{"version":"2.1.267","anchor":"plugin-symlink-materialization-now-verifies-link-identity-vi","canonical_anchor":"plugin-symlink-materialization-now-verifies-link-identity-vi","heading":"Plugin symlink materialization now verifies link identity via stat, not just realpath","tier":"notice","area":"Plugins Security","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.267\/e\/plugin-symlink-materialization-now-verifies-link-identity-vi","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.267","markdown":"### Plugin symlink materialization now verifies link identity via stat, not just realpath\n\nPlugin symlink handling now verifies file identity with a stat check, not just a path check\n\n**What**\n\nWhen Claude Code sets up a plugin's symlinks (shortcuts that point to another file), it now checks that the symlink and its resolved target are actually the same file, by comparing their inode and device numbers (low-level filesystem identifiers). A symlink is now rejected if it points somewhere different than it appears to resolve to, or if this identity can't be verified at all.\n\n**Why**\n\nThis closes a gap where a symlink could pass an earlier path-based check while actually opening a different file than expected, tightening protection against symlink-based tricks in plugin packages.\n\n- Area: Plugins Security\n- Tier: You'll notice\n- Useful: 1\/5\n- Signal: 1\/5"}