Follow Discord

DisclaimerUnofficial, and not affiliated with Anthropic. Nearly all of this is read straight out of what ships: npm bundles, captured prompts, published docs. Anthropic's own notes go in verbatim, marked as theirs. The rest is my reading, and every entry carries the strings behind it. If one looks wrong, vote it down and say why.

← All of v2.1.224 Home All releases ←olderv2.1.223 v2.1.225newer→

Claude Code v2.1.224 7 Aug 2026

Plugin marketplace downloads get a size cap and redirect checks

You'll notice

Useful2 Signal2

Plugins

Marketplace downloads now cap response size and vet redirects before following them.

What

Marketplace fetches now enforce a maximum response size and inspect redirects before following them, and errors redact the fetched URL out of the technical details shown to you.

Details

Plugin entries are checked for declared component paths, limited to 32 entries and rejecting URLs and traversal-style segments.
Archive extraction can now descend into a single wrapper directory when that directory contains a .claude-plugin directory.

Evidence

beforeRedirect

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

See this entry in the whole of v2.1.224 →