Under the hoodTier: how much it should matter to you
1Useful: my rating, 1 to 5
0Signal: worth watching, 1 to 5
PluginsArea: what it touches
Internal ChangesKind: in v2.1.268,
Internal ChangesSection of the release
What
Several places that check plugin-declared paths for safety — commands, MCP server file references, and plugin.json marketplace source paths — used to each run their own simple check for ".." in the path. They now all call a single shared helper function instead. A related helper that checks whether a directory exists also changed: it now takes the plugin's root folder plus a subpath, rather than an already-resolved path.
Why
Consolidating these checks into one helper reduces the chance that one of the several places validating plugin paths is checked inconsistently or missed when the logic needs to change.
