[dependabot]

Bumps @anthropic-ai/claude-code from 2.1.259 to 2.1.308.

Release notes

Sourced from @​anthropic-ai/claude-code's releases.

v2.1.308

What's changed

• Bug fixes and reliability improvements

v2.1.307

What's changed

• Added /claude-api api-version to move Claude API code to API version 2026-10-21
• Added the claude_code.safety_event OpenTelemetry event for each tool call a permission rule, auto mode, a safety check, a hook or the sandbox stopped, prompted or sent back
• Fixed requests failing with a model-not-found error when CLAUDE_CODE_DISABLE_1M_CONTEXT is set and the model is an alias with the [1m] suffix, such as opus[1m]
• Fixed the prompt-caching-scope beta header being sent behind custom ANTHROPIC_BASE_URL gateways and on Foundry, where it has no effect
• Fixed MCP servers showing "needs authentication" in claude -p on macOS while the login keychain was locked; they now say why, and the next run after an unlock connects without a new sign-in
• Fixed MCP servers being reported as timed out, and staying failed in headless runs, when a macOS or Linux computer went to sleep while they were connecting
• Fixed HTTP MCP tool calls being sent twice when the connection closed mid-call; only read-only or idempotent tools are now retried
• Fixed a turn sometimes starting without an SDK MCP server's latest tools when a background task was running
• Fixed some "Autocompact is thrashing" errors in turns that read many PDF pages, images or other large tool results
• Fixed /autocompact in cloud sessions going back to the default window after the session restarted
• Fixed a conversation cleared with /clear sometimes coming back when a cloud or self-hosted runner session restarted
• Fixed CLAUDE_STREAM_FIRST_BYTE_TIMEOUT_MS being ignored in Claude apps gateway sessions
• Fixed telemetry from Claude Desktop sessions behind a Claude apps gateway being rejected when OTEL_EXPORTER_OTLP_HEADERS is set
• Fixed /permissions > Recently denied not showing the denied shell command, and auto mode's local classifier ignoring an approval from there when it checks a retried command; approving a row now names the command, not its description
• Fixed /help and the / command menu showing long model-facing descriptions for bundled skills such as /claude-api instead of their short descriptions
• Fixed subagent transcripts recording placeholder token usage and an empty stop reason for streamed responses
• Fixed model switches through the Agent SDK's setModel(), and apps built on it, being refused when the API took more than 5 seconds to confirm the model; Claude Code now waits up to 15 seconds
• Fixed a background command stopped through a connected app (such as the desktop app archiving an idle session) being reported to Claude as stopped by the user; the notice now names its output file
• Fixed WebFetch in Cowork cloud sessions reporting a tool error when a site answered with a 4xx status or a robots.txt refusal; it is now a normal result, as in local sessions
• Fixed write tools on a directly configured GitHub MCP server showing a form that closed without creating anything in the desktop app's Code tab
• Fixed Artifact tool reads failing with a connection reset when the server had closed a reused connection
• Self-hosted runner: Fixed sessions with --use-anthropic-git-proxy committing a .claude/settings.local.json left in the clone by an earlier session
• Self-hosted runner: Fixed archiving or requeueing a session, or stopping the runner, during its checkout hook leaving the hook's processes running and the runner's slot held
• Improved recovery from unparseable tool calls: Claude Code now retries the call up to twice before ending the turn with an error
• Improved fork subagents launched together: each is now told which launch is its own, so forks are much less likely to try to start each other's work
• Improved browser sign-in: the success page now appears as soon as sign-in completes, without waiting for your account profile to load
• Improved web search errors in cloud and self-hosted runner sessions: a search refused with a 403 that gives a reason now shows that reason instead of a generic "Authentication error"
• Improved the time to the first reply in cloud sessions when one of the desktop app's MCP servers can't connect
• Improved Remote Control connect time for sessions whose transcript contains large pasted images or PDF reads
• Changed the notice Claude gets when the WebSearch budget is used up to also tell it not to query search engines in a browser or through computer use
• Changed the axScreenReader setting and CLAUDE_AX_SCREEN_READER in a settings env block to apply only from user, managed or --settings settings (since 2.1.305)
• Self-hosted runner: Changed checkout hooks to be stopped after 30 minutes by default, failing the session's setup; if yours needs longer, raise --checkout-hook-timeout-min or set it to 0
• Self-hosted runner: Changed the certificate file built for Anthropic-managed git to filter its trusted certificates as the CLI does; a [runner:warn] line gives the number left out
• [VSCode] Added a notice on the microphone button when voice dictation stops by itself (15 seconds without recognized speech, or the 2-minute limit), saying why and that the text so far is kept
• [VSCode] Fixed a long prompt expanded with Show more covering the whole chat panel: a pinned prompt is now capped at 40% of the panel and scrolls
• [VSCode] Fixed part of a list item or table cell with LaTeX math pasting as a new list or table in rich text editors
• [VSCode] Fixed dictation failing behind a TLS-inspecting proxy when NODE_EXTRA_CA_CERTS is set only in ~/.claude/settings.json; it now also follows CLAUDE_CODE_CERT_STORE
• [VSCode] Changed the "still open somewhere else" notice to also cover a Claude process left over from an extension restart, which usually ends on its own within about 10 minutes
• [VSCode] Changed voice dictation to filter its trusted certificates as the CLI does
• [VSCode] Changed the extension's own requests to filter their trusted certificates as the CLI does, and to trust the NODE_EXTRA_CA_CERTS file named in the environment or in user settings
• [Cloud sessions] Fixed the repository picker saying "No repositories match" while a search was still running; it now shows "Searching…" until the results arrive
• [Cloud sessions] Fixed the "Waiting for a runner" status on self-hosted environments being cut off; with on-demand runners it now counts up from your last message and shows failed attempts

... (truncated)

Commits

• 5ed799e chore: Update CHANGELOG.md and feed.xml
• 1132b8a chore: Update CHANGELOG.md and feed.xml
• d014fc0 chore: Update CHANGELOG.md and feed.xml
• 49b8c35 chore: Update CHANGELOG.md and feed.xml
• 5a2676e chore: Update mods/
• a6e289a chore: Update mods/
• 772c6be chore: Update CHANGELOG.md and feed.xml
• ef7bfdc chore: Update CHANGELOG.md and feed.xml
• dd6bee3 chore: Update mods/
• 8a8dff6 chore: Update mods/
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​anthropic-ai/claude-code since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Clean, narrowly-scoped Dependabot bump: @anthropic-ai/claude-code devDependency 2.1.259 → 2.1.308 in package.json/package-lock.json only. No findings.

• This CLI is used solely by the investigate job in .github/workflows/dependabot.yml (not by action.yml's pinned upstream anthropics/claude-code-action SHA), and per docs/release-pipeline.md:27 it is deliberately tracked by its own isolated npm Dependabot entry so it never bumps alongside the pinned upstream dependency — consistent with this diff touching nothing in action.yml.
• build(deps-dev): is the correct commit type for a patch release per this repository's own versioning table in CLAUDE.md — no prompt or behavioural change is bundled in.
• The CLI flags this repo actually invokes against this package (-p, --max-turns, --allowedTools, --disallowedTools in .github/workflows/dependabot.yml:159-162) are long-standing and nothing in the release notes between these versions indicates they changed.
• Title and description are the standard, complete Dependabot-generated format; nothing to correct.

No prior reviews on this pull request to reconcile.

[github-actions]

🗜️ Headroom context compression

Metric	Value
Requests proxied	15
Tokens saved	39898
Aggregate savings	3.6% of all tokens sent
Average per-request compression	5%

[dependabot]

Superseded by #160.