Unclear The finding does not say which variable names are in the allowlist beyond that they're uppercased.
What
When Claude Code builds the environment for running shell commands, it now checks a new allowlist of variable names first. If a variable's name is on this allowlist, its value is taken directly rather than being merged or split the way PATH normally is; names not on the allowlist still go through the previous merging logic.
Why
This gives Claude Code more explicit control over which environment variables get special handling, rather than relying only on the general-purpose PATH-merging behavior for everything.
Something disagreesSomething we can check disagrees with this entry, or the writer said they could not settle it.
The writer flagged doubt
The finding does not say which variable names are in the allowlist beyond that they're uppercased.