Module path validation for plugin hooks now also rejects a path that is exactly .., in addition to the existing startsWith('..') and resolve-mismatch checks, closing an edge case in the path-traversal guard.
Hooks module path checks tightened for path traversal
A plugin hook module path of exactly two dots is now rejected, closing a traversal edge case.
You'll noticeTier: how much it should matter to you
1Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
PluginsArea: what it touches
Bug FixesKind: in v2.1.257,
Bug FixesSection of the release