Claude Code 2.1.305 fixes a 2.1.304 provider outage and adds a Linux sandbox flag Anthropic says lets commands get around file protections
The 20 October release also changes how allowedMcpServers treats managed stdio servers: one your allowlist omitted will now load on upgrade.
Added sandbox.allowNestedUserNamespaces so sandboxed commands on Linux can create user namespaces (Chromium, rootless podman); this lets them get around the sandbox's file protections
Comprehensive take
Upgrade now if you run Claude Code through Vertex, Bedrock or a gateway, and audit managed-mcp.json before you do if you rely on allowedMcpServers. Leave sandbox.allowNestedUserNamespaces off unless a specific job needs a browser or rootless containers.
Use cases
Gateway and cloud-provider users
The 2.1.304 regression made every request fail when tool search was rejected; 2.1.305 retries without it.
Unattended and scheduled runs
The usage-limit recheck variable, fewer five-minute waits on WebFetch approvals and journal-based Workflow resume all target headless operation.
Security-conscious admins
Review the allowedMcpServers change and keep the nested-namespaces flag scoped per job.
Specs
| Release | v2.1.305, published 20 Oct 2026 20:46 UTC, immutable release source |
|---|---|
| New sandbox setting | sandbox.allowNestedUserNamespaces (Linux); release notes say it lets commands get around the sandbox's file protections source |
| Regression fixed | 2.1.304: all requests failed on Vertex/Bedrock/gateways when tool search was rejected source |
| Policy behaviour change | allowedMcpServers no longer filters managed-mcp.json stdio servers using ${VAR} only in env source |
Insights
- Axion reading: the sandbox line is the most consequential in an otherwise routine release, and it is Anthropic's own disclosure that the setting weakens file protections.
- Axion caution: this teardown rests on the release notes alone; Axion has not tested the flag or the fixes.
What shipped
Version 2.1.305 of Claude Code landed on GitHub on 20 October at 20:46 UTC, a day after 2.1.304. Most of the notes are fixes, but a handful matter to anyone running the tool in production, in CI or unattended.
The item to read twice
The first line of the release adds `sandbox.allowNestedUserNamespaces`, a setting that lets sandboxed commands on Linux create user namespaces so tools such as Chromium and rootless podman can run inside the sandbox. The notes themselves add that this "lets them get around the sandbox's file protections". That is Anthropic's own wording, and it is the right trade-off to flag: the flag exists because browsers and container tools need namespaces, but turning it on weakens the guarantee that a sandboxed command cannot touch protected files. Teams that enable it for a browser-testing job should scope it to that job rather than setting it globally.
A regression fixed
The release also fixes a 2.1.304 regression in which every request failed on Vertex, Bedrock and other providers when the endpoint or a gateway rejected tool search, including gateways with ToolSearch disallowed or omitted from `--tools`. Claude Code now retries without it. Separately, self-hosted runner fixes address two earlier regressions: repository access failing since 2.1.296 when a git credential helper reads its settings through `GIT_CONFIG`, and (since 2.1.300) start scripts failing with "Resource temporarily unavailable" when `TERM` is set.
For unattended and automated use
Several fixes target headless runs. A new `CLAUDE_CODE_RETRY_WATCHDOG_USAGE_LIMIT_RECHECK_MS` variable lets unattended retry mode notice a usage limit that was lifted before its scheduled reset, which should shorten idle waits. Scheduled cloud sessions no longer wait five minutes for each subagent whose WebFetch needs a URL approval that nobody is there to give. Workflow resume now serves completed `pipeline()` and `parallel()` agents from the run's journal instead of re-running them, which saves tokens on resumed multi-agent runs. And cloud sessions and teammates are now told when a compaction had to drop the oldest messages to fit the summary.
Smaller changes worth a line
A `modelOverrides` match is now tolerant of letter case and a `[1m]` tag, which was silently stopping `/effort` and `/autocompact` from applying. New worktrees in bare repositories no longer sometimes start from local HEAD instead of the default branch. A full disk now reports "disk is full and nothing ran" instead of a raw ENOSPC path. A same-named server in your own settings no longer replaces an MCP server supplied by a cloud session or the SDK's `setMcpServers`. On the policy side, `allowedMcpServers` no longer filters `managed-mcp.json` stdio servers that use `${VAR}` only in `env`, so one your allowlist omitted will now load on upgrade; use `deniedMcpServers` to keep it off.
Who should upgrade
Anyone on Vertex, Bedrock or a gateway should move now. Anyone with an `allowedMcpServers` allowlist should check `managed-mcp.json` before upgrading, because behaviour changes silently. Everyone else is looking at a routine maintenance release.