Git clone operations for marketplace plugins now use StrictHostKeyChecking=yes instead of the previous StrictHostKeyChecking=accept-new. This means new host keys are no longer automatically trusted — the user must explicitly add them first. Improved error messages now provide specific remediation steps:
- For changed host keys: shows
ssh-keygen -R <host>command - For unknown hosts: shows
ssh -T git@<host>command - Detects
REMOTE HOST IDENTIFICATION HAS CHANGEDandHost key verification failedscenarios
Evidence
SSH config change (search for "StrictHostKeyChecking=yes", "SSH host key has changed")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.