1
00:00:00,000 --> 00:00:01,117
Welcome to the show, everyone!

2
00:00:01,317 --> 00:00:05,356
I'm Lachlan Reed, here with James Turner,
and mate, we need to talk about Claude

3
00:00:05,420 --> 00:00:08,517
Code version 2.1.153.

4
00:00:08,717 --> 00:00:13,034
If you are using custom API gateways with
Claude, you need to update right now,

5
00:00:13,104 --> 00:00:15,757
because there was a serious credential
leak in the wild.

6
00:00:16,000 --> 00:00:17,521
Yeah, this is a massive deal.

7
00:00:18,434 --> 00:00:22,403
Essentially, a regression in the previous
version meant that if you configured a

8
00:00:22,449 --> 00:00:27,373
custom gateway, Claude Code was actually
sending your primary Anthropic OAuth

9
00:00:27,426 --> 00:00:31,931
credentials directly to that custom
gateway, instead of using the gateway's own

10
00:00:31,984 --> 00:00:32,890
specific token.

11
00:00:34,000 --> 00:00:36,279
That is absolutely wild.

12
00:00:37,251 --> 00:00:41,529
Imagine building a custom proxy to keep
things secure, and instead,

13
00:00:41,549 --> 00:00:45,609
you're literally hand-delivering your
master Anthropic keys to it.

14
00:00:45,753 --> 00:00:52,320
This 2.1.153 patch completely shuts that
down, isolated routing is back,

15
00:00:52,360 --> 00:00:56,081
and it properly scopes the OAuth tokens so
they don't wander off.

16
00:00:57,000 --> 00:00:57,797
Exactly.

17
00:00:57,837 --> 00:01:01,472
And while they were under the hood fixing
that security mess,

18
00:01:01,504 --> 00:01:06,518
they also dropped a fantastic optimization
for git and GitHub plugin sources.

19
00:01:06,614 --> 00:01:09,556
They added a new flag called `skipLfs`.

20
00:01:10,000 --> 00:01:12,080
Oh, the Large File Storage bypass!

21
00:01:12,512 --> 00:01:14,640
That is going to save so much bandwidth.

22
00:01:14,693 --> 00:01:18,479
If you're cloning or updating a massive
repo just to parse some source code,

23
00:01:18,499 --> 00:01:21,995
you don't want to waste ten minutes
pulling down gigabytes of compiled binary assets

24
00:01:22,102 --> 00:01:23,753
or heavy 3D models.

25
00:01:24,000 --> 00:01:28,007
Right, it dramatically speeds up local
environment setup and update times.

26
00:01:28,633 --> 00:01:34,477
But the third major update in 2.1.153 is
all about subagent security,

27
00:01:34,532 --> 00:01:39,587
specifically how Model Context Protocol,
or MCP, configurations are inherited.

28
00:01:39,683 --> 00:01:45,657
They've hardened the boundary by enforcing
flags like `--strict-mcp-config` and

29
00:01:45,737 --> 00:01:48,384
`--bare` when spinning up subagents.

30
00:01:49,000 --> 00:01:54,195
Ah, so if a primary agent launches a
subagent to do a specific task,

31
00:01:54,243 --> 00:01:59,309
that subagent can't just inherit a loose
config and start executing unauthorized

32
00:01:59,362 --> 00:02:00,187
local tools.

33
00:02:01,135 --> 00:02:04,273
It keeps the sandbox tight across those
agent boundaries.

34
00:02:05,000 --> 00:02:05,720
Precisely.

35
00:02:05,773 --> 00:02:09,245
It prevents privilege escalation between
the parent agent and the subagent.

36
00:02:09,405 --> 00:02:15,242
It's a highly technical release, but
v2.1.153 is an absolute must-install for

37
00:02:15,295 --> 00:02:16,201
security alone.

38
00:02:17,000 --> 00:02:17,799
Too right, mate.

39
00:02:18,504 --> 00:02:19,398
Get updating!

40
00:02:19,526 --> 00:02:21,158
That's it for this quick update.

41
00:02:21,398 --> 00:02:22,518
I'm Lachlan Reed.

42
00:02:23,000 --> 00:02:24,043
And I'm James Turner.

43
00:02:24,083 --> 00:02:24,364
See ya!

44
00:02:25,348 --> 00:02:26,846
Powered by Jellypod AI.