Anthropic JavaScript SDK Vertex Integration Gets Security Fix

At a glance

A fix has been applied to the Google Cloud Vertex integration part of Anthropic's TypeScript software development kit (SDK). The way request addresses are built was corrected so that invalid values can no longer escape the request path. Empty or invalid model names, project IDs, and region values now produce errors.

Key points

1. 1

   Project IDs, regions, and model names that go into request addresses are now handled in a safe format.

2. 2

   Even if a model name contains a slash, requests cannot leave the designated path.

3. 3

   An error is raised if the model name is empty, or if the project ID or region consists only of one or two dots.

Why it matters

When developers add AI features with this tool, it prevents problems where bad input sends requests to the wrong place.