← All guides

> claude --version

Current version

v2.1.261

Published September 4, 2026

ChangelogUpdates

Claude Code Changelog: Every Release Explained in Plain English

By Neo Zino - builder of ClockedCode·Updated September 5, 2026·57 min read

The Claude Code changelog in plain English: what each release actually changes, why it matters, and whether you should care. Updated with every release.

Latest version: 2.1.261, published September 4, 2026.

TL;DR: The last few weeks were unusually big. Claude Sonnet 5 became the default model with a 1M-token context window (2.1.197), subagents now run in the background by default (2.1.198), Claude in Chrome went GA (2.1.198), /doctor became a full setup checkup (2.1.205), and Claude Opus 5 became the default Opus model with the same 1M-token context window (2.1.219). Self-hosted environments arrived next (2.1.224), letting Team and Enterprise plans run Claude Code sessions on their own machines instead of Anthropic's hosted infrastructure. Most recently, Claude Fable 5.1 became the default Fable model, also with a 1M-token context window (2.1.257). If your install is older than 2.1.197, update today.

2.1.261 - a 67-bullet fix pile, with resumed sessions no longer losing hook context (September 4, 2026)

• Resuming a session used to lose hook output and other context around parallel tool calls, quietly changing what got sent when you picked the conversation back up. Fixed - this was a real correctness bug if you resume often.
• New /skill-doctor command shows which loaded skills you never actually use and how much context they're costing you, so you can prune the dead weight.
• bashOutputMaxChars and taskOutputMaxChars settings raise how much command and background-task output Claude reads inline before it gets dumped to a file, up to 128K characters.
• SDK and cloud sessions were ignoring a Stop or interrupt sent right after the first prompt, before the turn had actually started - it just ran to completion anyway. It stops now.
• A background agent that couldn't be resumed used to retry its wake-up in a tight loop and burn CPU. Fixed.

(The rest is the usual long tail: a --append-subagent-system-prompt-file flag for subagent prompts too large for the command line, an "Organization policy" line in /status/claude doctor explaining a failed policy load, the dangerous-rm safety prompt now also catching rm -rf on positional parameters and inside quoted sh -c scripts, several Remote Control fixes for stale permission modes and stuck stop spinners, Bedrock/Vertex/gateway auth polish, and a big batch of VS Code session-list and MCP-dialog polish.)

Verdict: update whenever - nothing here is urgent, but the hook-context fix on resume is worth having if you resume sessions a lot, and /skill-doctor is worth a run to see what your skills are actually costing you.

2.1.260 - permission rules with parentheses in the path finally behave (September 3, 2026)

• A permission rule pointing at a path with parentheses (think Program Files (x86)) was being silently dropped or ignored by the Bash sandbox, which left folders you'd marked read-only actually writable. Fixed.
• One bad file permission rule - an unclosed [, say - used to break every single edit in the session with an "Invalid regular expression" error. Now a broken rule only guards its own literal path instead of taking everything else down with it.
• zsh commands that hid a command substitution inside a REPORTTIME, REPORTMEMORY, or DIRSTACKSIZE assignment were slipping past auto-approval. They now prompt like any other command.
• The 2.1.259 change that made Read() deny rules apply to Bash arguments has been reverted - it was blocking plain npm run build under a Read(./**/build/**) rule and making cd … && grep prompt even in auto mode. If you hit that on 2.1.259, it's gone now.
• Also new: a /diff panel that sits beside the conversation in fullscreen mode and shows your uncommitted changes live as Claude edits, and /cost/the status line now explain why a prompt-cache miss happened instead of just flagging it.

(The rest is the usual long tail: Bedrock certificate and token-counting fixes for corporate root CAs, several Fable 5.1 model-picker and caching fixes, /rewind and background-session reliability patches, and a batch of VS Code and GitLab-repository polish.)

Verdict: update today if you write custom permission rules with parentheses in the path, use zsh, or got bitten by the npm run build regression in 2.1.259 - all three are real, and the last one is Claude Code fixing its own mistake from yesterday. Everyone else can update whenever.

2.1.259 - a 37-bullet fix pile, with concurrent sessions no longer scrambling your config (September 2, 2026)

• Running more than one session at a time could make them silently stomp on each other's ~/.claude.json - workspace trust resetting itself, MCP servers or project state just disappearing mid-work. Fixed.
• --resume could fail outright, and --continue could open an empty conversation, if the saved session held an attachment with no payload. Fixed.
• Worktree-isolated sessions were refusing ordinary Bash loops, xargs pipelines, and launcher-wrapped commands just because they couldn't reach the main checkout. They work again.
• Stop wasn't actually stopping background agents and workflows in Remote Control sessions - a killed task now stays visible and re-stoppable until it's really gone.
• Frontmatter model: on custom commands and skills was being ignored in interactive sessions. It's respected again.

(Also worth a glance if you manage MCP servers centrally: allowedMcpServers now only governs servers users add themselves - a managed-mcp.json server your allowlist used to filter out will load on upgrade unless you add it to deniedMcpServers.)

The rest is the usual long tail: a managedMcpServers setting for organizations to push MCP servers to everyone, --permission-prompts none for unattended headless hosts, GitLab merge requests now showing up in the tool summary and footer badge, two more permission-check bypasses closed (Bash Read() deny rules skipping option-value paths like --ignore-revs-file=.env, and managed settings going silently unenforced when unparseable - Claude Code now refuses to start instead), MCP servers that disconnect mid-startup no longer showing as connected with no tools, and a batch of VS Code, /workflows, and terminal-rendering polish.

Verdict: update today if you routinely run multiple sessions at once or lean on worktree isolation - both of those were real, reproducible papercuts. Everyone else can update whenever; nothing here is urgent.

2.1.257 - Fable 5.1 becomes the default, and auto mode gets a guardrail against credential theft (September 1, 2026)

• Claude Fable 5.1 (claude-fable-5-1) is the new default Fable model: same pricing as before ($10/$50 per Mtok, $0.25/Mtok for cache reads) with a 1M-token context window. If you're on a third-party gateway, fable and best still resolve to Fable 5 until your gateway adds 5.1 support - pick it explicitly in /model to use it now.
• Auto mode gets a new Containment Escape rule: attempts to fetch cloud metadata credentials, evade network egress controls, or reach across tenants are no longer auto-approved unless your environment explicitly expects them. It's paired with a one-time prompt (and an optional hard block via permissions.blockReadsOutsideWorkingDirectories) the first time auto mode tries to read a file outside your working directories.
• A cluster of permission-check bypasses got closed: plugins could read files outside their own directory through a symlinked command, agent, skill, or hook path; Bash Read()/Edit() deny rules didn't apply to < file redirects or reader commands like tac and egrep; and --disallowedTools plus session deny rules could silently vanish after the first settings reload under allowManagedPermissionRulesOnly. All fixed.
• Subagents that got cut off mid-response by a dropped connection, a server error, or your computer sleeping now pick back up automatically instead of ending with a broken answer - worth having if you lean on subagents for long-running work.
• New timeFormat/timeZone settings control how the turn-end clock and transcript timestamps render (12-hour, 24-hour, 24-hour UTC, or a strftime pattern), and CLAUDE_CODE_SUBAGENT_MODEL_FORCE lets you pin every subagent to one model regardless of per-agent overrides.

(2.1.258, also September 1, was two more fixes: Claude Code had stopped launching at all on macOS 12 Monterey, a regression from 2.1.255, and remote or scheduled sessions could crash with "user messages must have non-empty content" after a re-sent permission approval failed to apply. Both fixed.)

The rest is the usual long tail: rendering and prompt-input performance work in long conversations, a /doctor warning for stale sandbox mask files, several Bedrock/Vertex/Foundry credential-header fixes, and a batch of claude agents, Remote Control, and VS Code polish (a model picker pill, collapsible session-list sections, "Archive session" replacing "Delete session").

Verdict: update today. Fable users get a materially better default model for free, and the Containment Escape rule plus the permission-bypass fixes matter if you run Claude Code with plugins, in less-trusted environments, or under an org's managed permission rules.

2.1.252 - a small pile of reliability fixes, nothing urgent (August 31, 2026)

• Bash commands on some Macs were failing outright with a "task output swap refused" error whenever the tasks directory had moved or turned into a symlink. Fixed.
• Clicking "always allow" on a permission prompt silently failed to save in a project that didn't already have a .claude/settings.local.json file - you'd get asked again next time. Fixed.
• Remote Control sessions hosted by Claude Desktop or VS Code could stall for minutes after a tool finished if the connection to claude.ai was degraded, instead of just reporting the result. Fixed.
• A background task that failed with a lot of output (git errors on a full disk, for example) could push the conversation past the API's request size limit and break the turn. Fixed.

Verdict: update whenever. Four narrow bug fixes, none of them a must-have unless you've personally hit one of these.

2.1.251 - five permission-check bypasses get closed in one release (August 28, 2026)

• Five different ways to slip past a permission check got fixed at once: Read, Write, and Edit could be tricked into working outside the approved directory by swapping in a symlink after the check passed; Grep and Glob ignored Read() deny rules on paths reached through a symlink; a plugin marketplace entry could point its commands outside the plugin directory; the Workflow tool could read a scriptPath outside what the session was allowed to read; and project settings could quietly turn on raw API body logging or dodge an org-pinned OTLP collector.
• New PreModelSwitch and PostModelSwitch hook events let you block, confirm, or log a mid-session model change before or after it happens.
• CLAUDE_CODE_SUBAGENT_MODEL now sets the default subagent model instead of overriding everything - an agent's own model: or an explicit per-spawn model wins over it. /effort also now remembers its setting per model instead of one global level for all of them.
• Fixed conversations getting permanently stuck on a "text content blocks must be non-empty" error after a turn where the model produced only thinking.
• Fixed Opus 5 requests failing outright when effort was set to xhigh or max with thinking turned off; effort now quietly downgrades to high instead of erroring.

The rest is the usual long tail: live streaming of a foreground subagent's tool calls to Remote Control, a spend-limit bar in /usage for gateway users, a per-session prompt-cache breakdown in /cost, Opus 5 becoming the default for seat-based Enterprise plans, a smaller install (native binary down about 5 MB, plus another 2.5 MB from dropping six rarely used syntax-highlighting languages), and dozens of smaller reliability fixes across background sessions, Remote Control, and the sandbox.

Verdict: update today - the permission-check bypasses matter regardless of how likely you are to hit one, especially if you work with symlinks, install third-party plugins, or run under an org's beta-tracing policy. Everyone else still gets the stuck-conversation fix and the per-model effort setting, which are worth having either way.

2.1.248 and 2.1.250 - a --restricted mode arrives, and uncommitted secrets stop leaking to cloud sessions (August 27, 2026)

• New --restricted flag (or CLAUDE_CODE_RESTRICTED=1): strips out the tools that run commands or code and WebFetch, keeps file access inside the working directory, refuses bypassPermissions, and ignores your settings files. A real lockdown mode for running Claude Code somewhere you don't fully trust.
• /ultrareview and locally-seeded cloud sessions were uploading uncommitted edits to files like prod.env, *.tfvars, and editor backups of key files (key.pem.tmp, id_rsa.swo). Fixed - those now stay on your machine.
• A prompt-cache miss, with the extended-thinking context that goes with it, was quietly happening about once an hour in long sessions, triggered by an OAuth token refresh re-rendering your tool definitions. Fixed.
• Claude Desktop and Cowork sessions were disappearing after 30 days because cleanup didn't know they were still open in the app. Fixed; a new desktopSessionCleanupPeriodDays setting caps how long the exemption lasts.
• Cross-session messaging (SendMessage, ListAgents) now works on Bedrock, Vertex, and Foundry, and with telemetry disabled - closing the same gap 2.1.243 fixed for rootless containers.

(2.1.250, later the same day, was a single line: "Bug fixes and reliability improvements," with nothing to report.)

Verdict: update today if you've ever run Claude Code in a repo with secrets sitting in an untracked .env or backup file, or if you lean on cloud sessions or long-running sessions - the leak fix and the hourly cache miss both matter. Everyone else can update whenever; --restricted is worth knowing about if you ever run Claude Code somewhere you don't fully trust.

2.1.247 - SendFeedback lands, and sessions stop wedging on giant hook output (August 26, 2026)

• New SendFeedback tool: when something goes wrong mid-session, Claude can draft a feedback report for you to review and send from /feedback (turn it off with the feedbackDrafts setting).
• A hook or background agent that dumped megabytes of error output could overflow the conversation and wedge the whole session on "Prompt is too long." Fixed.
• Sub-agents that hit a 404 on their first model call used to just die. They now fall back through the session's model chain instead, and the error handed back to the parent includes the type, status, and request id so you can actually debug it.
• Fast arrow-key-then-Enter sequences in history search, /config, /mcp, /skills, background tasks, and /model were acting on the row above the one you'd actually navigated to - the same class of bug 2.1.235 fixed in permission dialogs, just showing up in more menus.
• Cloud sessions (web, desktop, mobile) used to go silent if the container restarted mid-turn while a background agent or shell was still running. A resumed session now tells you work was lost instead of leaving you guessing.

Verdict: update today if you lean on hooks or background agents - the giant-output wedge and the sub-agent 404 fallback both matter there - or use cloud sessions from web, desktop, or mobile. Everyone else can update whenever; SendFeedback is a nice touch, but nothing here is urgent.

2.1.246 - a 61-bullet fix pile, with a gateway credential leak closed (August 25, 2026)

• Telemetry and metrics requests could carry the API key configured for a third-party gateway (ANTHROPIC_BASE_URL) along to Anthropic's own endpoints. Fixed - a credential now only goes to the host it belongs to.
• Malformed Bash commands with a dangling && or || now always require your approval instead of possibly slipping through the permission check.
• Fullscreen mode gets several stability fixes: it could go blank after resizing the terminal, scroll erratically when you weren't at the bottom, and slow to a crawl on a diff with one very long line (like a base64 string) - long lines now render truncated instead.
• Background sessions get two real fixes: they no longer fail to open after 45 seconds when the starting directory was deleted or the machine had slept, and no longer fail with EACCES when another Claude Code process happened to be reinstalling the npm package at the same moment.
• The Write tool no longer freezes or reports "Out of memory" after overwriting a large existing file - the write had actually gone through, you just couldn't tell.

(2.1.245, the same day, was a single fix: a startup crash on Linux distributions shipping glibc 2.44, like Arch, CachyOS, and Fedora Rawhide.)

The rest is the usual long tail: a new Auto mode tab in /permissions for viewing and editing classifier rules, a startup warning for Bash allow rules with a wildcard before the subcommand, resumed sessions no longer failing every turn with a 400 on history a third-party proxy wrote badly, memory that no longer grows with session length in the fullscreen and Ctrl+O transcript views, and a batch of plugin, keybinding, and MCP fixes.

Verdict: update today if you route through a third-party gateway - that credential leak is worth closing regardless of how likely it was to matter for you. Everyone else can update whenever; it's a big pile of small reliability wins, not a must-have.

2.1.243 - installs shrink to a quarter of their size, and namespaced containers get SendMessage back (August 24, 2026)

• Native installs and auto-updates now ship zstd-compressed - about 75 MB instead of 340 MB on Linux x64 - and long sessions use noticeably less memory since code loads on demand instead of staying resident.
• Cross-session messaging (SendMessage, ListAgents) had been silently broken inside user namespaces and rootless containers since 2.1.232's socket hardening. Fixed - it works there again.
• Sessions that got no response at all from the API used to sit silently for 10+ minutes. They now time out after about 3 minutes, retry once, and surface a clear API Error: No response from API instead of leaving you guessing.
• New modelPicker setting curates the /model list with your own ordered, labeled models (any id, including Vertex/Bedrock); new promptCacheTtl/subagentPromptCacheTtl settings let API-key and cloud-provider users keep the main conversation on a full 1-hour prompt cache while subagents stay on the cheaper 5-minute one.
• Hook if conditions like Bash(cat *) could misfire on unrelated commands whenever the command contained $() or backtick substitution followed by more arguments. Fixed.

The rest is the usual long tail: a modelPricing managed setting for organizations with contracted per-model rates, a keyless "sign in with your Console account" option under /login, a Skipped sources line in /status for overridden managed settings, model and effort level now shown per subagent in /tasks, /usage gets a Loops breakdown, sandbox network-violation details no longer get dropped from Bash results that still exit 0, and a batch of MCP, plugin, and VSCode fixes.

Verdict: update today if you run Claude Code inside rootless containers or user namespaces - that SendMessage regression is worth closing. Everyone else can update whenever; the smaller install and lower memory use are nice, but nothing here is urgent.

2.1.240 and 2.1.241 - nothing to see here (August 22, 2026)

Both releases shipped as a single line each: "Bug fixes and reliability improvements," with no bullets underneath. Nothing user-visible to report.

Verdict: update whenever - there's no reason to rush this one.

2.1.239 - a 59-bullet fix pile, with a Bedrock billing bug closed (August 21, 2026)

• Bedrock users behind a proxy that strips the response Content-Type header were being silently double-billed: streaming quietly fell back to non-streaming and reran every turn from scratch. Fixed.
• A race with queued prompts: pressing Esc while a prompt was queued could let the next turn finish early and leave the session sitting idle while Claude was actually still working, and resubmitting the queued prompt afterward could repeat actions Claude had already taken. Fixed.
• Fullscreen mode gets a cluster of fixes: mouse movement no longer inserts stray text like "35;150;7M" into the prompt, clicking the terminal just to refocus it no longer answers a permission prompt or presses a button, and panels like /config and /workflows no longer cover the latest messages or overflow off-screen.
• WebFetch was holding expired page content in memory for the whole session instead of releasing it after the intended 15 minutes. Fixed.
• Windows catches up to macOS and Linux: cross-session messaging now works, so Claude Code sessions on your machines can message each other with SendMessage and find each other with ListAgents.

The rest is the usual long tail: a hang at startup behind an HTTPS proxy on Bedrock with SSO, remote MCP servers staying marked failed after a transient 5xx, custom session titles disappearing from /resume on long conversations, claude -c picking up the wrong session when directory names differed only by punctuation, a JetBrains pause on Edit/Write calls, /goal check-ins that now back off over time instead of repeating every 30 minutes, and a batch of keybinding and clipboard fixes.

Verdict: update today if you run Bedrock behind a proxy - that billing bug was real money. Everyone else can update whenever; nothing here changes your day-to-day beyond fewer rough edges in fullscreen mode.

2.1.238 - a memory leak fix, and a Remote Control reliability pass (August 20, 2026)

• Long interactive sessions could grow memory without bound as subagent tool results piled up. Fixed - results are now released once they scroll out of the recent display window.
• Custom, project, and plugin output styles used to drift back to Claude's default voice partway through a session. Fixed - your chosen style now sticks.
• MCP headersHelper (which runs a command to mint auth headers) on a project's .mcp.json or an inline agent-file server now requires that folder's trust dialog to have been accepted first, instead of running unprompted.
• Remote Control gets a real reliability pass: messages sent from web or Desktop mid-turn no longer vanish from the transcript, model picks made on a phone sync back to the terminal, sign-out no longer reports a fake failed-reconnect error, and ListAgents/SendMessage finally work from server-mode and Desktop/IDE-hosted sessions instead of claiming Remote Control isn't connected.
• New keybindingFlavor: "readline" setting makes Ctrl+W in the prompt delete back to the previous whitespace, Bash-style, instead of the whole word.

The rest is the usual long tail: two new self-hosted-runner flags for graceful shutdown and proxy re-authentication, a fix for self-hosted runners getting evicted after one slow poll, MCP elicitation dialogs going blank on very long URLs, leftover /tmp/claude-*-cwd files after a killed Bash command, held Backspace being dropped on slow SSH links, wide-character clipping in permission-prompt diffs, a bracketed-paste glitch after killing a suspended session, faster macOS startup, and a claude-api skill update for the Aug 19 Managed Agents release.

Verdict: update today if you run long sessions (the memory leak was real) or lean on Remote Control from a phone or web browser - both get meaningfully better here. The MCP headersHelper trust requirement is worth knowing if you use plugin marketplaces with one. Everyone else can update whenever.

2.1.237 - a Concise output style, and a caching fix for gateway users (August 19, 2026)

• New "Concise" output style: Claude leads with results and skips the preamble and narration, doing the same work with less chatter around it. Turn it on under Output style in /config.
• Fixed prompt caching breaking for sessions that go through an LLM gateway or a custom base URL - caching now works there again.

Verdict: try Concise if Claude's running commentary gets in your way. Everyone routing through a gateway or a custom base URL should update to get caching back; otherwise update whenever.

2.1.236 - a default-model env var, and a directory-deletion bug closed (August 19, 2026)

• New ANTHROPIC_DEFAULT_MODEL environment variable sets which model new sessions start on. Unlike the older ANTHROPIC_MODEL, a /model pick still overrides it and sticks across restarts.
• If you'd cd'd into a directory during a session and then deleted it, clipboard copy, background housekeeping, background sessions, and local MCP logs could all quietly stop working. Fixed - this had been broken since 2.1.229.
• macOS sandbox: wildcard read-deny rules like **/.env now actually hold inside allowed read regions, cover everything inside a matched directory, and can't be dodged by renaming the file they're supposed to block.
• Cross-session SendMessage gets notify_when_idle: ask another local Claude Code session to ping you once, the next time it goes idle, instead of polling it yourself.
• [VSCode] Screen reader support lands for the transcript - live announcements for replies, permission requests, and errors, plus per-turn heading navigation.

The rest is the usual long tail: the fullscreen renderer no longer breaks permanently after one failed start, the /model picker no longer overflows a short terminal, a SendMessage bug with malformed closing tags, a subprocess-crash regression from 2.1.234, several auto mode refinements (Monitor commands now reviewed like Bash, parity on Bedrock/Vertex/Foundry, a git-status spoofing fix), a /usage credits row for Team and Enterprise, faster Remote Control offline detection, and a batch of terminal-rendering and UI polish.

Verdict: update today if you use directories you delete mid-session (that bug touched more than it looked like) or rely on macOS sandbox read-deny rules. The ANTHROPIC_DEFAULT_MODEL env var and VSCode screen reader support are worth knowing about either way; everyone else can update whenever.

2.1.235 - two permission-prompt bugs could grant or pick the wrong thing (August 18, 2026)

• A stray Shift+Tab inside the permission prompt's comment field was approving the edit and granting session-wide edit permission instead of just closing the field. Fixed - that keystroke now does what it looks like it does.
• Dialogs in general had a similar problem: navigating with arrow keys and hitting Enter in quick succession could select the option you'd just moved to instead of whatever was highlighted a moment before. Matters most in a permission prompt, where the wrong selection means the wrong grant.
• Permission dialogs are also more honest now - what they display and offer as "don't ask again" always matches what the grant would actually cover, and "don't ask again" is withheld whenever the dialog can't show everything it applies to.
• Background cloud sessions like /ultrareview or /autofix-pr use noticeably less memory and CPU: their event streams stopped being re-scanned and re-rendered on every single update.
• New: an opt-in spellcheck setting underlines misspelled words in the prompt input as you type, using whatever aspell, hunspell, or ispell you already have installed.

Verdict: update today if you spend real time answering permission prompts - the Shift+Tab and dialog-selection bugs could both hand out a grant you didn't mean to give. Everyone else can update whenever; nothing else here is urgent.

2.1.234 - sessions auto-continue after usage limits reset, and permission answers stop vanishing (August 17, 2026)

• Claude Code now auto-continues your session as soon as a claude.ai usage limit resets, instead of leaving you stalled until you notice and nudge it yourself. Turn it off in /config ("Continue automatically at usage limit") if you'd rather it just stop.
• Fixed auto mode in very long, already-compacted sessions repeatedly re-checking and denying sandboxed commands' network access - it kept forgetting approvals it had already granted earlier in the conversation.
• Fixed session-scoped permission answers, including denies, getting silently dropped when you answered a background subagent's tool permission prompt. Your answer wasn't actually being remembered.
• The built-in claude-api skill used to cost roughly 200k+ tokens of context just to load. It now loads reference docs on demand and costs about 25k - a real difference in sessions that touch the Claude API.
• Security: Windows NT-namespace paths (the \??\ device prefix) are now blocked everywhere a file gets pre-approved - remote file reads, session restore, CLAUDE.md includes, workflow scripts, uploads - closing the rest of the credential-leak vector 2.1.233 started patching.

Verdict: update today if you're on Windows (this finishes the NT-namespace fix from 2.1.233) or you run long auto-mode sessions that got stuck re-approving network access. Everyone else can update whenever - the usage-limit auto-continue and the much cheaper claude-api skill are welcome, but nothing here is urgent.

2.1.233 - TodoWrite quietly disappears on newer models, and Windows closes a credential-leak bypass (August 14, 2026)

• Security: a Windows path spelled with the NT \??\ device prefix could slip past UNC path validation, opening an NTLM credential-leak vector. Closed - no action needed beyond updating.
• TodoWrite and the task-tracking tools (TaskCreate/Get/Update/List) are now off by default on Opus 4.8, Sonnet 5, Fable 5, Mythos 5, and newer models. If your workflow depends on visible todo lists, set CLAUDE_CODE_ENABLE_TODO_TOOLS=1 to get them back.
• Two Windows regressions from yesterday's 2.1.232 are fixed: auto mode no longer stops for manual approval on ordinary cd dir && command > file Bash commands, and the Cygwin-symlink and input-redirection permission changes from that release are reverted until a narrower fix ships.
• Cloud sessions were sometimes marked as lost if the environment shut down while Claude was waiting on a permission prompt. Fixed.
• MCP v2 connections could get stuck endlessly reopening the subscriptions stream against servers that close long-held connections on a fixed timeout - common on serverless hosts. Fixed.

Verdict: update today if you're on Windows - the credential-leak fix and the two 2.1.232 regressions all land here. Also check your workflow if you're on Sonnet 5, Opus 4.8, Fable 5, or Mythos 5 and rely on TodoWrite: it's now opt-in. Everyone else can update whenever.

2.1.232 - three more permission bypasses close, and sessions get easier to talk to (August 13, 2026)

• Security: three separate holes close at once - a PowerShell trick that could silently overwrite $PSDefaultParameterValues to redirect where later commands write, a Windows Git Bash bug where Cygwin-style symlinks slipped past the permission check, and nested git repositories that were silently inheriting trust from a parent folder instead of asking for their own. None of these needed you to do anything wrong to be exposed.
• Cross-session messaging gets easier to actually use: type @ in your prompt to mention another named Claude session and Claude reaches it with SendMessage directly, delivery to a name that matches one live session no longer stops to ask you to confirm first, and two sessions on the same machine can no longer collide on the same name.
• GitLab is now a first-class citizen alongside GitHub: secret redaction covers the full family of GitLab token types, the glab CLI gets the same sandbox and credential protections gh already had, and plugin marketplaces can point at a gitlab.com repo URL the same way they point at a GitHub one.
• Fixed: MCP connections used to hang for the full 30 seconds when a server failed to answer or sent back a malformed reply during setup. They now fail fast instead of stalling your session.
• Remote Control got a real reliability pass: sessions no longer show up as a duplicate claude.ai conversation every time you resume from Desktop or an IDE, bridge sessions restore their history after a worker restart instead of losing it, and reconnecting no longer silently yanks Remote Control away from another device that was using it.

(2.1.231, also August 13, was a single fix: MCP OAuth sign-in was failing with a redirect URI mismatch for servers that use a pre-registered OAuth client, like Slack.)

Verdict: update today if you use PowerShell, Git Bash on Windows, or work across nested git repositories - all three permission bypasses are closed here. Everyone else can update whenever; the session-naming, GitLab, and Remote Control fixes are welcome but nothing here is urgent for a single-session GitHub user.

2.1.229 - two more ways to crash on resume close, and VSCode gets session groups (August 12, 2026)

• Resuming a session could throw you straight to the error screen two different ways: if any turn in its history had a tool call with a bad (non-string) file path, glob, or command value, or if your terminal window was narrow enough to trigger a rendering crash in a progress bar or markdown table. Both are fixed, so --resume and --continue are safe to rely on again.
• Long streamed responses could visibly glitch - part of the text disappearing mid-print, then the whole response printing twice. Fixed.
• The GitHub Action that /install-github-app sets up could finish reviewing a pull request without ever posting the review, so it looked like nothing had run. Fixed.
• VSCode gets session groups in the sidebar: right-click to create, rename, or delete one, and Cmd/Ctrl- or Shift-click to move several sessions into it at once.

Verdict: update today if --resume or --continue has crashed on you lately - both crash paths are closed here. Everyone else can update whenever; the streaming glitch and the silent PR-review miss are minor annoyances, not blockers.

2.1.228 - session cleanup stops eating your memory files (August 11, 2026)

• A session-cleanup bug could delete the contents of your project's memory folder outright. Fixed - if files there have gone missing lately, this was why.
• Interactive sessions could freeze completely - no redraws, but the process kept running underneath - after a rare internal layout error. You had to kill and restart to get input back; that dead end is closed.
• Skills synced in from claude.ai are hardened: they can no longer shadow your local commands or MCP prompts, their descriptions are sanitized before display, and their bodies can no longer run ! shell commands or expand @-file references on your machine.
• Remote Control's /resume while connected could leak the resumed conversation's title or history into the session you were already connected to. Fixed.
• The Write tool now lets newer models overwrite a file they haven't read yet this session, matching what the Edit tool already allowed - a small safety-rule loosening if you were relying on the stricter behavior. Older models still need the read first.

Verdict: update today if you use claude.ai-synced skills or Remote Control - both had real trust gaps closed here. Everyone else should still update soon: the memory-folder deletion and frozen-session bugs are the kind that cost you work before you notice.

2.1.227 - claude-code-action's Bash commands work again (August 10, 2026)

• claude-code-action on GitHub-hosted runners: every Bash command was failing outright when allowed_non_write_users was set. Fixed - if your CI workflow uses that option, this was breaking every run.
• A session that started with an expired login token could evaluate your feature flags without checking your subscription tier, which was wrongly telling Max plan users to enable usage credits for Fable. Fixed.
• /tui used to resurrect a conversation after you had rewound it past its first message. It stays gone now.
• Slash-command menu cleanup: blue now marks only the selected row instead of bleeding onto others, matched characters are bolded instead of recolored, and emoji or accented command names keep their glyphs.
• Fewer event-loop stalls on file-not-found suggestions and at-mention size checks - snappier autocomplete while typing.

Verdict: update today if you run claude-code-action with allowed_non_write_users on GitHub-hosted runners - that combination was completely broken. Everyone else can update whenever; the rest is minor polish.

2.1.225 - claude agents finally asks before trusting a new folder (August 7, 2026)

• claude agents now shows the same workspace-trust prompt as claude before running in an unfamiliar directory - launching an agent used to skip that check entirely.
• A stored login's short-lived token could silently replace a long-lived CLAUDE_CODE_OAUTH_TOKEN, breaking headless sessions with a transient 401 until you restarted. Fixed.
• MCP OAuth servers on macOS could fail with a burst of 401s, looking like you'd never authenticated, whenever a keychain read timed out. Fixed.
• Gateway operators can now set a spend limit that Claude Code's usage warning actually names, along with the reset time and the operator's own message, once you hit it.
• SendMessage can now start a conversation with your Remote Control sessions on other machines by name, instead of only replying after they message you first.

(2.1.226, the next day, was bug fixes and reliability improvements only.)

The rest is the usual long tail: cross-session messages no longer sit parked without a notice or expiry in headless sessions, conversation history no longer breaks on Remote Control resume after a very large conversation gets compacted, hovering over another project's session in the agents list no longer changes where your next agent starts, claude self-hosted-runner now exits at startup with a clear error instead of registering and failing every session when its base directory can't be created, and a batch of VSCode Focus view and Remote Control polish.

Verdict: update whenever - nothing here forces your hand, but the workspace-trust prompt for claude agents and the headless-session 401 fix are worth having if you run agents against directories you don't fully trust, or run headless at all.

2.1.224 - self-hosted runners land, and sessions can finally talk to each other (August 7, 2026)

• Self-hosted environments: claude self-hosted-runner lets Team and Enterprise plans point web, mobile, and desktop sessions at their own machines or containers instead of Anthropic's hosted infrastructure.
• Claude Code sessions can now message each other across your machines - SendMessage to send, ListAgents to find them (macOS and Linux). If the target session is running with bypassed permissions, its inbound messages now sit in an approval queue instead of running immediately (new crossSessionInbound and dialogExpiry settings).
• Two silent isolation bugs are fixed: a sandbox deny rule written with a trailing slash (like denyRead: "~/.aws/") was being ignored on Linux and macOS, and long (200+ character) project paths could collide under a shared sanitized prefix - pointing one project's session list, rename, fork, or /resume at a different project's sessions.
• SendMessage used to report "Message sent" even when the write to a teammate's inbox had actually failed; failed deliveries now show as errors. Claude also finally sees why a sandboxed command was denied, instead of just that it was.
• The 200-subagent-per-session spawn cap is gone - long-running sessions no longer refuse new agents (the real concurrency and depth limits still apply).

Verdict: update today if you run sandboxed or worktree-isolated sessions - the trailing-slash and long-path bugs were both silently defeating isolation you thought you had. Everyone else can update whenever; self-hosted runners only matter if you're on a Team or Enterprise plan and want Claude Code sessions running on your own infrastructure.

2.1.223 - three permission bypasses close, and /review merges back into /code-review (August 5, 2026)

• Security: a crafted command, or one padded with tabs or invisible Unicode, could hide part of itself from Bash's permission check - so the command you approved was not always the command that ran. Both tricks are closed.
• Security: workflow scripts could use dynamic import() to run code outside the workflow sandbox. Closed.
• Security: an agent definition's bypassPermissions mode could override your org's policy disabling bypass permissions entirely. Closed.
• /review is an alias of /code-review again - the fast single-pass mode 2.1.202 split it into is gone. /code-review <level> <pr#> reviews a PR directly and now remembers the effort level you last typed instead of resetting every time.

The rest is the usual long tail: a /teleport hint now shows up in cloud sessions for continuing locally, CLAUDE_CODE_DISABLE_1M_CONTEXT auto-compacts every native 1M-context model down to 200K instead of a fixed list, managed settings from your org no longer stomp a machine-local env block, and a batch of gateway model-ID, sandbox, and session-resume fixes.

Verdict: update today. Three separate ways to fool your own permission prompts closing in one release is worth being current for, whether or not you have noticed any of them. If you liked the fast /review, note it is /code-review doing all the work again now.

2.1.222 - two more worktree escapes close, and ultraplan disappears (August 4, 2026)

• Security: worktree-isolated sessions and their subagents could still run destructive git commands against your real checkout - isolation now covers file edits and Bash in every session type, not just some.
• Security: a background agent task (summaries, compaction, renames) could bypass its own tool restrictions through a PreToolUse auto-allow hook. Closed.
• Security: a repo's checked-in .claude/settings.json could quietly turn Remote Control on for you. It can still turn it off, but turning it on now needs your own user-scope /config.
• "Connection closed mid-response" errors that were actually finished responses, and a startup connectivity check that hung behind an HTTPS proxy instead of timing out cleanly - both fixed, so a red error banner now means something actually failed.
• Removed: the ultraplan feature is gone.

The rest is the usual long tail: /usage was overattributing cost to MCP servers for turns that never touched their tool results, sessions weren't always linking to pull requests created after the branch was pushed, claude.ai connectors got falsely flagged as needing re-authorization, /diff and file-edit diffs now use raw git blob content instead of your configured diff driver, and a batch of screen-reader, enterprise model-alias, and custom-gateway fixes.

Verdict: another release where the security fixes matter more than the bullet count suggests. Update today if you run worktree-isolated subagents, background agents, or Remote Control - otherwise whenever. If you were using ultraplan, it's gone as of this update.

2.1.221 - a zsh permission bypass closes, and VSCode gets a Focus view (August 3, 2026)

• Security: zsh could run hidden commands inside [[ ]] regex conditionals without ever hitting Bash's permission check. Those commands now prompt for approval like everything else.
• VSCode gets a Focus view (Ctrl+Alt+F): it collapses tool activity into an expandable per-turn summary with a live "still working" indicator, so a busy tool run doesn't bury the actual conversation.
• Linux and WSL sandboxes can now mask credential files instead of blocking them outright: sandboxed commands see a stand-in value while the sandbox proxy swaps in the real one only as the request leaves. macOS still just blocks access to those files.
• Background sessions now act more like a teammate: they commit and push to save their work, open a draft PR only if the task actually calls for one, follow your CLAUDE.md's git conventions, and always tell you where the work ended up.
• MCP servers passed via --mcp-config used to connect too late in print mode (-p), so the model's first tool calls came out as plain text instead of running. Fixed.

The rest is the usual long tail: PowerShell paths with quote characters on Windows now prompt for approval instead of skipping the check, /fork sessions get their own worktree instead of sharing the original's, fast mode now tells you on the stream when credits run out instead of failing silently, Vim mode's yank register and undo confirmation stop resetting themselves mid-session, and a batch of Stats panel, Windows startup, and Bedrock/SSO fixes.

Verdict: update today if you use zsh - the permission bypass is a real hole, however narrow. Everyone else can update whenever; the Focus view and credential masking are welcome but nothing here forces your hand.

2.1.219 - Opus 5 becomes the default Opus model (July 24, 2026)

• Claude Opus 5 (claude-opus-5) is now the default Opus model, with a 1M-token context window and fast-mode pricing at $10/$50 per million tokens.
• New sandbox.network.strictAllowlist setting denies non-allowlisted hosts outright for sandboxed commands, instead of stopping to ask every time.
• Subagents can spawn nested subagents up to depth 3 by default again - 2.1.217 had capped this at 1 (no nesting). Set CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH=1 if you were relying on that tighter limit.
• Dynamic workflows now default to a "medium" size guideline (aim for fewer than 15 agents) instead of running unrestricted; change it in /config if you want more.
• claude -p no longer throws away the answer it already produced when a turn dies mid-stream on an API error.

(2.1.220, same day, was bug fixes and reliability improvements only.)

Verdict: update today if you use Opus at all - the price and context window are a real upgrade. If you were counting on 2.1.217's subagent-depth cap, check your env var before you update; nesting is back on by default.

2.1.218 - /code-review moves to the background, plus a hook-trust hole closed (July 22, 2026)

• /code-review now runs as a background subagent, so review output no longer fills up your conversation while it works.
• Security: agent frontmatter hooks could run from a folder you'd never actually granted workspace trust to. Hooks now require the agent file's own folder to have been trusted first.
• The left arrow key used to discard your whole conversation with no way to undo it. A press right after an edit now asks you to confirm, and Esc in the agent view returns you to the conversation it backgrounded instead of losing it.
• Windows paths with a \u-prefixed segment (like C:\Users\unicorn) were getting corrupted into CJK characters in tool inputs, which made those files inaccessible. Fixed.
• Skills marked context: fork now run in the background by default - opt a specific skill out with background: false if you want it to block like before.

The rest is the usual long tail: Bedrock application-inference-profile spend now meters at the right model's rate instead of overcharging, pull request events no longer get lost when a session exits right after creating one, a retry loop that kept re-sending doomed requests after a context-overflow error is fixed, a resumed session no longer fails every turn or crashes on a malformed transcript, fork-session lineage now survives compaction, and a batch of screen-reader, Bedrock setup-wizard, and prompt-history fixes.

Verdict: update today if you use agent frontmatter hooks at all - the untrusted-folder fix closes a real trust gap. Everyone else can update whenever, though the left-arrow and Windows path fixes are reason enough on their own.

2.1.217 - runaway subagents get reined in (July 21, 2026)

• Subagent spawning gets three guardrails at once: a default cap of 20 concurrently-running subagents (CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS to raise it), subagents no longer spawn their own nested subagents by default (CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH to allow deeper nesting), and --max-budget-usd now actually halts running background agents once the cap hits instead of just blocking new spawns. Together these stop one message from fanning out into an unbounded, unbudgeted swarm.
• Security: background session isolation wasn't canonicalizing symlinked working directories, so an isolated session could escape its workspace folder. Fixed.
• A real memory leak is fixed: truncated MCP tool outputs used to keep the full untruncated result in memory for the rest of the session - long sessions with big tool outputs get that headroom back.
• Corporate mTLS, TLS-verify, OAuth scope, and proxy settings being silently ignored in Claude Desktop sessions is fixed - if your org's network policies weren't applying there, this was why.
• A CLAUDE.md or SKILL.md frontmatter value with many brace groups could OOM-kill or stall the CLI before it even started. Brace expansion is now budget-bounded.

The rest is the usual long tail: emoji shortcode autocomplete in the prompt input, warnings instead of silent data loss when transcript writes fail, a Windows auto-update fix that could leave claude.exe missing, an Opus-4.8-on-Bedrock auto-compact fix, screen reader and Remote Control polish, an OTEL endpoint override bug, and a --resume crash on malformed transcripts.

Verdict: update today if you run subagents or background agents at any real scale - the concurrency, depth, and budget caps are the kind of thing you want in place before you hit the problem, not after. Everyone else can update whenever.

2.1.216 - a 40-bullet fix pile, with two more worktree escapes closed (July 20, 2026)

• Security: worktree-isolated subagents could still redirect git commands into your real checkout using git -C, --git-dir, or the GIT_DIR/GIT_WORK_TREE environment variables. Closed - the isolation guarantee no longer has this hole.
• Security: a symlink placed at .claude could redirect workflow saves and scheduled-task writes outside your project folder. Fixed.
• Long sessions get noticeably faster: message normalization cost was growing quadratically with turn count, which is why long sessions and resumes could stall for several seconds. Now fixed.
• Resuming a background agent session used to revert it to the default agent, silently dropping its custom prompt and tool restrictions. The agent's actual configuration is now restored on resume.
• Cloud sessions no longer lose your in-flight message if the container restarts mid-turn - the interrupted turn re-runs on resume instead of leaving the session stuck.

The rest is the usual long tail: auto mode no longer denies commands over a stale "HTTP 401" after your OAuth token rotates mid-session, worktree sessions landing in another project's leftover worktree, background sessions with no git repo being undeletable, a stale daemon lockfile that could let claude daemon stop --any kill an unrelated process, AskUserQuestion no longer nudging Claude to continue when your free-text answer asked it to wait, and a batch of Bash-parsing, PowerShell, fullscreen-UI, and Claude-in-Chrome fixes.

Verdict: two more worktree/symlink isolation gaps closed alongside a real background-agent bug. Update today if you run worktree-isolated subagents, background agents, or cloud sessions - otherwise whenever.

2.1.215 - /verify and /code-review stop running themselves (July 19, 2026)

• Claude used to invoke the /verify and /code-review skills automatically once it finished a change. It no longer does - you now run /verify or /code-review yourself when you want them.

Verdict: a default change, not a bug fix. If you were counting on Claude auto-reviewing its own work, add /verify or /code-review back into your routine - otherwise there is nothing to do here.

2.1.214 - the Bash permission checker gets six holes patched at once (July 18, 2026)

• Security: an allow rule like Edit(src/**) was meant to cover only the src/ folder in your working directory, but it was matching a src/ folder anywhere in the repo tree - so a rule you scoped to one place could quietly approve writes somewhere else entirely. Fixed, along with a cluster of adjacent gaps: a Windows PowerShell 5.1 bypass, commands over 10,000 characters skipping the prompt, zsh comparisons and file-descriptor redirects the checker was misreading as harmless, and some help/man invocations that could run unsafe options without asking.
• Security: permission prompts on remote sessions could let a command start running before you'd actually confirmed the local dialog - closed, so approval now means what it says.
• Scheduled tasks no longer treat their own configured prompt as untrusted input to refuse. If you run routines like this one, the prompt you set up now gets delivered as the session's real task instead of tripping an injection guard.
• Background sessions get a reliability pass: a crashed daemon could delete the control socket of the healthy replacement that took over for it, sessions parked idle with /background could leave daemons and worker processes running forever, and completed or non-git-folder sessions that were impossible to remove via claude rm or the agents view now clean up properly.
• Windows PowerShell tool: fixes for commands hanging when a child process waits on stdin, crashes on non-UTF-8 input or non-ASCII output, >/>> writing UTF-16LE files nothing else could read as UTF-8, and raw ANSI escape codes leaking into error text.

The rest is the usual long tail: a new EndConversation tool for abusive or jailbreak sessions, a progress heartbeat for long-running tool calls, several OpenTelemetry attribute additions, docker commands with daemon-redirect flags now prompting, a GrowthBook crash fix, and a batch of smaller session, hook, and telemetry cleanups.

Verdict: a security release wearing a fix-pile costume. Update today if you lean on Edit(pattern/**)-style allow rules, use remote or background sessions, or run scheduled automation - otherwise whenever.

2.1.212 - plan mode was letting Bash run without asking (July 16, 2026)

• Security: plan mode was supposed to stop and ask before touching anything, but file-modifying Bash commands like touch and rm could slip through with no permission prompt and no SDK canUseTool callback. Fixed.
• Security: creating a worktree that followed a repo-committed symlink at .claude/worktrees could write files outside your repository. Fixed.
• /fork splits into two commands: it now copies your conversation into a new background session with its own row in claude agents, while you keep working in the original. The old in-session delegate behavior is now /subtask.
• New runaway-loop guards: WebSearch calls cap at 200 per session, subagent spawns cap at 200 per session, and MCP tool calls still running after 2 minutes now move to the background automatically instead of blocking your session - all tunable via environment variables.
• Fixed conversations with lots of images wrongly failing with "Request too large," and web search/fetch silently handing back literal "API Error" text as if it were a real result.

The rest is the usual long tail: /resume now shows a picker that includes deleted sessions and reopens your pick as a background session, reopening a stopped background session no longer fails silently, headless/SDK sessions can switch models mid-turn instead of waiting for the next one, and a batch of /ultrareview, OpenTelemetry, and terminal-rendering fixes.

Verdict: two real trust bugs buried in a 48-bullet pile. Update today if you rely on plan mode's permission gate or use worktree-isolated subagents - otherwise whenever.

2.1.211 - your approval prompts can't be faked anymore (July 15, 2026)

• Security: a permission prompt relayed to a chat channel (Slack and similar) could be visually altered with invisible or look-alike characters hidden in the tool input, so what you approved wasn't necessarily what ran. Those characters are now stripped before you see the prompt.
• Security: auto mode could override a hook's ask decision on unsandboxed Bash commands and run them anyway. A hook that says "ask" is now honored no matter what.
• Background agents stopped making things up: Claude used to sometimes report a still-running agent as finished. It now waits for the real result instead of fabricating one.
• If you run Claude Code through Bedrock, Vertex, Mantle, or Foundry, a caching bug was billing your trailing system context as fresh input tokens on every single request. That's fixed - worth checking your last invoice if this applies to you.
• Sessions that share one credential store (common in team or CI setups) no longer all get logged out at once when the machine wakes from sleep.

The rest is the usual long tail: subagents with an explicit model override no longer forget it on resume, plugin MCP servers now reconnect properly after an idle web session wakes, /clear resets the statusline cost counter, and a pile of Claude in Chrome, Windows, and accessibility fixes.

Verdict: two real security fixes and a billing bug dressed up as an ordinary fix pile. Update today if you relay approvals through a chat integration, rely on hooks under auto mode, or run on Bedrock/Vertex/Mantle/Foundry - otherwise whenever.

2.1.210 - subagents actually stay in their worktree now (July 14, 2026)

• Worktree-isolated subagents could run git-mutating commands against your real repo checkout instead of their own isolated copy - the isolation guarantee is fixed for real now, not just for file writes.
• The Agent tool is hardened against indirect prompt injection from content a subagent reads, and the ultracode keyword opt-in no longer fires on non-human input like webhook payloads or relayed PR comments - both close paths where content you didn't type could change what a session does.
• Plan approvals without edits stopped mislabeling themselves "(edited by user)" and overwriting your plan file with a stale snapshot - a real way to lose planning work, now fixed.
• A hook callback timeout was being reported to the model as a user rejection, which made unattended sessions quietly stop and wait instead of erroring properly - matters if you run headless or background sessions.
• Unmatched $1/$2 placeholders in skills and commands used to get silently stripped. If a skill's arguments looked wrong for no reason, this was why - they're preserved verbatim now.

(2.1.209, same day, reverted an overly broad guard that had been blocking /model and other dialogs inside claude agents background sessions.)

The rest is the usual long tail: claude attach reliability during session transitions, a session crash from a tool result returning a bigint or plain text, memory writes over the MEMORY.md index limit now error instead of truncating silently, stale git worktree lock files from killed background sessions finally get swept automatically, and a batch of agents-view and accessibility polish.

Verdict: a security and reliability release wearing a fix-pile costume. The worktree isolation bug and the prompt-injection hardening are worth updating for even if nothing else here applies to you - update today if you run isolated subagents or unattended sessions, otherwise whenever.

2.1.208 - a 45-bullet fix pile, with a real memory cleanup (July 13, 2026)

• Long sessions get an actual cleanup: MCP server stderr no longer piles up to 64 MB per server, LSP documents now cap at 50 open docs instead of growing forever, and headless/SDK sessions stop ballooning from large tool results.
• Sessions with lots of MCP tools get noticeably snappier - tool-pool assembly is now cached, cutting per-call overhead by up to 7x at high tool counts.
• Session transcripts shrink up to 79x in edit-heavy sessions, and checkpoint disk usage is bounded by pruning old file-history backups instead of keeping every version.
• Added an opt-in screen reader mode (claude --ax-screen-reader) that renders plain text instead of the usual fullscreen UI.
• rm -rf and other catastrophic deletes now get caught even when hidden inside $(...), backticks, or <(...) - previously only the plain form triggered a confirmation prompt in auto mode and --dangerously-skip-permissions.

The rest is the usual long tail: background-session daemon and attach fixes, a fast-mode toggle that stopped restoring itself, several tool error-message improvements (Read, Grep, Glob), and a Bedrock SSO regression from 2.1.207.

Verdict: all fixes, no new workflow to learn - but if you run long sessions or lean on lots of MCP servers, the memory and speed cleanup alone makes this worth updating for. Update whenever.

2.1.207 - closing three settings and plugin loopholes (July 10, 2026)

• Security: a non-interactive run (claude -p, the SDK) could get its managed settings permanently marked as consented without ever showing you the security dialog. Fixed - the dialog now shows, or the settings do not apply.
• Security: plugin hooks written with ${user_config.*} inside a shell-form command were vulnerable to shell injection. That interpolation is now rejected; hooks read config values with $CLAUDE_PLUGIN_OPTION_<KEY> or an exec-form command instead.
• Security: plugin option values are no longer read from a project's checked-in .claude/settings.json - only your user settings, --settings, or managed settings count now. A cloned repo can no longer quietly configure plugin behavior for you.
• Auto mode got the same fix: it no longer reads autoMode from repo-resident .claude/settings.local.json. Set it in ~/.claude/settings.json instead.
• The terminal freezing and keystrokes lagging during long streamed responses (big lists, tables, code blocks) is fixed - if that was happening to you, it was not your machine.
• If you run Claude Code through Bedrock, Vertex AI, or a Foundry deployment: auto mode no longer needs the CLAUDE_CODE_ENABLE_AUTO_MODE opt-in, and Bedrock, Vertex, and Claude Platform on AWS now default to Claude Opus 4.8.

The rest is the usual pile: a crash loop in agent teams from a malformed teammate mailbox message, a few Remote Control reliability fixes (task status surviving a reconnect, mobile and web now showing background progress from desktop-hosted sessions), a Bedrock SSO credential-refresh loop, and /usage-credits now rejecting malformed amounts instead of silently truncating them.

Worth doing after this update: if you use plugins or auto mode at all, this release closes real gaps where a cloned repo could influence your settings without asking - update for that alone even if nothing else here applies to you.

2.1.206 - a 28-bullet fix pile (July 9, 2026)

• If your MCP tool calls were dying at exactly 60 seconds no matter what timeout you configured, this is the fix: a per-server request_timeout_ms in .mcp.json was being ignored in fresh sessions. OAuth MCP servers also stop demanding manual re-authentication after a single failed token refresh.
• An expired login used to fail every model with a misleading "There's an issue with the selected model" error. Now it just tells you to run /login.
• Background agents upgrade themselves right after a Claude Code update, instead of making you sit through a slow stale-session upgrade when you attach.
• /doctor gained a check that suggests trimming checked-in CLAUDE.md files of anything Claude could work out from the codebase on its own.

All fixes, no new workflow. Update whenever - though if you run long MCP tool calls, the timeout fix alone is worth forcing it today.

2.1.205 - /doctor becomes a full checkup (July 8, 2026)

• /doctor is now a complete setup checkup that can diagnose and fix issues instead of just listing them. /checkup is an alias.
• Auto mode got two safety guards: it asks before running rm -rf on a variable it cannot resolve, and it blocks tampering with session transcript files.
• The claude agents view got a real upgrade: sessions show a colored state word and a plain-English headline instead of raw tool-call text, and sessions that touch a pull request now link it.
• The auto-updater streams downloads to disk instead of buffering them, cutting roughly 400 MB of peak memory during updates.

Worth doing after this update: run /doctor once. It catches config problems you did not know you had. (2.1.204, same day, was a single fix for hook streaming in headless sessions.)

2.1.203 - background sessions stop dying quietly (July 7, 2026)

• You now get a warning before your login expires, so background sessions stop getting interrupted mid-run.
• A batch of background-agent fixes landed: sessions no longer become permanently unresponsive when a session token goes stale, Windows agents no longer inherit a stale PATH, and a bug that sent API keys to the wrong endpoint (failing with 401) is fixed.
• Worktree-isolated subagents sometimes ran shell commands in the parent checkout instead of their own worktree. Fixed - this one could silently write to the wrong working copy.
• Small but nice: a grey pause badge now shows in the footer when you are in manual permission mode.

If you run agents in the background and had ghost failures over the last month, this release and 2.1.199 below are probably why they stop.

2.1.202 - /review is fast again (July 6, 2026)

• /review <pr> went back to being a fast single-pass review. The heavy multi-agent version is /code-review <level> <pr#> - two commands, two speeds, pick per situation.
• New "Dynamic workflow size" setting in /config controls how many agents Claude spawns in dynamic workflows.
• The resume picker no longer takes minutes (and a pile of memory) in repositories with many git worktrees.
• Re-invoking an already-loaded skill no longer appends a duplicate copy of its instructions to context - a quiet token saver if you watch your usage.

2.1.199 and 2.1.200 - the resilience batch (July 2-3, 2026)

• Partial output is now kept when the API errors mid-stream, instead of the whole turn being discarded.
• Transient rate-limit errors (429s that are not your usage limit) retry automatically with backoff instead of failing the turn.
• Subagents that die on a rate limit or server error now return their partial work and report the error, instead of silently failing or - worse - reporting success.
• AskUserQuestion dialogs no longer auto-continue by default, and the "default" permission mode is now called "Manual" everywhere, which is what it always was.
• Stacked skills: /skill-a /skill-b do X now loads all leading skills (up to 5), not just the first.

2.1.198 - subagents go background by default, Chrome goes GA (July 1, 2026)

The biggest workflow change of this batch:

• Subagents now run in the background by default. Claude keeps working while they run and gets notified when they finish - no more sitting idle waiting for a delegate.
• Claude in Chrome is generally available.
• Background agents launched from claude agents now commit, push, and open a draft PR when they finish code work in a worktree, instead of stopping to ask.
• The built-in Explore agent now inherits your session's model instead of always running on a small one - exploration answers got noticeably better.
• New /dataviz skill for chart and dashboard design, with a runnable color-palette validator.

If you use parallel agents at all, this release changes how your sessions feel day to day. My parallel-agents setup tip pairs well with it.

2.1.197 - Claude Sonnet 5 becomes the default (June 30, 2026)

One line in the changelog, the biggest single change of the month: Claude Sonnet 5 is now the default model in Claude Code, with a native 1M-token context window and promotional pricing of $2/$10 per million tokens through August 31. You need 2.1.197 or newer to get it - if claude --version shows something older, that alone is the reason to update.

2.1.196 - a security fix worth knowing about (June 29, 2026)

• Security: a cloned repo can no longer self-approve its own .mcp.json servers by committing a .claude/settings.json. Untrusted workspaces now show servers as pending approval. This closes a real attack path where a malicious repo could auto-start MCP servers on your machine the moment you open it.
• Org admins can now set organization default models.
• Sessions get readable default names at start, and file attachments in chat became Cmd/Ctrl-clickable.
• Background reliability: long-running commands survive the session process being stopped or updated, and workers killed by a daemon restart auto-resume.

Older releases

This page explains releases from 2.1.196 (June 29, 2026) forward. Everything older is in the official CHANGELOG.md - complete, terse, and undated. If an older release still matters for something current, it gets folded into the explanation above instead of listed separately.

FAQ

How often does Claude Code update? Almost daily, often more than once a day. Most releases are bug fixes; a feature release worth changing your workflow for lands every week or two. This page separates the two so you can skim.

How do I check my Claude Code version? Run claude --version in your terminal, or /doctor inside a session for a full setup checkup (available since 2.1.205).

How do I update Claude Code? Claude Code updates itself automatically by default. To force it, run claude update. If you installed via npm, npm install -g @anthropic-ai/claude-code@latest does the same.

Where is the official Claude Code changelog? In the anthropics/claude-code repository on GitHub, in CHANGELOG.md. It is complete but terse - raw bullet points with no dates or context. This page adds the dates, the plain-English explanation, and a judgment call on what matters.

Do I need to update Claude Code to get new models? Sometimes. New models can require a minimum version - Claude Sonnet 5 needs 2.1.197 or newer. If a model announcement says update to access, check claude --version first.

I read every release the day it ships, because releases change defaults - permission modes get renamed, models get swapped, tools get new flags. That tracking is also what keeps ClockedCode current: the curated setup it installs reflects what the current Claude Code version actually supports, so one paste gets you a configuration that matches today's tool, not January's.