You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
PluginsArea: what it touches
ImprovementsKind: in v2.1.251,
ImprovementsSection of the release
What
Git URLs for marketplaces and plugin dependencies are now checked against an explicit allowlist of schemes: https, http, ssh, and file, plus git+ssh and ssh+git. Unencrypted git:// URLs are rejected, scp-style ssh addresses are validated, and file: URLs naming a host or a network-shaped path are refused.
Details
Applies to every git URL Claude Code validates, with no opt-out.
Evidence
never cleartext git://
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
