chore(deps): update dependency anthropic to v1.5.0

[knostic-renovate]

This PR contains the following updates:

Package	Update	Change
anthropic	minor	==1.4.0 -> ==1.5.0

---

Release Notes

anthropics/anthropic-sdk-python (anthropic)

v1.5.0

Compare Source

Full Changelog: v1.4.0...v1.5.0

Features

• api: add auto mode tool permissions for Managed Agents (62aa21b)
• api: add content_too_large web_fetch tool error code (4b5dec6)
• api: add the user-profiles-2026-09-04 beta value and external_user_details to user profiles (5f881a5)
• api: support mounting public GitHub repositories without an authorization_token in Managed Agents sessions (285937c)
• client: add Message.to_param() and BetaMessage.to_param() (192a2b2)
• credentials: add CredentialsError and IdentityTokenFileError (9acd79f)
• tools: accept tool objects directly in messages.create, parse, stream and count_tokens (ebd2fc5)

Bug Fixes

• client: merge extra_body before client hooks run (7aaf887)
• credentials: refuse credentials files accessible by group or others (7af3e2b)
• streaming: keep partial tool input JSON off content blocks (4605bca)
• types: leave parsed_output out of dumped text blocks (ca0706d)

Chores

• client: clean up the unused idempotency request option (c97830c)
• client: keep the idempotency_key request option as a deprecated no-op (#​621) (c2ab92e)
• docs: correct the environment scope field description (b903ee0)
• internal: remove generated file header comments (ae671f8)
• internal: restore package version (f3aefc7)
• internal: restore package version (e3c70e8)
• internal: stop stamping the package version into generated files (e7a6a28)
• tests: restore empty test package marker files (0803af0)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[gadievron]

Verification review — recommend-merge. (head 66beb10; evidence pinned to it)

Scope: single-line bump — anthropic[bedrock]==1.4.0 → ==1.5.0 (libs/openant-core/requirements.txt).

Consumed surface (all re-derived at the head): the anthropic adapter (messages.create, the exception taxonomy — Authentication/PermissionDenied/RateLimit/NotFound/APIConnection/APIStatus) and the Bedrock variant (AnthropicBedrock ctor + the same taxonomy). The 1.5.0 additions (Managed Agents tool permissions, content_too_large, user-profiles beta, Message.to_param(), the NEW CredentialsError/IdentityTokenFileError classes) touch no consumed path — the new classes narrow pre-existing AnthropicError raises on the identity-token path the adapters never call (a pre-existing, follow-up-noted gap, unchanged by this bump).

Upstream facts (re-derived from PyPI + the upstream changelog, not the PR body): requires_dist byte-identical 1.4.0↔1.5.0 (16 deps — no closure movement, the bedrock extra included); requires_python >=3.10 (repo floor >=3.11); not yanked; nothing beyond 1.5.0; the changelog is additive for this consumer. StopReason Literal members IDENTICAL both versions (7 members, re-derived in two environments — the new-member hazard closed).

Probes (fresh venv at the head, 7/7): real adapter ctor with the real SDK client; conn-refused → LLMConnectionError mapping; messages.create full round-trip via httpx2.MockTransport (the SDK is httpx2-backed and rejects legacy httpx clients — the repo's own factories already import httpx2); hermetic AnthropicBedrock construction (explicit dummy aws_access_key kwargs, no AWS contact); the pinned-exception classes intact. Tests: the SDK contract floor + anthropic + bedrock suites — 63 passed. CI at the head: tests + gitleaks success (the pin-equality floor proves 1.5.0 actually ran). Upstream source check: lib/bedrock/_auth.py is byte-identical 1.4.0↔1.5.0 — the bare-RuntimeError credential mapping in bedrock.py remains live.

Residual (pre-existing, follow-up-noted): request-time credential-refresh failures (now CredentialsError) escape the adapter's typed catch net untyped — same shape at 1.4.0 (AnthropicError), not introduced here.

Approve + merge are code-owner actions; never on red CI.