You'll noticeTier: how much it should matter to you
3Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
InternalsArea: what it touches
ImprovementsKind: in v2.1.242,
ImprovementsSection of the release
What
Connections made through an HTTPS proxy now check the server's certificate against the host you actually asked for, and for non-literal hostnames Claude Code resolves the address itself while still sending the original name for SNI and verification. Two new failure reasons cover a credentials file holding the gateway's TLS pin being a symlink or unreadable.
Details
symlinked credential files are not followed
applies to all proxied connections, with no setting to opt out
Evidence
"the credentials file that keeps the gateway's TLS pin is a symlink, which is not followed"
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
