This release includes 1 security fix for security teams reviewing exposed deployments.
Affected surfaces
ReleasePort's take
Moderate signalAuto mode is now enabled by default on Bedrock, Vertex AI, and Foundry; users can disable it via `disableAutoMode` in settings.
Why it matters: Defaulting auto‑mode to ON simplifies setup for developers and SREs while still allowing opt‑out through configuration (severity 20).
Summary
AI summaryFixed terminal freezing on long streaming responses and remote managed settings consent bug.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Critical |
Fixed remote managed settings being permanently recorded as consented without showing security dialog Fixed remote managed settings being permanently recorded as consented without showing security dialog Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Security | High |
Rejected `${user_config.*}` in plugin shell‑form commands to prevent shell injection; use exec form or env variables Rejected `${user_config.*}` in plugin shell‑form commands to prevent shell injection; use exec form or env variables Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Security | Medium |
Fixed `/usage-credits` amount inputs silently stripping malformed values; now rejects them with error and requires confirmation for amounts over $1,000 Fixed `/usage-credits` amount inputs silently stripping malformed values; now rejects them with error and requires confirmation for amounts over $1,000 Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Feature | Low |
Auto mode is now available without `CLAUDE_CODE_ENABLE_AUTO_MODE` opt-in on Bedrock, Vertex AI, and Foundry; disable via `disableAutoMode` in settings Auto mode is now available without `CLAUDE_CODE_ENABLE_AUTO_MODE` opt-in on Bedrock, Vertex AI, and Foundry; disable via `disableAutoMode` in settings Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Low |
Improved agent view: pasting same text expands collapsed `[Pasted text #N]` placeholder instead of adding a second one Improved agent view: pasting same text expands collapsed `[Pasted text #N]` placeholder instead of adding a second one Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Feature | Low |
Improved agent view: blocked session peeks lead with the question and show staleness clock (`waiting 3m`) instead of duplicate timestamps Improved agent view: blocked session peeks lead with the question and show staleness clock (`waiting 3m`) instead of duplicate timestamps Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Feature | Low |
Changed Bedrock, Vertex, and Claude Platform on AWS to default to Claude Opus 4.8 Changed Bedrock, Vertex, and Claude Platform on AWS to default to Claude Opus 4.8 Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Bugfix | Medium |
Fixed terminal freezing and keystrokes lagging while streaming long responses Fixed terminal freezing and keystrokes lagging while streaming long responses Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Medium |
Fixed spurious prompt‑injection warnings triggered by benign system updates Fixed spurious prompt‑injection warnings triggered by benign system updates Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Medium |
Fixed auto‑updater overwriting custom launcher script at `~/.local/bin/claude` on each release; `/doctor` reports externally managed launcher Fixed auto‑updater overwriting custom launcher script at `~/.local/bin/claude` on each release; `/doctor` reports externally managed launcher Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Medium |
Fixed compound commands with `cd` prompting for permission when output redirected to `/dev/null` Fixed compound commands with `cd` prompting for permission when output redirected to `/dev/null` Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Medium |
Fixed transcript jumping above answer start when response finishes streaming Fixed transcript jumping above answer start when response finishes streaming Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Medium |
Fixed `extensions.worktreeConfig` left in repo's `.git/config` after last worktree removal, breaking go‑git tools like `tea` Fixed `extensions.worktreeConfig` left in repo's `.git/config` after last worktree removal, breaking go‑git tools like `tea` Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Medium |
Fixed malformed bracket patterns in rules globs, skill paths, `.ignore`, and `.worktreeinclude` breaking file reads and worktree creation Fixed malformed bracket patterns in rules globs, skill paths, `.ignore`, and `.worktreeinclude` breaking file reads and worktree creation Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Medium |
Fixed crash loop in agent teams caused by malformed teammate mailbox message Fixed crash loop in agent teams caused by malformed teammate mailbox message Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Low |
Fixed background sessions auto‑named by accepting a plan not showing that name on their agent‑view row Fixed background sessions auto‑named by accepting a plan not showing that name on their agent‑view row Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Bugfix | Low |
Fixed background sessions resuming blank after cold reopen from the agent list when in a git worktree Fixed background sessions resuming blank after cold reopen from the agent list when in a git worktree Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Bugfix | Low |
Fixed Remote Control task status updates being lost on connection recovery Fixed Remote Control task status updates being lost on connection recovery Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Bugfix | Low |
Fixed Remote Control sessions not showing background agent and workflow progress on mobile and web Fixed Remote Control sessions not showing background agent and workflow progress on mobile and web Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Bugfix | Low |
Fixed Deep research runs labeling every Fetch‑phase agent "unknown" — chips now show source hostname Fixed Deep research runs labeling every Fetch‑phase agent "unknown" — chips now show source hostname Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Bugfix | Low |
Fixed Bedrock repeatedly requesting fresh AWS SSO credentials on every API request Fixed Bedrock repeatedly requesting fresh AWS SSO credentials on every API request Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Bugfix | Low |
Fixed indefinite hang on Windows when AWS credential resolution stalls; 60‑second stall guard now fires Fixed indefinite hang on Windows when AWS credential resolution stalls; 60‑second stall guard now fires Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Refactor | Low |
Auto mode no longer reads `autoMode` from repo‑resident `.claude/settings.local.json`; uses `~/.claude/settings.json` instead Auto mode no longer reads `autoMode` from repo‑resident `.claude/settings.local.json`; uses `~/.claude/settings.json` instead Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Refactor | Low |
Plugin option values (`pluginConfigs`) are no longer read from project‑level `.claude/settings.json`; only user, `--settings`, and managed settings are honored Plugin option values (`pluginConfigs`) are no longer read from project‑level `.claude/settings.json`; only user, `--settings`, and managed settings are honored Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
Full changelog
What's changed
- Auto mode is now available without
CLAUDE_CODE_ENABLE_AUTO_MODEopt-in on Bedrock, Vertex AI, and Foundry; disable viadisableAutoModein settings - Fixed the terminal freezing and keystrokes lagging while streaming responses containing very long lists, tables, paragraphs, or code blocks
- Fixed remote managed settings from a non-interactive run (
claude -p, the SDK) being permanently recorded as consented without ever showing the security consent dialog - Fixed spurious prompt-injection warnings triggered by benign system-generated conversation updates
- Fixed the auto-updater overwriting a custom launcher script or symlink at
~/.local/bin/claudeon every release;/doctornow reports an externally managed launcher - Fixed compound commands with
cdprompting for permission when the only output redirect was to/dev/null - Fixed the transcript jumping above the start of the answer when a response finishes streaming
- Fixed
extensions.worktreeConfigbeing left in the repo's.git/config(breaking go-git tools liketea) after the lastworktree.sparsePathsworktree was removed - Fixed malformed bracket patterns in rules globs, skill paths,
.ignore, and.worktreeincludebreaking file reads, file suggestions, and worktree creation - Fixed a crash loop in agent teams where a malformed teammate mailbox message caused repeated errors every second until the mailbox file was manually deleted
- Fixed background sessions auto-named by accepting a plan not showing that name on their agent-view row
- Fixed background sessions that entered a git worktree resuming blank after a cold reopen from the agent list
- Fixed Remote Control task status updates being lost when the connection recovered from a network interruption or credential refresh
- Fixed Remote Control sessions hosted by the desktop app not showing background agent and workflow progress on mobile and web
- Fixed Deep research runs labeling every Fetch-phase agent "unknown" — chips now show the source hostname
- Fixed Bedrock repeatedly requesting fresh AWS SSO credentials from IAM Identity Center on every API request
- Improved agent view: pasting the same text again now expands the collapsed
[Pasted text #N]placeholder instead of adding a second one - Improved agent view: blocked session peeks now lead with the question and show a worded staleness clock (
waiting 3m) instead of the same timestamp twice - Changed Bedrock, Vertex, and Claude Platform on AWS to default to Claude Opus 4.8
- Changed auto mode to no longer read
autoModefrom.claude/settings.local.json(repo-resident); use~/.claude/settings.jsoninstead - Fixed an indefinite hang on Windows when AWS credential resolution stalls (e.g. a stuck
credential_process): the 60-second stall guard now fires instead of waiting forever. - Plugin hooks/monitors/MCP headersHelper:
${user_config.*}in shell-form commands is now rejected (shell-injection fix). Hooks: use exec form (argsarray) or$CLAUDE_PLUGIN_OPTION_<KEY>; monitors and headersHelper: read the value inside the script (config file or the server'senvblock). - Plugin option values (
pluginConfigs) are no longer read from project-level.claude/settings.json; only user,--settings, and managed settings are honored - Fixed
/usage-creditsamount inputs silently stripping malformed values (e.g. a pasted timestamp) to digits; malformed amounts are now rejected with an error, and amounts over $1,000 require a typed confirmation
Breaking Changes
- autoMode config key removed from repo-resident .claude/settings.local.json; use ~/.claude/settings.json instead
- plugin option values (pluginConfigs) no longer read from project‑level .claude/settings.json
Security Fixes
- Shell injection vulnerability fixed – `${user_config.*}` in plugin hooks/monitors/MCP headersHelper now rejected
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About claude-code
All releases →Related context
Earlier breaking changes
- v2.1.215 Claude no longer automatically runs /verify and /code-review skills
- v2.1.160 Renames dynamic‑workflow trigger keyword from `workflow` to `ultracode`; `workflow` no longer triggers a run
- v2.1.160 Deprecates and removes the `CLAUDE_CODE_OPUS_4_6_FAST_MODE_OVERRIDE` environment variable; it is now a no‑op
- v2.1.147 Renames /simplify to /code-review; removes cleanup-and-fix behavior.
Featured in
Beta — feedback welcome: [email protected]