Claude Code's Stable Channel Jumps Ten Releases, and Copilot CLI's Localhost Sandbox Ships

At a glance

• Claude Code's slower channel now serves the same build as its fastest one.
• Copilot CLI's looser sandbox, which can reach localhost, is now the default release.
• GitHub retired six Copilot models, so saved model names may break.
• CodeQL traced scans and some anonymous clones need attention in CI.

Monday's brief asked you to pick a Claude Code channel and test the Copilot CLI sandbox before the defaults moved, and both moved overnight. Treat today as a catch up day: find out which Claude Code build each machine runs, retest the Copilot CLI sandbox on the real release, and check that nothing still names a retired Copilot model.

Top Stories

1. Claude Code's stable channel catches up to v2.1.304 in one move

Claude Code v2.1.304 was published to npm at 3:47 PM ET Monday 19 October, and by our 5:51 AM ET check Tuesday stable, latest and next all pointed at it. At Monday's 5:51 AM ET check, stable still served v2.1.292, published 1:10 PM ET Tuesday 6 October, so the slower channel just received ten published releases at once, including the OpenTelemetry cache write split from v2.1.300. Anthropic's setup docs describe stable as typically about one week old and skipping releases with major regressions. npm does not record when a pointer moves, so we can only say this build reached stable within a day of publishing. Anthropic has not said why.

Three v2.1.304 items change how a session feels. A new /auto-mode-setup command reads your project and recent sessions to teach auto mode about your environment. On Pro and Max plans, resuming an inactive conversation that would use a noticeable share of your 5-hour usage limit now shows a warning, offering to resume anyway or start fresh. And /claude-api managed-agents-secure compares a Managed Agents agent's settings with Anthropic's published security guide without changing anything.

Two fixes protect data. Starting Claude Code in a worktree no longer removes that worktree and its branch without asking at exit when HEAD was detached or on another branch, which could lose commits. And rm -r of a mounted drive or a top level folder such as /Volumes, /media or WSL's /mnt/c now gets the same safety prompt that rm -rf /Applications already got.

Practical dev impact: If you moved machines to stable on Monday to slow things down, they caught up overnight, so in our reading the teammate gap we warned about has closed for now. If you use worktree sessions with a detached HEAD, update before your next one, and on a Pro or Max plan expect the resume warning rather than a quiet hit to your limit.

2. Copilot CLI v1.0.100 ships the localhost sandbox to everyone on latest

Copilot CLI v1.0.100 was published to npm at 2:45 PM ET Monday 19 October, and by our 5:51 AM ET check Tuesday it had replaced v1.0.98 on latest. In our reading its notes roll up the prerelease builds Monday's brief covered, and the headline survived: the sandbox allows local network access by default, so commands can reach localhost and private network services. The rest of Monday's list, including the per session /sandbox switch and the new trust folder and telemetry flags, shipped too.

On prerelease, v1.0.101-0, published 5:13 PM ET Monday, adds an assistedApprovalInstructions setting to guide Assisted Permissions decisions, and its model picker marks your administrator managed model as the default when it is available.

Practical dev impact: The window to test before shipping has closed, because a plain update now delivers the looser sandbox. In our view, run one sandboxed command today against a local database or admin page you expect to be off limits, and if it connects, decide whether that is acceptable before the team updates.

3. Copilot retires six models and gives admins an API for the rest

In a GitHub Changelog post at 5:27 PM ET Monday, GitHub said it had deprecated Gemini 3.7 Flash, GPT-5.5, GPT-5.4, GPT-5.4 mini, GPT-5 mini and Grok 4.5 across most Copilot experiences, including Copilot Chat, inline edits, ask and agent modes, and code completions. Suggested replacements are Gemini 3.8 Flash, GPT-6.1 Sol for GPT-5.5 and GPT-5.4, GPT-6 Luna for the two mini models, and Grok 4.7. Copilot Enterprise admins may need to enable the replacements in their model policies.

At 5:32 PM ET GitHub made that job scriptable, with GET and PATCH endpoints for Copilot model policies now generally available for enterprises, enterprise teams, enterprise apps and organizations.

Practical dev impact: Any custom agent, script or saved setting that names a retired model needs a new one, and Enterprise admins should enable the replacements first. With several orgs, the new endpoints let you check policies in one pass.

Two Monday morning GitHub posts are for CI owners. At 6:29 AM ET, GitHub said CodeQL traced extraction is not available when Xcode 27 is installed and may not be available on macOS 27, and that CodeQL does not support Swift 6.4. It advises pinning workflows to macOS 26 and Xcode 26 or earlier, or using build mode none for C and C++, C# and Java. At 6:37 AM ET, it said that during unusual traffic it may require authentication for some anonymous HTTPS clones and fetches of public repositories, while SSH, pushes and authenticated HTTPS are unaffected.

Practical Impact Analysis

All three stories reached you without a decision on your part, like Monday's, but this time on default channels rather than test builds. In our view the Claude Code jump carries the most surprise, because stable exists for teams that want to lag behind and it did not lag. The Copilot CLI sandbox carries the most security weight, since a sandbox that reaches localhost changes what an agent can touch on a laptop. The model retirements risk quiet breakage, because a hard coded model name fails only when someone next runs it. So in our reading, check versions, then test the sandbox, then search configs for retired names, while CI owners pin macOS runners and give automated clones a token.

Elsewhere at our 5:51 AM ET check Tuesday, Codex latest held at v0.163.0, while alpha moved through three builds Monday to v0.164.0-alpha.6 at 7:02 PM ET, with no notes beyond the version name. Gemini CLI held at v0.64.0 with preview at v0.65.0-preview.0, and its 9:49 PM ET Monday nightly is the first with new code since Friday night's, with two small fixes. Neither Cursor changelog, main or CLI, had anything new.

Tutorial

We have not run this script end to end on every platform, so read it before you run it. It changes nothing unless you uncomment an install.

1. Run steps 1 and 2 and compare with this brief.
2. Uncomment a step 3 install only on a machine that is behind and already uses npm.
3. Run step 4 from the root of a repository with agent configs or workflows.
4. Swap any retired model name for GitHub's suggested replacement.

# We have not run this script end to end on every platform. It only prints and searches unless you uncomment an install.
# 1. Claude Code. At 5:51 AM ET Tue 20 Oct npm showed stable, latest and next all at v2.1.304.
#    The worktree exit fix applies to sessions started with: claude --worktree
npm view @anthropic-ai/claude-code dist-tags --json
if command -v claude; then claude --version; else echo "claude not on PATH"; fi

# 2. Copilot CLI. At 5:51 AM ET Tue 20 Oct npm showed latest v1.0.100, prerelease v1.0.101-0.
#    New flags in v1.0.100: --trust-folder and --disable-client-telemetry
npm view @github/copilot dist-tags --json
if command -v copilot; then copilot --version; else echo "copilot not on PATH"; fi

# 3. Optional, npm installs only. Pinned versions at 5:51 AM ET Tue 20 Oct:
#    Claude Code stable, latest and next channel:
# npm install -g @anthropic-ai/claude-code@2.1.304
#    Copilot CLI latest channel:
# npm install -g @github/copilot@1.0.100

# 4. Search for the six model names GitHub retired on Mon 19 Oct, as GitHub's post writes them.
#    Example patterns from display names, not confirmed config ids.
if grep -rniE -e "gpt-5[.]5" -e "gpt-5[.]4" -e "gpt-5[ -]mini" \
  -e "gemini[ -]3[.]7[ -]flash" -e "grok[ -]4[.]5" \
  --include="*.json" --include="*.yml" --include="*.yaml" --include="*.md" --include="*.toml" .
then echo "review the matches above"; else echo "no retired model names found"; fi

The step 4 patterns are examples built from the display names in GitHub's post, not confirmed model ids. Check GitHub's list against how your files name models and widen the patterns to match. Do not mix npm and native installs of Claude Code on one machine.

Sources:

• Claude Code changelog
• Claude Code release channels
• Copilot CLI v1.0.100 release notes
• Copilot CLI v1.0.101-0 release notes
• GitHub Copilot models deprecated on October 19, 2026
• Copilot model policy API for enterprise, orgs, and teams
• CodeQL changes for macOS 27, Xcode 27, and Swift 6.4
• Some Git over HTTPS may temporarily require authentication
• Codex releases
• Gemini CLI nightly
• Cursor changelog
• Cursor CLI changelog

Recommended AI prompt

Copy this paragraph into ChatGPT, Claude, Gemini, Grok, or whatever AI you use.