What's wrong with this entry?
Plugin configuration now distinguishes between non-sensitive values (saved to settings.json) and sensitive values (saved to macOS keychain or .credentials.json). Sensitive fields are scrubbed from settings.json after migration to secure storage.
Plugin secrets handling (search for "sensitive)", "to secure storage", "saveMcpServerUserConfig: scrubbed")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Related
Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.