Claude Code Changelog: September 2026 Updates That Matter

Claude Code updated nearly every day for three weeks this September, and the Claude Code changelog grew 23 entries across versions 2.1.243 to 2.1.273. Most are fix batches, but a handful change how you pick models, what long sessions cost, and what your permission rules block. This digest walks the official changelog so you can skip the scroll, with every claim tied to the release that shipped it.

The 23 releases span August 24 through September 15. The entries below are grouped by the job they touch: model choice, cache economics, permission rules, gateways, and the MCP plus skills layer.

The Claude Code changelog at a glance: 2.1.243 to 2.1.273

• 2.1.243 (Aug 24) release: the settings release. modelPicker, promptCacheTtl, subagentPromptCacheTtl, modelPricing, a Loops breakdown in /usage, and keyless Console sign-in.
• 2.1.245 (Aug 25) release: one fix, for a startup crash on glibc 2.44 distributions such as Arch and Fedora Rawhide.
• 2.1.246 (Aug 25) release: an Auto mode tab in /permissions plus a warning for wildcard Bash allow rules such as Bash(git * main).
• 2.1.247 (Aug 26) release: the SendFeedback tool, /claude-api cost-optimize, and Sonnet 5 auto-compact moving to its full 1M window.
• 2.1.248 (Aug 27) release: --restricted mode, per-agent cacheTtl frontmatter, and cross-session messaging on Bedrock, Vertex, and Foundry.
• 2.1.250 (Aug 28) release: reliability batch.
• 2.1.251 (Aug 28) release: PreModelSwitch and PostModelSwitch hooks, a per-session prompt-cache line in /cost, and a spend limit bar in /usage.
• 2.1.252 (Aug 31) release: fixes for a Mac task-output error, unsaved always-allow rules, and stalled Remote Control sessions.
• 2.1.257 (Sep 1) release: Fable 5.1 as the default Fable model, timeFormat and timeZone settings, and a Containment Escape rule in auto mode.
• 2.1.258 (Sep 1) release: restores launching on macOS 12 Monterey.
• 2.1.259 (Sep 2) release: managedMcpServers for organizations, --permission-prompts none for unattended hosts, GitLab MR recognition.
• 2.1.260 (Sep 3) release: the /diff panel, likely-cause reporting for cache misses, and the first deny-rule revert.
• 2.1.261 (Sep 4) release: /skill-doctor, plus bashOutputMaxChars and taskOutputMaxChars up to 128K.
• 2.1.263 (Sep 6) release: reliability batch.
• 2.1.265 (Sep 8) release: a 1 GB limit on what tool results can write to disk, and an SSE fallback for older HTTP MCP servers.
• 2.1.266 (Sep 8) release: reverts a 2.1.265 regression that broke gateway setups using CLAUDE_CODE_USE_GATEWAY.
• 2.1.267 (Sep 9) release: maxEffortLevel, plus the densest prompt-cache stability batch of the month.
• 2.1.268 (Sep 10) release: gateway pricing sync, a 300-second WebFetch deadline, MCP secret redaction, and the second deny-rule change.
• 2.1.269 (Sep 11) release: claude plugin eval, /output-style, and a workflow concurrency knob.
• 2.1.270 (Sep 12) release: fixes a 2.1.269 regression where read-only git commands started asking for permission.
• 2.1.271 (Sep 14) release: fast mode in Remote sessions, per-command allowed_domains, omitClaudeMd frontmatter, and --accept-command SHA pinning.
• 2.1.272 (Sep 15) release: reliability batch.
• 2.1.273 (Sep 15) release: gateway hint headers, MCP disconnect notices, remote-control session forking, the auto-compact double-count fix, and the second revert.

Fable 5.1 becomes the default, and model choice grows knobs

The model story of the month is 2.1.257: claude-fable-5-1 is now the default Fable model, with a 1M context window, $10/$50 per Mtok input/output pricing, and cache reads at $0.25 per Mtok. If you pinned model: fable or best in a gateway session, those aliases still resolve to Fable 5 for now, because gateways not configured for 5.1 reject it; pick the new model explicitly in /model.

Two follow-ups in 2.1.260 matter if you switched early. The /model picker previously hid Fable 5.1 even for organizations allowed to use it, accepting it only when typed as /model claude-fable-5-1. And prompt caching on Fable 5.1 missed context attached after tool results, so every tool-call turn re-sent it as uncached input. Both are fixed.

Around the model itself, control got finer. The modelPicker setting from 2.1.243 curates the picker with an ordered, labeled list, including Vertex and Bedrock id spellings. The maxEffortLevel setting from 2.1.267 caps effort per model on every provider, including Bedrock, Vertex, and Foundry. And Remote sessions gained fast mode in 2.1.271, honoring the host’s setting or /fast where the organization allows. Our settings.json reference covers where the new keys live.

The prompt-cache campaign: a month of small leaks plugged

A cache miss is priced like a first read, so a session that quietly re-renders its tool definitions every turn burns money. September reads like a deliberate sweep of every path that caused one. promptCacheTtl and subagentPromptCacheTtl (2.1.243) let the main conversation keep its cache for a full hour while subagents expire after five minutes, and 2.1.248 fixed an hourly miss caused by tool definitions re-rendering after an OAuth token refresh.

Visibility arrived too. /cost gained a per-session prompt-cache line in 2.1.251 with hit ratio, misses, and tokens re-cached; 2.1.260 added the likely cause of a miss, naming suspects such as changed tool definitions or idling past the TTL. If you want the underlying mechanics, our prompt caching explainer covers how the cache keys are built.

The stability fixes clustered in 2.1.265 and 2.1.267: resumed sessions, respawned subagents, agent teammates, and mid-session model switches all stopped rewriting the tool list or system prompt prefix, which used to invalidate the cache. 2.1.273 closed an odd corner where /login, /upgrade, and /extra-usage discarded earlier thinking and forced a full cache rewrite on the next request.

Permission deny rules: extended twice, reverted twice

The most instructive saga of the month is what happened to Read and Edit deny rules on Bash command lines. In 2.1.259, Read() deny rules started covering files passed as Bash arguments. In 2.1.260 that change was reverted: it denied npm run build under a Read() deny rule scoped to build output paths, in every mode, and made cd plus grep compounds prompt even in auto mode. In 2.1.268 the idea returned: deny rules were checked on Bash command lines the permission system cannot fully parse, such as eval or env -C. In 2.1.273 it was reverted again, because commands like time -p make build were denied outright. If you wrote deny rules around any of this, check them against 2.1.273 behavior, not what you observed mid-month.

What did stick is worth knowing. The Auto mode tab in /permissions (2.1.246) exposes classifier rules for editing. --restricted (2.1.248) removes the built-in command and code execution tools along with WebFetch, confines file tools to the working directory, blocks bypassPermissions, and skips user, project, and local settings files entirely. The Containment Escape rule (2.1.257) stops auto-approving cloud metadata credential fetches, egress evasion, and cross-tenant reach. Auto mode on Bedrock, Vertex, and Foundry temporarily defaults to the local classifier, with CLAUDE_CODE_AUTO_MODE_SERVER=1 to opt back into the server-side one (2.1.273).

Gateways get pricing sync, telemetry, and hint headers

Self-hosted LLM gateways became first-class this month. A pricing: block in gateway.yaml (2.1.268) pushes your negotiated rates out to signed-in clients via managed settings, which keeps /cost and telemetry aligned with the spend meter instead of guessing from list prices. modelPricing (2.1.243) does the same for contracted rates, and a multiplier up to 10 (2.1.271) supports marked-up internal chargeback. Gateway admins got warnings for empty allow_cidrs (2.1.268) and gatewayInternalNetworks for allowing /login from the organization’s own IPv4 block.

The newest piece is the hint headers in 2.1.273: five request headers describing the request class, agent type, previous tool-call durations, and compaction state, behind CLAUDE_CODE_GATEWAY_HINT_HEADERS=1. A router can use them to send compaction-heavy turns to a cache-friendly upstream. Telemetry grew alongside: OTEL_METRICS_INCLUDE_REPOSITORY tags metrics with repository attributes (2.1.269), and OTEL_LOG_TOOL_DETAILS=1 now tags metrics with the true names of the agent, skill, plugin, or MCP server involved (2.1.273). Our token management guide covers the cost side.

MCP servers and synced skills get housekeeping

Two MCP changes stand out. When an MCP server drops and reconnect attempts run out, 2.1.273 now surfaces a notice that directs you to /mcp, rather than failing quietly later. And HTTP MCP servers that only speak the legacy HTTP+SSE transport now connect via fallback (2.1.265), which unblocks older internal tools. managedMcpServers (2.1.259) provisions HTTP/SSE servers org-wide with the same entry shape as .mcp.json.

Skills synced from claude.ai got lifecycle rules: when an organization turns Skills off, synced copies move to the recoverable trash instead of staying available (2.1.273), and copies not refreshed within cleanupPeriodDays move to trash after signing out (2.1.271). If your context feels heavy, /skill-doctor (2.1.261) lists unused skills and their context cost, and the omitClaudeMd agent frontmatter (2.1.271) lets a subagent skip user, project, and local CLAUDE.md files.

Why auto-compact fired at half your context window

The changelog line is dense, so the mechanics are easy to miss: turns that invoke the advisor tool were being billed to the context meter at close to double their true footprint. Advisor tool calls carry both the advisory exchange and the wrapped call’s content, and the accounting doubled a portion of that. The visible symptom was compaction firing when the meter read near the limit, while the real window was only about half used.

The practical consequence runs backward from what you might expect: sessions that looked nearly full had more room than the meter claimed. If you restructured workflows around early compaction, or set CLAUDE_CODE_MAX_CONTEXT_TOKENS lower to compensate, revisit that after updating. The meter, not your workload, was wrong.

What the five gateway hint headers actually carry

Behind CLAUDE_CODE_GATEWAY_HINT_HEADERS=1, Claude Code attaches x-claude-code-request-class, x-claude-code-agent-type, x-claude-code-prev-tool-durations, x-claude-code-compaction, and x-claude-code-context-compacted to requests. Together they tell a gateway what kind of turn is arriving: a fresh interactive request, a subagent fan-out, a compaction summary exchange, or a request whose context was just compacted and therefore has a cold cache.

That is routing signal. A gateway can send compaction-heavy and long-context turns to an upstream with a bigger cache allowance, keep subagent bursts on a cheaper tier, and stop treating every request as identical. The headers are opt-in and additive, so existing gateway configurations behave exactly as before until you turn them on.

How the three cache TTL settings stack up

2.1.243 added promptCacheTtl and subagentPromptCacheTtl for API-key and cloud-provider users, and 2.1.248 added experimental.cacheTtl in agent frontmatter, accepting 5m or 1h. The precedence is per-agent frontmatter first, then the subagent setting, then the main conversation setting.

The useful pattern is asymmetric: hold the main conversation at one hour, where system prompts and tool definitions sit, while subagents expire at five minutes since they rarely revisit their own cache. The one-hour TTL costs more per cached token on the Anthropic APIs, so it pays off in sessions with many turns over the same base context, and loses in short one-shot runs.

The deny-rule reversals, read closely

Both reversals follow the same shape: a change that made deny rules stricter in corner cases, a population it broke, a revert. The 2.1.259 change extended Read() deny rules to files given as Bash option values, file operands, and compound commands. Real configurations denied legitimate builds, so 2.1.260 restored the old behavior wholesale rather than patching the broken cases.

The 2.1.268 change targeted lines the permission checker cannot fully analyze, applying Read and Edit deny rules when eval or env -C appeared. That caught deny-rule bypasses, but also denied ordinary commands the checker simply could not parse, so 2.1.273 reverted it and those lines prompt again instead of being denied. The lesson for anyone writing deny rules: pin your CLI version in CI when testing rule semantics, because this surface moved twice in one month.

Small entries worth knowing

• SendFeedback tool (2.1.247): Claude can draft a bug report from a failed session for you to review in /feedback; turn it off with feedbackDrafts.
• /claude-api cost-optimize (2.1.247): profiles a project’s API spend and walks cost levers such as caching, batch, and model choice one change at a time.
• timeFormat and timeZone (2.1.257): choose between 12-hour and 24-hour clocks, UTC, or a custom strftime string, applied to the turn-end clock and the transcript view.
• /diff panel (2.1.260): uncommitted changes render beside the conversation in fullscreen mode, toggled with /diff.
• claude plugin eval (2.1.269): execute a plugin’s eval suite inside Claude Code and get a scored report in JSON or HTML.
• WebFetch deadline (2.1.268): fetches against a server that never finishes the response now fail after 300 seconds; override with CLAUDE_CODE_WEBFETCH_DEADLINE_MS.
• Remote-control forking (2.1.273): a session started with claude --remote-control can be forked from the Claude app, running as a background session on your machine.

Claude Code changelog, bottom line: update immediately if you run long sessions that hit auto-compact (the meter was double-counting), route through a gateway (pricing sync plus hint headers), or maintain deny rules (the semantics moved twice). Everyone else can let auto-update ride, but the Fable 5.1 switch and the /cost cache line are worth a look before your next long session.