The Wire · Showcase
CLAUDE CODE 2.1.237 SHIPS CONCISE OUTPUT STYLE AND CRITICAL GIT AUTH FIX
By RepoJournal · Filed · About Anthropic
Claude Code just got a built-in 'Concise' output style and a long-awaited fix for actions/checkout credential leakage, and one of them is a security patch you should grab before your next CI run.
Claude Code v2.1.237 lands a new built-in 'Concise' output style that the release notes say lets Claude "lead[] with results and skip[] preamble and narration" [1], plus a prompt caching fix for LLM gateway users [1]. But the real headline is in claude-code-action: v1.0.197 fixes a credential leak where configureGitAuth() failed to neutralize the actions/checkout auth header because it edited only the local config, not the separate RUNNER_TEMP file pulled in via include.path [2][3]. This bug, which shipped with actions/checkout v6.0.0 and backports, means CI jobs using Claude Code could expose GitHub tokens to untrusted repos. The fix also landed in v1.0.196 with unified secret redaction in public comments [4]. Meanwhile, v2.1.236 introduced ANTHROPIC_DEFAULT_MODEL and sandbox wildcard read-deny precedence [5], and claude-agent-sdk-python bumped to v0.2.142, bundling CLI 2.1.237 [6]. If you use claude-code-action with actions/checkout v4.3.1 or later, update now.
One email a day. Unsubscribe in one click.
Keep up with Anthropic in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
One email a day. Unsubscribe in one click. Read a past issue →
Action items
- → Update claude-code-action to v1.0.197 before your next CI run to fix the checkout credential leak anthropics/claude-code-action [immediate]
- → Review any claude-code-action jobs that may have logged tokens and rotate exposed credentials anthropics/claude-code-action [immediate]
- → Upgrade to Claude Code v2.1.237 to get the Concise output style and gateway prompt-caching fix anthropics/claude-code [plan]
- → Follow v2.1.236's new ANTHROPIC_DEFAULT_MODEL and sandbox precedence changes in your dev environment anthropics/claude-code [monitor]
References
- [1] v2.1.237 ↗ anthropics/claude-code
- [2] fix(git-config): neutralize checkout credential in include-based config (#1526) anthropics/claude-code-action
- [3] v1.0.197 ↗ anthropics/claude-code-action
- [4] v1.0.196 ↗ anthropics/claude-code-action
- [5] v2.1.236 ↗ anthropics/claude-code
- [6] v0.2.142 ↗ anthropics/claude-agent-sdk-python