Skip to content

claude-code

v2.1.217 Feature

This release adds 4 notable features for engineering teams evaluating rollout.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Affected surfaces

auth rbac

Summary

AI summary

Fixed a memory leak that retained full untruncated MCP tool outputs in memory for the session duration.

Full changelog

What's changed

  • Added emoji shortcode autocomplete in the prompt input: type :heart: to insert ❤️, or :hea for suggestions — disable with the emojiCompletionEnabled setting
  • Added warnings when transcript writes are failing (e.g. disk full) or when session saving is off due to an inherited environment variable, instead of losing transcripts silently
  • Fixed a memory leak where truncated MCP tool outputs kept the full untruncated result in memory for the rest of the session
  • Fixed Windows auto-update failures that could leave claude.exe missing; failed updates now restore the preserved executable automatically
  • Fixed background session isolation not canonicalizing symlinked working directories, which could let sessions escape their workspace folder
  • Fixed auto-compact never triggering for Claude Opus 4.8 on Bedrock and /compact failing once over the limit
  • Fixed corporate mTLS, TLS-verify, OAuth scope, and proxy settings being ignored in Claude Desktop sessions
  • Fixed screen reader mode's startup announcement being cut off by the first prompt render, and the thinking status row re-rendering every few seconds to update elapsed time and token counts
  • Fixed managed settings that set OTEL_EXPORTER_OTLP_ENDPOINT not governing all signals — lower-scope signal-specific overrides no longer redirect telemetry away from the managed endpoint
  • Fixed --resume/--continue and /resume failing with a TypeError when a transcript has a malformed attachment entry
  • Fixed Remote Control sessions not showing a pending permission prompt or dialog to viewers that connected after it appeared
  • Fixed background shells sometimes becoming impossible to stop after a session is sent to the background (/background or ) or when the session exits on a heavily loaded machine, most visible on Windows
  • Fixed a CLAUDE.md or SKILL.md paths frontmatter value with many brace groups OOM-killing or stalling the CLI at startup — brace expansion is now budget-bounded
  • Fixed the transcript preview sitting flush against the input area when attaching to a starting background session; it now leaves the same one-line gap as the live layout, so the transcript no longer shifts when the session takes over
  • Improved footer PR badge links to be clickable hyperlinks even when terminal support can't be detected (e.g. over ssh/tmux); set FORCE_HYPERLINK=0 to opt out
  • Changed the login-expiry warning to appear 3 days before expiry instead of 5
  • Capped the frontend-design plugin suggestion tip at 3 lifetime impressions instead of repeating indefinitely
  • Added a cap on concurrently-running subagents (default 20, override with CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS) so one message can't fan out unbounded background agents
  • Changed subagents to no longer spawn nested subagents by default; set CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH to allow deeper nesting
  • Fixed --max-budget-usd not stopping background subagents: once the cap is reached, new spawns are denied and running background agents are halted

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track claude-code

Get notified when new releases ship.

Sign up free

About claude-code

All releases →

Related context

Earlier breaking changes

  • v2.1.215 Claude no longer automatically runs /verify and /code-review skills
  • v2.1.160 Renames dynamic‑workflow trigger keyword from `workflow` to `ultracode`; `workflow` no longer triggers a run
  • v2.1.160 Deprecates and removes the `CLAUDE_CODE_OPUS_4_6_FAST_MODE_OVERRIDE` environment variable; it is now a no‑op
  • v2.1.147 Renames /simplify to /code-review; removes cleanup-and-fix behavior.

Beta — feedback welcome: [email protected]