Claude Agent SDK Java 1.7.0

Claude Agent SDK Java 1.7.0

Fixes a hang when closing or cancelling a session: the SDK now destroys the Claude CLI process tree
before closing its streams.

Why this release exists

destroyProcessTree() is bounded — descendants first, destroy, wait up to 5 s, destroy forcibly, wait up to
2 s — but it ran after the transport closed its streams, and closing a pipe reader while another thread is
blocked reading it is not bounded at all. The bound never got the chance to apply.

Measured before the change, one close took 3 minutes 20 seconds against a CLI that never wrote to stdout, and
another had not returned after 420 seconds. On the real CLI, after a live cancel the prompt returned in
0.1 s but the claude child process stayed alive through a 45-second settle and the following turn.

Destroying the process tree first gives the blocked reader its EOF, so the stream close that follows is
immediate — 34 ms measured after the change. The same ordering is corrected in closeGracefully(), so the
asynchronous path no longer hangs the same way.

What changed

• Transport close() and closeGracefully() destroy the process tree before closing streams
  (282fb1ee), with StreamingTransportCloseOrderTest pinning the order.
• Source headers name the current copyright holder (2b57b367).

No API change and no dependency change since 1.6.0.

Upgrading

Drop-in. Bump io.github.markpollack:claude-code-sdk to 1.7.0. Agent Client 0.31.0 builds on this release for
run cancellation.

Maven Central

io.github.markpollack version 1.7.0: claude-agent-sdk-parent, claude-code-sdk. Each carries its
consumer-rooted CycloneDX SBOM (-cyclonedx.json) as a signed attachment.

Claude Agent SDK 1.6.0

Full Changelog: v1.5.1...v1.6.0

Release 1.5.1

Claude Agent SDK Java 1.5.1

Maintenance release refreshing compatible runtime and test dependencies and publishing
consumer-correct CycloneDX SBOMs for every artifact.

Release 1.5.0

Claude Agent SDK for Java 1.5.0

A security, packaging and behaviour-correction release. No public API changed; every
1.4.0 program compiles against 1.5.0 unmodified. One documented behaviour is corrected:
a no-argument connect() no longer sends a prompt of its own.

Licensing is unchanged: this SDK is and remains Apache License 2.0.

Why upgrade

1.4.0 handed standalone consumers vulnerable Jackson. If you depend on
claude-code-sdk without importing a BOM, 1.4.0 resolves a runtime closure containing
com.fasterxml.jackson.core 2.21.2 and tools.jackson.core 3.0.3 — 23 known
vulnerabilities, 8 of them HIGH.

The reactor build was clean, which is why this went unnoticed: flattenMode=ossrh
strips <dependencyManagement> from the published POM, so the parent's Jackson BOM
imports governed the project's own build but never travelled to anyone consuming it.

1.5.0 declares the floors directly on the published module, so they travel. The same
no-BOM consumer now resolves the same 18-artifact closure with zero findings.

Nothing makes 1.4.0 safe retroactively. Upgrading is the fix.

Changes

Behaviour

• connect() no longer sends a synthetic "Hello". Both the sync and the async
  client used to substitute the literal string "Hello" when connect() was called
  with no initial prompt, and send it as a user message. That contradicted the
  documented contract — "connects to the Claude CLI without an initial prompt" — and
  billed a model turn the caller never requested. connect() now starts and
  initialises the session and writes nothing to the CLI, leaving the client ready for
  query(...).

  This matches the official Python SDK, which connects with an empty stream and writes
  a user message only when the caller supplied one.

  connect(String) is unchanged and still sends exactly the prompt you pass. If you
  relied on the old behaviour, call connect("Hello") explicitly.

Dependencies

• Jackson 2 floor raised to 2.21.6 (from 2.21.2).
• Jackson 3 floor raised to 3.1.6, declared directly on claude-code-sdk rather
  than only imported into the parent's dependency management.
  tools.jackson.dataformat:jackson-dataformat-yaml is declared alongside core and
  databind because Jackson 3 requires its modules to share a minor version.
• org.snakeyaml:snakeyaml-engine moves 2.10 to 3.0.1 as a consequence, pulled by the
  aligned YAML dataformat.

Packaging

• The binary, sources and Javadoc archives now each embed the repository's Apache
  License 2.0 text at META-INF/LICENSE, byte-identical to the root LICENSE.
• A single aggregate CycloneDX 1.6 JSON SBOM is produced and published, attached to
  claude-agent-sdk-parent. Previously no SBOM was produced at all.
• The parent POM is no longer excluded from the release bundle.
• The published POM resolves from Maven Central only; the unused Spring and Central
  Portal snapshot repositories are gone.

Build and CI

• scripts/standalone-consumer-gate.sh reproduces the no-parent, no-BOM consumer
  shape, asserts the Jackson floors and the Java 21 artifact shape, and runs an offline
  smoke over the resolved closure. It derives the Maven version, so it needs no edit
  across releases. CI runs it on every build.
• CI, snapshot and release workflows are pinned to an immutable build-tools commit, and
  snapshot and release verification no longer skip tests.
• The nightly OWASP-NVD workflow and the -Powasp profile are removed in favour of an
  offline local Trivy procedure; scripts/security-scan.sh scans the actual consumer
  JAR closure first and the SBOM as supporting inventory.

Claude Code CLI compatibility

Verified against Claude Code CLI 2.1.235 for the capabilities this SDK already
exposes: executable discovery, process startup, option construction, the control
protocol handshake, recorded-fixture parsing, session identifiers, hooks, permissions,
MCP message handling and clean shutdown.

Flags the CLI has added since 1.4.0 — --forward-subagent-text, --autocompact,
--cloud, --environment, --teleport, --safe-mode, --bg/--background and
--ax-screen-reader — are not modelled by CLIOptions in this release and are
recorded as future compatibility backlog. Most are cloud, remote-session or interactive
UI concepts with no local-subprocess equivalent. Anything you need today remains
passable through extraArgs.

Compatibility

• Java 21 or later, unchanged.
• No API additions or removals; every 1.4.0 program compiles unmodified.
• One behaviour change, described above: a no-argument connect() sends no prompt.
  Callers that depended on the unsolicited "Hello" turn must now pass it explicitly.

Release 1.4.0

Initial release.

Release 1.2.0

Full Changelog: v1.1.0...v1.2.0

Release 1.1.0

Full Changelog: v1.0.0...v1.1.0