tools: bump mise tools - #13

v1.18.3

Compare Source

Core

Improvements

• Added an Up Arrow shortcut to close the subagent picker when the first item is selected.

Desktop

Bugfixes

• Fixed home page scrolling so sticky headers and the session list behave correctly.
• Fixed startup readiness so WSL server loading is included before the desktop app reports ready.
• Removed the inactive help button from the app layout.
• Fixed custom agent selector visibility when custom agents are available.

Improvements

• Home page command palette search can now find and open sessions.

v1.18.2

Compare Source

Core

Bugfixes

• Stopped subagents from launching nested subagents by default, with a configurable subagent_depth limit when needed.
• Improved default reasoning depth for Meta models.

Desktop

Improvements

• Added Mod+N as another shortcut for opening a new tab.

Bugfixes

• Restored the Help button in release builds.
• Kept sessions with null archive times visible instead of dropping them from the home list.
• Hid the drawer close button on Windows where it conflicts with the window chrome.

Thank you to 1 community contributor:

• @​BB-84C:
  • fix(core): tolerate AlreadyExists in FSUtil.ensureDir (#​36542)

v1.18.1

Compare Source

Desktop

Bugfixes

• Fixed spacing between model provider sections in Settings.

v1.18.0

Compare Source

Desktop

Improvements

• Completed the Desktop v2 migration, including upgrade handling for the new layout and first-launch onboarding.
• Added a setting to switch between the new and old Desktop layouts during the transition period.

Bugfixes

• Fixed file views using the wrong background in the v2 layout.
• Fixed connected project picker positioning when its anchor is still loading.
• Kept permission auto-accept state separate for each server.
• Fixed a project picker positioning crash.
• Kept terminal tab rename focused while editing.
• Enabled remote sessions to auto-accept permissions correctly.
• Fixed terminal tabs stealing focus when they mount.
• Loaded more timeline history at once to reduce repeated backfill while scrolling.
• Resynced the timeline correctly after reconnecting.
• Preserved the composer caret after request updates.
• Reduced Home cold-load time substantially.
• Preserved timeline bottom anchoring more reliably.
• Clarified status indicator severity.

v1.17.20

Compare Source

Core

Bugfixes

• Removed an obsolete Codex workaround that could interfere with OpenAI Luna Responses Lite requests.

Improvements

• Updated Azure AI support for GPT-5.6.

v1.17.19

Compare Source

Core

Bugfixes

• Supported OpenAI pro reasoning mode.
• Disabled response storage by default for xAI Responses. (@​geraint0923)
• Added OAuth support for Luna Responses Lite.
• Switched to another available org after logging out in the console.
• Used Codex context limits for GPT-5.6 over OAuth. (@​nabilfreeman)

TUI

Bugfixes

• Forwarded CLI environment variables to the TUI worker.

Desktop

Bugfixes

• Removed interface transition changes that were accidentally shipped to dev.
• Fixed clipped labels and branch tooltips.
• Stopped the review panel width from jumping when opening or closing it.
• Focused the prompt input when starting a new session.
• Prevented some new-session updates from blocking the UI.
• Fixed timeline outlines getting clipped.
• Aligned context token counts with usage totals.
• Kept the file tree visible while opening files.

Improvements

• Redesigned attachment cards and file comment chips in the new interface.
• Updated the review panel with persistent file browsing, better file tabs, and easier open-in-app actions.
• Restyled the Edit Project modal to match the new interface.
• Added middle-click to open sessions in a new tab.
• Added a temporary setting to switch between the old and new interface.
• Added per-prompt model selection in the composer.
• Polished the new interface styling across the session view and terminal.

Thank you to 2 community contributors:

• @​nabilfreeman:
  • fix(openai): use codex context limits for gpt-5.6 (#​36248)
• @​geraint0923:
  • fix(xai): default store to false for Responses (#​36629)

v2.1.212

Compare Source

• /fork now copies your conversation into a new background session (its own row in claude agents) while you keep working; the in-session subagent it used to launch is now /subtask
• Added claude auto-mode reset to restore the default auto-mode configuration, with a confirmation prompt (pass --yes to skip)
• Added a session-wide limit on WebSearch tool calls (default 200, tunable via CLAUDE_CODE_MAX_WEB_SEARCHES_PER_SESSION) to stop runaway search loops
• Added a per-session cap on subagent spawns (default 200, override with CLAUDE_CODE_MAX_SUBAGENTS_PER_SESSION) to stop runaway delegation loops; /clear resets the budget
• MCP tool calls running longer than 2 minutes now move to the background automatically so the session stays usable; configure the threshold or disable with CLAUDE_CODE_MCP_AUTO_BACKGROUND_MS
• Typing /resume in the agent view now opens a picker of past sessions — including sessions deleted from the list — and resumes your pick as a background session
• Fixed plan mode auto-running file-modifying Bash commands (e.g. touch, rm) without a permission prompt or SDK canUseTool callback
• Fixed worktree creation following a repository-committed symlink at .claude/worktrees, which could create files outside the repository
• Fixed a continue:false hook's halt being dropped when the tool fails or completes mid-stream, and hook infrastructure errors being misreported as user rejections
• Fixed SIGTERM during a running Bash tool orphaning the command's process tree in print/SDK mode; the CLI now aborts the turn, kills the tree, and exits 143
• Fixed /background and claude --bg failing with "EUNKNOWN: unknown error, uv_spawn" on Windows when Group Policy blocks PowerShell 5.1; the daemon now prefers PowerShell 7
• Fixed shell mode (!) not executing commands containing file paths while the path autocomplete popup was open
• Fixed auto-mode denial notifications rendering broken characters when a long denial reason was truncated mid-emoji
• Fixed Ctrl+J not inserting a newline in the agent view dispatch input on terminals with extended key reporting, and surfaced the newline shortcut in the ? help overlay
• Fixed /ultrareview rejecting PR references like #123, PR 123, and pasted PR URLs; error hints now name the command you actually typed
• Fixed /ultrareview <branch> not fetching the branch from origin when it exists remotely; it now suggests the closest branch name on typos
• Fixed /ultrareview skipping the billing confirmation in a new conversation after /clear
• Fixed /ultrareview's "not a git repository" error on Claude Desktop now suggesting the project's repository folder instead of terminal commands
• Fixed hosted (host-managed) sessions failing at startup when repository settings configured mTLS certs, extra CA bundles, or OAuth scopes; these transport settings are now ignored with a warning
• Fixed a spurious "File has not been read yet" error when editing a file that had been read with offset/limit before resuming a session
• Fixed ExitWorktree failing with "no active EnterWorktree session" after resuming a session with --continue/--resume in print/SDK mode
• Fixed the workflow agent grid staying empty for Remote Control clients that join a session mid-run
• Fixed streaming-mode control requests being marked complete before their handler finished, which could lose the request on session restart
• Fixed background sessions created with /fork losing their live-parent protection after a state write failure
• Fixed reopening a stopped background session from the agent view failing silently — it now resumes the session, or shows why it can't and lets you force a restart
• Fixed agent teams: a stopping teammate could send the leader duplicate idle notifications when team initialization re-ran within a session
• Fixed the plan-approval dialog footer splitting "ctrl+g to edit in " apart when the file path is long
• Fixed the welcome banner keeping its old panel widths after a combined width+height terminal resize in fullscreen mode
• Fixed diff previews losing their line numbers and +/- markers in narrow layouts
• Fixed @​-mentions attaching nothing after a partial file read, plugin uninstall targeting the wrong marketplace, and false "Command timed out" on exit code 143
• Fixed OpenTelemetry HTTP exports being rejected with 411/400 by Azure Monitor and other endpoints that don't accept chunked transfer encoding
• Fixed OTLP event log records missing trace_id/span_id when TRACEPARENT is set in SDK/headless mode
• Fixed conversations with many images incorrectly failing with "Request too large" errors, and improved the error message to explain the actual cause
• Fixed web search and web fetch returning "API Error" text as search results or page content when the API was overloaded
• Improved web search and web fetch reliability by retrying 529 errors and rate-limited requests with bounded backoff
• Improved prompt caching: the mid-conversation system block now works behind LLM gateways and custom base URLs (Bedrock, Vertex, 1P)
• Improved background agent attach: cold-attaching now instantly shows the formatted transcript while the session boots, instead of a blank wait
• Reduced token usage in inter-agent messaging: SendMessage bodies are no longer duplicated into replayed history and tool results
• Changed /fork to name the copy after your prompt when the session has no title, so the row is recognizable in the agent view
• Changed bare /btw to reopen the side-question panel on your most recent exchange so you can browse earlier answers
• Changed the ← footer hint to pulse N done for a moment when a background agent finishes while nothing needs your input
• Deprecated the Task tool's mode parameter (now ignored); subagents inherit the parent session's permission mode by default
• Changed Enterprise forceLoginMethod to be enforced for VS Code extension, SDK, setup-token, and install-github-app logins, not just the terminal
• Changed session transcripts to record the reasoning effort level on each assistant message
• Changed headless/SDK sessions to apply a set_model control request mid-turn; the next model round-trip uses the new model instead of waiting for the next turn
• Changed agent view / claude agents --json: sessions waiting on a sandbox, MCP-input, or managed-settings prompt now show as "Needs input" instead of "Working"
• Updated the auth status panel title from "Cloud authentication" to "Authentication"
• Corrected an earlier release note (2.1.200): tmux through the 3.6 series lacks synchronized output; newer tmux with support is detected automatically

v2.1.211

Compare Source

• Added --forward-subagent-text flag and CLAUDE_CODE_FORWARD_SUBAGENT_TEXT environment variable to include subagent text and thinking in stream-json output
• Fixed permission previews relayed to chat channels not neutralizing bidirectional-override, zero-width, and look-alike quote characters, so tool inputs cannot visually alter the approval message
• Fixed auto mode overriding a PreToolUse hook's ask decision for unsandboxed Bash — a hook ask now floors the decision at a prompt
• Fixed parallel Claude Code sessions all logging out simultaneously after wake-from-sleep when many sessions share one credential store
• Fixed plugin MCP servers not reconnecting after an idle web session woke, leaving MCP calls failing until the next message
• Fixed Claude Code on Vertex and Bedrock attempting the default Opus model at startup and printing a spurious fallback notice when a model is explicitly configured
• Fixed subagents spawned with an explicit model override reverting to the parent's model when resumed or sent a follow-up message
• Fixed nested .claude/rules/*.md files loading even when setting sources exclude project settings
• Fixed file upload validation: filenames ending in a DOS device suffix (.prn) or trailing dot are now accepted, and files with multiple hard links are refused
• Fixed file uploads to Claude in Chrome from remote and CLI sessions
• Fixed edits that leave the input as "?" being silently swallowed and toggling the shortcuts panel
• Fixed a startup hang when the Claude in Chrome extension is enabled but Chrome is not running
• Fixed a 300ms delay revealing async content (Settings tabs, Stats, diff views, and other loading states)
• Fixed reopening a just-stopped background session from the agents view starting a blank conversation under the same session id
• Fixed /loop hiding the session from /resume after a single use
• Fixed screen reader users losing the audible terminal bell after /terminal-setup or onboarding terminal setup
• Fixed background jobs on LLM gateway auth (ANTHROPIC_AUTH_TOKEN + ANTHROPIC_BASE_URL) coming back "Not logged in" after the daemon respawns them
• Fixed claude agents jobs becoming permanently undeletable when git no longer recognizes their worktree — the row now shows why the delete was refused instead of silently reappearing
• Fixed /clear not resetting the session cost counter — the statusline's cost now starts at $0 after /clear
• Fixed Claude in Chrome setup pages failing to open in the browser on Windows
• Fixed headless print-mode sessions on Windows crashing or silently exiting when stdin is unreadable
• Fixed background session titles in the agents view showing the naming model's refusal text when the prompt contains a link
• Fixed background agents killed by the user auto-respawning, and revived agents re-running stale prompts from old sessions
• Fixed routines with no schedule reporting a next run time in the year 1
• Hardened synced skill/plugin directory naming on Windows and kept CCR web fetch/search proxies working after /clear
• Improved terminal layout and rendering performance
• Improved background agent result reporting — Claude now reports the status of still-running agents and waits for the real completion instead of fabricating results
• Improved the memory index over-limit warning to measure only loaded content, excluding frontmatter and HTML comments
• Updated integer environment variables (timeouts, token budgets, retry counts) to accept scientific notation and digit-separator spellings like 1e6 and 64_000
• Updated documentation links to the current docs sites
• Changed "always allow" permission rules to save at the repository root, so approvals granted in a git worktree persist across sessions and worktrees
• Changed /usage-credits to ask for confirmation before sending a request to organization admins
• Changed Vim mode s and S (substitute char/line) to work in NORMAL mode, matching vim behavior
• [VSCode] Updated the Remote Control banner to describe what it does
• Claude in Chrome: hardened file-upload path validation
• Claude in Chrome: save_to_disk on screenshot actions now writes the image to disk and returns the path; previously it did nothing
• Fixed a prompt-caching regression on Bedrock, Vertex, Mantle, and Foundry that billed the trailing system context block as fresh input tokens on every request.

v2.1.210

Compare Source

• Added a live elapsed-time counter to the collapsed tool summary line so long-running tool calls visibly tick instead of looking stuck
• Added a startup warning for Write(path), NotebookEdit(path), and Glob(path) permission rules — use Edit(path) or Read(path) instead
• Fixed isolation: 'worktree' subagents being able to run git-mutating commands against the main repo checkout instead of their own isolated worktree
• Fixed the ultracode keyword opt-in firing on non-human-originated input such as webhook payloads and relayed PR comments
• Fixed a rendered text fragment leaking into crash telemetry when a UI component returned content outside a styled text element
• Fixed paste markers leaking into external editors opened from Claude Code, which could appear as stray È/É characters around pasted text
• Fixed claude attach sometimes failing with "job not found" or "agent is still starting" errors during session transitions — attach now waits for the daemon to settle, and terminal resizes during a slow attach are applied once it completes
• Fixed a session crash when a tool's result renderer returned a numeric bigint value or plain text instead of a UI element
• Fixed a hook callback timeout being misreported to the model as a user rejection, which made unattended sessions stop and wait
• Fixed Claude assuming a cd took effect after its command was moved to the background; the tool result now states the working directory is unchanged
• Fixed plugin-provided MCP servers being torn down when MCP servers are re-synced mid-session
• Fixed plan approvals without edits being labeled "(edited by user)" and overwriting the plan file with a stale snapshot
• Fixed /doctor skipping its auto-mode-default proposal on Bedrock, Vertex, and Foundry, where auto mode no longer needs an opt-in
• Fixed Grep content mode claiming "No matches found" when paginating past the end of results
• Fixed unmatched $1/$2 positional placeholders in skills and commands being silently stripped; they are now preserved verbatim
• Fixed plugin cache writes leaving temp files behind on failure and failing on locked-file renames on Windows and network filesystems
• Fixed background workers crash-looping when a client resets its connection to the background service
• Fixed claude agents --effort ultracode not reaching dispatched sessions; the value was silently dropped
• Fixed pressing ← to open the agents view dropping the task tracker when returning to the session
• Fixed the agents dashboard retaining pasted images from abandoned reply drafts after their session was deleted
• Fixed killed background sessions leaving a permanent git worktree lock behind; the periodic sweep now releases locks whose owning process is gone
• Fixed SDK MCP servers registered via an initialize control request waiting until the next turn to start connecting
• Fixed returning to the agents view from a session leaving overlapping ghost frames with CLAUDE_CODE_DISABLE_ALTERNATE_SCREEN=1
• Fixed late-appearing .claude/* symlinks not being reconciled into the sandbox deny-write list
• Hardened the Agent tool against indirect prompt injection via content a subagent read
• Improved the Bash/PowerShell tool message when a command hits its timeout and is auto-backgrounded, so the model can distinguish a hang from an explicit background request
• Improved auto mode: the permission classifier now defaults to Sonnet 5 for external sessions, validated on the session's first request and pinned for the session
• Improved the bundled dataviz skill's chart color validation with perceptual OKLab color difference and recalibrated color-blindness thresholds
• Memory writes that leave a MEMORY.md index over its read limit now produce an explicit error instead of silent truncation
• Screen reader mode now announces permission mode changes aloud when cycling modes with Shift+Tab
• The agents footer hint now shows how many background agents are waiting on your input, with a brief color emphasis when the count changes
• Agent view: the session you pressed ← from stays visibly marked even after mouse hover or arrow keys move the selection
• Fable temporarily shows as unavailable in the advisor picker while a server-side issue causing Fable advisor failures is fixed

v2.1.209

Compare Source

• Fixed /model and other dialogs being blocked in claude agents background sessions (reverts an overly broad guard)

v2.1.208

Compare Source

• Added screen reader mode: opt-in plain-text rendering for screen reader users. Run claude --ax-screen-reader, set CLAUDE_AX_SCREEN_READER=1, or add "axScreenReader": true to settings.
• Added vimInsertModeRemaps setting: map two-key insert-mode sequences like jj to Escape in vim mode
• Added CLAUDE_CODE_PROCESS_WRAPPER: agent view and the background service now honor a corporate launcher by running every Claude Code self-spawn through a required wrapper executable
• Added mouse-click support for multi-select menus and "Other" input rows in fullscreen mode
• Changed the Fable 5 usage-credits consent prompt to start with the decline option focused
• Fixed fast mode staying off after switching back to a model that supports it — it now restores automatically when enabled in settings
• Fixed replies typed to a background agent being lost when delivery fails — the text is now saved and delivered when the session restarts
• Fixed background-session attach failing permanently ("Couldn't start the background daemon") after an update replaced the binary a running claude agents process was launched from
• Fixed the context window (and auto-compact indicator) briefly resetting to 200k after the CLI auto-updates, causing a false "100% context used" when resuming long-context sessions
• Fixed supervised and background sessions crashing when a server closed an HTTP/2 connection with a GOAWAY while requests were in flight
• Fixed truncated stream-json/JSON output and missing result message when piping large responses from claude -p
• Fixed CLAUDE_CODE_MAX_OUTPUT_TOKENS and similar env vars silently using the mantissa of scientific-notation values (1e6 became 1)
• Fixed very large markdown tables stalling rendering or using excessive memory; tables over 200 rows show the first 200 with a "… N more rows" notice
• Fixed the Edit tool failing on files modified after reading when the target text still matches uniquely
• Fixed Read reporting empty files as "shorter than offset", Grep silently returning "No files found" for invalid regex patterns, Grep count mode under-reporting totals when paginated, and Glob crashing with an unclear error when the pattern, path, or working directory contained a null byte
• Fixed apiKeyHelper script failures being hidden behind a generic 401 after ~10 silent retries; the script's own error is now shown within 3 attempts
• Fixed Bedrock streaming requests failing with a misleading "Truncated event message received" when a gateway transforms the response — the error now names the content-type and points at the proxy
• Fixed /upgrade showing a login flow instead of the upgrade URL when the browser fails to open
• Fixed stream-json input killing the session on blank CRLF or whitespace-only lines from Windows-style SDK hosts
• Fixed headless stream-json sessions hanging permanently when a control_request carried a non-string set_model payload; the CLI now answers with an error response
• Fixed repeated "No completion record was found" notices on session resume — orphaned background tasks now collapse into a single summary
• Fixed Remote Control clients attaching to a terminal-hosted session not seeing background agents and workflow progress until a task started or stopped
• Fixed the Agent tool launching with no tools when a subagent's tools list resolves to nothing — it now returns a clear error naming the unrecognized entries
• Fixed /usage showing stale cached bars over fresher data, and /mcp not reclassifying placeholder servers after config edits
• Fixed "Change directory" in SDK hosts (e.g. Claude Desktop) failing with "A turn is in progress" on idle sessions that have a running background task
• Fixed the workflow save dialog showing ~/.claude/workflows/ instead of the CLAUDE_CONFIG_DIR location for user-scope saves
• Fixed /release-notes adding the viewed notes to the model's context — "Show all" previously injected the entire changelog into every subsequent request
• Fixed a memory leak in the agent view where pasted images were retained for the screen's lifetime after sending peek replies
• Fixed SDK sessions losing agents defined via the initialize request when a plugin refresh ran before the client attached
• Fixed several memory leaks in long sessions: MCP stdio server stderr accumulating up to 64 MB per server, LSP documents staying open indefinitely (now LRU with 50-doc cap), async hook output retained after backgrounding, and unbounded growth in headless/SDK sessions from large tool-result payloads
• Fixed a memory blowup when reading files with extremely long single lines using offset/limit — the read now returns a clean error instead of loading the whole line
• Fixed multi-second per-turn slowdowns in sessions with many permission deny/ask rules — rule matchers are now compiled once and cached
• Improved input responsiveness while agent task lists update — task updates no longer re-render the entire UI
• Reduced per-tool-call CPU overhead in print/SDK sessions with many MCP tools by caching tool-pool assembly (up to 7x faster tool rounds at high tool counts)
• Reduced memory usage by bounding the file edit read cache to 16 MB instead of pinning up to 1,000 full files
• Reduced session transcript size (up to 79x in edit-heavy sessions) and bounded checkpoint disk usage by pruning superseded file-history backups
• Reduced memory usage when resuming sessions with background agents or forks spawned from large conversations
• Completed background agents now stay listed in /tasks until cleanup instead of vanishing the moment they finish
• Attaching to a stopped background agent now shows its transcript immediately while the session warms up, instead of a blank "Session is starting" screen
• Background sessions: an older daemon no longer silently restarts workers spawned by a newer version onto the older binary
• Agent view: Ctrl+X now deletes renamed-branch worktrees, never destroys unpushed commits, keeps the session row when a worktree is kept, and reused worktree names reset to the current base
• Catastrophic removals (e.g. rm -rf ~) in commands containing $(…)/backticks/<(…) now prompt in --dangerously-skip-permissions and auto mode, matching the plain form
• /install-github-app and the /mcp settings menu no longer open in background sessions
• MCP servers configured with an empty URL now show as "not configured" in /mcp instead of a config error
• /usage now shows your last-known usage bars with an "as of" note when the usage endpoint is rate-limited, instead of an error screen
• Fixed Bedrock auth failing with "Session token not found or invalid" for AWS SSO profiles whose sso_region differs from the Bedrock region (2.1.207 regression)

v2.1.207

Compare Source

• Auto mode is now available without CLAUDE_CODE_ENABLE_AUTO_MODE opt-in on Bedrock, Vertex AI, and Foundry; disable via disableAutoMode in settings
• Fixed the terminal freezing and keystrokes lagging while streaming responses containing very long lists, tables, paragraphs, or code blocks
• Fixed remote managed settings from a non-interactive run (claude -p, the SDK) being permanently recorded as consented without ever showing the security consent dialog
• Fixed spurious prompt-injection warnings triggered by benign system-generated conversation updates
• Fixed the auto-updater overwriting a custom launcher script or symlink at ~/.local/bin/claude on every release; /doctor now reports an externally managed launcher
• Fixed compound commands with cd prompting for permission when the only output redirect was to /dev/null
• Fixed the transcript jumping above the start of the answer when a response finishes streaming
• Fixed extensions.worktreeConfig being left in the repo's .git/config (breaking go-git tools like tea) after the last worktree.sparsePaths worktree was removed
• Fixed malformed bracket patterns in rules globs, skill paths, .ignore, and .worktreeinclude breaking file reads, file suggestions, and worktree creation
• Fixed a crash loop in agent teams where a malformed teammate mailbox message caused repeated errors every second until the mailbox file was manually deleted
• Fixed background sessions auto-named by accepting a plan not showing that name on their agent-view row
• Fixed background sessions that entered a git worktree resuming blank after a cold reopen from the agent list
• Fixed Remote Control task status updates being lost when the connection recovered from a network interruption or credential refresh
• Fixed Remote Control sessions hosted by the desktop app not showing background agent and workflow progress on mobile and web
• Fixed Deep research runs labeling every Fetch-phase agent "unknown" — chips now show the source hostname
• Fixed Bedrock repeatedly requesting fresh AWS SSO credentials from IAM Identity Center on every API request
• Improved agent view: pasting the same text again now expands the collapsed [Pasted text #N] placeholder instead of adding a second one
• Improved agent view: blocked session peeks now lead with the question and show a worded staleness clock (waiting 3m) instead of the same timestamp twice
• Changed Bedrock, Vertex, and Claude Platform on AWS to default to Claude Opus 4.8
• Changed auto mode to no longer read autoMode from .claude/settings.local.json (repo-resident); use ~/.claude/settings.json instead
• Fixed an indefinite hang on Windows when AWS credential resolution stalls (e.g. a stuck credential_process): the 60-second stall guard now fires instead of waiting forever.
• Plugin hooks/monitors/MCP headersHelper: ${user_config.*} in shell-form commands is now rejected (shell-injection fix). Hooks: use exec form (args array) or $CLAUDE_PLUGIN_OPTION_<KEY>; monitors and headersHelper: read the value inside the script (config file or the server's env block).
• Plugin option values (pluginConfigs) are no longer read from project-level .claude/settings.json; only user, --settings, and managed settings are honored
• Fixed /usage-credits amount inputs silently stripping malformed values (e.g. a pasted timestamp) to digits; malformed amounts are now rejected with an error, and amounts over $1,000 require a typed confirmation

v2.36.1

Compare Source

v2.36.0

Compare Source

v2.35.24

Compare Source

v2.35.23

Compare Source

v2.35.22

Compare Source

v2.35.21

Compare Source

v2.9.2

Compare Source

Highlights

Flux v2.9.2 is a patch release. The main fix addresses a regression introduced in
v2.9.1 where a Kustomization with openapi.path pointing to a URL failed to
reconcile with failed to read OpenAPI schema. This release also corrects several
CRD field descriptions that contained inaccurate or leaked content. Users are
encouraged to upgrade for the best experience.

ℹ️ Please follow the Upgrade Procedure for Flux v2.7+ for a smooth upgrade from Flux v2.6 to the latest version.

Fixes:

• Fix a regression where a Kustomization with openapi.path pointing to a URL failed to reconcile with failed to read OpenAPI schema (kustomize-controller)
• Fix the HelmChart CRD description for .status.url, which pointed users at BucketStatus.Artifact instead of HelmChartStatus.Artifact (source-controller)
• Fix the ImageRepository CRD description for .status.observedExclusionList, which referred to spec.lastScanResult instead of status.lastScanResult (image-reflector-controller)
• Fix the ImageUpdateAutomation CRD description for .status.observedSourceRevision, which had a stray Go struct declaration leaking into it (image-automation-controller)

Improvements:

• Update fluxcd/pkg dependencies

Components changelog

• source-controller v1.9.3
• kustomize-controller v1.9.3
• helm-controller v1.6.2
• notification-controller v1.9.2
• image-reflector-controller v1.2.3
• image-automation-controller v1.2.3
• source-watcher v2.2.2

CLI changelog

• Update fluxcd/pkg dependencies by @​fluxcdbot in #​5984
• Update fluxcd/pkg dependencies by @​fluxcdbot in #​5990
• Update toolkit components by @​fluxcdbot in #​5994

Full Changelog: fluxcd/flux2@v2.9.1...v2.9.2

v1.30.3: Istio 1.30.3

Compare Source

Artifacts
Release Notes

v3.5.5

Compare Source

🐛 Bug Fixes

• (parse) allow hyphen-prefixed flag values by @​jdx in #​715

🧪 Testing

• invoke typescript compiler through npx package by @​jdx in #​719

v0.12.6

Compare Source

What's Changed

• Chore: (deps): bump golang.org/x/mod from 0.37.0 to 0.38.0 by @​dependabot[bot] in #​352
• chore: (deps): bump actions/setup-go from 6 to 7 by @​dependabot[bot] in #​355
• fix(oci): bump kpm to fix the docker credentials fallback regression by @​cjuega in #​354

Full Changelog: kcl-lang/cli@v0.12.5...v0.12.6

v0.12.5

Compare Source

What's Changed

• Chore: (deps): bump github.com/fatih/color from 1.18.0 to 1.19.0 by @​dependabot[bot] in #​331
• chore: (deps): bump docker/login-action from 4.0.0 to 4.1.0 by @​dependabot[bot] in #​332
• Chore: (deps): bump golang.org/x/mod from 0.34.0 to 0.35.0 by @​dependabot[bot] in #​333
• Chore: (deps): bump github.com/onsi/ginkgo/v2 from 2.28.1 to 2.28.2 by @​dependabot[bot] in #​334
• Chore: (deps): bump github.com/onsi/ginkgo/v2 from 2.28.2 to 2.28.3 by @​dependabot[bot] in #​336
• Chore: (deps): bump golang.org/x/mod from 0.35.0 to 0.36.0 by @​dependabot[bot] in #​337
• Chore: (deps): bump github.com/onsi/gomega from 1.40.0 to 1.41.0 by @​dependabot[bot] in #​338
• chore: (deps): bump docker/login-action from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​341
• chore: (deps): bump docker/metadata-action from 6.0.0 to 6.1.0 by @​dependabot[bot] in #​340
• Chore: (deps): bump github.com/onsi/ginkgo/v2 from 2.28.3 to 2.29.0 by @​dependabot[bot] in #​339
• Chore: (deps): bump golang.org/x/mod from 0.36.0 to 0.37.0 by @​dependabot[bot] in #​344
• Chore: (deps): bump github.com/onsi/ginkgo/v2 from 2.29.0 to 2.31.0 by @​dependabot[bot] in #​343
• chore: (deps): bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​345
• Chore: (deps): bump github.com/onsi/gomega from 1.41.0 to 1.42.1 by @​dependabot[bot] in #​347
• Chore: (deps): bump github.com/onsi/ginkgo/v2 from 2.31.0 to 2.32.0 by @​dependabot[bot] in #​348
• chore: (deps): bump docker/login-action from 4.2.0 to 4.3.0 by @​dependabot[bot] in #​350
• chore: (deps): bump docker/metadata-action from 6.1.0 to 6.2.0 by @​dependabot[bot] in #​349
• chore: (deps): bump docker/login-action from 4.3.0 to 4.4.0 by @​dependabot[bot] in #​351
• feat(oci): allow host-less repos complemented by the KPM_REG envvar by @​cjuega in #​353

New Contributors

• @​cjuega made their first contribution in #​353

Full Changelog: kcl-lang/cli@v0.12.4...v0.12.5

v3.234.0

Compare Source

Added

• Added idle mode for preview environments (feature.preview.idle).
• Added the MIRRORD_AGENT_STEALER_FLUSH_CONNECTIONS_CONNTRACK agent
  environment variable. When set to false, the connection flush performed
  when stealing starts skips the conntrack -D command and relies only on ss -K, avoiding a burst of dropped redirected connections (and accompanying
  ENOENT errors) on busy ports. Defaults to true, preserving the previous
  behaviour.
• mirrord up now infers a service's target from its key in mirrord-up.yaml
  when target.path is omitted, prompting you to pick one when nothing
  matches.

Changed

• Fix bug in AddressFilter::Name that allowed port filters to match hostnames
  ports incorrectly.
• Fix error File not found being shown when running mirrord ui stop with no
  mirrord UI running.
• Renamed feature.preview.idle.timeout_secs to sleep_after_secs.
• The environment variable used to control the logging level for the mirrord
  CLI and layer has been changed from RUST_LOG to MIRRORD_LOG.

Fixed

• Fixed mirrord operator session kill --id rejecting the names of
  multi-cluster sessions, which carry an mc- prefix.
• Fixed local redis database branch startup so readiness no longer depends on
  redis-cli being installed on the host.

v3.233.0

Compare Source

Added

• Detect missing queue splitting configuration.
• Inject mirrord-key into all forwarded messages.
• Preview environments can now selectively filter which labels are copied from
  the target through the feature.preview.labels.{include,exclude} options,
  analogous to our existing feature.env.{include,exclude} options.
• Support CronJob and Job database branching targets.
• mirrord preview start now overrides existing sessions with the same key and
  target by default, essentially making --force the default behavior.
  Consequently, that argument is now unnecessary and deprecated.

Changed

• Copy target with an HTTP filter now tailors its warning to the connected
  operator's behaviour
  instead of always claiming that unmatched requests are discarded.
• List active sessions through the operator's active-sessions API.

v3.232.0

Compare Source

Removed

• Removed the experimental go_cgo_stack_switch flag. The Go 1.25+ cgo
  stack-switch fix is now covered only by the go_asmcgocall experimental
  flag.
  go_asmcgocall is now enabled by default for OSS users.

Added

• Add a retryable agent error variant.
• Add support for generic db branching.
• Added container.host_gateway_detection, enabled by default, which makes
  mirrord container detects
  and connects through host gateway.
• Added feature.preview.secret_mounts to mount files into a preview pod from
  a Kubernetes Secret, so sensitive files can be access-controlled via RBAC
  separately from the session.
• Added a context and namespace selector to the mirrord ui, backed by a new
  context/namespace-aware /api/v2 API. You can now view cluster sessions per
  kube context and filter them by namespace, independently in each browser tab.
  Local sessions always show, and each one displays the context and namespace
  it runs against. The previous /api/* routes stay in place for backward
  compatibility.
• Added support for jq_filter in Kafka queue splitting. The jq program runs
  on a JSON representation of each Kafka message (topic, partition, offset,
  timestamp, key, payload, and headers), and messages for which it outputs
  true are routed to the local application. Requires a mirrord Operator
  version that supports jq filters for Kafka.
• Allow sharing preview environments.

Changed

• API routes for managing chaos rules are now under /api/chaos/rules instead
  of /chaos/rules.
• Add queue splitting config support to mirrord up.
• Improve error message when no mirrord-up.yaml config file is found as part
  of mirrord up, suggesting mirrord up init.
• Requests for chaos rules with a latency effect now specify "read_ms" and
  "write_ms" instead of
  "delay_ms". They are applied in the read and write directions respectively
  and cannot both be 0.
• The mirrord ui session monitor and the mirrord wizard config wizard are
  now a single web app
  served by mirrord ui. mirrord wizard opens the same app on the config
  wizard tab, and both
  features share one server, one theme, and a light/dark toggle.

Fixed

• Requesting a database branch whose engine is disabled on the mirrord operator
  now fails with a
  clear "not enabled on the mirrord operator" message, instead of an opaque
  404 page not found or a
  hang waiting for the branch to become ready.
• The mirrord ui session monitor no longer shows a duplicate logo inside the
  merged UI, and its
  kube context, namespace, and account controls now share the shell's top bar
  instead of a separate
  row. The logo is also no longer inverted in dark mode.
• The mirrord ui session monitor no longer shows an operator error when the
  operator's status
  service is momentarily unavailable (e.g. during a pod restart). It now keeps
  the last-known team
  sessions on screen and displays a "Reconnecting to operator…" hint instead.
• The config wizard's mirrord logo is now legible in dark mode, shown on a
  light backdrop instead of blending into the dark card.

v1.12.4

Compare Source

BUG FIXES:

• tofu plan -out no longer fails when the plan includes a resource with lifecycle { destroy = false } that needs replacement, which previously errored with invalid change action ForgetThenCreate. (#​4324)
• Moved block now correctly compares provider source addresses. (#​4280)[#​4280]
• Correct Source Provider Address now passed into Provider MoveResource requests. (#​4355)[#​4355]

Full Changelog: opentofu/opentofu@v1.12.3...v1.12.4

v1.3.3

Compare Source

ORAS CLI v1.3.3 is a maintenance release focused on security hardening, dependency updates, and a few user-facing improvements to oras attach.

Highlights

• 🔒 Security: upgraded oras-go to v2.6.2, which addresses a tar-extraction path-traversal advisory (GHSA-fxhp-mv3v-67qp) affecting hardlink entries during pull/extract.
• ✨ oras attach gains --config support, and --annotation $config:* values now flow through to the packed manifest.
• 🛡️ Supply-chain hardening: GitHub Actions are now pinned to commit SHAs, SBOMs are attached to release artifacts, and static security scanning (gosec) runs in CI.
• 🐛 Copy/mount fixes: no longer mounts when source and destination credentials differ, and falls back to blob upload when a cross-repo mount fails.

✨ Features

• Add --config flag support for oras attach by @​ogulcanaydogan in #​2000
• Pass --annotation $config:* through to PackManifestOptions for attach by @​SAY-5 in #​2037
• Allow setting org.opencontainers.image.title in the annotation file by @​rafaelgieschke in #​1872
• Add SBOMs to the release workflow by @​bupd in #​1940

🐛 Bug Fixes

• cp should not mount when source and destination credentials differ by @​wangxiaoxuan273 in #​1903
• Fall back to blob upload when cross-repo mount fails by @​bupd in #​1924
• Redact password values from e2e test execution logs by @​TerryHowe in #​2042
• Revert Alpine base image to fix multi-arch build by @​bupd in #​1933
• Set GOTOOLCHAIN=local in snapcraft.yaml to prevent auto-download by @​TerryHowe in #​2012
• Fix typo in logEntrySeparator const by @​Ahmad-Faraj in #​2087

🔒 Security

• Bump oras.land/oras-go/v2 to 2.6.2 (addresses GHSA-fxhp-mv3v-67qp) by @​dependabot in #​2105, #​2106
• Add static security scanning (gosec) to CI by @​bupd in #​1934; resolve gosec findings (G703, G117, G704) by @​TerryHowe in #​1985
• Pin GitHub Actions to commit SHAs by @​TerryHowe in #​2016; pin to full version comments by @​alliasgher in #​2038
• Add golangci-lint configuration with additional linters by @​bupd in #​1936

📖 Documentation

• Add examples to the logout command help text by @​ogulcanaydogan in #​2079
• Add multi-repository backup and restore proposal by @​shizhMSFT in #​1917

🧰 Maintenance

• Upgrade to Go 1.25.7 by @​TerryHowe / @​adriansali in #​1980, #​1910
• Migrate from unmaintained gopkg.in/yaml.v3 to go.yaml.in/yaml/v4 by @​bupd in #​1922
• Add goheader (license headers) and revive linters, plus gofmt/go modernize passes

✂ Note

PR body was truncated to here.