This release includes 1 security fix for security teams reviewing exposed deployments.
Published 27d
Developer Productivity
✓ No known CVEs patched
This release patches 1 known CVE
Affected surfaces
auth
breaking_upgrade
Summary
AI summaryOrganization default models can now be set by admins and clickable file attachments added to chat.
Full changelog
What's changed
- Added support for organization default models — admins set it in the org console; it shows as "Org default" (or "Role default") in
/modelwhen you haven't picked one yourself - Added readable default names for sessions at start, making them easier to identify and message
- Added clickable file attachments in chat — Cmd/Ctrl-click reveals the file in Finder/Explorer
- Security:
claude mcp list/getno longer spawn.mcp.jsonservers that a repo self-approved via a committed.claude/settings.json; untrusted workspaces show⏸ Pending approval - Fixed waking a background job permanently deleting its conversation and re-running the original prompt when the transcript probe misread a real transcript; the file is now set aside, never deleted
- Fixed the rate-limit warning flickering off and rate-limit telemetry being over-counted when multiple parallel requests were in flight at the moment a usage limit was hit
- Fixed duplicate recap lines after a background session's turn: a schema-rejected StructuredOutput attempt no longer renders alongside its retry
- Fixed PowerShell
git diff/git grep,egrep/fgrep, and quoted search patterns containing|being reported as failures when they exit 1, matching Bash behavior - Fixed multiple
claude agentsside panel issues: keyboard focus getting stuck when opening an agent, background jobs losing their subagent types on every open, and sessions showing incorrect status while actively running - Fixed
claude agents --dangerously-skip-permissionssilently falling back to auto mode instead of showing the bypass disclaimer and applying bypass mode to spawned agents - Fixed mid-turn crash recovery for Remote sessions — sessions interrupted by a server restart now auto-resume on the next worker
- Fixed sessions moved with
/cdreappearing in the old directory's resume list after a non-graceful exit when the old path contained special characters - Fixed
claude plugin validateskipping local plugins whose source is "." and stopping after the first error class - Fixed Esc Esc at an idle prompt not opening the rewind menu (regression); use Ctrl+C or Ctrl+X Ctrl+K to stop background agents
- Fixed MCP OAuth requesting the authorization server's full
scopes_supportedcatalog when no scope is specified, causinginvalid_scopefailures on GitLab self-hosted and other enterprise IdPs - Fixed
/contextshowing 0 tokens for all tool groups on Bedrock - Fixed
/deep-researchmisreporting verifier failures as "all claims refuted" instead ofunverified - Fixed plugin dependency version pins not being honored when the marketplace was added as a local folder path backed by a git repo
- Fixed
claude agentssession status: completed rows no longer flip between "Done" and "Needs your input", stalled agents are now labeled "Needs attention", and results that mention a PR show a clickable link - Fixed voice dictation swallowing spaces and spuriously starting a recording during very fast typing when voice mode is enabled
- Improved background session reliability: long-running commands and workflows now survive the session's process being stopped, restarted, or updated — including on Windows, where background shells are handed off instead of being killed
- Improved background agents: workers killed by a daemon restart are now automatically resumed from where they left off the next time the agents view opens
- Improved
/code-reviewworkflow: merged five cleanup finders into one, cutting token usage by roughly 25% - Reduced per-frame rendering work in the terminal UI by skipping no-op subtree walks during streaming
- The streaming idle watchdog is now on by default for all providers — it aborts and retries when a response stream produces no events for 5 minutes. Set
CLAUDE_ENABLE_STREAM_WATCHDOG=0to disable. - Remote Control is now disabled when
ANTHROPIC_BASE_URLpoints at a non-Anthropic host, matching the existing behavior underCLAUDE_CODE_USE_BEDROCK/_VERTEX/_FOUNDRY - Changed opening the agents view from a foreground session to require a single
←press instead of two, matching the behavior in background sessions
Security Fixes
- claude mcp list/get no longer spawns .mcp.json servers from untrusted committed .claude/settings.json; such workspaces show ⏸ Pending approval.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About claude-code
All releases →Related context
Earlier breaking changes
- v2.1.215 Claude no longer automatically runs /verify and /code-review skills
- v2.1.160 Renames dynamic‑workflow trigger keyword from `workflow` to `ultracode`; `workflow` no longer triggers a run
- v2.1.160 Deprecates and removes the `CLAUDE_CODE_OPUS_4_6_FAST_MODE_OVERRIDE` environment variable; it is now a no‑op
- v2.1.147 Renames /simplify to /code-review; removes cleanup-and-fix behavior.
Beta — feedback welcome: [email protected]