Source Intelligence
Follow Discord

DisclaimerUnofficial, and not affiliated with Anthropic. Nearly all of this is read straight out of what ships: npm bundles, captured prompts, published docs. Anthropic's own notes go in verbatim, marked as theirs. The rest is my reading, and every entry carries the strings behind it. If one looks wrong, vote it down and say why.

← All of v2.1.139 Home All releases ←olderv2.1.138 v2.1.140newer→
Claude Code v2.1.139

  • Bash safety analysis now detects ambiguous heredoc terminators, including <<- tab-prefixed delimiters and heredoc body lines that can be mistaken for terminators with shell metacharacters. Evidence: heredoc safety checks (search for "ambiguous heredoc terminator", "Heredoc uses <<- with a tab-prefixed delimiter")
  • Plugin ZIP loading now handles archives with a wrapper directory instead of failing or choosing the wrong root. Evidence: inline plugin ZIP handling (search for "Inline plugin zip had wrapper directory; using")
  • Missing plugin errors are more actionable and now suggest claude plugin list or --plugin-dir <path>. Evidence: plugin lookup error (search for "not found. Run claude plugin list to see installed plugins")
  • Marketplace plugin cache misses now explain that the plugin may have been removed and tell users to disable it via /plugin. Evidence: plugin source cache-miss message (search for "the plugin may have been removed. Disable it via /plugin to clear this warning")
  • Settings-file watching now tracks symlink targets so atomic-save edits to the target file are detected. Evidence: symlink target watcher (search for "also watching", "so atomic-save edits to the target are detected")
  • Plugin directory copying now handles cyclic symlinks, non-regular symlink targets, and symlinks escaping the containment root more carefully. Evidence: symlink materialization safeguards (search for "copyDir: skipping cyclic symlink target", "copyDir: skipping symlink escaping containment root")
  • HTTP/SSE transport now aborts streams that exceed the body limit without an SSE event boundary, preventing unbounded memory growth when a server returns non-protocol data. Evidence: SSE body overflow guard (search for "without an SSE event boundary", "HttpBodyOverflowError")
  • Proxy and TLS connection setup now has explicit timeout/failure errors for gateway-style connections. Evidence: connection error strings (search for "TLS connection timed out", "proxy CONNECT failed", "proxy CONNECT timed out")

See this entry in the whole of v2.1.139 →