This release includes breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
ReleasePort's take
Moderate signalSessions that previously became permanently stuck when using a 1 million‑token context without credits will now automatically compact and resume under the standard limit.
Why it matters: Fixes critical session deadlock for contexts exceeding 1M tokens, restoring reliability for high‑volume workloads.
Summary
AI summarySessions stuck with 1M context now auto‑compact back under limits.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Critical |
Fixed background agents potentially reading another directory's `.mcp.json` approvals and trust settings Fixed background agents potentially reading another directory's `.mcp.json` approvals and trust settings Source: llm_adapter@2026-06-10 Confidence: high |
— |
| Feature | Low |
Sub-agents can now spawn their own sub-agents up to 5 levels deep Sub-agents can now spawn their own sub-agents up to 5 levels deep Source: llm_adapter@2026-06-10 Confidence: high |
— |
| Feature | Low |
Amazon Bedrock reads AWS region from `~/.aws` config when `AWS_REGION` unset, shown in `/status` Amazon Bedrock reads AWS region from `~/.aws` config when `AWS_REGION` unset, shown in `/status` Source: llm_adapter@2026-06-10 Confidence: high |
— |
| Feature | Low |
Added search bar for browsing marketplace plugins in `/plugin` Added search bar for browsing marketplace plugins in `/plugin` Source: llm_adapter@2026-06-10 Confidence: high |
— |
| Feature | Low |
Added `model` attribute to `claude_code.lines_of_code.count` OTEL metric Added `model` attribute to `claude_code.lines_of_code.count` OTEL metric Source: llm_adapter@2026-06-10 Confidence: high |
— |
| Feature | Low |
Disabled mouse tracking on Windows consoles lacking full support Disabled mouse tracking on Windows consoles lacking full support Source: granite4.1:30b@2026-06-10-audit Confidence: low |
— |
| Feature | Low |
Enhanced non‑interactive Usage Policy refusal message to suggest starting a new session or changing the model Enhanced non‑interactive Usage Policy refusal message to suggest starting a new session or changing the model Source: granite4.1:30b@2026-06-10-audit Confidence: low |
— |
| Feature | Low |
Keeps `ultra` option visible in `/code-review` for users not signed into claude.ai, with explanatory note about cloud review requirements Keeps `ultra` option visible in `/code-review` for users not signed into claude.ai, with explanatory note about cloud review requirements Source: granite4.1:30b@2026-06-10-audit Confidence: low |
— |
| Feature | Low |
Shortened Remote Control footer indicator to "/rc active" and hid it on narrow terminals Shortened Remote Control footer indicator to "/rc active" and hid it on narrow terminals Source: granite4.1:30b@2026-06-10-audit Confidence: low |
— |
| Feature | Low |
Stopped promoting `/loop` in remote sessions where pending loops don't keep the container alive Stopped promoting `/loop` in remote sessions where pending loops don't keep the container alive Source: granite4.1:30b@2026-06-10-audit Confidence: low |
— |
| Performance | Low |
Improved long‑conversation performance by removing redundant message normalization and avoiding full history transforms when streaming state unchanged Improved long‑conversation performance by removing redundant message normalization and avoiding full history transforms when streaming state unchanged Source: llm_adapter@2026-06-10 Confidence: high |
— |
| Performance | Low |
Reduced idle CPU usage: `/goal` status chip no longer re‑renders at 5 Hz while idle; fewer UI re‑renders with parallel subagents Reduced idle CPU usage: `/goal` status chip no longer re‑renders at 5 Hz while idle; fewer UI re‑renders with parallel subagents Source: granite4.1:30b@2026-06-10-audit Confidence: low |
— |
| Performance | Low |
Improved Claude in Chrome tool loading by batching browser tool calls into a single request instead of per‑tool Improved Claude in Chrome tool loading by batching browser tool calls into a single request instead of per‑tool Source: granite4.1:30b@2026-06-10-audit Confidence: low |
— |
| Bugfix | Medium |
Sessions using 1M context without credits no longer get permanently stuck; they auto‑compact under the standard limit Sessions using 1M context without credits no longer get permanently stuck; they auto‑compact under the standard limit Source: llm_adapter@2026-06-10 Confidence: high |
— |
| Bugfix | Medium |
Fixed repeating "image could not be processed" error when conversation contains multiple images Fixed repeating "image could not be processed" error when conversation contains multiple images Source: llm_adapter@2026-06-10 Confidence: high |
— |
| Bugfix | Medium |
Fixed agents view spinner persisting up to 30 seconds after worker reply Fixed agents view spinner persisting up to 30 seconds after worker reply Source: llm_adapter@2026-06-10 Confidence: high |
— |
| Bugfix | Medium |
Fixed background‑session attach failing with EAUTH after daemon auto‑update Fixed background‑session attach failing with EAUTH after daemon auto‑update Source: llm_adapter@2026-06-10 Confidence: high |
— |
| Bugfix | Low |
Fixed background sub-agent staying stuck as "active" after its nested agent stops Fixed background sub-agent staying stuck as "active" after its nested agent stops Source: granite4.1:30b@2026-06-10-audit Confidence: low |
— |
| Bugfix | Low |
Fixed `/model` suggestions in `claude agents` dispatch input rendering with misleading slash prefix and showing disabled models Fixed `/model` suggestions in `claude agents` dispatch input rendering with misleading slash prefix and showing disabled models Source: granite4.1:30b@2026-06-10-audit Confidence: low |
— |
| Bugfix | Low |
Fixed `availableModels` restrictions not applied to subagent model overrides, agent dispatch picker, and advisor model Fixed `availableModels` restrictions not applied to subagent model overrides, agent dispatch picker, and advisor model Source: granite4.1:30b@2026-06-10-audit Confidence: low |
— |
| Bugfix | Low |
Fixed `availableModels` allowlists hiding Opus and Sonnet 1M rows when using version‑specific IDs like `claude-opus-4-8` Fixed `availableModels` allowlists hiding Opus and Sonnet 1M rows when using version‑specific IDs like `claude-opus-4-8` Source: granite4.1:30b@2026-06-10-audit Confidence: low |
— |
| Bugfix | Low |
Fixed `/model` picker on Bedrock offering unavailable models; selection now correctly marks the chosen row Fixed `/model` picker on Bedrock offering unavailable models; selection now correctly marks the chosen row Source: granite4.1:30b@2026-06-10-audit Confidence: low |
— |
| Bugfix | Low |
Fixed model IDs receiving duplicated 1M-context suffix (e.g., `[1M][1m]`) when `ANTHROPIC_DEFAULT_OPUS_MODEL` already includes one Fixed model IDs receiving duplicated 1M-context suffix (e.g., `[1M][1m]`) when `ANTHROPIC_DEFAULT_OPUS_MODEL` already includes one Source: granite4.1:30b@2026-06-10-audit Confidence: low |
— |
| Bugfix | Low |
Fixed `opusplan` model not shipping with 1M context in plan mode for entitled users; `opusplan[1m]` workaround now switches to Opus correctly Fixed `opusplan` model not shipping with 1M context in plan mode for entitled users; `opusplan[1m]` workaround now switches to Opus correctly Source: granite4.1:30b@2026-06-10-audit Confidence: low |
— |
| Bugfix | Low |
Fixed `WebFetch(domain:*.example.com)` wildcard domain rules never matching subdomains and mid‑pattern file permission wildcards being rejected at startup Fixed `WebFetch(domain:*.example.com)` wildcard domain rules never matching subdomains and mid‑pattern file permission wildcards being rejected at startup Source: granite4.1:30b@2026-06-10-audit Confidence: low |
— |
| Bugfix | Low |
Fixed up‑arrow prompt history showing main agent's prompts while a subagent's chat tab is open Fixed up‑arrow prompt history showing main agent's prompts while a subagent's chat tab is open Source: granite4.1:30b@2026-06-10-audit Confidence: low |
— |
| Bugfix | Low |
Fixed memory recall not finding mounted team memory stores (`CLAUDE_MEMORY_STORES`) in remote sessions Fixed memory recall not finding mounted team memory stores (`CLAUDE_MEMORY_STORES`) in remote sessions Source: granite4.1:30b@2026-06-10-audit Confidence: low |
— |
| Bugfix | Low |
Fixed workflow validation rejecting scripts that merely mention `Date.now()` or `Math.random()` in prompts or comments Fixed workflow validation rejecting scripts that merely mention `Date.now()` or `Math.random()` in prompts or comments Source: granite4.1:30b@2026-06-10-audit Confidence: low |
— |
| Bugfix | Low |
Fixed `/plugin` marketplace list losing cursor after backing out and Esc returning to wrong tab Fixed `/plugin` marketplace list losing cursor after backing out and Esc returning to wrong tab Source: granite4.1:30b@2026-06-10-audit Confidence: low |
— |
| Bugfix | Low |
Fixed PowerShell tool calls in VSCode rendering as raw JSON instead of proper command display and permission dialog, and stripped ANSI escape codes from shell output Fixed PowerShell tool calls in VSCode rendering as raw JSON instead of proper command display and permission dialog, and stripped ANSI escape codes from shell output Source: granite4.1:30b@2026-06-10-audit Confidence: low |
— |
Full changelog
What's changed
- Sub-agents can now spawn their own sub-agents (up to 5 levels deep)
- Amazon Bedrock now reads the AWS region from
~/.awsconfig files whenAWS_REGIONisn't set, matching AWS SDK precedence;/statusshows where the region came from - Added a search bar when browsing a marketplace's plugins in
/plugin - Added
modelattribute to theclaude_code.lines_of_code.countOTEL metric - Fixed sessions using 1M context without usage credits getting permanently stuck — the session now automatically compacts back under the standard context limit
- Fixed a repeating "an image in the conversation could not be processed and was removed" error when the conversation contained multiple images
- Fixed the agents view keeping a session under Working with a busy spinner for up to 30 seconds after the worker replied
- Fixed background agents potentially reading another directory's project settings (
.mcp.jsonapprovals, trust) when dispatched onto a pre-warmed worker - Fixed background-session attach failing with EAUTH for sessions started on an older version after the daemon auto-updated
- Fixed a background sub-agent staying stuck as "active" in the agent panel after a nested agent it spawned was stopped
- Fixed
/modelsuggestions in theclaude agentsdispatch input rendering with a misleading slash prefix and showing models disabled for your org - Fixed
availableModelsrestrictions not being applied to subagent model overrides, the agent dispatch model picker, and the advisor model - Fixed
availableModelsallowlists hiding the/modelpicker's Opus and Sonnet 1M rows when entries use version-specific IDs likeclaude-opus-4-8 - Fixed the
/modelpicker on Bedrock offering models the provider doesn't serve — selecting one silently switched the session model and lit the selection marker on multiple rows - Fixed model IDs getting a doubled 1M-context suffix (e.g.
[1M][1m]) whenANTHROPIC_DEFAULT_OPUS_MODELalready includes one - Fixed
opusplanmodel setting not shipping with 1M context in plan mode for entitled users; theopusplan[1m]workaround now also correctly switches to Opus in plan mode - Fixed
WebFetch(domain:*.example.com)wildcard domain rules never matching subdomains in allow, deny, and ask position, and file permission rules with mid-pattern wildcards (e.g.Read(secrets-*/config.json)) being rejected at startup - Fixed up-arrow prompt history showing the main agent's prompts while a subagent's chat tab is open
- Fixed memory recall not finding mounted team memory stores (
CLAUDE_MEMORY_STORES) in remote sessions - Fixed workflow validation rejecting scripts whose prompt strings or comments merely mention
Date.now()/Math.random() - Disable mouse tracking on Windows consoles that don't fully support it
- Fixed the
/pluginmarketplace list losing its cursor after backing out of a long plugin list, and Esc from the plugin browser returning to the wrong tab - Improved performance in long conversations by removing redundant message normalization and avoiding full message-history transforms when streaming tool-use state is unchanged
- Reduced idle CPU usage:
/goalstatus chip no longer re-renders the terminal at 5 Hz while idle, and fewer UI re-renders while subagents run in parallel - Improved Claude in Chrome tool loading: browser tools now load in a single batched call instead of one per tool
- Improved the non-interactive Usage Policy refusal message to suggest starting a new session or changing your model
/code-reviewnow keeps theultraoption visible when you're not signed in to claude.ai, with an explanation that the cloud review requires a claude.ai account- Shortened the Remote Control footer indicator to "/rc active" and hid it on narrow terminals
- Stopped promoting
/loopin remote sessions, where pending loops don't keep the container alive - [VSCode] Fixed PowerShell tool calls rendering as raw JSON instead of a proper command display and permission dialog, and stripped ANSI escape codes from displayed shell output
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About claude-code
All releases →Related context
Earlier breaking changes
- v2.1.215 Claude no longer automatically runs /verify and /code-review skills
- v2.1.160 Renames dynamic‑workflow trigger keyword from `workflow` to `ultracode`; `workflow` no longer triggers a run
- v2.1.160 Deprecates and removes the `CLAUDE_CODE_OPUS_4_6_FAST_MODE_OVERRIDE` environment variable; it is now a no‑op
- v2.1.147 Renames /simplify to /code-review; removes cleanup-and-fix behavior.
Beta — feedback welcome: [email protected]