Claude Code shipped four releases in five days and the npm 'stable' tag is 27 versions behind 'latest'

Creative AI News (verified against npm dist-tags for @anthropic-ai/claude-code)·high signalXBlueskyLinkedInCopy link

npm registry data confirms 2.1.259 (Sep 2), 2.1.260 (Sep 3), 2.1.261 (Sep 4) and 2.1.263 (Sep 6, 02:07 UTC), with no 2.1.262 ever published. Together they add unattended-run plumbing: `managedMcpServers`, `--permission-prompts none`, `/reload-plugins` in headless sessions, `/skill-doctor` for finding skills that burn context without earning it, and `bashOutputMaxChars`/`taskOutputMaxChars` raised to 128K. The catch checked directly against the registry: dist-tags currently read stable=2.1.236, latest=2.1.263, so anyone pinned to the stable channel is missing all of it including the 2.1.259/2.1.260 permission-enforcement fixes for Read() deny-rule gaps and a zsh command-substitution bypass.