What
Claude Code checks certain addresses to see whether they start with a risky scheme, such as ssh://, git://, git+ssh://, ssh+git:// or file://. The scheme is the part before :// that says how to connect.
Before, the check only matched when the address began exactly with one of those schemes. It now first removes leading spaces and invisible control characters, and ignores tabs and line breaks inside the scheme. An address written as a space followed by ssh:, a tab, then // is now recognised as ssh.
Why
This closes a gap where extra whitespace could slip an ssh address past the check. Ssh addresses can be abused to make your computer run commands, so catching them matters.
Something disagreesSomething we can check disagrees with this entry, or the writer said they could not settle it.
The writer flagged doubt
It is not clear which Claude Code feature, such as plugin sources from git, relies on this check.