Claude Code adds GitLab merge requests, drops todo tools on Opus 4.8+
The v2.1.233 drop also patches a Windows credential-leak vector, adds per-user API spend attribution, and caps memory on runaway builds.
Copy markdown
GitLab merge requests join the agent flow
The `--worktree` flag and the `claude agents` view now accept GitLab MR URLs, displayed as `!N` — bringing GitLab teams the same PR-driven agent workflow GitHub users already had. No more shoehorning merge requests into a GitHub-shaped tool.
Todo tools switch off on Opus 4.8 and Sonnet 5
Task-tracking tools are now disabled by default on newer models (Opus 4.8+, Sonnet 5+), so Claude Code's todo lists quietly stop appearing if your workflow leans on them. Set `CLAUDE_CODE_ENABLE_TODO_TOOLS=1` to bring them back.
A Windows credential-leak vector, closed
Path validation was hardened against an NT device prefix that bypassed UNC checks and could leak NTLM credentials. If you run Claude Code on Windows, this alone is a reason to update now.
Per-user spend attribution arrives
A new opt-in `forward_user_identity` gateway setting forwards signed-in identity headers, letting teams routing through a gateway attribute API spend to individual users instead of one shared bucket.
Memory caps stop runaway builds
On Linux, `CLAUDE_CODE_TOOL_MEMORY_LIMIT` uses cgroups to cap tool memory so a runaway build or test no longer stalls the whole session. There's also a new `CLAUDE_CODE_WEBFETCH_CACHE_TTL_MS` knob for tuning WebFetch's URL cache.