You'll noticeTier: how much it should matter to you
1Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
ElsewhereArea: what it touches
Bug FixesKind: in v2.1.267,
Bug FixesSection of the release
What
When Claude Code validates a plugin's hook configuration, it already checked the hook's module path for path traversal (an attempt to reference files outside the intended directory, e.g. using ../) and existence. It now performs the same checks on the hook's surfacePath as well, returning a path-traversal or path-not-found error if it fails.
Why
This closes a gap where a hook's surface file could point outside its intended directory without being caught, tightening the security checks around plugin hooks.
