You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
PluginsArea: what it touches
ImprovementsKind: in v2.1.224,
ImprovementsSection of the release
What
Marketplace fetches now enforce a maximum response size and inspect redirects before following them, and errors redact the fetched URL out of the technical details shown to you.
Details
Plugin entries are checked for declared component paths, limited to 32 entries and rejecting URLs and traversal-style segments.
Archive extraction can now descend into a single wrapper directory when that directory contains a .claude-plugin directory.
Evidence
beforeRedirect
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
