Unclear The finding does not say which variables or sources are newly excluded, so the practical effect on any specific variable is unclear.
What
When Claude Code builds the environment variables for a process it spawns, it now runs an extra filtering pass over variable names that contain a dash, checking them against a lookup that ignores hyphen differences. It also pulls in additional sources of variables to exclude, beyond the fixed list it used before.
Why
This broadens and tightens which environment variables get passed through to spawned processes, reducing the chance that an unwanted or sensitive variable leaks into a child process.
Something disagreesSomething we can check disagrees with this entry, or the writer said they could not settle it.
The writer flagged doubt
The finding does not say which variables or sources are newly excluded, so the practical effect on any specific variable is unclear.