Follow Discord
Sweep 06 Nov 2026 · 01:32Z Build v2.1.319 537 read Stable v2.1.311 Latest v2.1.318 Next v2.1.319 Feeds RSS JSON llms.txt llms-full.txt Unofficial

Claude Code v2.1.274 ·

Sandboxed dynamic-render-hook runtime template hardens against global tampering

Sandboxed render-hook runtime now locks down global objects before running untrusted code

Under the hood Internal Changes
JSON All of v2.1.274
Under the hoodTier: how much it should matter to you
1Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
ElsewhereArea: what it touches
Internal ChangesKind: in v2.1.274,
Internal ChangesSection of the release
What

When Claude Code runs a render hook (custom code that draws part of the interface) in its sandboxed JavaScript runtime, that runtime now captures references to Object.freeze, defineProperty, defineProperties, keys, Array.isArray, Map, JSON.stringify, Error, and TypeError into local constants up front, instead of referencing the global versions directly each time.

Why

This guards against a render hook tampering with these global objects or methods to interfere with how the sandbox itself works, making the sandbox more resilient against misbehaving or malicious render-hook code.

See this entry in the whole of v2.1.274 →

Feedback