New Claude API SDK Major Versions: What Breaks, How to Pin, and the Switch to Apache 2.0

Every Claude API SDK got a new major version on October 21, 2026, and each one now sends a new API version, 2026-10-21, by default, according to Anthropic’s API release notes. The new releases also change the SDK license from MIT to Apache 2.0.

For agencies, the risk is an upgrade nobody planned. A client site with a loose version rule or an auto-merge bot can pull in a release that changes how requests are built and authenticated. This post covers what Anthropic released, what breaks in the API and in the SDK code, how long the old API version works, the PHP SDK in WordPress and Drupal, how to pin, and what the license change means.

Nothing breaks until you upgrade. Per Anthropic’s migration guide, older SDK versions keep sending API version 2023-06-01, and as of October 22, 2026, Anthropic has published no end date for it. The upgrade itself removes temperature, top_p and top_k, changes the auth header to Authorization: Bearer, and allows one credential per client. Pin your current major version now, then upgrade on purpose.

What Anthropic released on October 21

Anthropic’s platform release notes list these as the first versions that send 2026-10-21. The package details come from the migration guide and Anthropic’s SDK pages. By October 22, the SDK overview page listed a follow-up minor release for each, such as Python 2.1.0.

The SDK overview page explains the pattern: "Each major version of a client SDK sends one API version by default, and a new major version comes with each new API version." The Python 3.10 rule is on Anthropic’s Python SDK page. The last PHP 0.x tag, 0.61.0, is on the PHP SDK’s GitHub repo.

The same day, Anthropic added enforcement_status and enforcement_actions fields to user profiles, which launched on October 20. If you route several clients through one Claude organization, a profile tells you when Anthropic has restricted or banned one end customer.

What breaks in API version 2026-10-21

The migration guide lists three Messages API changes. Each returns a 400 error:

• Sampling parameters are gone. Sending `temperature`, `top_p` or `top_k` fails, even at the default value. Claude 4.7 and later already accepted only defaults, so they sample as before. On older models such as Sonnet 4.6, lower temperature has no replacement.
• No documents in assistant messages. Send `document` blocks in `user` messages.
• No citations on user text. Remove `citations` from `text` blocks in `user` messages.

The Admin API and Enterprise Analytics API also rename fields. For example, API keys return scope instead of workspace_id, and per-user reports use actor.email_address. If you built a client usage dashboard on the Admin API, check it.

The sampling change is the one most CMS integrations will hit. Many WordPress AI plugins and scripts still send a low temperature for steadier output. We flagged the same rule for one model in our Claude Sonnet 5.5 post. It now applies to every model on the new version.

What breaks in the Claude API SDK code

Some Claude API SDK changes do not depend on the API version at all. They change how you write code. The migration guide lists them by language.

One type per message role. MessageParam is now a union of UserMessageParam, AssistantMessageParam and SystemMessageParam. Messages written as plain dicts or arrays need no change. Code that builds the class directly does. The new system type matches the pattern in our post on mid-conversation system messages.

A new auth header. The SDKs send your API key as Authorization: Bearer instead of X-Api-Key. The Claude API accepts either. A proxy or gateway that reads X-Api-Key will not, unless you add the old header back with middleware.

One credential per client. Passing both an API key and an auth token is now an error. With none passed, the SDK reads ANTHROPIC_API_KEY first, then ANTHROPIC_AUTH_TOKEN, then profile and workload identity settings.

Removed features. Text Completions is gone from the TypeScript, Go, Java and Ruby SDKs and the CLI. The betas option moves off the regular Models methods to client.beta.models. TypeScript and Ruby lose client-side compaction in the tool runner; use server-side compaction instead.

Language details. Go needs Go 1.25 and the /v2 import path. Java getters such as apiKey() now return an Optional. The C#, Go, Java, PHP and Ruby SDKs turn one-value enums into constants.

Does the old API version keep working?

Yes, as of October 22, 2026. Anthropic’s API versioning page still lists 2023-06-01 and 2023-01-01 with no deprecation or retirement date. The migration guide says requests that rely on non-default sampling can stay on 2023-06-01.

Earlier SDK versions send 2023-06-01 with every request. So a site that stays on an older Claude API SDK, such as Python 1.x or PHP 0.x, keeps working as it did. We did not find a statement on how long Anthropic will keep fixing the older SDK lines.

The migration guide notes one exception. On Amazon Bedrock, 2026-10-21 works only with Claude 4.7 and later. If a client calls an older model through Bedrock, keep the current SDK version until that model is replaced.

The PHP SDK in WordPress and Drupal

The PHP SDK moved from 0.61.0 to 1.0.0. Composer’s version docs say ^0.3 means >=0.3.0 <0.4.0, so a caret rule on 0.x already blocks 1.0. Anthropic’s migration guide says the same: composer update alone stays within your constraint. You need composer require to move.

When you do move, the guide’s PHP notes point to four things to check in plugin or module code:

• Argument order. `MessageParam::with()` now takes `role` first. A positional call in the old order throws `UnhandledMatchError`, and PHPStan does not warn about it.
• Type hints. `instanceof MessageParam` is now false. Name the three role classes instead.
• Enum comparisons. Properties you set with an enum case are read back as the string value. A strict comparison to the case quietly turns false.
• Log noise. If both `ANTHROPIC_API_KEY` and `ANTHROPIC_AUTH_TOKEN` are set, the client writes a warning with `error_log()`. On a web server, that is once per request. Unset the one you do not use.

The PHP SDK page still asks for PHP 8.1 or later and recommends Guzzle for streaming. If a client site also sends traces, our Claude OpenTelemetry post covers the SDK side.

How to pin a Claude API SDK so bots do not upgrade client sites

Pin the Claude API SDK major version you run today. Each line below allows bug fixes and blocks the new major version.

# requirements.txt (Python)
anthropic~=1.17

// composer.json (PHP)
"anthropic-ai/sdk": "^0.61"

// package.json (TypeScript, if you run 0.x)
"@anthropic-ai/sdk": "<1.0.0"

In Python, ~=1.17 means >=1.17, ==1.*, per the version specifier spec. A bare anthropic line with no version gets 2.x on the next install. In npm, a caret on 0.x such as ^0.2.3 already stops below 0.3.0, per npm’s semver docs. Commit your lock file either way.

Then tell the bots. Dependabot’s options reference supports ignore with update-types:

ignore:
  - dependency-name: "anthropic-ai/sdk"
    update-types: ["version-update:semver-major"]

Renovate’s Dependency Dashboard docs show how to require approval before a major update opens a pull request:

{ "major": { "dependencyDashboardApproval": true } }

Pinned versions are not a security fix on their own. Our Plugin4Shell post shows how a pin can fail. Treat the pin as a pause, and plan the upgrade.

Apache 2.0 vs MIT: what changes in practice

Starting with these releases, each Claude API SDK and the CLI use the Apache License 2.0, according to the migration guide. Earlier versions remain MIT. Anthropic says no code changes are needed, but you should update your dependency license records.

These facts come from the license texts. They are not legal advice:

• Notices. The MIT License asks you to keep the copyright and permission notice. Apache 2.0 asks you to include a copy of the license, keep existing notices, mark files you changed, and carry a NOTICE file’s contents if the package has one.
• Patents. Apache 2.0 includes an explicit patent license from contributors. It ends for anyone who sues claiming the work infringes a patent.
• Trademarks. Apache 2.0 grants no trademark rights.
• GPL. The Apache Software Foundation’s compatibility page says the FSF considers Apache 2.0 compatible with GPLv3 but not GPLv2.

The GPL point affects WordPress plugins. The plugin directory guidelines require bundled third-party libraries to be GPL-compatible. If you ship a plugin with the SDK in a vendor folder, raise it with whoever handles your licensing.

How OpenAI and Google version their SDKs

Anthropic now ties one API version to each SDK major version. OpenAI’s API reference says its REST API is "currently v1" and that its "released libraries adhere to semantic versioning." The README for OpenAI’s Python library adds that some backward-incompatible changes can ship in minor versions. It shows an API version setting only for Azure OpenAI. Google versions the Gemini API by path: v1 is stable and v1beta carries early features. Google’s API versions page says the Gemini API SDKs default to v1beta. At both vendors, the dated shutdowns tend to hit models and endpoints more than SDKs, as in our posts on the OpenAI Assistants API shutdown and Gemini shutdown dates this fall.

A Claude API SDK migration checklist

1. Inventory. List every client site, plugin and script with a Claude API SDK, and note the version and API version it sends.
2. Pin. Lock each one to its current major version and set Dependabot or Renovate to hold major updates.
3. Remove sampling parameters. Search for `temperature`, `top_p` and `top_k`.
4. Move documents and citations. Check assistant messages for `document` blocks and user text for `citations`.
5. Check auth. Pass one credential per client. Fix any proxy that reads `X-Api-Key`.
6. Update typed code. Replace direct `MessageParam` use with the role classes, and fix positional PHP calls.
7. Check Bedrock models. Keep calls to pre-4.7 models on the old SDK.
8. Update license records to Apache 2.0.
9. Test against 2026-10-21, then upgrade the SDK and code fixes together.

Frequently Asked Questions