$ cat anthropics/week/2026-10-19.log
the week in review · Oct 19 – Oct 25, 2026
Claude Code 2.1.304 adds plugin hook-skip transcripts
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
Release train reached 2.1.308 in the action while the sandbox-runtime closed Node proxy and Windows fence gaps.
v2.1.304 anthropics/claude-code
The bulk release adds a transcript line when a plugin that runs first skips one of your mod's hooks, naming the event and the plugin, and a new decider: "person" on a mod's tool.check answer, so only the permission dialog or a host callback can approve the ask. If your plugin answers tool.check programmatically, that new decider changes who is allowed to say yes.
fix(sessions): return every parallel tool call and result from get_session_messages anthropics/claude-agent-sdk-python
get_session_messages and get_session_messages_from_store had dropped tool calls and results from any turn that ran tools in parallel: with three parallel calls they returned one of the three results, and one to three of the calls depending on which result was written last. Anything that reconstructs a session from stored messages was reading an incomplete turn.
windows: network fence fix, a fuller fence check, and a loopback switch anthropics/sandbox-runtime
Three changes to the Windows network fence landed together: BLOCK filters now also match AppContainer tokens, the fence check covers more, and a loopback switch is added. Re-check your Windows sandbox allowlists against the tighter matching, particularly where AppContainer identities were previously passing the access check.
windows: write-restricted token, kept grants, profile read grant anthropics/sandbox-runtime
The Windows filesystem model changed in five reviewed pieces: deny entries are now only removed when every grant is gone, grants are kept, and the profile gets a read grant. The first matters most, since a failed grant revoke previously restored a deny and left the session in a state it should not have reached.
Node's built-in HTTP clients use the sandbox's proxy anthropics/sandbox-runtime
A sandboxed Node program's built-in fetch and http/https clients ignore HTTP_PROXY/HTTPS_PROXY unless NODE_USE_ENV_PROXY=1 is set, so they attempted direct connections the sandbox blocked and failed even for allowed hosts. The library now sets that variable whenever it sets the proxy, which fixes outbound fetches in sandboxed Node without a code change.
security-guidance: find the earlier version of a file reached through a symlinked folder anthropics/claude-plugins-official
When the tool's path and the session directory named the same repo through different symlinks (/tmp and /var on macOS), the relative path left the repo and the earlier-version lookup found nothing. Paths that cross symlinks now resolve to the baseline the review compares against.
Enrol Ruby on Rails anthropics/oss-scanner
Rails and four other established projects enrolled in oss-scanner this week, alongside gofiber/fiber, graphql-platform, ILSpy, nextcloud/server and eigen. Enrollment is maintainer-driven, and the scanner's output coverage widens with each project added.
ci: publish to PyPI with trusted publishing instead of an API token anthropics/claude-agent-sdk-python
Alongside: releases of the Python Agent SDK now upload to PyPI via trusted publishing, with the publish job taking id-token: write and twine exchanging a GitHub OIDC token for a short-lived upload token instead of a stored secret; the release notes say the job "no longer sets `TWINE_USERNAME`/`TWINE_PASSWORD`".
$ ls anthropics/week/ # the briefings behind this review
Keep up with Anthropic in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.