Security patch: credential leak in Vertex/Bedrock integrations fixed. Upgrade now for affected deployments.
Anthropic TypeScript SDK v0.19.2 patches credential exposure in Vertex and Bedrock
Original: anthropics/anthropic-sdk-typescript: vertex-sdk: v0.19.2
Importance: 認証情報漏洩の可能性を持つセキュリティバグ修正のため、既存ユーザーに即座の影響あり。
Summary
Anthropic TypeScript SDK updated to v0.19.2 with a critical security fix. The patch prevents ambient first-party credentials from being inadvertently sent to Vertex AI and AWS Bedrock provider endpoints. This addresses a potential credential exposure risk for applications using SDK in cloud environments. Immediate upgrade recommended for affected deployments.
Key Points
- Ambient credentials leaked via Vertex and Bedrock provider endpoints
- Tokens and temporary credentials exposed to third parties
- Fixed in v0.19.2; immediate upgrade required
View developer notes (APIs, breaking changes, migration)
anthropic-sdk-typescript vertex-sdk updated to v0.19.2. The critical fix prevents ambient credentials (ADC, AWS SDK default credential chain, environment variables) from leaking to Vertex AI and AWS Bedrock provider endpoints during API calls. The vulnerability exposed tokens and temporary credentials to third-party endpoints. Implementation: credential sanitization logic in auth header construction. Users must upgrade immediately via npm. No breaking changes; drop-in replacement.
Source: https://github.com/anthropics/anthropic-sdk-typescript/releases/tag/vertex-sdk-v0.19.2
Outlet: SDK (anthropic-sdk-typescript)
This article is an AI-generated summary (OpenAI GPT-4o-mini) of publicly available information from Anthropic, OpenAI, Google, Meta, Mistral, DeepSeek, Sakana, and other vendors. The original source URL is always provided in accordance with fair-use citation requirements. Summaries are AI-generated and may contain mistranslations or misinterpretations. Always verify details with the original source.