Follow Discord
Sweep 22 Oct 2026 · 21:04Z Build v2.1.309 528 read Stable v2.1.308 Latest v2.1.309 Next v2.1.309 Feeds RSS JSON llms.txt llms-full.txt Unofficial
HomeReleasesv2.1.251entry #162

Claude Code v2.1.251 ·

Git commands run with risky protocols turned off

Git now refuses the ext, fd, git, ftp and ftps transports, closing a command-execution path.

You'll notice New Features
JSON All of v2.1.251
You'll noticeTier: how much it should matter to you
3Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
GitArea: what it touches
New FeaturesKind: in v2.1.251,
New FeaturesSection of the release
What

Git invocations now carry flags that refuse the ext, fd, git, ftp and ftps transports. The ext protocol in particular can make a repository run arbitrary commands, so a hostile remote or submodule URL can no longer reach it through Claude Code.

Details
  • Applied as a fixed set of -c protocol.<name>.allow=never settings, not conditional on any flag.
  • HTTPS and SSH remotes are unaffected.
Evidence

protocol.ext.allow=never

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

See this entry in the whole of v2.1.251 →

Feedback