Plugins can no longer use .. path segments to reference files outside their plugin directory. This is enforced for:
- Plugin file resolution (plugin.json paths)
- Marketplace name validation
- Package references
Evidence
Path traversal checks (search for "path-traversal")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.