Under the hoodTier: how much it should matter to you
3Useful: my rating, 1 to 5
3Signal: worth watching, 1 to 5
PermissionsArea: what it touches
Internal ChangesKind: in v2.1.248,
Internal ChangesSection of the release
What
Bash command parsing gained two lists: shells and wrappers to look past when finding the real command (sudo, doas, xargs, timeout, nsenter and more), and environment variables treated as harmless when prefixed onto a command (GOEXPERIMENT, RUST_LOG, NO_COLOR, CI, ANTHROPIC_API_KEY among them), with a matching VAR= assignment pattern.
Evidence
PYTEST_DISABLE_PLUGIN_AUTOLOAD
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
How sure we are
One source agreesOne thing we can check says the same as this entry.
Anthropic's release notes agreeFixed the recommended Console sign-in in /login failing with an OAuth error before showing a sign-in URL on machines where it can't be used…
