Skip to content

claude-code

v2.1.196 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Affected surfaces

auth breaking_upgrade

Summary

AI summary

Organization default models can now be set by admins and clickable file attachments added to chat.

Full changelog

What's changed

  • Added support for organization default models — admins set it in the org console; it shows as "Org default" (or "Role default") in /model when you haven't picked one yourself
  • Added readable default names for sessions at start, making them easier to identify and message
  • Added clickable file attachments in chat — Cmd/Ctrl-click reveals the file in Finder/Explorer
  • Security: claude mcp list/get no longer spawn .mcp.json servers that a repo self-approved via a committed .claude/settings.json; untrusted workspaces show ⏸ Pending approval
  • Fixed waking a background job permanently deleting its conversation and re-running the original prompt when the transcript probe misread a real transcript; the file is now set aside, never deleted
  • Fixed the rate-limit warning flickering off and rate-limit telemetry being over-counted when multiple parallel requests were in flight at the moment a usage limit was hit
  • Fixed duplicate recap lines after a background session's turn: a schema-rejected StructuredOutput attempt no longer renders alongside its retry
  • Fixed PowerShell git diff/git grep, egrep/fgrep, and quoted search patterns containing | being reported as failures when they exit 1, matching Bash behavior
  • Fixed multiple claude agents side panel issues: keyboard focus getting stuck when opening an agent, background jobs losing their subagent types on every open, and sessions showing incorrect status while actively running
  • Fixed claude agents --dangerously-skip-permissions silently falling back to auto mode instead of showing the bypass disclaimer and applying bypass mode to spawned agents
  • Fixed mid-turn crash recovery for Remote sessions — sessions interrupted by a server restart now auto-resume on the next worker
  • Fixed sessions moved with /cd reappearing in the old directory's resume list after a non-graceful exit when the old path contained special characters
  • Fixed claude plugin validate skipping local plugins whose source is "." and stopping after the first error class
  • Fixed Esc Esc at an idle prompt not opening the rewind menu (regression); use Ctrl+C or Ctrl+X Ctrl+K to stop background agents
  • Fixed MCP OAuth requesting the authorization server's full scopes_supported catalog when no scope is specified, causing invalid_scope failures on GitLab self-hosted and other enterprise IdPs
  • Fixed /context showing 0 tokens for all tool groups on Bedrock
  • Fixed /deep-research misreporting verifier failures as "all claims refuted" instead of unverified
  • Fixed plugin dependency version pins not being honored when the marketplace was added as a local folder path backed by a git repo
  • Fixed claude agents session status: completed rows no longer flip between "Done" and "Needs your input", stalled agents are now labeled "Needs attention", and results that mention a PR show a clickable link
  • Fixed voice dictation swallowing spaces and spuriously starting a recording during very fast typing when voice mode is enabled
  • Improved background session reliability: long-running commands and workflows now survive the session's process being stopped, restarted, or updated — including on Windows, where background shells are handed off instead of being killed
  • Improved background agents: workers killed by a daemon restart are now automatically resumed from where they left off the next time the agents view opens
  • Improved /code-review workflow: merged five cleanup finders into one, cutting token usage by roughly 25%
  • Reduced per-frame rendering work in the terminal UI by skipping no-op subtree walks during streaming
  • The streaming idle watchdog is now on by default for all providers — it aborts and retries when a response stream produces no events for 5 minutes. Set CLAUDE_ENABLE_STREAM_WATCHDOG=0 to disable.
  • Remote Control is now disabled when ANTHROPIC_BASE_URL points at a non-Anthropic host, matching the existing behavior under CLAUDE_CODE_USE_BEDROCK/_VERTEX/_FOUNDRY
  • Changed opening the agents view from a foreground session to require a single press instead of two, matching the behavior in background sessions

Security Fixes

  • claude mcp list/get no longer spawns .mcp.json servers from untrusted committed .claude/settings.json; such workspaces show ⏸ Pending approval.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track claude-code

Get notified when new releases ship.

Sign up free

About claude-code

All releases →

Related context

Earlier breaking changes

  • v2.1.215 Claude no longer automatically runs /verify and /code-review skills
  • v2.1.160 Renames dynamic‑workflow trigger keyword from `workflow` to `ultracode`; `workflow` no longer triggers a run
  • v2.1.160 Deprecates and removes the `CLAUDE_CODE_OPUS_4_6_FAST_MODE_OVERRIDE` environment variable; it is now a no‑op
  • v2.1.147 Renames /simplify to /code-review; removes cleanup-and-fix behavior.

Beta — feedback welcome: [email protected]