Claude Code v2.1.223 · 5 Aug 2026
Marketplace host policy folds ssh.github.com to github.com
Org marketplace rules naming github.com now also match plugins cloned over GitHub's SSH alias host.
You'll notice Tier: how much it should matter to you
2 Useful: my rating, 1 to 5
0 Signal: worth watching, 1 to 5
Plugins Area: what it touches
Improvements Kind: in v2.1.223, 05 Aug 26
Improvements Section of the release
What
An org policy hostPattern that names github.com now also matches marketplaces cloned over the GitHub SSH alias host.
Details
strictKnownMarketplaces hostPattern matching now passes { foldGitHubAliases : !0 }, so the URL host is tested against both ssh.github.com and github.com.Only affects orgs that use policy-settings hostPattern rules. Invalid patterns still log "Invalid hostPattern regex in policy settings". Evidence
ssh.github.com
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
How sure we are
One source agrees One thing we can check says the same as this entry.
Anthropic's release notes agree Added owner wildcard entries ("owner/*") to the strictKnownMarketplaces and blockedMarketplaces managed settings for allowing or blocking…
See this entry in the whole of v2.1.223 →
5 Aug 2026 · 201 entries, this one is #112.
Use it now26 You'll notice99 Nothing to try yet21 Under the hood55
Open the release →
Names in this entry
setting hostPattern Org marketplace rules naming github.com now also match plugins cloned over GitHub's SSH alias host.
setting strictKnownMarketplaces Allowlist the marketplace sources users can add and install from
setting foldGitHubAliases Marketplace block and allow lists now match repos written differently, and accept owner-wide wildcards.
cli ssh Marketplace block and allow lists now match repos written differently, and accept owner-wide wildcards.
Anthropic's note
Upstream's own release notes for v2.1.223 name something this entry names, so the two are probably about the same change. Probably: the pairing is made on a shared name rather than on the words around it.
Is this right?
0
0
Feedback
What's wrong with this entry?
Hard to understand Too vague Looks wrong Not relevant to me Too long Missing the detail I wanted Duplicate of another card
Clear Learned something new I can act on this Good catch
Related
Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.
← Previous · 111 of 201
api.anthropic.com and api-staging.anthropic.com are accepted as trusted OAuth origins
You'll notice Auth
In v2.1.223 Improvements release-page order
Next → · 113 of 201
Workflow scripts reject dynamic import()
You'll notice Elsewhere