Follow Discord
Sweep 22 Oct 2026 · 04:32Z Build v2.1.308 527 read Stable v2.1.308 Latest v2.1.308 Next v2.1.308 Feeds RSS JSON llms.txt llms-full.txt Unofficial
HomeReleasesv2.1.221entry #121

Claude Code v2.1.221 ·

Artifact credentials and artifact base URLs are stripped from child process environments

Artifact tokens and artifact base URLs no longer leak into processes Claude spawns.

You'll notice Improvements
JSON All of v2.1.221
You'll noticeTier: how much it should matter to you
3Useful: my rating, 1 to 5
0Signal: worth watching, 1 to 5
PermissionsArea: what it touches
ImprovementsKind: in v2.1.221,
ImprovementsSection of the release
What

The environment handed to spawned processes now drops the artifacts API token and any artifact base URL variable, alongside the OAuth token and subscription vars it already removed.

Details
  • A new predicate matches any variable that starts with CLAUDE_CODE_ARTIFACT and ends with _BASE_URL, and those are deleted.
  • The presence of such a variable alone is now enough to force the sanitizing path instead of returning process.env untouched.
  • The artifacts token was added to the sensitive-variable list alongside ANTHROPIC_API_KEY and CLAUDE_CODE_OAUTH_TOKEN, and to the set stripped from config-derived env.
  • Applies to everyone on this build.
Evidence

return e.startsWith("CLAUDE_CODE_ARTIFACT") && e.endsWith("_BASE_URL");

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

Read from
Names in the bundleCLAUDE_CODE_OAUTH_TOKENANTHROPIC_API_KEY

See this entry in the whole of v2.1.221 →

Feedback