Claude Code v2.1.88 Release - Performance Improvements and Security Concerns

Anthropic has released Claude Code v2.1.88. This update includes performance improvements and Windows-specific fixes.

Changes

New Environment Variable

• CLAUDE_CODE_NO_FLICKER=1: Added environment variable for flicker-free alt-screen rendering with virtualized scrollback

Permission Management

• PermissionDenied Hook: Introduced a hook that fires after auto-mode classifier denials, allowing the model to retry if {retry: true} is returned

UX Improvements

• @mention Typeahead: Improved named subagent suggestions in typeahead

Bug Fixes

• Prompt Cache Fix: Fixed prompt cache misses in long sessions caused by tool schema bytes changing mid-session
• Nested CLAUDE.md Fix: Resolved an issue where nested CLAUDE.md files were reinjected multiple times in long sessions that read many files
• Windows CRLF Fix: Fixed a bug where Edit/Write tools doubled CRLF on Windows and stripped Markdown hard line breaks
• Windows Drive Safety: Improved detection for dangerous removal of Windows drive roots (e.g., C:, C:\Windows)

Security Note

This release has been marked by a significant transparency issue. The npm package included a 60MB source map file (cli.js.map), which allowed reconstruction of 1,906 proprietary source files. This leak exposed details about internal API design, telemetry analysis systems, and encryption tools.

This marks the second time such a vulnerability has occurred, with a similar incident in February 2025. The community has raised concerns about transparency and security practices.