Build(deps): Update claude-agent-sdk requirement from <0.3,>=0.2.82 to >=0.2.87,<0.3

[dependabot]

Updates the requirements on claude-agent-sdk to permit the latest version.

Release notes

Sourced from claude-agent-sdk's releases.

v0.2.87

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.150
• Switched CI workflows from static API key to Workload Identity Federation for Claude authentication, using short-lived tokens instead of long-lived secrets (#984)

---

PyPI: https://pypi.org/project/claude-agent-sdk/0.2.87/

pip install claude-agent-sdk==0.2.87

Changelog

Sourced from claude-agent-sdk's changelog.

0.2.87

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.150
• Switched CI workflows from static API key to Workload Identity Federation for Claude authentication, using short-lived tokens instead of long-lived secrets (#984)

0.2.86

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.149

0.2.85

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.148

0.2.84

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.147

0.2.83

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.146

0.2.82

New Features

• EffortLevel type export: Added a public EffortLevel type alias for Claude effort string levels ("low", "medium", "high", "max", "xhigh") and exported it from the package root, making it available for downstream SDK wrappers and type annotations (#951)

Bug Fixes

• Stderr callback isolation: Fixed an issue where a user-provided stderr callback that raises an exception would silently terminate the stderr reader loop, dropping all subsequent stderr lines for the rest of the session. Exceptions are now caught per-line so a failing callback does not prevent delivery of later lines (#932)
• CancelledError in eager-flush done callback: Fixed noisy Exception in callback log messages on shutdown when pending eager-flush tasks were cancelled. The done callback now gracefully handles CancelledError instead of unconditionally calling Task.exception() (#931)
• Tighter permission_suggestions type: Replaced list[Any] | None with list[dict[str, Any]] | None on SDKControlPermissionRequest.permission_suggestions, enabling proper type-checking on consumers of that field (#955)

Documentation

• Clarified that hooks dispatch for a given event is concurrent (all matchers fire in parallel), not sequential, preventing incorrect assumptions about ordering-dependent hooks like rate limiters gating subsequent hooks (#956)

Internal/Other Changes

• Bumped mcp dependency lower bound to >=1.23.0 to address GHSA-9h52-p55h-vw2f (CVE-2025-66416), which disables DNS rebinding protection by default in older versions (#927)

... (truncated)

Commits

• 9970096 docs: update changelog for v0.2.87
• 2237c9e chore: release v0.2.87
• a6146c2 chore: bump bundled CLI version to 2.1.150
• 3471a9f Use workload identity federation for Claude auth in CI workflows (#984)
• 095a8b3 docs: update changelog for v0.2.86
• dd06657 chore: release v0.2.86
• 1113acf chore: bump bundled CLI version to 2.1.149
• 2a3720d docs: update changelog for v0.2.85
• eee6bf4 chore: release v0.2.85
• 0bc333f chore: bump bundled CLI version to 2.1.148
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)