{"version":"2.1.267","anchor":"marketplace-directory-entries-walked-with-lstat-when-realpat","canonical_anchor":"marketplace-directory-entries-walked-with-lstat-when-realpat","heading":"Marketplace directory entries walked with lstat when realpath is unreliable, instead of being refused outright","tier":"notice","area":"Plugins Security","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.267\/e\/marketplace-directory-entries-walked-with-lstat-when-realpat","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.267","markdown":"### Marketplace directory entries walked with lstat when realpath is unreliable, instead of being refused outright\n\nMarketplace plugin directories with unresolvable paths can now still be scanned safely, instead of being rejected\n\n**What**\n\nIf a plugin marketplace directory's path can't be reliably resolved to its real location (for example, because it contains a backslash on a non-Windows system), Claude Code no longer simply refuses to read it. Instead, it walks the directory tree one component at a time, checking each step to make sure it's a plain directory and not a symlink. Where the path can be resolved normally, entries are still checked by comparing their filesystem identity against the marketplace root, as before.\n\n**Why**\n\nThis lets marketplaces with unusual but legitimate paths still work, while keeping the same protection against symlinks being used to escape the marketplace directory.\n\n- Area: Plugins Security\n- Tier: You'll notice\n- Useful: 1\/5\n- Signal: 1\/5"}