You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
PluginsArea: what it touches
ImprovementsKind: in v2.1.251,
ImprovementsSection of the release
What
When copying plugin directories outside the marketplace-publish path, a symlink whose chain of targets cannot be verified as trusted is now dropped and logged instead of being copied along.
Details
The marketplace-publish branch of the copy keeps its own handling; this covers every other copy.
Evidence
copyDir: dropping a symlink whose target chain cannot be trusted
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
