build(deps-dev): bump @anthropic-ai/claude-code from 2.1.259 to 2.1.274

[dependabot]

Bumps @anthropic-ai/claude-code from 2.1.259 to 2.1.274.

Release notes

Sourced from @​anthropic-ai/claude-code's releases.

v2.1.274

What's changed

• Added a visible warning when memory usage is critical, with steps to free memory or restart safely
• Added CLAUDE_CODE_MCP_STARTUP_WAIT_MS to bound how long the first non-interactive turn waits for connecting MCP servers (0 = don't wait)
• Added effort attribute to the claude_code.llm_request OpenTelemetry trace span, matching the api_request event
• Added claude_code.managed_settings_resolved OTel event: managed-settings sources and policy helper state; redacted settings and digests with OTEL_LOG_MANAGED_SETTINGS=1
• Added store.connect_timeout_seconds to the Claude apps gateway config to lengthen the Postgres connect timeout (default 5 seconds), and improved the boot error when the database is unreachable to point to store.postgres_url and the configured timeout
• Added enduser.sub, the IdP subject, to the telemetry Claude Desktop and Cowork send through a Claude apps gateway
• Added a Claude apps gateway warning when a replica has more requests open than the 256 it sends upstream at once, and a startup log line showing that limit
• Added click-to-expand for collapsed teammate and agent messages in fullscreen mode
• Fixed sessions getting stuck endlessly retrying "unexpected tool_use_id" 400 errors: corrupted transcripts now self-heal where possible, and otherwise a clear error (with a /rewind hint) ends the loop
• Fixed MCP servers configured as http that only speak legacy HTTP+SSE failing to connect when they answer the first request with 422 or another 4xx error
• Fixed Streamable HTTP MCP tool calls timing out after about 5 minutes even when a longer per-server timeout was set
• Fixed MCP prompts and resources not refreshing when a server sends list-changed notifications without declaring listChanged
• Fixed MCP tool calls refused with 403 insufficient_scope being reported as an expired sign-in: the error now names the missing permissions and points to /mcp re-authentication
• Fixed hook-driven sessions (such as an active /goal) ending with "Prompt is too long" instead of compacting when the context overflowed again after a reactive compaction
• Fixed an active /goal being lost when resuming (--continue / --resume) a session that had compacted
• Fixed claude agents losing --model, --effort, --permission-mode, --allow-dangerously-skip-permissions and --agent after an auto-update relaunch
• Fixed a per-turn slowdown when a language server publishes project-wide diagnostics for thousands of files
• Fixed subagents with model: "opus" on Bedrock, Vertex or Foundry leaving the session's model when its id has no recognizable model family (unless ANTHROPIC_DEFAULT_OPUS_MODEL is set)
• Fixed self-hosted runner sessions failing every turn with a 401 after a few failed token refreshes, until the next scheduled refresh; the runner now keeps retrying, and fetches a new token after a 401
• Fixed clickable links to local file paths doing nothing in VS Code and other terminals that require a file:// URI
• Fixed the transcript renumbering ordered lists in your own messages (typing "3. 2. 1." displayed "3. 4. 5."); numbers and "N)" markers now show as typed
• Fixed AskUserQuestion preview notes being attached to a previously chosen option instead of the highlighted one
• Fixed AskUserQuestion preview mode dropping the highlighted option when submitting a note with Enter
• Fixed a resumed background agent keeping half of an interrupted tool batch when one of its calls was approved with a message
• Fixed a local claude -p --resume started with CLAUDE_CODE_RESUME_INTERRUPTED_TURN not reporting background tasks the previous process left unfinished
• Fixed the first turn of a cloud session sometimes starting without the tools of an SDK-hosted MCP server that was still connecting
• Fixed background agent notifications claiming the agent had no live background work when it was still waiting on its own background task and would resume
• Fixed error hints in Claude Desktop sessions to suggest slash commands like /usage-credits instead of CLI flags that cannot be used there
• Fixed /schedule saving a routine's prompt without its message role when Claude writes the routine in the shape that listing routines returns
• Fixed /status not showing the apiKeyHelper failure that its own error banner told you to check
• Fixed /fast on in non-interactive sessions reporting on and then turning off under an organization's managed fast mode policy; it now says the organization has disabled it
• Fixed the Artifact tool asking you to approve an update to an artifact that it then refused because the session had not read the latest version
• Fixed Cowork and claude.ai cloud sessions with network access on treating reads of a teammate's artifact as if network access were off
• Fixed a plugin or marketplace directory with no git repository of its own taking its version from an enclosing git repository, such as a git-managed ~/.claude
• Fixed --strict-mcp-config with an empty --mcp-config holding the first non-interactive turn for up to MCP_TIMEOUT on incidental MCP servers
• Fixed Stop prompt hooks re-sending their whole prompt on every block in a conversation; repeat blocks now name the condition with a 500-character label
• Fixed extra empty editor windows opening at startup on Linux under Wayland when running inside the Cursor or VS Code terminal
• Fixed an unhandled promise rejection in the Claude apps gateway when Postgres drops a connection during a spend check
• Fixed Claude apps gateway cutting every open stream on SIGTERM: it now lets in-flight requests finish for up to 25 seconds before exiting (CLAUDE_GATEWAY_DRAIN_TIMEOUT_MS)
• Fixed installed_plugins.json being rewritten on nearly every start-up when plugin policy comes from remote managed settings, which made Claude Desktop reload every open session's plugins
• Fixed headless and SDK sessions making a separate model call for every background task that finished; completions already queued are now answered by one call
• Fixed the Bash tool re-sourcing the shell profile (a multi-second stall on the next command) after every plugin reload; it now does so only when the plugins' bin/ directories changed
• Fixed plugins with a top-level $schema in hooks/hooks.json showing an "unknown key" notice
• Fixed MCP connection errors and the MCP login tool's description showing secrets resolved from ${VAR} placeholders in MCP configs
• Fixed Bash permission checks for commands that loop over or assign certain special shell variables; these commands now ask for permission
• Fixed worktree-isolated sessions accepting Bash commands with certain nested shell expansions; these are now refused
• Fixed the Edit permission prompt preview sometimes showing a different location than the approved edit in files with multi-byte characters

... (truncated)

Changelog

Sourced from @​anthropic-ai/claude-code's changelog.

2.1.274

• Added a visible warning when memory usage is critical, with steps to free memory or restart safely
• Added CLAUDE_CODE_MCP_STARTUP_WAIT_MS to bound how long the first non-interactive turn waits for connecting MCP servers (0 = don't wait)
• Added effort attribute to the claude_code.llm_request OpenTelemetry trace span, matching the api_request event
• Added claude_code.managed_settings_resolved OTel event: managed-settings sources and policy helper state; redacted settings and digests with OTEL_LOG_MANAGED_SETTINGS=1
• Added store.connect_timeout_seconds to the Claude apps gateway config to lengthen the Postgres connect timeout (default 5 seconds), and improved the boot error when the database is unreachable to point to store.postgres_url and the configured timeout
• Added enduser.sub, the IdP subject, to the telemetry Claude Desktop and Cowork send through a Claude apps gateway
• Added a Claude apps gateway warning when a replica has more requests open than the 256 it sends upstream at once, and a startup log line showing that limit
• Added click-to-expand for collapsed teammate and agent messages in fullscreen mode
• Fixed sessions getting stuck endlessly retrying "unexpected tool_use_id" 400 errors: corrupted transcripts now self-heal where possible, and otherwise a clear error (with a /rewind hint) ends the loop
• Fixed MCP servers configured as http that only speak legacy HTTP+SSE failing to connect when they answer the first request with 422 or another 4xx error
• Fixed Streamable HTTP MCP tool calls timing out after about 5 minutes even when a longer per-server timeout was set
• Fixed MCP prompts and resources not refreshing when a server sends list-changed notifications without declaring listChanged
• Fixed MCP tool calls refused with 403 insufficient_scope being reported as an expired sign-in: the error now names the missing permissions and points to /mcp re-authentication
• Fixed hook-driven sessions (such as an active /goal) ending with "Prompt is too long" instead of compacting when the context overflowed again after a reactive compaction
• Fixed an active /goal being lost when resuming (--continue / --resume) a session that had compacted
• Fixed claude agents losing --model, --effort, --permission-mode, --allow-dangerously-skip-permissions and --agent after an auto-update relaunch
• Fixed a per-turn slowdown when a language server publishes project-wide diagnostics for thousands of files
• Fixed subagents with model: "opus" on Bedrock, Vertex or Foundry leaving the session's model when its id has no recognizable model family (unless ANTHROPIC_DEFAULT_OPUS_MODEL is set)
• Fixed self-hosted runner sessions failing every turn with a 401 after a few failed token refreshes, until the next scheduled refresh; the runner now keeps retrying, and fetches a new token after a 401
• Fixed clickable links to local file paths doing nothing in VS Code and other terminals that require a file:// URI
• Fixed the transcript renumbering ordered lists in your own messages (typing "3. 2. 1." displayed "3. 4. 5."); numbers and "N)" markers now show as typed
• Fixed AskUserQuestion preview notes being attached to a previously chosen option instead of the highlighted one
• Fixed AskUserQuestion preview mode dropping the highlighted option when submitting a note with Enter
• Fixed a resumed background agent keeping half of an interrupted tool batch when one of its calls was approved with a message
• Fixed a local claude -p --resume started with CLAUDE_CODE_RESUME_INTERRUPTED_TURN not reporting background tasks the previous process left unfinished
• Fixed the first turn of a cloud session sometimes starting without the tools of an SDK-hosted MCP server that was still connecting
• Fixed background agent notifications claiming the agent had no live background work when it was still waiting on its own background task and would resume
• Fixed error hints in Claude Desktop sessions to suggest slash commands like /usage-credits instead of CLI flags that cannot be used there
• Fixed /schedule saving a routine's prompt without its message role when Claude writes the routine in the shape that listing routines returns
• Fixed /status not showing the apiKeyHelper failure that its own error banner told you to check
• Fixed /fast on in non-interactive sessions reporting on and then turning off under an organization's managed fast mode policy; it now says the organization has disabled it
• Fixed the Artifact tool asking you to approve an update to an artifact that it then refused because the session had not read the latest version
• Fixed Cowork and claude.ai cloud sessions with network access on treating reads of a teammate's artifact as if network access were off
• Fixed a plugin or marketplace directory with no git repository of its own taking its version from an enclosing git repository, such as a git-managed ~/.claude
• Fixed --strict-mcp-config with an empty --mcp-config holding the first non-interactive turn for up to MCP_TIMEOUT on incidental MCP servers
• Fixed Stop prompt hooks re-sending their whole prompt on every block in a conversation; repeat blocks now name the condition with a 500-character label
• Fixed extra empty editor windows opening at startup on Linux under Wayland when running inside the Cursor or VS Code terminal
• Fixed an unhandled promise rejection in the Claude apps gateway when Postgres drops a connection during a spend check
• Fixed Claude apps gateway cutting every open stream on SIGTERM: it now lets in-flight requests finish for up to 25 seconds before exiting (CLAUDE_GATEWAY_DRAIN_TIMEOUT_MS)
• Fixed installed_plugins.json being rewritten on nearly every start-up when plugin policy comes from remote managed settings, which made Claude Desktop reload every open session's plugins
• Fixed headless and SDK sessions making a separate model call for every background task that finished; completions already queued are now answered by one call
• Fixed the Bash tool re-sourcing the shell profile (a multi-second stall on the next command) after every plugin reload; it now does so only when the plugins' bin/ directories changed
• Fixed plugins with a top-level $schema in hooks/hooks.json showing an "unknown key" notice
• Fixed MCP connection errors and the MCP login tool's description showing secrets resolved from ${VAR} placeholders in MCP configs
• Fixed Bash permission checks for commands that loop over or assign certain special shell variables; these commands now ask for permission
• Fixed worktree-isolated sessions accepting Bash commands with certain nested shell expansions; these are now refused
• Fixed the Edit permission prompt preview sometimes showing a different location than the approved edit in files with multi-byte characters
• Fixed background commands being stopped after 30 idle minutes on machines under mild memory pressure; they're now stopped only when memory is critically low, and the debug log says why

... (truncated)

Commits

• 68ac8bb chore: Update CHANGELOG.md and feed.xml
• 744fb6a diff: the prompt hint reads the viewport's layout through a type that may lac...
• b782847 diff: the first edit opens the pane only where the layout docks it (#94653)
• 7dd0636 diff: run git when the built-in panel would, never at the session's start (#9...
• aad35ba chore: Update CHANGELOG.md and feed.xml
• f96c3b4 chore: Update CHANGELOG.md and feed.xml
• f2ccbe2 chore: Update CHANGELOG.md and feed.xml
• f4ceeec Merge pull request #94184 from anthropics/poteat/diff-parity-2
• 7d4f947 diff: the docked window's hunks are made printable and split under a leaf's c...
• 9d302a8 Merge remote-tracking branch 'origin/main' into poteat/diff-parity-2
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Routine Dependabot devDependency bump of @anthropic-ai/claude-code (2.1.259 → 2.1.274), touching only package.json and package-lock.json. Package/lockfile versions are consistent throughout the diff (no leftover 2.1.259 references in the lockfile).

Should fix

• package.json's allowScripts entry (line 43) still names the old version (@anthropic-ai/claude-code@2.1.259), while the dependency itself now resolves to 2.1.274. npm 12's lifecycle-script gate matches on exact resolved name@version, so this bump leaves the CLI's postinstall script unapproved for the version actually installed going forward — it will be silently skipped (a warning, not a failure, since strict-allow-scripts isn't set) rather than run. See the inline comment for why this matters concretely (the dependabot.yml investigate job invokes this CLI directly via npx, and the postinstall script was explicitly approved for exactly that reason in the commit that introduced this field).

No other findings — title and description are already accurate and complete (standard Dependabot format naming the exact old/new version), so I left them as-is. Nothing else needed checking beyond the lockfile/package.json diff itself.

[github-actions]

🗜️ Headroom context compression

Metric	Value
Requests proxied	36
Tokens saved	226931
Aggregate savings	5.6% of all tokens sent
Average per-request compression	8%

[dependabot]

Superseded by #99.