{"version":"2.1.238","anchor":"marketplace-validation-flags-unsafe-archive-credential-setup","canonical_anchor":"marketplace-validation-flags-unsafe-archive-credential-setup","heading":"Marketplace validation flags unsafe archive credential setups","tier":"use","area":"Plugins","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.238\/e\/marketplace-validation-flags-unsafe-archive-credential-setup","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.238","markdown":"### Marketplace validation flags unsafe archive credential setups\n\nMarketplace validation now warns about unsafe `headersHelper` and missing `sha256` setups.\n\n**What**\n\nCatalog validation gained errors and warnings for fetch credentials: an entry using `headersHelper` must inline its full manifest or the helper will not be run, `headers`\/`headersHelper` on non-archive sources warn as ineffective, and an archive fetched with a helper but no `sha256` warns.\n\n**Details**\n\n- Routing and identity headers are reported as dropped at download time rather than silently discarded.\n\n**Evidence**\n\n`An entry with headersHelper must inline its full manifest`\n\n- Area: Plugins\n- Names: `headersHelper`, `headers`, `sha256`\n- Tier: Use it now\n- Useful: 2\/5\n- Signal: 2\/5"}