Download Latest Version v1.29.7 source code.zip (47.4 MB) Google Add to Preferred Sources
Home / v1.29.7
Name Modified Size InfoDownloads / Week
Parent folder
README.md 2026-10-09 1.0 kB
1 1 weekly downloads
v1.29.7 source code.tar.gz 2026-10-09 39.7 MB
1 1 weekly downloads
v1.29.7 source code.zip 2026-10-09 47.4 MB
2 2 weekly downloads
Totals: 3 Items   87.1 MB 4

Security

  • Fix command injection in the analytics Console Bridge (port 3334) — GHSA-4jm9-m3fr-9jpx, reported by @manus-pi. Affected 1.11.0 through 1.29.6. Terminal input is spawned with argv and passed through the environment instead of interpolated into expect/osascript source, the macOS do script fallback is removed, and the WebSocket handshake now requires a loopback peer, the local dashboard origin and a per-process token.
  • Same class, found by the follow-up audit: --health-check, --command-stats, --hook-stats, --mcp-stats, global agent wrappers and --clone-session no longer pass text from project files, downloaded components or arguments through a shell. The Claude API proxy (port 3335) binds to loopback and refuses browser and non-loopback requests. A setting component can only write files under .claude/.

Changed

  • Mods: removed the early-access warning and the CLAUDE_CODE_ENABLE_FUNCTION_HOOKS instruction; Claude Code 2.1.287+ loads mods by default.
Source: README.md, updated 2026-10-09