You'll noticeTier: how much it should matter to you
1Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
Plugins SecurityArea: what it touches
Bug FixesKind: in v2.1.267,
Bug FixesSection of the release
What
When Claude Code sets up a plugin's symlinks (shortcuts that point to another file), it now checks that the symlink and its resolved target are actually the same file, by comparing their inode and device numbers (low-level filesystem identifiers). A symlink is now rejected if it points somewhere different than it appears to resolve to, or if this identity can't be verified at all.
Why
This closes a gap where a symlink could pass an earlier path-based check while actually opening a different file than expected, tightening protection against symlink-based tricks in plugin packages.
