chore(deps): update bump-dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
@anthropic-ai/claude-code	2.1.266 → 2.1.270				patch	2.1.273 (+2)
@openai/codex (source)	0.153.4 → 0.154.0				minor
docker-buildx-plugin	0.37.0-1~debian.13~trixie → 0.37.1-1~debian.13~trixie				patch
docker-ce	5:29.8.0-1~debian.13~trixie → 5:29.8.1-1~debian.13~trixie				patch
github.com/bufbuild/buf	v1.72.0 → v1.73.0				minor
node (source)	f7d34e5 → 9516e22			final	digest
node (source)	f7d34e5 → 9516e22			stage	digest

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

anthropics/claude-code (@​anthropic-ai/claude-code)

v2.1.270

Compare Source

• Fixed read-only git commands in Bash unexpectedly asking for permission after a session had been running for a while (regression in 2.1.269)

v2.1.269

Compare Source

• Added claude plugin eval: run a plugin's eval suite against Claude Code and get scored, reproducible results (JSON + HTML report); see claude plugin eval --help
• Added /output-style [name] to list and switch output styles, including over Remote Control and in cloud and other headless sessions
• Added a diff of the files a Bash command changed to the Bash tool result when the Bash tool handles file edits (setting bashEditDiffEnabled)
• Added OTEL_METRICS_INCLUDE_REPOSITORY to tag OpenTelemetry metrics and events with vcs.* repository attributes; commit events get vcs.ref.head.* with OTEL_LOG_TOOL_DETAILS
• Added CLAUDE_CODE_GATEWAY_MODEL_DISCOVERY_TIMEOUT_MS to extend the LLM gateway /v1/models discovery timeout (default 3s)
• Added a spinner tip suggesting /focus for a view with just your prompt, a one-line work summary, and the response
• Added CLAUDE_CODE_WORKFLOW_MAX_CONCURRENT_AGENTS (1–256) to raise the Workflow tool's per-run concurrent agent limit for inference-bound fan-outs
• Fixed the prompt cache being partially invalidated on the turn after a response was cut off at the output-token limit and automatically resumed
• Fixed a case where resuming a session after interrupting Claude mid-thought could change how earlier context was re-sent, hurting prompt-cache reuse
• Fixed F1/F2/F4 not working in kitty-protocol terminals and Delete in st, Alt+arrows acting as Escape in rxvt-unicode, and Shift+punctuation typing the unshifted key in WezTerm (regression in 2.1.247)
• Fixed remote and headless sessions reporting "waiting for your input" while background agents were still running (set CLAUDE_CODE_BG_TASKS_REPORT_RUNNING=0 to restore the old behavior)
• Fixed the terminal's replies to capability queries (^[[?1;2c) appearing as stray text at startup in some terminals
• Fixed rows at the top or bottom of the transcript going blank in fullscreen after resizing the terminal
• Fixed a deny or ask permission rule starting with ! applying beyond the settings source that wrote it; such a rule now applies only within its own source, and a bare ! negation is ignored
• Fixed the git status Claude is told after a compaction: it is now the current status, not the one from the start of the session
• Fixed synced plugin MCP servers not connecting when a remote session resumes
• Fixed resumed headless sessions losing a turn's replies when the model was switched or a request was retried mid-turn
• Fixed terminal escape codes, line breaks and oversized text from a background task's on-disk record reaching the task list and task notifications when work is resumed
• Fixed CMYK JPEG images failing to attach with "cannot decode"; they are now converted and resized like other JPEGs
• Fixed the managed settings approval dialog not naming the collector for a gRPC telemetry endpoint set without a scheme
• Fixed plugin headersHelper consent prompts showing a URL path that could be misread as a different host
• Fixed plugin errors showing [redacted URL] in place of a relative Windows path with a folder name that starts with @
• Fixed missing cursor in the permission-rule, auto-mode-rule, add-directory, session-rename and feedback-review text fields when the terminal's native cursor is enabled
• Fixed repeated clicks on a /fork receipt, each under a second apart, never backgrounding the session right away while it waited for the current tool to finish
• Fixed plugin LSP servers that reject shutdown params (e.g. rust-analyzer) being left running at session end; exit is now sent even if shutdown fails
• Fixed the attribution reminder overriding a CLAUDE.md or memory rule against commit and pull request attribution; lines set by managed settings still apply
• Fixed prompt suggestions being dropped for text in Japanese, Chinese, Thai and other languages written without spaces between words
• Fixed synchronized output being assumed from the terminal's name in GNOME Terminal and Konsole versions that do not support it
• Fixed permission_denials in --output-format stream-json results omitting Read, Edit and Write calls blocked by a path-scoped deny rule
• Fixed sessions run through the SDK or the desktop app showing an unknown status in other sessions' agent list
• Fixed /insights failing on Bedrock, Vertex, Foundry, and gateway deployments whose account can't reach the default Opus model by using the session model there instead
• Fixed organization policy limits not loading for the session when another Claude Code process refreshed the login at the same moment
• Fixed Claude Desktop sessions using Bedrock, Vertex, or a gateway not getting the contextual "what Claude needs" turn-end notification text
• Fixed MCP servers reconnecting when an updated config only changed the order of the server URL's query parameters
• Fixed the prompt box's top border splitting into extra lines when viewing a background agent whose name or description has line breaks or is wider than the terminal
• Fixed sessions getting permanently stuck on "Prompt is too long" when auto-compaction had no complete earlier exchange to summarize (mostly Agent SDK sessions with very large prompts)
• Fixed /goal runs silently stalling after API errors, network drops, or token limits: the goal now retries with backoff, or pauses and says why, including until a usage limit resets
• Fixed prompt cache misses in cloud sessions by waiting briefly for server configuration before the first request
• Fixed /btw answers that contained made-up tool calls and output: the side question is now told not to write them, and any that appear are flagged as not executed
• Fixed CLAUDE_CODE_RESUME_INTERRUPTED_TURN re-running a turn that had failed with an API error over 6 hours earlier, or longer ago than CLAUDE_CODE_RESUME_INTERRUPTED_TURN_MAX_AGE_MS when set
• Fixed organization plugins enabled through managed settings not loading in headless sessions and on Claude Desktop (once Desktop bundles this CLI version); they load from the next session
• Fixed plugin archives extracted for a session being readable by other local users, extracted files keeping world-writable bits from the archive, and stale files surviving re-extraction
• Fixed Edit() deny rules and the write-path check not applying to the file a Bash tee command writes; a Bash(tee:*) allow rule no longer covers destinations outside the working directories
• Fixed stray characters like 22c, or a terminal's color or version reply, being typed into the prompt at startup over slow connections (ssh, browser terminals)
• Fixed the terminal's block cursor showing under the interface in rxvt-unicode after leaving or re-entering fullscreen
• Fixed the cursor block staying visible after returning from an external editor in fullscreen mode on rxvt-unicode
• Fixed the interface being drawn twice after returning from an external editor (Ctrl+G) outside fullscreen mode
• Fixed the interface being drawn twice in Konsole after returning from an external editor
• Windows: Fixed PowerShell tool commands sent to the background stopping when Claude Code exits
• Improved the /diff panel to open fully rendered in one step instead of showing a loading state first
• Improved prompt suggestion filtering for Japanese, Chinese and Korean text: mixed-script and single-word suggestions are kept, and meta or evaluative text is dropped as it is for English
• Improved the Skill tool's "Unknown skill" error to name the plugin skill's full name when a bare name matches exactly one plugin skill
• Improved keyboard support over SSH and in unrecognized terminals: terminals that answer the kitty keyboard query (such as foot and Alacritty 0.16+) now get Shift+Enter and Ctrl+Shift shortcuts
• Improved responsiveness in long sessions: transcript updates no longer re-process the whole conversation to build the collapsed tool-use summaries
• Improved first-party sessions with telemetry disabled: an alwaysLoad MCP server that finishes connecting mid-conversation is usable on the next turn without a tool-search round trip
• Changed /ultrareview --post to post the PR comment directly when the findings arrive and print the comment link, instead of starting a second cloud session to post it
• Changed artifact database reads that save into the session scratchpad so they no longer stop for working-folder approval
• Changed skills synced from claude.ai in cloud sessions to be named anthropic-skills:<name>, matching Claude Desktop; the bare name still works when nothing else uses it
• [VSCode] Added an agent map: an "N agents" footer pill opens a map of the session's sub-agents with per-agent cards, Stop agent, and read-only transcripts
• [VSCode] Added a Hooks dialog to the command menu for viewing hooks and adding, editing, or removing them in user, project, and local settings; managed, plugin, and session hooks stay read-only
• [VSCode] Added live progress rows for running subagents under the tool-call groups in Focus view
• [VSCode] Added a Permission rules dialog that lists permission rules and adds or removes them in user, project, and local settings; startup-option, session-only, and managed rules stay read-only
• [VSCode] Added a Cancel button to the Switch account screen that returns to your session as the current account
• [VSCode] Fixed Focus view showing a turn started by a delivered plain-text prompt, such as a scheduled task's, as part of the previous turn
• [VSCode] Fixed the footer's prompt cache clock hiding its minutes when the panel is narrow
• [VSCode] Fixed the session list keeping sessions from the default folder when CLAUDE_CONFIG_DIR is set in a settings file or the environmentVariables setting
• [VSCode] Fixed a plan preview that finished loading late sometimes hiding its comment box or showing an older plan
• [VSCode] Fixed a plan preview accepting comments that went nowhere after its Claude tab closed
• [VSCode] Fixed the prompt cache clock and reopen notice for a session compacted after its last reply and then closed, which now reads as cold when reopened
• [VSCode] Fixed a session renamed in the extension while Remote Control is on keeping its old name on claude.ai/code
• [VSCode] Fixed the "Enable Remote Control for all sessions" toggle keeping its last position after the setting was reset to default from a terminal
• [VSCode] Fixed restored Claude tabs not counting as open in the session list after a window reload until clicked, and their row opening a second tab
• [VSCode] Fixed Switch account making a tab forget its dismissed usage-limit warnings when you sign back in as the same account
• [VSCode] Fixed a session rename being replaced by the generated name after a window reload when the session was renamed during a long turn
• [VSCode] Fixed the sidebar usage meter keeping a stale per-model weekly limit row after the account loses that limit
• [VSCode] Fixed a rare case where an @​-mention sent with the keyboard shortcut while a new chat view was still starting could be inserted into the input long after the keystroke
• [VSCode] Fixed the session list jumping down when the Account & usage header appeared a moment after opening the Claude side bar
• [VSCode] Improved documents and messages written for someone other than the user: Claude now writes them for that audience and names it at the top of its reply
• [VSCode] Improved screen reader and keyboard accessibility in the slash-command menu, @​-mention menu, output-style picker, Send/Stop button, permission and question cards, and onboarding checklist
• [VSCode] Changed the current-file chip in the message box: an X now removes it, replacing the Hide toggle
• [VSCode] Removed the Claude Code items from a session tab's right-click menu and the editor title bar's "..." menu; they could not act on the tab the menu was opened on
• [Claude Code on the web] Added taking back a queued message in a cloud session before Claude reads it: remove it from the queue, or press Esc or Up, and the text returns to the message box
• [Claude Code on the web] Fixed /model default in a cloud session leaving every later message failing in organizations that restrict which models Claude Code can use
• [Claude Code on the web] Fixed one-off scheduled routines occasionally running a second time after a transient server error
• [Claude Code on the web] Fixed routine runs that use subagents sometimes being treated as finished too early, which could skip the retry after a real failure or start a duplicate run
• [Claude Code on the web] Fixed file links in cloud session transcripts opening a GitHub 404 when Claude was working from a subfolder of the repository
• [Claude Code on the web] Changed the Cloud environments admin page to list every environment instead of capping each table at five rows behind a Show more control that could be unreachable
• [Claude Code on the web] Changed claude.ai/code for Free-plan users to open the plans page with a path to upgrade, instead of a "Disabled by org admin" page with no way forward
• [Claude Tag] Added a confirmation dialog before Connect all or Disconnect on a GitHub installation in admin settings, to guard against accidental organization-wide changes
• [Claude Tag] Fixed threads occasionally going silent after a failed turn because the failure notice was dropped when Slack briefly rate-limited it; the notice is now retried
• [Claude Tag] Fixed Claude accepting a switch to a model your organization hasn't enabled and then quietly answering with a fallback model; it now declines and says an admin can enable it
• [Claude Tag] Fixed a table posting as raw pipe text when Claude attached files to the same message; the table now posts as a normal reply and the files follow with a plain caption
• [Claude Tag] Fixed @Claude !restart at the top level of a channel where Claude isn't active starting an unrelated conversation; it now privately says there is nothing to restart
• [Claude Tag] Fixed plugin rows in Slack access settings showing an unlabeled raw ID with no way to turn the plugin off; they now show its name and link to the bundle that manages it
• [Claude Tag] Fixed the shared-session banner and Share dialog on sessions started from Slack claiming the whole organization could open the link; they now name the Slack channel's audience
• [Claude Tag] Improved load time of the admin settings page and its Slack channel picker, most noticeably for organizations with many channels or several connected workspaces
• [Claude Tag] Improved scheduled routines in Slack channels: a routine run can now reply in an existing thread instead of always posting a new top-level channel message
• [Claude Tag] Improved the timestamp on Claude's live progress checklists to show each reader's local time and how long ago it was updated, instead of a fixed UTC time

v2.1.268

Compare Source

• Added to the Claude apps gateway: with pricing: set in gateway.yaml, signed-in Claude Code clients receive the same rates through managed settings, so /cost and telemetry match the spend meter
• Added a startup warning for gateways when access_control.allow_cidrs is empty, and a one-time warning the first time a request arrives from a public address
• Added the gatewayInternalNetworks managed setting, letting administrators allow /login to a Claude apps gateway on their organization's own public IPv4 block
• Added claude self-hosted-runner --remove-session-state (default off): delete each session's per-session directories under <base-dir>/_sessions/ when the session ends
• Added configDirectory to the output of claude auth status --json
• Added --json to claude plugin install, uninstall, update, enable and disable, and errorDetails/noteDetails to each row of claude plugin list --json
• Added browser-tab icons for published artifacts, chosen by Claude to match each page
• Fixed every turn failing with HTTP 400 on third-party Anthropic-compatible endpoints (ANTHROPIC_BASE_URL) since 2.1.265: a regex in the Artifact tool's input schema that those endpoints reject
• Fixed WebFetch hanging indefinitely on a server that keeps the response open without finishing; a fetch now fails after 300 seconds. Set CLAUDE_CODE_WEBFETCH_DEADLINE_MS to override the deadline (0 turns it off)
• Fixed a respawned in-process teammate picking up tools or a system prompt from a same-named agent file in a folder you have not trusted
• Fixed sustained high CPU usage: a busy loop in long-running idle sessions no longer pins a CPU core, and rapid terminal focus reports during a session recap no longer keep the CPU high
• Fixed Claude sometimes replying "your message came through empty" after an MCP tool call
• Fixed deny and ask permission rules on symlinked directories (/etc, /tmp, /var on macOS; /bin on Linux) not applying when a path was given by its real location, and Bash commands ignoring deny rules written on a symlinked path spelling
• Fixed a case where a Read or Edit deny rule did not apply when an env -C, eval or similar command the permission checker cannot analyze was on the same line
• Fixed plugin and marketplace errors showing a token or password from a git source URL
• Fixed /mcp and /plugin server details, claude mcp list/get, and MCP login errors showing secrets resolved from ${VAR} placeholders in MCP configs
• Fixed prompt caching and extended thinking breaking mid-session for SDK sessions using excludeDynamicSections: the first message is no longer re-rendered each request
• Fixed entitled users being told a model is restricted after restart or in the Desktop Code tab when a cached model-access denial was stale
• Fixed a running session silently switching to the organization's default model when another Claude Code process refreshed a stale model-access entry
• Fixed long-context 429s on Fable models showing the usage-credits consent prompt instead of the 1M-context message on Pro and Team plans
• Fixed workload identity federation via a profile (as claude-code-action configures it): processes sharing the profile could fail mid-run with 401 … jti reused
• Fixed MCP server OAuth sign-in failing with "No available ports for OAuth redirect" when the local callback port range can't be bound
• Fixed the conversation summary produced by /compact and auto-compact mangling text that contained $ sequences
• Fixed resuming a conversation that ended with /compact: its restored-file notes now load in the same order on every resume
• Fixed SDK prompt suggestions, side questions and /rename sending the conversation from before a compaction
• Fixed @ file and / command suggestions not appearing after recalling a previous prompt with the up arrow and editing it
• Fixed claude agents: pressing ← again at a natural pace to go back to the agent list no longer gets ignored until you pause for over a second
• Fixed claude agents session delete getting stuck when a worktree can't be removed: the message names the cause and next step, and for a git worktree ctrl+x again deletes the directory anyway
• Fixed background agent and workflow rows in the agents panel expanding to many lines when their text contained line breaks
• Fixed Claude in Slack sessions losing their Slack tools when org managed settings set an MCP allowlist
• Fixed Claude in Chrome asking to allow the host "https" when a navigation URL had a scheme but a host that could not be parsed
• Fixed the spinner wrapping onto several lines when the current task's label is long; the label and the "Next:" task line now stay within one terminal row
• Fixed the /bug and /feedback description field showing no cursor when the terminal's native cursor is enabled
• Fixed Remote Control sessions served by claude remote-control showing a generated name instead of their session title in ListAgents
• Fixed claude plugin validate rejecting plugin paths whose directory name begins with two dots, which the plugin loader accepts
• Fixed plugins silently skipping a default monitors file or root SKILL.md that could not be checked
• Fixed WebFetch's error for localhost and other dotless hostnames to explain why the URL is refused and suggest curl
• Fixed PermissionRequest hooks not firing in --print mode
• Fixed policy-helper warnings not printing on headless (-p) runs
• Fixed /resume listing a /fork background session under its parent's name instead of its own ⑂ fork name
• Fixed /remote-control and other claude.ai-gated commands to suggest /login when signed out instead of showing a Claude for Enterprise migration message
• Fixed CLAUDE_CODE_SESSIONEND_HOOKS_TIMEOUT_MS not extending SessionEnd hooks that have no per-hook timeout (they were still cancelled after 1.5 seconds)
• Fixed /autofix-pr and other cloud-session commands saying to retry or install the Claude GitHub App when no GitHub account is connected; they now point to /web-setup or the web connect page
• Fixed cloud-session commands such as /teleport and /remote-env to explain when an organization policy turns them off, instead of answering "Unknown command"
• Fixed Bash sandbox instructions over-stating confinement: no unenforced path lists when filesystem isolation is off, and strict mode no longer claims commands can never run unsandboxed
• Improved fullscreen mode: adding or removing a prompt line (Shift+Enter) now repaints as fast as typing a character instead of re-rendering the visible transcript
• Improved --continue / --resume: the conversation appears immediately instead of waiting for SessionStart hooks, and the first message no longer re-reads the whole transcript
• Improved responsiveness during tool-heavy turns by no longer redrawing the transcript for a hidden per-tool-batch reminder
• Improved startup time in projects with .claude/workflows/ scripts: listing them no longer parses each script
• Improved auto mode denials: the message Claude receives now names the rule that blocked the action and asks Claude to try a safer method and finish unrelated work before stopping to ask you
• Improved Claude in Chrome: long page reads now stay inline instead of being saved to a file and read back
• Improved the MEMORY.md truncation warning to say how many lines were cut and where the cut starts
• Improved the terminal permission prompt for artifacts: it now leads with the ask's question
• Improved the prompt footer: an editor or /diff selection now shows inside the prompt input, and fullscreen mode shows Remote Control status in the header instead of the footer
• Improved the "Usage credits required for 1M context" message to say that usage credits turned on mid-session take effect after restarting Claude Code
• Improved /plugin: installing, enabling or disabling a plugin now takes effect when you close the menu; /reload-plugins is no longer needed afterwards
• Changed the system prompt on Bedrock, Vertex and Foundry to deliver environment, model and settings details as attachments, matching first-party sessions
• Changed Bedrock, Vertex and Foundry sessions to keep the tool list byte-stable across a conversation (late-connecting tools load deferred instead of rewriting it), matching first-party sessions
• Changed the task-tracking tools (TaskCreate/Get/Update/List, TodoWrite) to be offered only on Claude 3.x, Opus 4.0–4.7, Sonnet 4.0–4.6, Haiku 4.5; set CLAUDE_CODE_ENABLE_TODO_TOOLS=1 elsewhere
• Changed the artifact data-edit permission prompt in the terminal to a card that shows the document count and who can open the artifact
• Changed local Cowork sessions set to skip all approvals: the Artifact tool now refuses a local file outside the session's folders, or behind a symlink, instead of reading it without asking
• Changed plain WebFetch deny and ask rules to no longer apply to Artifact tool reads and updates; use an Artifact rule (or WebFetch(domain:claude.ai)) to block or gate them
• Changed the "N MCP servers need authentication" startup notice to announce each server once instead of at every launch
• [VSCode] Fixed the session list, settings toggles, and chat tabs when CLAUDE_CONFIG_DIR is set in a settings file or the environmentVariables setting
• [VSCode] Fixed the model pill, model picker and command menu going blank in open tabs for a few seconds after a login, logout or account switch
• [VSCode] Fixed Auto disappearing from the mode picker in new-tab or just-reloaded conversations when a project or local setting overrides the model named in ~/.claude/settings.json
• [VSCode] Fixed session names reverting to the last prompt after a window reload when a SessionStart hook is configured
• [VSCode] Fixed the footer's model pill and Remote Control pill waiting for the new tab's Claude process to start when another tab in the window is already up
• [VSCode] Fixed a second Claude process running through its full startup when a session tab's launch arrived more than half a second after its config read
• [VSCode] Fixed resuming a session from the session list ignoring claudeCode.preferredLocation: "sidebar" (it always opened a panel), and programmatic opens resetting that setting to "panel"
• [VSCode] Fixed Windows issues: the WSL install prompt no longer appears on machines without WSL installed, and IDE diagnostics are now returned correctly for Windows files when WSL is installed
• [VSCode] Fixed the custom style builder saving a User level style in a folder the CLI does not read when CLAUDE_CONFIG_DIR is set through settings
• [VSCode] Added Left and Right arrow keys to change where an always-allow permission rule is saved, for keyboard and screen reader users
• [VSCode] Added a "Claude Code: Focus last message" command that moves keyboard focus to the newest message in the conversation, for keyboard and screen reader users
• [VSCode] Changed the Manage plugins dialog to apply installs, enables, disables and uninstalls to open sessions without a restart
• [VSCode] Changed some artifact permission prompts to omit the "don't ask again" choice, matching the terminal
• [Claude Code on the web] Fixed cloud sessions running longer than about six hours silently losing files saved to persisted session folders; saves now persist for up to a day
• [Claude Code on the web] Fixed "Invalid effort level" errors when a routine resumes a session, or a session starts with no set effort, in orgs where an admin caps a model's effort
• [Claude Code on the web] Improved routine creation from a conversation: when the new routine has no connectors, Claude now says so and how to add them instead of only confirming it
• [Claude Tag] Fixed the admin settings page hanging on a loading skeleton or going blank after a transient load failure; a section that fails to load now shows a Retry button
• [Claude Tag] Added a link from a Slack channel's configure page back to the organization's Claude in Slack admin settings
• [Claude Tag] Fixed a Slack Enterprise Grid channel losing its Claude settings (repository, environment, access) after a Slack admin moved it to another workspace
• [Claude Tag] Improved how Claude explains a blocked action: it now says whether a permission check, its own decision to confirm first, or missing access stopped it
• [Claude Tag] Improved reply speed: Claude now runs several read-only lookups (searching Slack, reading a thread, finding people) at once instead of one after another
• [Claude Tag] Improved formatting of comparisons: sentence-length comparisons now come as lists instead of wide tables that scroll sideways, and long table cells wrap
• [Claude Tag] Fixed @Claude !restart in a thread with its own session sometimes also posting a contradictory "this thread is handled by the channel session" notice
• [Claude Tag] Improved the message shown when your Claude account is in a different organization than the Slack workspace: it now explains how to connect the workspace to your org
• [Claude Tag] Fixed Markdown links whose URL is wrapped in angle brackets showing as literal bracket text in Slack instead of a clickable link
• [Claude Tag] Fixed a workspace guest's top-level @​mention in a channel where guests may use Claude sometimes getting a "your Slack account isn't connected" reply instead of an answer
• [Claude Tag] Fixed a channel's long-running session being replaced with a fresh one mid-conversation; the scheduled refresh now waits until the channel and its threads are quiet
• [Claude Tag] Fixed channel-settings cards clicked more than once telling the proposing session the change was refused after it had already applied; the outcome is now sent once
• [Claude Tag] Changed memory in public channels: each channel now keeps its own notes, and Claude no longer recalls notes it saved in other public channels; workspace notes stay shared
• [Code Review] Added a note under the still-open findings list in follow-up reviews: resolving a finding's thread, not just replying to it, stops later reviews from counting it as open
• [Code Review] Fixed reviews sometimes ending as incomplete when one of the agents verifying a finding failed midway; the review now replaces that agent and reaches a verdict
• [Code Review] Fixed a push-triggered review that was queued behind a running review still posting after the pull request had been converted to draft
• [Code Review] Fixed reviews ignoring a directory's CLAUDE.md conventions when the PR edited a root file (e.g. README.md) that only shares a name with a file that CLAUDE.md lists

v2.1.267

Compare Source

• Added maxEffortLevel setting (top-level or per model under modelSettings): caps the effort level on every provider, including Bedrock, Vertex and Foundry; users can still pick a lower level
• Added --system-prompt-snapshot off to render the system prompt fresh on every request instead of reusing the conversation's recorded prompt (for iterating on prompt text)
• Fixed Cowork scheduled tasks in the cloud failing at startup for organizations whose managed settings require sandboxing
• Fixed /context and other local command output rendering blank on mobile clients
• Fixed shift+enter and option+backspace not working after reconnecting to a tmux or ssh session inside an agent view
• Fixed the dim last-prompt header not appearing at the top of the conversation when scrolling up in fullscreen mode
• Fixed Workflow agent() calls with large output schemas being refused in auto mode instead of being checked by the safety classifier
• Fixed a case where a marketplace entry path containing a backslash could bypass the containment check for fetched marketplaces on macOS and Linux
• Fixed expired AWS or Google Cloud credentials under a host app such as Claude Desktop retrying ten times with a generic "request failed" before the re-authenticate error appeared
• Fixed resuming a session after /compact or another slash command ran via -p --resume: a spurious "Continue from where you left off." turn is no longer inserted
• Fixed resuming a large session (transcript over 5 MB): parallel tool calls and their hook output are no longer dropped from the reloaded conversation
• Fixed managed allowedHttpHookUrls, httpHookAllowedEnvVars and allowedChannelPlugins to admit nothing, not everything, when unreadable
• Fixed /login on machines whose managed settings require Claude apps gateway sign-in: Esc now closes the dialog instead of doing nothing
• Fixed artifact publishes cut off by a dropped connection mid-upload: they now retry once when Claude Code can tell the upload never completed, instead of reporting an unknown outcome
• Fixed effort: frontmatter on custom commands, skills, and subagents being ignored on models whose default effort is still pinned (Opus 4.7, Opus 4.8, Fable 5)
• Fixed artifact publish failing with an unhelpful error when the page file isn't valid UTF-8 or contains a replacement character (U+FFFD); the error now names the line and column to fix
• Fixed claude agents @ directory menu not listing repositories created after the session started
• Fixed Remote Control clients that join a Claude Desktop or VS Code session showing a stale permission mode until it was changed again
• Fixed claude remote-control exiting and dropping every attached session when its server credential expires (about 30 days after start); the host now re-registers and keeps going
• Fixed the usage-limit warning flickering on and off during a session when requests for different models or modes report different limit windows
• Fixed earlier reasoning being dropped when an MCP server re-sends, or a built-in tool re-renders, a tool the model already loaded
• Fixed a tool that disappears mid-conversation, from a disconnected MCP server or an upgrade, rewriting the tool list and discarding earlier thinking
• Fixed a background worker forked from a conversation adding EnterWorktree to the conversation's tool block mid-session, which broke prompt-cache reuse
• Fixed mid-session MCP and plugin tools being added to the tool list in sessions without ToolSearch, which broke prompt-cache reuse; supported models now receive them as deferred definitions
• Fixed switching models with /model re-sending every tool definition (a prompt-cache miss); commit and PR attribution text now arrives as a conversation note that updates on model changes
• Fixed resumed sessions rewriting the inline tool set when an MCP connector reconnects at a different moment than before
• Fixed resumed sessions re-rendering tool descriptions instead of replaying the recorded ones when the first turn ran a tool
• Fixed prompt-cache misses and dropped extended thinking when a claude.ai connector's tools change between a session and its resume
• Fixed resumed sessions rewriting earlier MCP tool announcements (and dropping extended thinking) before their connectors reconnect
• Fixed a prompt-cache break when a print-mode (-p) conversation is resumed interactively: the system prompt prefix no longer changes
• Improved the /diff panel: it no longer flashes "0 files changed" and a spinner before settling, and its empty state is centered in the panel
• Improved the Bash tool's description guidance so Claude describes what a command does in plain words instead of echoing the command
• Improved sandbox guidance so Claude suggests /copy when clipboard commands such as pbcopy fail inside the sandbox
• Improved --resume first-render time for sessions with many Bash tool calls
• Improved prompt input responsiveness: keystrokes no longer occasionally wait a frame behind spinner or streaming repaints
• Improved prompt-cache stability: subagents and sessions started with --system-prompt or --append-system-prompt now record the system prompt and tool definitions once instead of re-rendering them
• Improved Artifact tool publish errors: when a publish is refused, the message now says why and what to do about it
• Self-hosted runner: Changed --use-anthropic-git-proxy to be reported to the server at registration and to print a warning for each session that still clones through the legacy git proxy
• Gateway: Changed forward_user_identity upstreams to return a 429 as-is to a developer whose email was forwarded, instead of failing over to the next upstream, so the proxy's per-user limits hold
• [VSCode] Fixed the extension host hanging at 100% CPU when forking, editing an earlier message, or rewinding in a conversation whose saved transcript contains a cyclic parent link
• [VSCode] Fixed pasting a screenshot on WSL2/WSLg inserting raw image bytes into the chat input; the image is now attached when the clipboard provides it, otherwise the paste is ignored
• [VSCode] Fixed chat diff blocks always rendering with a dark editor theme; they now follow the active VS Code color theme, including high contrast
• [VSCode] Fixed mixed right-to-left and English text rendering in the wrong order while typing in the message input
• [VSCode] Fixed accepting an edit in the diff view on a file with Windows (CRLF) line endings failing with "String not found in file"
• [VSCode] Fixed @​-mentions dropping files whose paths contain spaces
• [VSCode] Fixed the sessions list view failing to load in windows connected over Remote-SSH when the workspace folder exists only on the remote host
• [VSCode] Fixed runaway ripgrep processes when viewing files in large or symlink-heavy workspaces
• [Claude Code on the web] Fixed GitHub Enterprise Server sessions showing your GitHub account as disconnected once its token expired; PR and issue operations now refresh it automatically
• [Claude Code on the web] Fixed gh and GitHub API calls failing in organizations without the Claude GitHub App; they now use your connected GitHub account and say so when none is connected
• [Claude Tag] Added a "Use a custom connector" link to the preset connection forms in Claude Tag admin settings, so you can switch to a custom connection without starting over
• [Claude Tag] Fixed Claude replying "The API rejected the request as invalid" when the organization has run out of usage credits; the reply now says so and explains how to add more
• [Claude Tag] Fixed thread requests to edit or delete a message Claude posted at the channel's top level being answered with a correction instead of reaching the session that posted it
• [Claude Tag] Fixed Connect on Tool access requests under Admin settings > Review requests failing with "Authorization failed" or showing the requested access bundle as deleted

bufbuild/buf (github.com/bufbuild/buf)

v1.73.0

Compare Source

• Fix buf format dropping comments next to commas or semicolons in message literals.
• Fix compilation failing to resolve symbols re-exported through import public when the
  re-exporting file also reaches those symbols through a non-public import.
• Fix LSP go to definition not resolving across files inside dependency and well-known-type
  files, and release workspaces when their last open file closes to free resources.
• Fix LSP finding only a subset of references to symbols declared in
  dependencies, including well-known types.
• Fix buf format non-idempotent trailing comment formatting.
• Update built-in Well-Known Types to Protobuf v35.1.
• Fix managed mode setting java_multiple_files on Edition 2024 files, which is not
  allowed and causes code generation to fail.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Only on Wednesday (* * * * 3)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.