Plugin loading now resolves an anchor, the real path of the plugin directory, once and threads it through hook-file and skill-file path resolution, so hooks or skills referenced outside the declared plugin directory via path traversal or symlinks can be correctly detected.
Plugin hook/skill file resolution now anchors against realpath of the plugin directory
Plugin hook and skill paths are resolved against the plugin directory's real path, catching traversal and symlink escapes.
You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
PluginsArea: what it touches
Bug FixesKind: in v2.1.257,
Bug FixesSection of the release