← All guides

> claude --version

Current version

v2.1.241

Published August 22, 2026

ChangelogUpdates

Claude Code Changelog: Every Release Explained in Plain English

By Neo Zino - builder of ClockedCode·Updated August 23, 2026·42 min read

The Claude Code changelog in plain English: what each release actually changes, why it matters, and whether you should care. Updated with every release.

Latest version: 2.1.241, published August 22, 2026.

TL;DR: The last few weeks were unusually big. Claude Sonnet 5 became the default model with a 1M-token context window (2.1.197), subagents now run in the background by default (2.1.198), Claude in Chrome went GA (2.1.198), /doctor became a full setup checkup (2.1.205), and Claude Opus 5 became the default Opus model with the same 1M-token context window (2.1.219). Most recently, self-hosted environments arrived (2.1.224), letting Team and Enterprise plans run Claude Code sessions on their own machines instead of Anthropic's hosted infrastructure. If your install is older than 2.1.197, update today.

2.1.240 and 2.1.241 - nothing to see here (August 22, 2026)

Both releases shipped as a single line each: "Bug fixes and reliability improvements," with no bullets underneath. Nothing user-visible to report.

Verdict: update whenever - there's no reason to rush this one.

2.1.239 - a 59-bullet fix pile, with a Bedrock billing bug closed (August 21, 2026)

• Bedrock users behind a proxy that strips the response Content-Type header were being silently double-billed: streaming quietly fell back to non-streaming and reran every turn from scratch. Fixed.
• A race with queued prompts: pressing Esc while a prompt was queued could let the next turn finish early and leave the session sitting idle while Claude was actually still working, and resubmitting the queued prompt afterward could repeat actions Claude had already taken. Fixed.
• Fullscreen mode gets a cluster of fixes: mouse movement no longer inserts stray text like "35;150;7M" into the prompt, clicking the terminal just to refocus it no longer answers a permission prompt or presses a button, and panels like /config and /workflows no longer cover the latest messages or overflow off-screen.
• WebFetch was holding expired page content in memory for the whole session instead of releasing it after the intended 15 minutes. Fixed.
• Windows catches up to macOS and Linux: cross-session messaging now works, so Claude Code sessions on your machines can message each other with SendMessage and find each other with ListAgents.

The rest is the usual long tail: a hang at startup behind an HTTPS proxy on Bedrock with SSO, remote MCP servers staying marked failed after a transient 5xx, custom session titles disappearing from /resume on long conversations, claude -c picking up the wrong session when directory names differed only by punctuation, a JetBrains pause on Edit/Write calls, /goal check-ins that now back off over time instead of repeating every 30 minutes, and a batch of keybinding and clipboard fixes.

Verdict: update today if you run Bedrock behind a proxy - that billing bug was real money. Everyone else can update whenever; nothing here changes your day-to-day beyond fewer rough edges in fullscreen mode.

2.1.238 - a memory leak fix, and a Remote Control reliability pass (August 20, 2026)

• Long interactive sessions could grow memory without bound as subagent tool results piled up. Fixed - results are now released once they scroll out of the recent display window.
• Custom, project, and plugin output styles used to drift back to Claude's default voice partway through a session. Fixed - your chosen style now sticks.
• MCP headersHelper (which runs a command to mint auth headers) on a project's .mcp.json or an inline agent-file server now requires that folder's trust dialog to have been accepted first, instead of running unprompted.
• Remote Control gets a real reliability pass: messages sent from web or Desktop mid-turn no longer vanish from the transcript, model picks made on a phone sync back to the terminal, sign-out no longer reports a fake failed-reconnect error, and ListAgents/SendMessage finally work from server-mode and Desktop/IDE-hosted sessions instead of claiming Remote Control isn't connected.
• New keybindingFlavor: "readline" setting makes Ctrl+W in the prompt delete back to the previous whitespace, Bash-style, instead of the whole word.

The rest is the usual long tail: two new self-hosted-runner flags for graceful shutdown and proxy re-authentication, a fix for self-hosted runners getting evicted after one slow poll, MCP elicitation dialogs going blank on very long URLs, leftover /tmp/claude-*-cwd files after a killed Bash command, held Backspace being dropped on slow SSH links, wide-character clipping in permission-prompt diffs, a bracketed-paste glitch after killing a suspended session, faster macOS startup, and a claude-api skill update for the Aug 19 Managed Agents release.

Verdict: update today if you run long sessions (the memory leak was real) or lean on Remote Control from a phone or web browser - both get meaningfully better here. The MCP headersHelper trust requirement is worth knowing if you use plugin marketplaces with one. Everyone else can update whenever.

2.1.237 - a Concise output style, and a caching fix for gateway users (August 19, 2026)

• New "Concise" output style: Claude leads with results and skips the preamble and narration, doing the same work with less chatter around it. Turn it on under Output style in /config.
• Fixed prompt caching breaking for sessions that go through an LLM gateway or a custom base URL - caching now works there again.

Verdict: try Concise if Claude's running commentary gets in your way. Everyone routing through a gateway or a custom base URL should update to get caching back; otherwise update whenever.

2.1.236 - a default-model env var, and a directory-deletion bug closed (August 19, 2026)

• New ANTHROPIC_DEFAULT_MODEL environment variable sets which model new sessions start on. Unlike the older ANTHROPIC_MODEL, a /model pick still overrides it and sticks across restarts.
• If you'd cd'd into a directory during a session and then deleted it, clipboard copy, background housekeeping, background sessions, and local MCP logs could all quietly stop working. Fixed - this had been broken since 2.1.229.
• macOS sandbox: wildcard read-deny rules like **/.env now actually hold inside allowed read regions, cover everything inside a matched directory, and can't be dodged by renaming the file they're supposed to block.
• Cross-session SendMessage gets notify_when_idle: ask another local Claude Code session to ping you once, the next time it goes idle, instead of polling it yourself.
• [VSCode] Screen reader support lands for the transcript - live announcements for replies, permission requests, and errors, plus per-turn heading navigation.

The rest is the usual long tail: the fullscreen renderer no longer breaks permanently after one failed start, the /model picker no longer overflows a short terminal, a SendMessage bug with malformed closing tags, a subprocess-crash regression from 2.1.234, several auto mode refinements (Monitor commands now reviewed like Bash, parity on Bedrock/Vertex/Foundry, a git-status spoofing fix), a /usage credits row for Team and Enterprise, faster Remote Control offline detection, and a batch of terminal-rendering and UI polish.

Verdict: update today if you use directories you delete mid-session (that bug touched more than it looked like) or rely on macOS sandbox read-deny rules. The ANTHROPIC_DEFAULT_MODEL env var and VSCode screen reader support are worth knowing about either way; everyone else can update whenever.

2.1.235 - two permission-prompt bugs could grant or pick the wrong thing (August 18, 2026)

• A stray Shift+Tab inside the permission prompt's comment field was approving the edit and granting session-wide edit permission instead of just closing the field. Fixed - that keystroke now does what it looks like it does.
• Dialogs in general had a similar problem: navigating with arrow keys and hitting Enter in quick succession could select the option you'd just moved to instead of whatever was highlighted a moment before. Matters most in a permission prompt, where the wrong selection means the wrong grant.
• Permission dialogs are also more honest now - what they display and offer as "don't ask again" always matches what the grant would actually cover, and "don't ask again" is withheld whenever the dialog can't show everything it applies to.
• Background cloud sessions like /ultrareview or /autofix-pr use noticeably less memory and CPU: their event streams stopped being re-scanned and re-rendered on every single update.
• New: an opt-in spellcheck setting underlines misspelled words in the prompt input as you type, using whatever aspell, hunspell, or ispell you already have installed.

Verdict: update today if you spend real time answering permission prompts - the Shift+Tab and dialog-selection bugs could both hand out a grant you didn't mean to give. Everyone else can update whenever; nothing else here is urgent.

2.1.234 - sessions auto-continue after usage limits reset, and permission answers stop vanishing (August 17, 2026)

• Claude Code now auto-continues your session as soon as a claude.ai usage limit resets, instead of leaving you stalled until you notice and nudge it yourself. Turn it off in /config ("Continue automatically at usage limit") if you'd rather it just stop.
• Fixed auto mode in very long, already-compacted sessions repeatedly re-checking and denying sandboxed commands' network access - it kept forgetting approvals it had already granted earlier in the conversation.
• Fixed session-scoped permission answers, including denies, getting silently dropped when you answered a background subagent's tool permission prompt. Your answer wasn't actually being remembered.
• The built-in claude-api skill used to cost roughly 200k+ tokens of context just to load. It now loads reference docs on demand and costs about 25k - a real difference in sessions that touch the Claude API.
• Security: Windows NT-namespace paths (the \??\ device prefix) are now blocked everywhere a file gets pre-approved - remote file reads, session restore, CLAUDE.md includes, workflow scripts, uploads - closing the rest of the credential-leak vector 2.1.233 started patching.

Verdict: update today if you're on Windows (this finishes the NT-namespace fix from 2.1.233) or you run long auto-mode sessions that got stuck re-approving network access. Everyone else can update whenever - the usage-limit auto-continue and the much cheaper claude-api skill are welcome, but nothing here is urgent.

2.1.233 - TodoWrite quietly disappears on newer models, and Windows closes a credential-leak bypass (August 14, 2026)

• Security: a Windows path spelled with the NT \??\ device prefix could slip past UNC path validation, opening an NTLM credential-leak vector. Closed - no action needed beyond updating.
• TodoWrite and the task-tracking tools (TaskCreate/Get/Update/List) are now off by default on Opus 4.8, Sonnet 5, Fable 5, Mythos 5, and newer models. If your workflow depends on visible todo lists, set CLAUDE_CODE_ENABLE_TODO_TOOLS=1 to get them back.
• Two Windows regressions from yesterday's 2.1.232 are fixed: auto mode no longer stops for manual approval on ordinary cd dir && command > file Bash commands, and the Cygwin-symlink and input-redirection permission changes from that release are reverted until a narrower fix ships.
• Cloud sessions were sometimes marked as lost if the environment shut down while Claude was waiting on a permission prompt. Fixed.
• MCP v2 connections could get stuck endlessly reopening the subscriptions stream against servers that close long-held connections on a fixed timeout - common on serverless hosts. Fixed.

Verdict: update today if you're on Windows - the credential-leak fix and the two 2.1.232 regressions all land here. Also check your workflow if you're on Sonnet 5, Opus 4.8, Fable 5, or Mythos 5 and rely on TodoWrite: it's now opt-in. Everyone else can update whenever.

2.1.232 - three more permission bypasses close, and sessions get easier to talk to (August 13, 2026)

• Security: three separate holes close at once - a PowerShell trick that could silently overwrite $PSDefaultParameterValues to redirect where later commands write, a Windows Git Bash bug where Cygwin-style symlinks slipped past the permission check, and nested git repositories that were silently inheriting trust from a parent folder instead of asking for their own. None of these needed you to do anything wrong to be exposed.
• Cross-session messaging gets easier to actually use: type @ in your prompt to mention another named Claude session and Claude reaches it with SendMessage directly, delivery to a name that matches one live session no longer stops to ask you to confirm first, and two sessions on the same machine can no longer collide on the same name.
• GitLab is now a first-class citizen alongside GitHub: secret redaction covers the full family of GitLab token types, the glab CLI gets the same sandbox and credential protections gh already had, and plugin marketplaces can point at a gitlab.com repo URL the same way they point at a GitHub one.
• Fixed: MCP connections used to hang for the full 30 seconds when a server failed to answer or sent back a malformed reply during setup. They now fail fast instead of stalling your session.
• Remote Control got a real reliability pass: sessions no longer show up as a duplicate claude.ai conversation every time you resume from Desktop or an IDE, bridge sessions restore their history after a worker restart instead of losing it, and reconnecting no longer silently yanks Remote Control away from another device that was using it.

(2.1.231, also August 13, was a single fix: MCP OAuth sign-in was failing with a redirect URI mismatch for servers that use a pre-registered OAuth client, like Slack.)

Verdict: update today if you use PowerShell, Git Bash on Windows, or work across nested git repositories - all three permission bypasses are closed here. Everyone else can update whenever; the session-naming, GitLab, and Remote Control fixes are welcome but nothing here is urgent for a single-session GitHub user.

2.1.229 - two more ways to crash on resume close, and VSCode gets session groups (August 12, 2026)

• Resuming a session could throw you straight to the error screen two different ways: if any turn in its history had a tool call with a bad (non-string) file path, glob, or command value, or if your terminal window was narrow enough to trigger a rendering crash in a progress bar or markdown table. Both are fixed, so --resume and --continue are safe to rely on again.
• Long streamed responses could visibly glitch - part of the text disappearing mid-print, then the whole response printing twice. Fixed.
• The GitHub Action that /install-github-app sets up could finish reviewing a pull request without ever posting the review, so it looked like nothing had run. Fixed.
• VSCode gets session groups in the sidebar: right-click to create, rename, or delete one, and Cmd/Ctrl- or Shift-click to move several sessions into it at once.

Verdict: update today if --resume or --continue has crashed on you lately - both crash paths are closed here. Everyone else can update whenever; the streaming glitch and the silent PR-review miss are minor annoyances, not blockers.

2.1.228 - session cleanup stops eating your memory files (August 11, 2026)

• A session-cleanup bug could delete the contents of your project's memory folder outright. Fixed - if files there have gone missing lately, this was why.
• Interactive sessions could freeze completely - no redraws, but the process kept running underneath - after a rare internal layout error. You had to kill and restart to get input back; that dead end is closed.
• Skills synced in from claude.ai are hardened: they can no longer shadow your local commands or MCP prompts, their descriptions are sanitized before display, and their bodies can no longer run ! shell commands or expand @-file references on your machine.
• Remote Control's /resume while connected could leak the resumed conversation's title or history into the session you were already connected to. Fixed.
• The Write tool now lets newer models overwrite a file they haven't read yet this session, matching what the Edit tool already allowed - a small safety-rule loosening if you were relying on the stricter behavior. Older models still need the read first.

Verdict: update today if you use claude.ai-synced skills or Remote Control - both had real trust gaps closed here. Everyone else should still update soon: the memory-folder deletion and frozen-session bugs are the kind that cost you work before you notice.

2.1.227 - claude-code-action's Bash commands work again (August 10, 2026)

• claude-code-action on GitHub-hosted runners: every Bash command was failing outright when allowed_non_write_users was set. Fixed - if your CI workflow uses that option, this was breaking every run.
• A session that started with an expired login token could evaluate your feature flags without checking your subscription tier, which was wrongly telling Max plan users to enable usage credits for Fable. Fixed.
• /tui used to resurrect a conversation after you had rewound it past its first message. It stays gone now.
• Slash-command menu cleanup: blue now marks only the selected row instead of bleeding onto others, matched characters are bolded instead of recolored, and emoji or accented command names keep their glyphs.
• Fewer event-loop stalls on file-not-found suggestions and at-mention size checks - snappier autocomplete while typing.

Verdict: update today if you run claude-code-action with allowed_non_write_users on GitHub-hosted runners - that combination was completely broken. Everyone else can update whenever; the rest is minor polish.

2.1.225 - claude agents finally asks before trusting a new folder (August 7, 2026)

• claude agents now shows the same workspace-trust prompt as claude before running in an unfamiliar directory - launching an agent used to skip that check entirely.
• A stored login's short-lived token could silently replace a long-lived CLAUDE_CODE_OAUTH_TOKEN, breaking headless sessions with a transient 401 until you restarted. Fixed.
• MCP OAuth servers on macOS could fail with a burst of 401s, looking like you'd never authenticated, whenever a keychain read timed out. Fixed.
• Gateway operators can now set a spend limit that Claude Code's usage warning actually names, along with the reset time and the operator's own message, once you hit it.
• SendMessage can now start a conversation with your Remote Control sessions on other machines by name, instead of only replying after they message you first.

(2.1.226, the next day, was bug fixes and reliability improvements only.)

The rest is the usual long tail: cross-session messages no longer sit parked without a notice or expiry in headless sessions, conversation history no longer breaks on Remote Control resume after a very large conversation gets compacted, hovering over another project's session in the agents list no longer changes where your next agent starts, claude self-hosted-runner now exits at startup with a clear error instead of registering and failing every session when its base directory can't be created, and a batch of VSCode Focus view and Remote Control polish.

Verdict: update whenever - nothing here forces your hand, but the workspace-trust prompt for claude agents and the headless-session 401 fix are worth having if you run agents against directories you don't fully trust, or run headless at all.

2.1.224 - self-hosted runners land, and sessions can finally talk to each other (August 7, 2026)

• Self-hosted environments: claude self-hosted-runner lets Team and Enterprise plans point web, mobile, and desktop sessions at their own machines or containers instead of Anthropic's hosted infrastructure.
• Claude Code sessions can now message each other across your machines - SendMessage to send, ListAgents to find them (macOS and Linux). If the target session is running with bypassed permissions, its inbound messages now sit in an approval queue instead of running immediately (new crossSessionInbound and dialogExpiry settings).
• Two silent isolation bugs are fixed: a sandbox deny rule written with a trailing slash (like denyRead: "~/.aws/") was being ignored on Linux and macOS, and long (200+ character) project paths could collide under a shared sanitized prefix - pointing one project's session list, rename, fork, or /resume at a different project's sessions.
• SendMessage used to report "Message sent" even when the write to a teammate's inbox had actually failed; failed deliveries now show as errors. Claude also finally sees why a sandboxed command was denied, instead of just that it was.
• The 200-subagent-per-session spawn cap is gone - long-running sessions no longer refuse new agents (the real concurrency and depth limits still apply).

Verdict: update today if you run sandboxed or worktree-isolated sessions - the trailing-slash and long-path bugs were both silently defeating isolation you thought you had. Everyone else can update whenever; self-hosted runners only matter if you're on a Team or Enterprise plan and want Claude Code sessions running on your own infrastructure.

2.1.223 - three permission bypasses close, and /review merges back into /code-review (August 5, 2026)

• Security: a crafted command, or one padded with tabs or invisible Unicode, could hide part of itself from Bash's permission check - so the command you approved was not always the command that ran. Both tricks are closed.
• Security: workflow scripts could use dynamic import() to run code outside the workflow sandbox. Closed.
• Security: an agent definition's bypassPermissions mode could override your org's policy disabling bypass permissions entirely. Closed.
• /review is an alias of /code-review again - the fast single-pass mode 2.1.202 split it into is gone. /code-review <level> <pr#> reviews a PR directly and now remembers the effort level you last typed instead of resetting every time.

The rest is the usual long tail: a /teleport hint now shows up in cloud sessions for continuing locally, CLAUDE_CODE_DISABLE_1M_CONTEXT auto-compacts every native 1M-context model down to 200K instead of a fixed list, managed settings from your org no longer stomp a machine-local env block, and a batch of gateway model-ID, sandbox, and session-resume fixes.

Verdict: update today. Three separate ways to fool your own permission prompts closing in one release is worth being current for, whether or not you have noticed any of them. If you liked the fast /review, note it is /code-review doing all the work again now.

2.1.222 - two more worktree escapes close, and ultraplan disappears (August 4, 2026)

• Security: worktree-isolated sessions and their subagents could still run destructive git commands against your real checkout - isolation now covers file edits and Bash in every session type, not just some.
• Security: a background agent task (summaries, compaction, renames) could bypass its own tool restrictions through a PreToolUse auto-allow hook. Closed.
• Security: a repo's checked-in .claude/settings.json could quietly turn Remote Control on for you. It can still turn it off, but turning it on now needs your own user-scope /config.
• "Connection closed mid-response" errors that were actually finished responses, and a startup connectivity check that hung behind an HTTPS proxy instead of timing out cleanly - both fixed, so a red error banner now means something actually failed.
• Removed: the ultraplan feature is gone.

The rest is the usual long tail: /usage was overattributing cost to MCP servers for turns that never touched their tool results, sessions weren't always linking to pull requests created after the branch was pushed, claude.ai connectors got falsely flagged as needing re-authorization, /diff and file-edit diffs now use raw git blob content instead of your configured diff driver, and a batch of screen-reader, enterprise model-alias, and custom-gateway fixes.

Verdict: another release where the security fixes matter more than the bullet count suggests. Update today if you run worktree-isolated subagents, background agents, or Remote Control - otherwise whenever. If you were using ultraplan, it's gone as of this update.

2.1.221 - a zsh permission bypass closes, and VSCode gets a Focus view (August 3, 2026)

• Security: zsh could run hidden commands inside [[ ]] regex conditionals without ever hitting Bash's permission check. Those commands now prompt for approval like everything else.
• VSCode gets a Focus view (Ctrl+Alt+F): it collapses tool activity into an expandable per-turn summary with a live "still working" indicator, so a busy tool run doesn't bury the actual conversation.
• Linux and WSL sandboxes can now mask credential files instead of blocking them outright: sandboxed commands see a stand-in value while the sandbox proxy swaps in the real one only as the request leaves. macOS still just blocks access to those files.
• Background sessions now act more like a teammate: they commit and push to save their work, open a draft PR only if the task actually calls for one, follow your CLAUDE.md's git conventions, and always tell you where the work ended up.
• MCP servers passed via --mcp-config used to connect too late in print mode (-p), so the model's first tool calls came out as plain text instead of running. Fixed.

The rest is the usual long tail: PowerShell paths with quote characters on Windows now prompt for approval instead of skipping the check, /fork sessions get their own worktree instead of sharing the original's, fast mode now tells you on the stream when credits run out instead of failing silently, Vim mode's yank register and undo confirmation stop resetting themselves mid-session, and a batch of Stats panel, Windows startup, and Bedrock/SSO fixes.

Verdict: update today if you use zsh - the permission bypass is a real hole, however narrow. Everyone else can update whenever; the Focus view and credential masking are welcome but nothing here forces your hand.

2.1.219 - Opus 5 becomes the default Opus model (July 24, 2026)

• Claude Opus 5 (claude-opus-5) is now the default Opus model, with a 1M-token context window and fast-mode pricing at $10/$50 per million tokens.
• New sandbox.network.strictAllowlist setting denies non-allowlisted hosts outright for sandboxed commands, instead of stopping to ask every time.
• Subagents can spawn nested subagents up to depth 3 by default again - 2.1.217 had capped this at 1 (no nesting). Set CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH=1 if you were relying on that tighter limit.
• Dynamic workflows now default to a "medium" size guideline (aim for fewer than 15 agents) instead of running unrestricted; change it in /config if you want more.
• claude -p no longer throws away the answer it already produced when a turn dies mid-stream on an API error.

(2.1.220, same day, was bug fixes and reliability improvements only.)

Verdict: update today if you use Opus at all - the price and context window are a real upgrade. If you were counting on 2.1.217's subagent-depth cap, check your env var before you update; nesting is back on by default.

2.1.218 - /code-review moves to the background, plus a hook-trust hole closed (July 22, 2026)

• /code-review now runs as a background subagent, so review output no longer fills up your conversation while it works.
• Security: agent frontmatter hooks could run from a folder you'd never actually granted workspace trust to. Hooks now require the agent file's own folder to have been trusted first.
• The left arrow key used to discard your whole conversation with no way to undo it. A press right after an edit now asks you to confirm, and Esc in the agent view returns you to the conversation it backgrounded instead of losing it.
• Windows paths with a \u-prefixed segment (like C:\Users\unicorn) were getting corrupted into CJK characters in tool inputs, which made those files inaccessible. Fixed.
• Skills marked context: fork now run in the background by default - opt a specific skill out with background: false if you want it to block like before.

The rest is the usual long tail: Bedrock application-inference-profile spend now meters at the right model's rate instead of overcharging, pull request events no longer get lost when a session exits right after creating one, a retry loop that kept re-sending doomed requests after a context-overflow error is fixed, a resumed session no longer fails every turn or crashes on a malformed transcript, fork-session lineage now survives compaction, and a batch of screen-reader, Bedrock setup-wizard, and prompt-history fixes.

Verdict: update today if you use agent frontmatter hooks at all - the untrusted-folder fix closes a real trust gap. Everyone else can update whenever, though the left-arrow and Windows path fixes are reason enough on their own.

2.1.217 - runaway subagents get reined in (July 21, 2026)

• Subagent spawning gets three guardrails at once: a default cap of 20 concurrently-running subagents (CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS to raise it), subagents no longer spawn their own nested subagents by default (CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH to allow deeper nesting), and --max-budget-usd now actually halts running background agents once the cap hits instead of just blocking new spawns. Together these stop one message from fanning out into an unbounded, unbudgeted swarm.
• Security: background session isolation wasn't canonicalizing symlinked working directories, so an isolated session could escape its workspace folder. Fixed.
• A real memory leak is fixed: truncated MCP tool outputs used to keep the full untruncated result in memory for the rest of the session - long sessions with big tool outputs get that headroom back.
• Corporate mTLS, TLS-verify, OAuth scope, and proxy settings being silently ignored in Claude Desktop sessions is fixed - if your org's network policies weren't applying there, this was why.
• A CLAUDE.md or SKILL.md frontmatter value with many brace groups could OOM-kill or stall the CLI before it even started. Brace expansion is now budget-bounded.

The rest is the usual long tail: emoji shortcode autocomplete in the prompt input, warnings instead of silent data loss when transcript writes fail, a Windows auto-update fix that could leave claude.exe missing, an Opus-4.8-on-Bedrock auto-compact fix, screen reader and Remote Control polish, an OTEL endpoint override bug, and a --resume crash on malformed transcripts.

Verdict: update today if you run subagents or background agents at any real scale - the concurrency, depth, and budget caps are the kind of thing you want in place before you hit the problem, not after. Everyone else can update whenever.

2.1.216 - a 40-bullet fix pile, with two more worktree escapes closed (July 20, 2026)

• Security: worktree-isolated subagents could still redirect git commands into your real checkout using git -C, --git-dir, or the GIT_DIR/GIT_WORK_TREE environment variables. Closed - the isolation guarantee no longer has this hole.
• Security: a symlink placed at .claude could redirect workflow saves and scheduled-task writes outside your project folder. Fixed.
• Long sessions get noticeably faster: message normalization cost was growing quadratically with turn count, which is why long sessions and resumes could stall for several seconds. Now fixed.
• Resuming a background agent session used to revert it to the default agent, silently dropping its custom prompt and tool restrictions. The agent's actual configuration is now restored on resume.
• Cloud sessions no longer lose your in-flight message if the container restarts mid-turn - the interrupted turn re-runs on resume instead of leaving the session stuck.

The rest is the usual long tail: auto mode no longer denies commands over a stale "HTTP 401" after your OAuth token rotates mid-session, worktree sessions landing in another project's leftover worktree, background sessions with no git repo being undeletable, a stale daemon lockfile that could let claude daemon stop --any kill an unrelated process, AskUserQuestion no longer nudging Claude to continue when your free-text answer asked it to wait, and a batch of Bash-parsing, PowerShell, fullscreen-UI, and Claude-in-Chrome fixes.

Verdict: two more worktree/symlink isolation gaps closed alongside a real background-agent bug. Update today if you run worktree-isolated subagents, background agents, or cloud sessions - otherwise whenever.

2.1.215 - /verify and /code-review stop running themselves (July 19, 2026)

• Claude used to invoke the /verify and /code-review skills automatically once it finished a change. It no longer does - you now run /verify or /code-review yourself when you want them.

Verdict: a default change, not a bug fix. If you were counting on Claude auto-reviewing its own work, add /verify or /code-review back into your routine - otherwise there is nothing to do here.

2.1.214 - the Bash permission checker gets six holes patched at once (July 18, 2026)

• Security: an allow rule like Edit(src/**) was meant to cover only the src/ folder in your working directory, but it was matching a src/ folder anywhere in the repo tree - so a rule you scoped to one place could quietly approve writes somewhere else entirely. Fixed, along with a cluster of adjacent gaps: a Windows PowerShell 5.1 bypass, commands over 10,000 characters skipping the prompt, zsh comparisons and file-descriptor redirects the checker was misreading as harmless, and some help/man invocations that could run unsafe options without asking.
• Security: permission prompts on remote sessions could let a command start running before you'd actually confirmed the local dialog - closed, so approval now means what it says.
• Scheduled tasks no longer treat their own configured prompt as untrusted input to refuse. If you run routines like this one, the prompt you set up now gets delivered as the session's real task instead of tripping an injection guard.
• Background sessions get a reliability pass: a crashed daemon could delete the control socket of the healthy replacement that took over for it, sessions parked idle with /background could leave daemons and worker processes running forever, and completed or non-git-folder sessions that were impossible to remove via claude rm or the agents view now clean up properly.
• Windows PowerShell tool: fixes for commands hanging when a child process waits on stdin, crashes on non-UTF-8 input or non-ASCII output, >/>> writing UTF-16LE files nothing else could read as UTF-8, and raw ANSI escape codes leaking into error text.

The rest is the usual long tail: a new EndConversation tool for abusive or jailbreak sessions, a progress heartbeat for long-running tool calls, several OpenTelemetry attribute additions, docker commands with daemon-redirect flags now prompting, a GrowthBook crash fix, and a batch of smaller session, hook, and telemetry cleanups.

Verdict: a security release wearing a fix-pile costume. Update today if you lean on Edit(pattern/**)-style allow rules, use remote or background sessions, or run scheduled automation - otherwise whenever.

2.1.212 - plan mode was letting Bash run without asking (July 16, 2026)

• Security: plan mode was supposed to stop and ask before touching anything, but file-modifying Bash commands like touch and rm could slip through with no permission prompt and no SDK canUseTool callback. Fixed.
• Security: creating a worktree that followed a repo-committed symlink at .claude/worktrees could write files outside your repository. Fixed.
• /fork splits into two commands: it now copies your conversation into a new background session with its own row in claude agents, while you keep working in the original. The old in-session delegate behavior is now /subtask.
• New runaway-loop guards: WebSearch calls cap at 200 per session, subagent spawns cap at 200 per session, and MCP tool calls still running after 2 minutes now move to the background automatically instead of blocking your session - all tunable via environment variables.
• Fixed conversations with lots of images wrongly failing with "Request too large," and web search/fetch silently handing back literal "API Error" text as if it were a real result.

The rest is the usual long tail: /resume now shows a picker that includes deleted sessions and reopens your pick as a background session, reopening a stopped background session no longer fails silently, headless/SDK sessions can switch models mid-turn instead of waiting for the next one, and a batch of /ultrareview, OpenTelemetry, and terminal-rendering fixes.

Verdict: two real trust bugs buried in a 48-bullet pile. Update today if you rely on plan mode's permission gate or use worktree-isolated subagents - otherwise whenever.

2.1.211 - your approval prompts can't be faked anymore (July 15, 2026)

• Security: a permission prompt relayed to a chat channel (Slack and similar) could be visually altered with invisible or look-alike characters hidden in the tool input, so what you approved wasn't necessarily what ran. Those characters are now stripped before you see the prompt.
• Security: auto mode could override a hook's ask decision on unsandboxed Bash commands and run them anyway. A hook that says "ask" is now honored no matter what.
• Background agents stopped making things up: Claude used to sometimes report a still-running agent as finished. It now waits for the real result instead of fabricating one.
• If you run Claude Code through Bedrock, Vertex, Mantle, or Foundry, a caching bug was billing your trailing system context as fresh input tokens on every single request. That's fixed - worth checking your last invoice if this applies to you.
• Sessions that share one credential store (common in team or CI setups) no longer all get logged out at once when the machine wakes from sleep.

The rest is the usual long tail: subagents with an explicit model override no longer forget it on resume, plugin MCP servers now reconnect properly after an idle web session wakes, /clear resets the statusline cost counter, and a pile of Claude in Chrome, Windows, and accessibility fixes.

Verdict: two real security fixes and a billing bug dressed up as an ordinary fix pile. Update today if you relay approvals through a chat integration, rely on hooks under auto mode, or run on Bedrock/Vertex/Mantle/Foundry - otherwise whenever.

2.1.210 - subagents actually stay in their worktree now (July 14, 2026)

• Worktree-isolated subagents could run git-mutating commands against your real repo checkout instead of their own isolated copy - the isolation guarantee is fixed for real now, not just for file writes.
• The Agent tool is hardened against indirect prompt injection from content a subagent reads, and the ultracode keyword opt-in no longer fires on non-human input like webhook payloads or relayed PR comments - both close paths where content you didn't type could change what a session does.
• Plan approvals without edits stopped mislabeling themselves "(edited by user)" and overwriting your plan file with a stale snapshot - a real way to lose planning work, now fixed.
• A hook callback timeout was being reported to the model as a user rejection, which made unattended sessions quietly stop and wait instead of erroring properly - matters if you run headless or background sessions.
• Unmatched $1/$2 placeholders in skills and commands used to get silently stripped. If a skill's arguments looked wrong for no reason, this was why - they're preserved verbatim now.

(2.1.209, same day, reverted an overly broad guard that had been blocking /model and other dialogs inside claude agents background sessions.)

The rest is the usual long tail: claude attach reliability during session transitions, a session crash from a tool result returning a bigint or plain text, memory writes over the MEMORY.md index limit now error instead of truncating silently, stale git worktree lock files from killed background sessions finally get swept automatically, and a batch of agents-view and accessibility polish.

Verdict: a security and reliability release wearing a fix-pile costume. The worktree isolation bug and the prompt-injection hardening are worth updating for even if nothing else here applies to you - update today if you run isolated subagents or unattended sessions, otherwise whenever.

2.1.208 - a 45-bullet fix pile, with a real memory cleanup (July 13, 2026)

• Long sessions get an actual cleanup: MCP server stderr no longer piles up to 64 MB per server, LSP documents now cap at 50 open docs instead of growing forever, and headless/SDK sessions stop ballooning from large tool results.
• Sessions with lots of MCP tools get noticeably snappier - tool-pool assembly is now cached, cutting per-call overhead by up to 7x at high tool counts.
• Session transcripts shrink up to 79x in edit-heavy sessions, and checkpoint disk usage is bounded by pruning old file-history backups instead of keeping every version.
• Added an opt-in screen reader mode (claude --ax-screen-reader) that renders plain text instead of the usual fullscreen UI.
• rm -rf and other catastrophic deletes now get caught even when hidden inside $(...), backticks, or <(...) - previously only the plain form triggered a confirmation prompt in auto mode and --dangerously-skip-permissions.

The rest is the usual long tail: background-session daemon and attach fixes, a fast-mode toggle that stopped restoring itself, several tool error-message improvements (Read, Grep, Glob), and a Bedrock SSO regression from 2.1.207.

Verdict: all fixes, no new workflow to learn - but if you run long sessions or lean on lots of MCP servers, the memory and speed cleanup alone makes this worth updating for. Update whenever.

2.1.207 - closing three settings and plugin loopholes (July 10, 2026)

• Security: a non-interactive run (claude -p, the SDK) could get its managed settings permanently marked as consented without ever showing you the security dialog. Fixed - the dialog now shows, or the settings do not apply.
• Security: plugin hooks written with ${user_config.*} inside a shell-form command were vulnerable to shell injection. That interpolation is now rejected; hooks read config values with $CLAUDE_PLUGIN_OPTION_<KEY> or an exec-form command instead.
• Security: plugin option values are no longer read from a project's checked-in .claude/settings.json - only your user settings, --settings, or managed settings count now. A cloned repo can no longer quietly configure plugin behavior for you.
• Auto mode got the same fix: it no longer reads autoMode from repo-resident .claude/settings.local.json. Set it in ~/.claude/settings.json instead.
• The terminal freezing and keystrokes lagging during long streamed responses (big lists, tables, code blocks) is fixed - if that was happening to you, it was not your machine.
• If you run Claude Code through Bedrock, Vertex AI, or a Foundry deployment: auto mode no longer needs the CLAUDE_CODE_ENABLE_AUTO_MODE opt-in, and Bedrock, Vertex, and Claude Platform on AWS now default to Claude Opus 4.8.

The rest is the usual pile: a crash loop in agent teams from a malformed teammate mailbox message, a few Remote Control reliability fixes (task status surviving a reconnect, mobile and web now showing background progress from desktop-hosted sessions), a Bedrock SSO credential-refresh loop, and /usage-credits now rejecting malformed amounts instead of silently truncating them.

Worth doing after this update: if you use plugins or auto mode at all, this release closes real gaps where a cloned repo could influence your settings without asking - update for that alone even if nothing else here applies to you.

2.1.206 - a 28-bullet fix pile (July 9, 2026)

• If your MCP tool calls were dying at exactly 60 seconds no matter what timeout you configured, this is the fix: a per-server request_timeout_ms in .mcp.json was being ignored in fresh sessions. OAuth MCP servers also stop demanding manual re-authentication after a single failed token refresh.
• An expired login used to fail every model with a misleading "There's an issue with the selected model" error. Now it just tells you to run /login.
• Background agents upgrade themselves right after a Claude Code update, instead of making you sit through a slow stale-session upgrade when you attach.
• /doctor gained a check that suggests trimming checked-in CLAUDE.md files of anything Claude could work out from the codebase on its own.

All fixes, no new workflow. Update whenever - though if you run long MCP tool calls, the timeout fix alone is worth forcing it today.

2.1.205 - /doctor becomes a full checkup (July 8, 2026)

• /doctor is now a complete setup checkup that can diagnose and fix issues instead of just listing them. /checkup is an alias.
• Auto mode got two safety guards: it asks before running rm -rf on a variable it cannot resolve, and it blocks tampering with session transcript files.
• The claude agents view got a real upgrade: sessions show a colored state word and a plain-English headline instead of raw tool-call text, and sessions that touch a pull request now link it.
• The auto-updater streams downloads to disk instead of buffering them, cutting roughly 400 MB of peak memory during updates.

Worth doing after this update: run /doctor once. It catches config problems you did not know you had. (2.1.204, same day, was a single fix for hook streaming in headless sessions.)

2.1.203 - background sessions stop dying quietly (July 7, 2026)

• You now get a warning before your login expires, so background sessions stop getting interrupted mid-run.
• A batch of background-agent fixes landed: sessions no longer become permanently unresponsive when a session token goes stale, Windows agents no longer inherit a stale PATH, and a bug that sent API keys to the wrong endpoint (failing with 401) is fixed.
• Worktree-isolated subagents sometimes ran shell commands in the parent checkout instead of their own worktree. Fixed - this one could silently write to the wrong working copy.
• Small but nice: a grey pause badge now shows in the footer when you are in manual permission mode.

If you run agents in the background and had ghost failures over the last month, this release and 2.1.199 below are probably why they stop.

2.1.202 - /review is fast again (July 6, 2026)

• /review <pr> went back to being a fast single-pass review. The heavy multi-agent version is /code-review <level> <pr#> - two commands, two speeds, pick per situation.
• New "Dynamic workflow size" setting in /config controls how many agents Claude spawns in dynamic workflows.
• The resume picker no longer takes minutes (and a pile of memory) in repositories with many git worktrees.
• Re-invoking an already-loaded skill no longer appends a duplicate copy of its instructions to context - a quiet token saver if you watch your usage.

2.1.199 and 2.1.200 - the resilience batch (July 2-3, 2026)

• Partial output is now kept when the API errors mid-stream, instead of the whole turn being discarded.
• Transient rate-limit errors (429s that are not your usage limit) retry automatically with backoff instead of failing the turn.
• Subagents that die on a rate limit or server error now return their partial work and report the error, instead of silently failing or - worse - reporting success.
• AskUserQuestion dialogs no longer auto-continue by default, and the "default" permission mode is now called "Manual" everywhere, which is what it always was.
• Stacked skills: /skill-a /skill-b do X now loads all leading skills (up to 5), not just the first.

2.1.198 - subagents go background by default, Chrome goes GA (July 1, 2026)

The biggest workflow change of this batch:

• Subagents now run in the background by default. Claude keeps working while they run and gets notified when they finish - no more sitting idle waiting for a delegate.
• Claude in Chrome is generally available.
• Background agents launched from claude agents now commit, push, and open a draft PR when they finish code work in a worktree, instead of stopping to ask.
• The built-in Explore agent now inherits your session's model instead of always running on a small one - exploration answers got noticeably better.
• New /dataviz skill for chart and dashboard design, with a runnable color-palette validator.

If you use parallel agents at all, this release changes how your sessions feel day to day. My parallel-agents setup tip pairs well with it.

2.1.197 - Claude Sonnet 5 becomes the default (June 30, 2026)

One line in the changelog, the biggest single change of the month: Claude Sonnet 5 is now the default model in Claude Code, with a native 1M-token context window and promotional pricing of $2/$10 per million tokens through August 31. You need 2.1.197 or newer to get it - if claude --version shows something older, that alone is the reason to update.

2.1.196 - a security fix worth knowing about (June 29, 2026)

• Security: a cloned repo can no longer self-approve its own .mcp.json servers by committing a .claude/settings.json. Untrusted workspaces now show servers as pending approval. This closes a real attack path where a malicious repo could auto-start MCP servers on your machine the moment you open it.
• Org admins can now set organization default models.
• Sessions get readable default names at start, and file attachments in chat became Cmd/Ctrl-clickable.
• Background reliability: long-running commands survive the session process being stopped or updated, and workers killed by a daemon restart auto-resume.

Older releases

This page explains releases from 2.1.196 (June 29, 2026) forward. Everything older is in the official CHANGELOG.md - complete, terse, and undated. If an older release still matters for something current, it gets folded into the explanation above instead of listed separately.

FAQ

How often does Claude Code update? Almost daily, often more than once a day. Most releases are bug fixes; a feature release worth changing your workflow for lands every week or two. This page separates the two so you can skim.

How do I check my Claude Code version? Run claude --version in your terminal, or /doctor inside a session for a full setup checkup (available since 2.1.205).

How do I update Claude Code? Claude Code updates itself automatically by default. To force it, run claude update. If you installed via npm, npm install -g @anthropic-ai/claude-code@latest does the same.

Where is the official Claude Code changelog? In the anthropics/claude-code repository on GitHub, in CHANGELOG.md. It is complete but terse - raw bullet points with no dates or context. This page adds the dates, the plain-English explanation, and a judgment call on what matters.

Do I need to update Claude Code to get new models? Sometimes. New models can require a minimum version - Claude Sonnet 5 needs 2.1.197 or newer. If a model announcement says update to access, check claude --version first.

I read every release the day it ships, because releases change defaults - permission modes get renamed, models get swapped, tools get new flags. That tracking is also what keeps ClockedCode current: the curated setup it installs reflects what the current Claude Code version actually supports, so one paste gets you a configuration that matches today's tool, not January's.