You'll noticeTier: how much it should matter to you
1Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
ElsewhereArea: what it touches
Bug FixesKind: in v2.1.268,
Bug FixesSection of the release
What
Before Claude Code builds a fallback https:// URL out of a bare host string, it now checks whether that string already looks like it starts with a URL scheme (something like foo: at the start) and bails out if so, instead of blindly prepending https://. It also now strips tab, newline, carriage-return, and surrounding whitespace characters from the string before parsing it.
Why
This closes off ways a crafted host string could be misinterpreted as pointing somewhere other than intended, such as smuggling in a different scheme or hiding characters in whitespace.
