Sweep 19 Sep 2026 · 02:36Z Build v2.1.278 500 read Stable v2.1.267 Latest v2.1.278 Next v2.1.278 Feeds RSS JSON llms.txt Unofficial
Claude Code v2.1.267 ·

Marketplace directory entries walked with lstat when realpath is unreliable, instead of being refused outright

Marketplace plugin directories with unresolvable paths can now still be scanned safely, instead of being rejected

TierYou'll noticehow much it should matter to you
Useful1my rating, 1 to 5
Signal1worth watching, 1 to 5
AreaPlugins Securitywhat it touches
KindBug Fixesin v2.1.267,
You'll notice

Marketplace plugin directories with unresolvable paths can now still be scanned safely, instead of being rejected

What

If a plugin marketplace directory's path can't be reliably resolved to its real location (for example, because it contains a backslash on a non-Windows system), Claude Code no longer simply refuses to read it. Instead, it walks the directory tree one component at a time, checking each step to make sure it's a plain directory and not a symlink. Where the path can be resolved normally, entries are still checked by comparing their filesystem identity against the marketplace root, as before.

Why

This lets marketplaces with unusual but legitimate paths still work, while keeping the same protection against symlinks being used to escape the marketplace directory.

See this entry in the whole of v2.1.267 →