[dependabot]

Bumps @anthropic-ai/claude-code from 2.1.259 to 2.1.309.

Release notes

Sourced from @​anthropic-ai/claude-code's releases.

v2.1.309

What's changed

• Fixed sandboxed Bash commands on macOS and Linux running the shell's startup files outside the sandbox before each command
• Fixed macOS sandbox denyWrite glob patterns not applying at a path's real location when the pattern's folder is reached through a symlink
• Fixed sandboxed commands and auto-accepted edits being able to modify the MCP config file passed with --mcp-config
• Fixed a disabled MCP server being reconnected by a later permission prompt in print and SDK sessions
• Fixed the Bash permission check trusting a variable set by a command whose redirect can fail to open
• Fixed Bash permission checks not prompting for some compound commands that change directory before running git when the cd is wrapped or prefixed, as they do for a plain cd
• Fixed an Edit(path) deny rule not blocking a Bash redirect to that path in some commands that also held a subshell
• Fixed worktree-isolated sessions accepting some locale-prefixed commands the isolation guard should refuse
• Fixed worktree-isolated sessions on zsh accepting some arithmetic commands that the isolation guard should refuse
• Fixed worktrees and branch checkouts that Claude Code creates so they ignore git replace refs, as its other git operations already do
• Fixed profile store write protection not applying when the config directory is reached through a symlink
• Fixed sessions compacting repeatedly after reading files under a very large nested CLAUDE.md; a nested CLAUDE.md over the size limit now loads only its start
• Fixed ctrl+enter (send now) only queuing a message when pressed before the response had started, and restarting a prompt's hooks while leaving the message queued when pressed while those hooks were running
• Fixed key-bound slash commands running in the shell from ! mode
• Fixed ctrl+o not showing messages from other agents and sessions that are still waiting to be delivered; they now appear in full under the transcript, marked as waiting
• Fixed long tool output previews being cut through an emoji, leaving session transcripts that jq could not parse
• Fixed Read reporting "File does not exist" for PDF page ranges in Linux sandboxes that share the parent's /proc
• Fixed messages from a Claude Desktop-hosted session sometimes being lost when its connection refreshed
• Fixed features missing from Claude Code sessions in the Claude desktop app when the terminal on the same computer was signed in to a different account or organization
• Fixed the claude remote-control status line showing HEAD as the branch for a folder that is not in a git repository
• Fixed split-pane agent teammates not inheriting the tool deny and --tools rules given on the leader's command line
• Fixed sessions renamed with /rename appearing to other sessions under a generated name after a VS Code window reload or a non-interactive --resume
• Fixed the /rewind list showing "No code changes" for a turn that changed checkpointed files through /code-review --fix, a subagent or a shell command
• Fixed /privacy-settings showing an out-of-date "Help improve our AI models" value; it now also says when the setting can't be fetched
• Fixed feedback saying "try again later" when your organization does not accept feedback; it now shows the server's reason and where to report a bug
• Fixed oversized /feedback reports failing instead of being resent without the transcript
• Fixed a skill in an --add-dir folder being unreachable when another skill already held its name; it is now offered as <folder>:<name>
• Fixed /verify and /code-review not finding a nested package's own skill when its files were changed from the shell
• Fixed the /claude-api skill saying that ant beta:worker poll --on-work passes trace context to the command
• Fixed the /claude-api skill's C# tracing setup missing spans from the cloud platform clients
• Fixed the /claude-api skill saying that API spans for requests to Claude Platform on AWS can't join the caller's trace
• Fixed hooks that run in PowerShell not blocking when the hook's program exits with code 2, and on Windows PreToolUse and PermissionRequest hooks with "shell": "powershell" failing open when Git for Windows isn't installed
• Fixed a mod's turn.step hook that names a model by alias, such as haiku, failing every request with a model error: the alias now resolves to its model
• Fixed plugins and skills synced from claude.ai being removed, sometimes mid-session, after a disk read error
• Fixed artifact publishes and updates being refused for some ordinary pages, such as pages with certain minified scripts or artifacts Claude could not read first
• Fixed Claude asking for permission on each artifact update for the rest of a turn after the conversation was compacted in that turn
• Fixed fine-grained tool streaming staying off on Amazon Bedrock when ANTHROPIC_BEDROCK_BASE_URL is set to the default bedrock-runtime.<region>.amazonaws.com endpoint
• Fixed the "Waiting for API response" hint flickering behind gateways that send only keepalive pings: routes off Anthropic's backend now wait 45 seconds
• Fixed Claude notifying unrelated GitHub users by writing role names and placeholders as mentions in PRs, issues and comments
• Linux: Fixed sandbox write denies lifting when a background command outlived the session
• Windows: Fixed PowerShell permission checks auto-approving some Set-Location or cd commands that target the current directory and carry extra arguments; these now prompt for approval
• macOS: Fixed the "Install Command Line Developer Tools" dialog opening each time Claude Code starts on a Mac without Xcode or the Command Line Tools
• Self-hosted runner: Fixed --startup-timeout-min stopping a session whose first prompt, such as /code-review, was still working in a subagent; a frozen process is still stopped
• Improved the speed of many git commands Claude Code runs for itself on Windows; on every platform, errors from those commands now show in English even when git is set to another language
• Improved the error when a hooks module is nested too deep to load: it now names the file instead of showing a bare stack-overflow message
• Improved disk-full handling: a Bash command cut off by a full disk now says so and names the folder to free up, and starting on a full temp volume prints a clear message, not a raw ENOSPC error
• Improved the /claude-api skill to offer API tracing alongside SDK tracing when asked to add OpenTelemetry

... (truncated)

Commits

• 65823ec chore: Update CHANGELOG.md and feed.xml
• 5ed799e chore: Update CHANGELOG.md and feed.xml
• 1132b8a chore: Update CHANGELOG.md and feed.xml
• d014fc0 chore: Update CHANGELOG.md and feed.xml
• 49b8c35 chore: Update CHANGELOG.md and feed.xml
• 5a2676e chore: Update mods/
• a6e289a chore: Update mods/
• 772c6be chore: Update CHANGELOG.md and feed.xml
• ef7bfdc chore: Update CHANGELOG.md and feed.xml
• dd6bee3 chore: Update mods/
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​anthropic-ai/claude-code since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Routine Dependabot devDependency bump (@anthropic-ai/claude-code 2.1.259 → 2.1.309, patch within 2.1.x), touching only package.json/package-lock.json. Title and description are the standard, accurate Dependabot output, so I left them untouched.

Should fix

• package.json:44 — the allowScripts entry is still pinned to the old version (@anthropic-ai/claude-code@2.1.259); it needs to move to 2.1.309 alongside the bump, or npm's lifecycle-script gate will stop recognising this package's install script as approved.

Nothing else in the diff — the lockfile changes are a consistent, mechanical reflection of the package.json bump, and every platform-specific optional dependency moved together.

[github-actions]

🗜️ Headroom context compression

Metric	Value
Requests proxied	25
Tokens saved	99600
Aggregate savings	4.2% of all tokens sent
Average per-request compression	6.1%