Under the hoodTier: how much it should matter to you
1Useful: my rating, 1 to 5
3Signal: worth watching, 1 to 5
InternalsArea: what it touches
Internal ChangesKind: in v2.1.246,
Internal ChangesSection of the release
What
The subscribe path now validates requests and refuses ones aimed at cached plugin-marketplace data or at line-append streams, and only serves transcript subscriptions narrowed to a single session. The check is unconditional.
Details
Refused: keys or scopes in the marketplace cache namespace, covering the tree, its files and a manifest synthesized from them.
Refused: subscriptions to line-append streams.
Evidence
subscriptions to a marketplace tree, its files or a synthesized manifest are not served
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
