Version 2.1.290 of Claude Code, released by Anthropic on October 5, 2026, adds a gateway sign-in deny option, partial-name attach and logs, and mod and plugin hook context, alongside fixes for proxy beta headers, long image sessions, WebFetch truncation, scheduled tasks, and plan-mode connector approval. None of this is a pricing change or a new tier. It is a maintenance release. But for teams that have already deployed Claude Code behind a gateway, the sign-in deny control changes who can authenticate into the tool at all, which is an access decision, not a convenience feature.
Anthropic did not disclose whether the gateway sign-in deny applies retroactively to existing sessions or only new logins, and it did not specify which plan tiers or seat types include the feature. That gap matters because gateway controls are typically the kind of thing procurement teams ask about during security review, not after rollout. Buyers evaluating Claude Code for teams larger than a handful of developers should treat this release as a prompt to re-check admin documentation rather than assume the changelog entry fully describes the control surface.
The partial-name attach and logs feature and the plugin hook context addition both point toward a tool that is accumulating more extensibility surface over time, which is typical of developer tools maturing past early adoption. For operators, each new hook point or plugin context is also a new place where custom integrations can break on the next release, which raises the ongoing maintenance cost of any internal tooling built on top of Claude Code. Teams that have written scripts against scheduled tasks or WebFetch behavior should check the fix list against their own usage before assuming nothing changed.
Nothing in this release touches pricing, contract terms, or data handling commitments, so it does not shift the lock-in calculus directly. But the steady cadence of point releases, now at 2.1.290, is itself a fact buyers should weigh when comparing switching costs against competitors. A tool that ships frequent small fixes to proxy headers, image sessions, and connector approval is one that requires ongoing attention from whoever owns the integration, which is a real operating cost even when no invoice changes.
For procurement teams specifically, the decision this release actually touches is narrower than the changelog suggests. It does not redefine what Claude Code costs or who is billed. It does change what IT and security teams should verify before renewing or expanding a deployment: whether gateway sign-in deny meets existing access policies, whether plugin hook context exposes any new data paths, and whether the WebFetch and scheduled task fixes resolve issues already reported internally. None of that is disclosed in enough detail to close the review on changelog text alone.
Anthropic's release notes describe fixes, not guarantees, and the absence of pricing or contract detail in a point release is normal, not a loophole. The open question for any team running Claude Code at scale is whether a vendor shipping this many incremental patches is signaling active maintenance or ongoing instability, and the changelog alone does not answer that.