Claude Code 2.1.305 hit npm on Monday evening, a little over 23 hours after 2.1.304. Two entries in the changelog are worth reading before you upgrade.
A sandbox option the changelog itself describes as a hole
The new setting is sandbox.allowNestedUserNamespaces. It lets sandboxed commands on Linux create their own user namespaces, which is what Chromium and rootless podman need in order to start inside the sandbox at all.
The changelog says what that costs in the same sentence: those processes can then get around the sandbox’s file protections. That is unusually blunt wording, and it is the right order to present it in. If you need Playwright tests or containers inside the sandbox, you turn it on knowing the sandbox no longer enforces a file boundary for those commands.
An MCP server that quietly comes back after the update
The second change is softer and aimed at managed installs. allowedMcpServers no longer filters out stdio servers from managed-mcp.json that use ${VAR} only in their env block. Concretely: a server your allowlist has been excluding will load after the upgrade. If you want it to stay out, you have to block it explicitly through deniedMcpServers.
Related: plugins that Claude Desktop mounts by path no longer keep their allowed tools once your organization’s managed settings set allowManagedPermissionRulesOnly.
The rest: keys, widths and a watchdog
CLAUDE_CODE_RETRY_WATCHDOG_USAGE_LIMIT_RECHECK_MS makes unattended retry mode notice a usage limit that was lifted before its scheduled reset. The delete confirmation under /artifacts now takes 1 or Enter to keep, 2 to delete and Esc to cancel; y and n do nothing. A mod’s docked pane stays within 45% of the terminal width, even when it carried a width over from a wider terminal.
In VS Code there is a “Running start-up hooks” spinner with a screen reader announcement while SessionStart or Setup hooks run. And Code Review no longer opens a re-review with LGTM while earlier blocking findings are still unresolved. Six improvements and 22 bug fixes round it out.
If you follow stable, you don’t have 2.1.305 yet
On npm, stable still points at 2.1.304, latest at 2.1.305, and next has been carrying 2.1.306 since the early hours. The gap between channels has grown to two versions this week. With the sandbox option in play, that isn’t bad news: a setting that deliberately opens a protection boundary is one you’d rather take in a build that has had a few days in the field.