{"version":"2.1.251","anchor":"stricter-git-url-rules-for-plugin-marketplaces","canonical_anchor":"stricter-git-url-rules-for-plugin-marketplaces","heading":"Stricter git URL rules for plugin marketplaces","tier":"notice","area":"Plugins","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.251\/e\/stricter-git-url-rules-for-plugin-marketplaces","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.251","markdown":"### Stricter git URL rules for plugin marketplaces\n\nMarketplace git URLs must use approved schemes; plain git:\/\/ addresses are rejected.\n\n**What**\n\nGit URLs for marketplaces and plugin dependencies are now checked against an explicit allowlist of schemes: https, http, ssh, and file, plus git+ssh and ssh+git. Unencrypted `git:\/\/` URLs are rejected, scp-style ssh addresses are validated, and `file:` URLs naming a host or a network-shaped path are refused.\n\n**Details**\n\n- Applies to every git URL Claude Code validates, with no opt-out.\n\n**Evidence**\n\n`never cleartext git:\/\/ `\n\n- Area: Plugins\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 2\/5"}