Claude Code v2.1.325 patches a zstd security issue and fixes subagent bugs

Claude Code v2.1.325 was published on November 13, 2026. The release pairs one security fix with a long list of smaller corrections across decoding, subagents, sessions, and the terminal interface.

The security fix addresses how zstd-compressed responses are decoded. The release also adds a spinner tip in VS Code and similar integrated terminals. After Claude reads or edits a Jupyter notebook, the tip suggests re-running a notebook cell, and it appears only once.

Other changes cover several areas. When an organization’s policy blocks a request, the error now explains how to continue: run /rewind and change the message, or run /clear. Subagents with their own model keep it when the model setting is opusplan or haiku, and they size file reads and MCP results with their own model. Sessions on many third-party gateways and Foundry now compact instead of failing with a context length error on every turn. Fixes also cover recent turns missing from resumed sessions, shell commands run after the working directory was deleted, and approved plan edits that were lost when the plans folder could not accept them.

Why it matters

The zstd fix is a security patch, so teams running Claude Code should treat this update as a priority rather than routine maintenance. Several other fixes affect people who depend on subagents, third-party gateways, or resumed sessions, where the bugs could cost work or cause repeated errors. Clearer policy messages and the notebook tip also reduce friction for daily use.

What to do

Update to v2.1.325 if you run Claude Code in shared or production environments, especially if you use subagents with custom models or third-party gateways. Read the full release notes on GitHub to check for any behavior change that affects your setup, and confirm upgrade steps on the vendor’s site before rolling the update out.