Follow Discord
Sweep 06 Nov 2026 · 01:32Z Build v2.1.319 537 read Stable v2.1.311 Latest v2.1.318 Next v2.1.319 Feeds RSS JSON llms.txt llms-full.txt Unofficial

Claude Code v2.1.267 ·

Marketplace directory entries walked with lstat when realpath is unreliable, instead of being refused outright

Marketplace plugin directories with unresolvable paths can now still be scanned safely, instead of being rejected

You'll notice Bug Fixes
JSON All of v2.1.267
You'll noticeTier: how much it should matter to you
1Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
Plugins SecurityArea: what it touches
Bug FixesKind: in v2.1.267,
Bug FixesSection of the release
What

If a plugin marketplace directory's path can't be reliably resolved to its real location (for example, because it contains a backslash on a non-Windows system), Claude Code no longer simply refuses to read it. Instead, it walks the directory tree one component at a time, checking each step to make sure it's a plain directory and not a symlink. Where the path can be resolved normally, entries are still checked by comparing their filesystem identity against the marketplace root, as before.

Why

This lets marketplaces with unusual but legitimate paths still work, while keeping the same protection against symlinks being used to escape the marketplace directory.

See this entry in the whole of v2.1.267 →

Feedback