Follow Discord
Sweep 10 Nov 2026 · 02:18Z Build v2.1.322 539 read Stable v2.1.311 Latest v2.1.322 Next v2.1.322 Feeds RSS JSON llms.txt llms-full.txt Unofficial

Claude Code v2.1.257 ·

SSRF/metadata-endpoint protection for outbound requests

Outbound requests to cloud metadata hostnames and private, link-local or loopback ranges are now blocked.

You'll notice Improvements
JSON All of v2.1.257
You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
NetworkArea: what it touches
ImprovementsKind: in v2.1.257,
ImprovementsSection of the release

New IP and hostname classification logic recognizes cloud metadata hostnames, including metadata.google.internal and instance-data endpoints, along with private, link-local, loopback, NAT64, and 6to4 IPv4-mapped IPv6 ranges, as unsafe destinations. This is used to block outbound requests to cloud metadata services and internal addresses.

See this entry in the whole of v2.1.257 →

Feedback