News
Claude Code 2.1.325 fixes zstd decoding and makes sandboxed Bash ask first
Claude Code 2.1.325 fixes zstd response decoding and makes sandboxed Bash ask for permission by default unless auto-allow is explicitly set.
Claude Code v2.1.325 was published on November 13, 2026. The GitHub release notes on anthropics/claude-code include a security fix in zstd response decoding and a default change that sends sandboxed Bash through the normal permission flow.
What the zstd note actually says
The security line is a single sentence: "Fixed a security issue in how zstd-compressed responses are decoded."
That is the full disclosure in this release. The notes do not name a CVE, do not list affected versions, and do not describe an exploit path or impact. Those details are unknown from this page. The confirmed fact is narrower: v2.1.325 records a fix for a security issue in how zstd-compressed responses are decoded.
Sandboxed Bash follows the permission flow unless you opt out
The permission change is written as a default change, not as a silent patch.
The notes say: "Changed sandboxed Bash commands to follow the normal permission flow by default; set sandbox.autoAllowBashIfSandboxed: true to keep running them without prompts."
A second line covers setups that enable the sandbox from managed settings: "Changed managed settings that turn the sandbox on: to keep commands running without prompts, set sandbox.autoAllowBashIfSandboxed: true in your highest-ranking managed source."
Read together, the sandbox being on is no longer enough, by itself, to skip prompts for sandboxed Bash. The flag sandbox.autoAllowBashIfSandboxed set to true is what the notes say restores running those commands without prompts. Where managed settings turn the sandbox on, that same flag has to sit in the highest-ranking managed source if the no-prompt behavior should continue. A copy only in a lower settings file is not what the notes describe.
The notes do not define how that ranking is calculated, and they do not name the earlier versions that skipped the prompt. They do state the new default and the setting that keeps the old one.
What to do next
Read the v2.1.325 release notes, then check every settings source that turns the sandbox on. If sandboxed Bash must keep running without prompts, set sandbox.autoAllowBashIfSandboxed: true in the highest-ranking managed source before you rely on that path. If it does not, leave the flag unset and expect the normal permission flow.
Sources
- Claude Code v2.1.325 release notes github.com