You'll noticeTier: how much it should matter to you
3Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
PluginsArea: what it touches
ImprovementsKind: in v2.1.247,
ImprovementsSection of the release
What
Names, sources, versions and descriptions coming from marketplace metadata are cleaned before being printed in plugin list, detail, update and prune output, and marketplace names containing control or text-direction characters are now rejected outright. This blocks terminal escape sequences and right-to-left spoofing in third-party plugin metadata.
Details
The marketplace-name schema rejects control and bidirectional-formatting characters with the message quoted below.
The plugin update command path sanitises its messages too.
Evidence
Marketplace name cannot contain control or bidirectional-formatting characters
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
