This release adds 7 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Affected surfaces
ReleasePort's take
Moderate signalThe release hardens cross‑session messaging by stripping user authority from relayed `SendMessage` calls; receivers now refuse permission requests and auto mode blocks them. Several critical bugs affecting image processing, remote sessions, and IDE terminal rendering have been fixed.
Why it matters: Security: cross‑session messages no longer carry user authority (severity 90). Reliability: fixes for recurring image errors, stuck remote sessions, and terminal flickering improve stability for developers, SREs, and security engineers.
Summary
AI summaryFixed recurring image processing errors, remote session hangs, terminal flickering, character input drops, CPU‑spinning background processes, voice auth checks, managed‑settings validation, git worktree crashes, transcript duplication, doctor command contradictions, and cursor behavior.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Critical |
Hardened cross‑session messaging: relayed `SendMessage` messages no longer carry user authority; receivers refuse permission requests and auto mode blocks them. Hardened cross‑session messaging: relayed `SendMessage` messages no longer carry user authority; receivers refuse permission requests and auto mode blocks them. Source: llm_adapter@2026-06-06 Confidence: high |
— |
| Feature | Low |
Added `fallbackModel` setting to configure up to three fallback models for primary model overload or unavailability; applies to interactive sessions. Added `fallbackModel` setting to configure up to three fallback models for primary model overload or unavailability; applies to interactive sessions. Source: llm_adapter@2026-06-06 Confidence: high |
— |
| Feature | Low |
Added glob pattern support in deny rules (`"*"` denies all tools); allow rules reject non-MCP globs, unknown tool names warn at startup. Added glob pattern support in deny rules (`"*"` denies all tools); allow rules reject non-MCP globs, unknown tool names warn at startup. Source: llm_adapter@2026-06-06 Confidence: high |
— |
| Feature | Low |
`MAX_THINKING_TOKENS=0`, `--thinking disabled`, and per‑model toggle now disable thinking on models that think by default via Claude API (3P providers unchanged). `MAX_THINKING_TOKENS=0`, `--thinking disabled`, and per‑model toggle now disable thinking on models that think by default via Claude API (3P providers unchanged). Source: llm_adapter@2026-06-06 Confidence: high |
— |
| Feature | Low |
Claude Code retries a turn once on the fallback model when API rejects an unexpected non‑retryable error; auth, rate‑limit, request‑size, transport errors still surface immediately. Claude Code retries a turn once on the fallback model when API rejects an unexpected non‑retryable error; auth, rate‑limit, request‑size, transport errors still surface immediately. Source: llm_adapter@2026-06-06 Confidence: high |
— |
| Feature | Low |
`claude update` now announces the target version before downloading instead of going silent. `claude update` now announces the target version before downloading instead of going silent. Source: llm_adapter@2026-06-06 Confidence: high |
— |
| Feature | Low |
In `claude agents`, typing a URL into the list now filters to the session whose first prompt contained it. In `claude agents`, typing a URL into the list now filters to the session whose first prompt contained it. Source: llm_adapter@2026-06-06 Confidence: high |
— |
| Bugfix | Medium |
Fixed recurring "image could not be processed" error and extra token usage when an unprocessable image was sent in a session. Fixed recurring "image could not be processed" error and extra token usage when an unprocessable image was sent in a session. Source: llm_adapter@2026-06-06 Confidence: high |
— |
| Bugfix | Medium |
Fixed remote sessions becoming permanently stuck after brief backend disruption during worker registration at startup. Fixed remote sessions becoming permanently stuck after brief backend disruption during worker registration at startup. Source: llm_adapter@2026-06-06 Confidence: high |
— |
| Bugfix | Medium |
Fixed flickering in JetBrains IDE terminals (IntelliJ, PyCharm, WebStorm, etc.) on 2026.1+ by enabling synchronized output. Fixed flickering in JetBrains IDE terminals (IntelliJ, PyCharm, WebStorm, etc.) on 2026.1+ by enabling synchronized output. Source: llm_adapter@2026-06-06 Confidence: high |
— |
| Bugfix | Low |
Fixed Shift+non‑ASCII characters being dropped in terminals using the Kitty keyboard protocol (WezTerm, Ghostty, kitty). Fixed Shift+non‑ASCII characters being dropped in terminals using the Kitty keyboard protocol (WezTerm, Ghostty, kitty). Source: granite4.1:30b@2026-06-06-audit Confidence: low |
— |
| Bugfix | Low |
Fixed PowerShell command validation occasionally hanging far past its time budget on Windows when a killed process's children held its output pipes. Fixed PowerShell command validation occasionally hanging far past its time budget on Windows when a killed process's children held its output pipes. Source: granite4.1:30b@2026-06-06-audit Confidence: low |
— |
| Bugfix | Low |
Fixed orphaned `claude --bg-pty-host` processes spinning at 100% CPU after the daemon dies while connected on macOS. Fixed orphaned `claude --bg-pty-host` processes spinning at 100% CPU after the daemon dies while connected on macOS. Source: granite4.1:30b@2026-06-06-audit Confidence: low |
— |
| Bugfix | Low |
Fixed voice mode requiring `/login` to clear a stale auth check after toggling `/voice`. Fixed voice mode requiring `/login` to clear a stale auth check after toggling `/voice`. Source: granite4.1:30b@2026-06-06-audit Confidence: low |
— |
| Bugfix | Low |
Fixed managed settings with an invalid entry silently disabling enforcement of remaining valid policies. Fixed managed settings with an invalid entry silently disabling enforcement of remaining valid policies. Source: granite4.1:30b@2026-06-06-audit Confidence: low |
— |
| Bugfix | Low |
Fixed `allowedMcpServers`/`deniedMcpServers` predicates not matching when they use `${VAR}` references. Fixed `allowedMcpServers`/`deniedMcpServers` predicates not matching when they use `${VAR}` references. Source: granite4.1:30b@2026-06-06-audit Confidence: low |
— |
| Bugfix | Low |
Fixed background agent sessions in a git worktree crash‑looping with "No conversation found" when reopened from `claude agents`. Fixed background agent sessions in a git worktree crash‑looping with "No conversation found" when reopened from `claude agents`. Source: granite4.1:30b@2026-06-06-audit Confidence: low |
— |
| Bugfix | Low |
Fixed duplicated thinking text in the Ctrl+O transcript view while streaming. Fixed duplicated thinking text in the Ctrl+O transcript view while streaming. Source: granite4.1:30b@2026-06-06-audit Confidence: low |
— |
| Bugfix | Low |
Fixed `/doctor` showing contradictory "Not inside a remote session" error when run inside a remote session. Fixed `/doctor` showing contradictory "Not inside a remote session" error when run inside a remote session. Source: granite4.1:30b@2026-06-06-audit Confidence: low |
— |
| Bugfix | Low |
Fixed cursor sticking at the end of the first line when typing multiline prompts in `claude agents` dispatch and reply inputs. Fixed cursor sticking at the end of the first line when typing multiline prompts in `claude agents` dispatch and reply inputs. Source: granite4.1:30b@2026-06-06-audit Confidence: low |
— |
| Bugfix | Low |
Fixed blank lines appearing between background agent rows in task list on terminals without Unicode support. Fixed blank lines appearing between background agent rows in task list on terminals without Unicode support. Source: granite4.1:30b@2026-06-06-audit Confidence: low |
— |
Full changelog
What's changed
- Added
fallbackModelsetting to configure up to three fallback models tried in order when the primary model is overloaded or unavailable;--fallback-modelnow also applies to interactive sessions - Added glob pattern support in deny rule tool-name position (
"*"denies all tools); allow rules reject non-MCP globs, and unknown tool names in deny rules warn at startup - Hardened cross-session messaging: messages relayed via
SendMessagefrom other Claude sessions no longer carry user authority — receivers refuse relayed permission requests, and auto mode blocks them MAX_THINKING_TOKENS=0,--thinking disabled, and the per-model thinking toggle now disable thinking on models that think by default via the Claude API (3P providers unchanged)- Claude Code now retries a turn once on the fallback model when the API rejects an unexpected non-retryable error; auth, rate-limit, request-size, and transport errors still surface immediately
claude updatenow announces the target version before downloading instead of going silentclaude agents: typing a URL into the list now filters to the session whose first prompt contained it- Fixed a recurring "image could not be processed" error and extra token usage when an unprocessable image was sent in a session
- Fixed remote sessions becoming permanently stuck when a brief backend disruption occurred during worker registration at startup
- Fixed flickering in JetBrains IDE terminals (IntelliJ, PyCharm, WebStorm, etc.) on 2026.1+ by enabling synchronized output
- Fixed Shift+non-ASCII characters (e.g. Shift+ä → Ä) being dropped in terminals using the Kitty keyboard protocol (WezTerm, Ghostty, kitty)
- Fixed PowerShell command validation occasionally hanging far past its time budget on Windows when a killed process's children held its output pipes
- Fixed orphaned
claude --bg-pty-hostprocesses spinning at 100% CPU after the daemon dies while connected on macOS - Fixed voice mode requiring
/loginto clear a stale auth check after toggling/voice - Fixed managed settings with an invalid entry silently disabling enforcement of their remaining valid policies
- Fixed managed-settings
allowedMcpServers/deniedMcpServerspredicates not matching when they use${VAR}references - Fixed background agent sessions that entered a git worktree crash-looping with "No conversation found" when reopened from
claude agents - Fixed duplicated thinking text in the Ctrl+O transcript view while streaming
- Fixed
/doctorshowing a contradictory failed "Not inside a remote session" check when run inside a remote session - Fixed the cursor sticking at the end of the first line when typing a multiline prompt in the
claude agentsdispatch and reply inputs - Fixed blank lines appearing between background agent rows in the task list on terminals without Unicode support
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About claude-code
All releases →Related context
Related tools
Earlier breaking changes
- v2.1.215 Claude no longer automatically runs /verify and /code-review skills
- v2.1.160 Renames dynamic‑workflow trigger keyword from `workflow` to `ultracode`; `workflow` no longer triggers a run
- v2.1.160 Deprecates and removes the `CLAUDE_CODE_OPUS_4_6_FAST_MODE_OVERRIDE` environment variable; it is now a no‑op
- v2.1.147 Renames /simplify to /code-review; removes cleanup-and-fix behavior.
Beta — feedback welcome: [email protected]