Claude Code v2.1.260 · 3 Sep 2026
Loopback/non-https URL rejection widened to array-valued bootstrap fields
URL safety checks now cover list-valued config fields, with a new setting to allow loopback response URLs.
Use it now Notable
No documentation found Improvements
Copy link
Copy markdown
JSON
All of v2.1.260
Use it now Tier: how much it should matter to you
2 Useful: my rating, 1 to 5
1 Signal: worth watching, 1 to 5
Bootstrap Config Area: what it touches
Improvements Kind: in v2.1.260, 03 Sep 26
What probably matters to you Section of the release
The loopback/https hygiene check for bootstrap config, previously limited to single string URLs, now also inspects array-valued fields using a new helper that collects URLs from strings, arrays, and {url } objects. A new allowLoopbackResponseUrls
See this entry in the whole of v2.1.260 →
3 Sep 2026 · 383 entries, this one is #72.
55 151 34 143
Open the release →
Names in this entry
setting url Your MCP allow and deny rules now match servers whose commands or URLs use environment variables.
setting allowLoopbackResponseUrls URL safety checks now cover list-valued config fields, with a new setting to allow loopback response URLs.
Is this right?
0 0 Feedback
What's wrong with this entry?
Hard to understand Too vague Looks wrong Not relevant to me Too long Missing the detail I wanted Duplicate of another card
Clear Learned something new I can act on this Good catch
Related
Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.
← Previous · 71 of 383
Direct API client construction now respects ANTHROPIC_BASE_URL as a fallback baseURL
Use it now API Configuration
In v2.1.260 What probably matters to you release-page order
Next → · 73 of 383
New OTLP headers helper script support
Use it now Telemetry
