[dependabot]

Bumps the actions group with 1 update in the / directory: anthropics/claude-code-action.

Updates anthropics/claude-code-action from 1.0.252 to 1.0.264

Release notes

Sourced from anthropics/claude-code-action's releases.

v1.0.264

What's Changed

• docs: use claude-plugins-official in plugin examples by @​mhegazy in anthropics/claude-code-action#1932

Full Changelog: anthropics/claude-code-action@v1.0.263...v1.0.264

v1.0.263

Full Changelog: anthropics/claude-code-action@v1.0.262...v1.0.263

v1.0.262

What's Changed

• chore: bump Bun to 1.4.4 by @​dylan-conway in anthropics/claude-code-action#1916

New Contributors

• @​dylan-conway made their first contribution in anthropics/claude-code-action#1916

Full Changelog: anthropics/claude-code-action@v1.0.261...v1.0.262

v1.0.261

Full Changelog: anthropics/claude-code-action@v1.0.260...v1.0.261

v1.0.260

What's Changed

• Pin the PR version a run checks out by @​OctavianGuzu in anthropics/claude-code-action#1915

Full Changelog: anthropics/claude-code-action@v1.0.259...v1.0.260

v1.0.259

Full Changelog: anthropics/claude-code-action@v1.0.258...v1.0.259

v1.0.258

Full Changelog: anthropics/claude-code-action@v1.0.257...v1.0.258

v1.0.257

Full Changelog: anthropics/claude-code-action@v1.0.256...v1.0.257

v1.0.256

Full Changelog: anthropics/claude-code-action@v1.0.255...v1.0.256

v1.0.255

Full Changelog: anthropics/claude-code-action@v1.0.254...v1.0.255

v1.0.254

Full Changelog: anthropics/claude-code-action@v1.0.253...v1.0.254

v1.0.253

Full Changelog: anthropics/claude-code-action@v1.0.252...v1.0.253

Commits

• d70510b chore: bump Claude Code to 2.1.312 and Agent SDK to 0.3.312
• 98a9e39 docs: use claude-plugins-official in plugin examples (#1932)
• 8041f1d chore: bump Claude Code to 2.1.311 and Agent SDK to 0.3.311
• 925afb5 chore: bump Bun to 1.4.4 (#1916)
• 16f9f71 chore: bump Claude Code to 2.1.310 and Agent SDK to 0.3.310
• 8d70a0d Pin the PR version a run checks out (#1915)
• ae68417 chore: bump Claude Code to 2.1.309 and Agent SDK to 0.3.309
• 6b6870e chore: bump Claude Code to 2.1.308 and Agent SDK to 0.3.308
• aa8a773 chore: bump Claude Code to 2.1.307 and Agent SDK to 0.3.307
• a5a423f chore: bump Claude Code to 2.1.306 and Agent SDK to 0.3.306
• Additional commits viewable in compare view

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
isogram	Ready	Preview	Nov 1, 2026 12:26am UTC

[github-actions]

Dependency review (automated, 2026-11-01)

Verdict: SAFE TO MERGE (once CI passes): a patch-level bump of one pinned action, no advisories, new release is 5 days old, and its diff shows nothing suspicious.

The PR moves anthropics/claude-code-action from f27be6b (v1.0.252) to d70510b (v1.0.264) in the five .github/workflows/claude*.yml files, as the title says. Nothing else changes and there are no major bumps.

Impact

Advisory	Package	Severity	Class	Evidence
none	anthropics/claude-code-action	n/a	n/a	advisories?ecosystem=actions&affects=…@1.0.264 returns 0. Dependabot alerts could not be listed (403 for this token), so the global advisory DB was used.

This is a plain version update. The action runs with CLAUDE_CODE_OAUTH_TOKEN and GITHUB_TOKEN, so its supply chain matters, and the vetting below covers it.

Version vetting

Package	Old → New	Published	Publisher	Provenance	Scripts / build.rs	New deps	Diff
anthropics/claude-code-action	v1.0.252 f27be6b → v1.0.264 d70510b	2026-10-27 (5 days old; v1.0.252 was 2026-10-16)	github-actions[bot], same as the previous release, same owner	Tag v1.0.264 resolves to d70510b, matching the pinned SHA	action.yml change: bun 1.3.14 → 1.4.4 and bundled Claude Code CLI 2.1.302 → 2.1.312 (version bumps only; oven-sh/setup-bun pin unchanged)	Bun lockfile only: claude-agent-sdk 0.3.302 → 0.3.312, @types/bun 1.2.11 → 1.4.3, and an @octokit/plugin-request-log nesting change. No new packages of note.	13 commits, 11 files. Real changes: branch.ts now pins the PR checkout to the head SHA and refuses to run if the PR was updated after the trigger; tag/index.ts reports that failure in the tracking comment; docs and CI tweaks. No new network calls to non-GitHub hosts, no token or env reads, no obfuscated code.

Checks

• CI: Test and build passed; Vercel Preview Comments passed; CodeQL neutral. review, E2E (real browser) and Bundle size and Lighthouse are still running.
• Not done: Dependabot alerts API returned 403 for this token. Only the action's top-level diff and its bun.lock changes were read; the transitive npm packages inside the action's bun.lock were not individually vetted (they are Anthropic-owned SDK and type packages).
• Not verified: the diff was read via the compare API, not by building the action.