This release includes 2 security fixes for security teams reviewing exposed deployments.
Affected surfaces
Summary
AI summaryAdded --forward-subagent-text flag and env var to include subagent text in stream‑json output.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Medium |
Hardens file‑upload path validation in Claude in Chrome Hardens file‑upload path validation in Claude in Chrome Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Feature | Low |
Adds `--forward-subagent-text` flag and CLAUDE_CODE_FORWARD_SUBAGENT_TEXT env var to include subagent text in stream-json output Adds `--forward-subagent-text` flag and CLAUDE_CODE_FORWARD_SUBAGENT_TEXT env var to include subagent text in stream-json output Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Feature | Low |
Enhances background agent result reporting; Claude now reports status of still‑running agents and waits for real completion instead of fabricating results Enhances background agent result reporting; Claude now reports status of still‑running agents and waits for real completion instead of fabricating results Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Feature | Low |
Allows integer environment variables (timeouts, token budgets, retry counts) to accept scientific notation and digit‑separator spellings like `1e6` and `64_000` Allows integer environment variables (timeouts, token budgets, retry counts) to accept scientific notation and digit‑separator spellings like `1e6` and `64_000` Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Feature | Low |
Changes "always allow" permission rules to save at the repository root so approvals persist across sessions and worktrees Changes "always allow" permission rules to save at the repository root so approvals persist across sessions and worktrees Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Feature | Low |
Modifies `/usage-credits` to request confirmation before sending a request to organization admins Modifies `/usage-credits` to request confirmation before sending a request to organization admins Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Feature | Low |
Enables Vim mode `s` and `S` (substitute char/line) to work in NORMAL mode, matching vim behavior Enables Vim mode `s` and `S` (substitute char/line) to work in NORMAL mode, matching vim behavior Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Performance | Low |
Reduces a 300 ms delay that revealed async content such as Settings tabs, Stats, and diff views Reduces a 300 ms delay that revealed async content such as Settings tabs, Stats, and diff views Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Performance | Low |
Improves terminal layout and rendering performance Improves terminal layout and rendering performance Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Performance | Low |
Refines memory index over‑limit warning to measure only loaded content, excluding frontmatter and HTML comments Refines memory index over‑limit warning to measure only loaded content, excluding frontmatter and HTML comments Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Bugfix | Medium |
Fixes permission previews not neutralizing bidirectional-override, zero-width, and look-alike quote characters in chat channels Fixes permission previews not neutralizing bidirectional-override, zero-width, and look-alike quote characters in chat channels Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Fixes auto mode overriding PreToolUse hook's `ask` decision for unsandboxed Bash, now flooring the decision at a prompt Fixes auto mode overriding PreToolUse hook's `ask` decision for unsandboxed Bash, now flooring the decision at a prompt Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Fixes parallel Claude Code sessions logging out simultaneously after wake-from-sleep when sharing one credential store Fixes parallel Claude Code sessions logging out simultaneously after wake-from-sleep when sharing one credential store Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Fixes plugin MCP servers not reconnecting after an idle web session wakes, causing MCP calls to fail until the next message Fixes plugin MCP servers not reconnecting after an idle web session wakes, causing MCP calls to fail until the next message Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Fixes Claude Code on Vertex and Bedrock attempting the default Opus model at startup and printing a spurious fallback notice when a model is explicitly configured Fixes Claude Code on Vertex and Bedrock attempting the default Opus model at startup and printing a spurious fallback notice when a model is explicitly configured Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Fixes subagents spawned with an explicit model override reverting to the parent's model when resumed or sent a follow‑up message Fixes subagents spawned with an explicit model override reverting to the parent's model when resumed or sent a follow‑up message Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Fixes nested `.claude/rules/*.md` files loading even when sources exclude project settings Fixes nested `.claude/rules/*.md` files loading even when sources exclude project settings Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Fixes file upload validation: now accepts filenames ending in `.prn` or trailing dot, and refuses files with multiple hard links Fixes file upload validation: now accepts filenames ending in `.prn` or trailing dot, and refuses files with multiple hard links Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Fixes a prompt‑caching regression on Bedrock, Vertex, Mantle, and Foundry that billed trailing system context as fresh input tokens on every request Fixes a prompt‑caching regression on Bedrock, Vertex, Mantle, and Foundry that billed trailing system context as fresh input tokens on every request Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Low |
Fixes Claude in Chrome setup pages failing to open in the browser on Windows Fixes Claude in Chrome setup pages failing to open in the browser on Windows Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Bugfix | Low |
Prevents headless print‑mode sessions on Windows from crashing or silently exiting when stdin is unreadable Prevents headless print‑mode sessions on Windows from crashing or silently exiting when stdin is unreadable Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Bugfix | Low |
Ensures reopening a just‑stopped background session from the agents view starts with a non‑blank conversation under the same session ID Ensures reopening a just‑stopped background session from the agents view starts with a non‑blank conversation under the same session ID Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Bugfix | Low |
Prevents `/loop` from hiding the session from `/resume` after a single use Prevents `/loop` from hiding the session from `/resume` after a single use Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Bugfix | Low |
Restores audible terminal bell for screen‑reader users after `/terminal-setup` or onboarding terminal setup Restores audible terminal bell for screen‑reader users after `/terminal-setup` or onboarding terminal setup Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Bugfix | Low |
Fixes background jobs on LLM gateway auth (`ANTHROPIC_AUTH_TOKEN` + `ANTHROPIC_BASE_URL`) from returning “Not logged in” after daemon respawn Fixes background jobs on LLM gateway auth (`ANTHROPIC_AUTH_TOKEN` + `ANTHROPIC_BASE_URL`) from returning “Not logged in” after daemon respawn Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Bugfix | Low |
Shows why deletion is refused when git no longer recognizes a `claude agents` job's worktree instead of silently reappearing Shows why deletion is refused when git no longer recognizes a `claude agents` job's worktree instead of silently reappearing Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Bugfix | Low |
Resets the session cost counter after `/clear`, starting the status‑line cost at $0 Resets the session cost counter after `/clear`, starting the status‑line cost at $0 Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Refactor | Low |
Hardens synced skill/plugin directory naming on Windows and preserves CCR web fetch/search proxies after `/clear` Hardens synced skill/plugin directory naming on Windows and preserves CCR web fetch/search proxies after `/clear` Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Refactor | Low |
Updates documentation links to the current docs sites Updates documentation links to the current docs sites Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Refactor | Low |
Updates the Remote Control banner in VSCode to describe its functionality Updates the Remote Control banner in VSCode to describe its functionality Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
Full changelog
What's changed
- Added
--forward-subagent-textflag andCLAUDE_CODE_FORWARD_SUBAGENT_TEXTenvironment variable to include subagent text and thinking in stream-json output - Fixed permission previews relayed to chat channels not neutralizing bidirectional-override, zero-width, and look-alike quote characters, so tool inputs cannot visually alter the approval message
- Fixed auto mode overriding a PreToolUse hook's
askdecision for unsandboxed Bash — a hookasknow floors the decision at a prompt - Fixed parallel Claude Code sessions all logging out simultaneously after wake-from-sleep when many sessions share one credential store
- Fixed plugin MCP servers not reconnecting after an idle web session woke, leaving MCP calls failing until the next message
- Fixed Claude Code on Vertex and Bedrock attempting the default Opus model at startup and printing a spurious fallback notice when a model is explicitly configured
- Fixed subagents spawned with an explicit model override reverting to the parent's model when resumed or sent a follow-up message
- Fixed nested
.claude/rules/*.mdfiles loading even when setting sources exclude project settings - Fixed file upload validation: filenames ending in a DOS device suffix (
.prn) or trailing dot are now accepted, and files with multiple hard links are refused - Fixed file uploads to Claude in Chrome from remote and CLI sessions
- Fixed edits that leave the input as "?" being silently swallowed and toggling the shortcuts panel
- Fixed a startup hang when the Claude in Chrome extension is enabled but Chrome is not running
- Fixed a 300ms delay revealing async content (Settings tabs, Stats, diff views, and other loading states)
- Fixed reopening a just-stopped background session from the agents view starting a blank conversation under the same session id
- Fixed
/loophiding the session from/resumeafter a single use - Fixed screen reader users losing the audible terminal bell after
/terminal-setupor onboarding terminal setup - Fixed background jobs on LLM gateway auth (
ANTHROPIC_AUTH_TOKEN+ANTHROPIC_BASE_URL) coming back "Not logged in" after the daemon respawns them - Fixed
claude agentsjobs becoming permanently undeletable when git no longer recognizes their worktree — the row now shows why the delete was refused instead of silently reappearing - Fixed
/clearnot resetting the session cost counter — the statusline's cost now starts at $0 after/clear - Fixed Claude in Chrome setup pages failing to open in the browser on Windows
- Fixed headless print-mode sessions on Windows crashing or silently exiting when stdin is unreadable
- Fixed background session titles in the agents view showing the naming model's refusal text when the prompt contains a link
- Fixed background agents killed by the user auto-respawning, and revived agents re-running stale prompts from old sessions
- Fixed routines with no schedule reporting a next run time in the year 1
- Hardened synced skill/plugin directory naming on Windows and kept CCR web fetch/search proxies working after
/clear - Improved terminal layout and rendering performance
- Improved background agent result reporting — Claude now reports the status of still-running agents and waits for the real completion instead of fabricating results
- Improved the memory index over-limit warning to measure only loaded content, excluding frontmatter and HTML comments
- Updated integer environment variables (timeouts, token budgets, retry counts) to accept scientific notation and digit-separator spellings like
1e6and64_000 - Updated documentation links to the current docs sites
- Changed "always allow" permission rules to save at the repository root, so approvals granted in a git worktree persist across sessions and worktrees
- Changed
/usage-creditsto ask for confirmation before sending a request to organization admins - Changed Vim mode
sandS(substitute char/line) to work in NORMAL mode, matching vim behavior - [VSCode] Updated the Remote Control banner to describe what it does
- Claude in Chrome: hardened file-upload path validation
- Claude in Chrome:
save_to_diskon screenshot actions now writes the image to disk and returns the path; previously it did nothing - Fixed a prompt-caching regression on Bedrock, Vertex, Mantle, and Foundry that billed the trailing system context block as fresh input tokens on every request.
Security Fixes
- Hardened file‑upload path validation in Claude in Chrome.
- Fixed permission previews relayed to chat channels not neutralizing bidirectional‑override, zero‑width, and look‑alike quote characters, preventing visual tampering of approval messages.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About claude-code
All releases →Related context
Earlier breaking changes
- v2.1.215 Claude no longer automatically runs /verify and /code-review skills
- v2.1.160 Renames dynamic‑workflow trigger keyword from `workflow` to `ultracode`; `workflow` no longer triggers a run
- v2.1.160 Deprecates and removes the `CLAUDE_CODE_OPUS_4_6_FAST_MODE_OVERRIDE` environment variable; it is now a no‑op
- v2.1.147 Renames /simplify to /code-review; removes cleanup-and-fix behavior.
Beta — feedback welcome: [email protected]