claude-code - 💡(How to fix) Fix [BUG] autoUpdates: false in ~/.claude.json is not respected on native installation — CLI self-updates on launch

Description

When autoUpdates is explicitly set to false in ~/.claude.json, the CLI still downloads and installs new versions on launch. This bypasses the user's explicit opt-out from automatic updates.

Steps to Reproduce

1. Install Claude Code via native installation (installMethod: "native")
2. Set "autoUpdates": false in ~/.claude.json
3. Wait for a new version to be released
4. Launch claude from the terminal

Expected Behavior

The CLI should respect autoUpdates: false and not download or install any new version. The user should remain on their current version until they explicitly choose to update.

Actual Behavior

The CLI silently downloads and installs the latest version on launch, ignoring the autoUpdates: false setting. The symlink at ~/.local/bin/claude is updated to point to the new binary without any user prompt or confirmation.

Evidence

• ~/.claude.json contains "autoUpdates": false
• Prior version: 2.1.100 (installed 2026-04-10)
• New version: 2.1.145 was downloaded automatically on launch (2026-05-20)
• 40-day version gap was bridged silently, with no user interaction

Security Concern

This is a security-sensitive issue. In the context of the recent wave of supply chain attacks (Axios, TanStack/Mini Shai-Hulud, PyTorch Lightning, etc.), a user who explicitly disables auto-updates expects to have control over when updates are applied.

If a malicious version were published — even briefly — the current behavior would cause users who believed they had auto-updates disabled to pull the compromised version automatically on their next CLI launch.

The autoUpdates flag should be a reliable security control, not advisory.

Environment

• OS: Linux (Pop!_OS)
• Installation method: native
• Claude Code version: 2.1.145 (auto-updated from 2.1.100)
• Shell: bash

Co-Authored-By: Claude Opus 4.6 (1M context) [email protected]