org/project/claude-agent-sdk/0.2.121/

pip install claude-agent-sdk==0.2.121

v0.2.120

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.211

---

PyPI: https://pypi.org/project/claude-agent-sdk/0.2.120/

pip install claude-agent-sdk==0.2.120

v0.2.119

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.210

---

PyPI: https://pypi.org/project/claude-agent-sdk/0.2.119/

pip install claude-agent-sdk==0.2.119
</tr></table> 

... (truncated)

Changelog

Sourced from claude-agent-sdk's changelog.

0.2.121

Bug Fixes

• Fixed argv flag injection via resume and session_id options: --resume and --session-id are now passed as single =-joined argv tokens (e.g. --resume=<value>) so that a dash-prefixed value is never misinterpreted as an independent CLI flag (#1123)

Internal/Other Changes

• Hardened build scripts against command injection via CLAUDE_CLI_VERSION: Added version validation (_cli_version_validation.py) and eliminated shell interpolation in download_cli.py and update_cli_version.py so that a malformed version string cannot inject shell or Python code during builds (#1117)
• CI now lints and typechecks scripts/ alongside src/ and tests/
• CI CLI install steps now fail properly when curl errors (added shell: bash for pipefail)
• Updated bundled Claude CLI to version 2.1.212

0.2.120

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.211

0.2.119

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.210

0.2.118

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.209

0.2.117

Bug Fixes

• Escaped untrusted fields in Slack issue notification workflow: Fixed the Slack notification workflow to properly escape issue titles and usernames using jq instead of bash substitution, preventing malformed JSON payloads and mrkdwn injection from specially crafted issue titles (#1116)

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.208

0.2.116

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.207
• Fixed CI workspace trust so Claude Code honors project-scoped permission grants in checkout directories (#1085)

0.2.115

... (truncated)

Commits

• f604b8c docs: update changelog for v0.2.121
• 0a87d2c chore: release v0.2.121
• 1cd470d chore: bump bundled CLI version to 2.1.212
• 0278287 Validate CLAUDE_CLI_VERSION and remove shell interpolation from the build scr...
• 347a1cb Pass --resume and --session-id as a single argv token (#1123)
• af69c01 docs: update changelog for v0.2.120
• 07f1ab3 chore: release v0.2.120
• 135bf9a chore: bump bundled CLI version to 2.1.211
• 57f67cd docs: update changelog for v0.2.119
• d434722 chore: release v0.2.119
• Additional commits viewable in compare view

---

Note

Overview
Bumps claude-agent-sdk from 0.2.110 / >=0.2 to >=0.2.121 across the workspace and refreshes uv.lock to pin 0.2.121.

The launchdarkly-ai-claude-agents package now requires the newer minimum at runtime; the root dev dependency group matches the same floor. No application code changes—only version constraints and lockfile artifacts.

Upstream 0.2.121 brings a security fix for argv flag injection when passing resume and session_id (relevant to this repo’s Claude agents handler, which forwards those options), plus build-script hardening and a newer bundled Claude CLI.

^{Reviewed by Cursor Bugbot for commit f720b7d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[jeffdupont]

Approved: raises the claude-agent-sdk floor to 0.2.121 for the resume/session_id argv fix.