Update checks now validate that version strings from GCS, npm, Homebrew and the binary repo actually look like versions
When Claude Code checks for updates, it fetches a version string from sources like Google Cloud Storage (GCS), npm, and Homebrew. Previously it would trust whatever string came back; now it validates that the string is a properly formed version number (using semver, the standard versioning scheme) before using it. If the response is invalid, it's logged (truncated to 300 characters) and treated as no result rather than acted on. The same validation was added to the logic that compares a target version against the current one to decide whether to skip an update check.
- GCS, npm-view, and Homebrew version fetches are now validated before use
- The binary-repo version check now throws an error if the fetched value doesn't look like a version, instead of silently accepting it
This prevents a malformed or unexpected response from a version-check endpoint from being mistaken for a real version and causing incorrect update behavior.