0d82eac bump: switch to per-entry PR mode (one PR per stale plugin) (#2051)
3d368d2 Merge pull request #2105 from anthropics/fix-2098-output-config-format
84011d4 security-guidance: migrate from deprecated output_format to output_config.format (#2098)
2a822c0 Merge pull request #2101 from anthropics/fix-2099-quotepath-global
a40c9f1 security-guidance: move core.quotePath=false to GIT_CMD globally (#2099 followup)
c7a3e2f Merge pull request #2100 from anthropics/fix-2099-text-true-pythonutf8
1ecf3d1 security-guidance: purge text=True from subprocess.run + bake PYTHONUTF8=1 (#2099)
c40770a Merge pull request #2078 from anthropics/fix-1868-claude-config-dir
7a0a7f4 Bump 58 plugin SHA pin(s) to upstream HEAD (#2079)
42487ee Merge pull request #2091 from anthropics/fix-2089-if-clause-regression
bc07f7a security-guidance: 5 precise if entries fixing #2089 regression + gt support
9e150cf Merge pull request #2086 from anthropics/fix-2082-diff-parser-non-ascii
38b298d security-guidance: pass core.quotePath=false to diff feeders (#2082)
8435428 Merge pull request #2077 from anthropics/fix-1358-1375-1783-hook-output-protocol
0d22ba3 security-guidance: respect CLAUDE_CONFIG_DIR for plugin state files (#1868)
37ffc76 security-guidance: emit findings via hookSpecificOutput.additionalContext (#1358 #1375 #1783)
982070e Merge pull request #2076 from anthropics/fix-2048-graphite-gt-workflow
68a7008 Merge pull request #2075 from anthropics/fix-2056-windows-unicode-decode
5212308 security-guidance: detect Graphite (gt) commands as commit/push events (#2048)
3d349d4 Merge pull request #2074 from anthropics/fix-xss-rules-non-js-false-positives
6a63e35 security-guidance: lenient UTF-8 decode in 6 git-subprocess helpers (#2056)
12a5376 security-guidance: gate XSS pattern rules to JS-family files
04127de Merge pull request #2073 from anthropics/fix-2071-macos-python-39
a67587c security-guidance: enable LLM review on default macOS Python 3.9
502de97 Add vibe-prospecting plugin (#1997)
679f52d feat(scan): emit per-entry sticky verdict comments (#2009)
13a0208 Add Skill-bundle plugins section to README (#2067)
e9b5437 Add Apache 2.0 LICENSE to repo root (#1999)
fc49e68 recommender: add Convex to database/backend MCP coverage (#1981)
06b6d5b Refresh Convex plugin: rename to `convex`, bump SHA to v1.0.1, richer metadata (#1980)
2a3dd81 Merge pull request #2055 from anthropics/fix-windows-agentic-reviewer
c112447 Address Windows verification: --prefer-binary + pywin32 bootstrap
4decd2e Enable agentic commit reviewer on Windows
e77ff91 Merge pull request #2054 from anthropics/fix-2043-windows-posix-path
390c2fe Convert POSIX script paths to Windows form before exec on Git Bash
1109c43 Bump 68 plugin SHA pin(s) to upstream HEAD (#2049)
4c4b300 ci: validate Apache 2.0 LICENSE file exists in every plugin (#2028)
fd06e99 Bump carta-* SHA pins (3 plugins) to upstream HEAD (#2052)
a8f5f1b Merge pull request #2041 from anthropics/security-guidance-update
0bde168 Update security-guidance plugin
1b527e2 ci: migrate scan-plugins.yml to Workload Identity Federation auth (#1991)
3449c10 fix(UI5): Rename GitHub repository and bump SHAs (#1976)
cb8424c Fix MCP URL probe: connection failure was reported as PASS (#1922)
1d5ba64 Bump 51 plugin SHA pin(s) to upstream HEAD (#1957)
6cc16f4 Merge pull request #1953 from anthropics/add-plugin/mcp-tunnels
529d105 Rename mcp-gateway -> mcp-proxy throughout
12482fd Link to public MCP tunnels docs and use public mcp-proxy image
0a6ff87 Add mcp-tunnels plugin
d68033b Bump mercadopago to 63ff263c (v2 + PreToolUse hook gating) (#1949)
bef2b9b Merge pull request #1935 from anthropics/fix/quote-claude-plugin-root-paths
b58bdbf fix: quote \${CLAUDE_PLUGIN_ROOT} in hookify and security-guidance hook commands
ae21a93 Bump snowflake-cortex-code to v3.1.0 (#1932)
6a05dc2 Add 24 first-party plugins from major-brand orgs (#1919)
d42e163 Bump 25 plugin SHA pins to upstream HEAD (huggingface–railway) (#1914)
4bf0858 Add carta-crm and carta-investors plugins (#1877)
9f0275a Add convex-backend plugin (#1918)
0b9a622 Fix broken plugin source configs and bump their SHAs (#1915)
b7c0654 Raise bump cap with verdict cache and skip-and-revert (#1913)
af4e1ad Bump 21 plugin SHA pins to upstream HEAD (#1911)
de2bcc9 Bump 27 plugin SHA pins to upstream HEAD (#1912)
e98784f Run plugin SHA bump nightly instead of weekly (#1909)
237a6b9 Add CI check for HTTP MCP server URL liveness (#1910)
0c54d4a Bump 20 plugin SHA pin(s) to upstream HEAD (#1904)
61b760a Add save-to-spotify plugin (#1905)
f475d3c Add zoominfo plugin (#1885)
d7b273d Bump crowdstrike-falcon-foundry SHA to v1.0.0 (#1842)
b5a156b Add carta-cap-table plugin (#1876)
32b176e Bump pagerduty plugin to latest upstream SHA (#1862)
d8e4105 Bump vanta-mcp-plugin SHA to 345d86b5 (#1843)
5dbfa0f Bump box plugin SHA and enumerate skills (#1845)
1a2f18b chore: modify data-agent-kit-starter-pack plugin details (#1826)
1cf022e Fix servicenow-sdk ref: ServiceNow/sdk uses master, not main (#1830)
573ecf3 Merge pull request #1820 from anthropics/morganl/code-modernization-plugin
5e4a450 code-modernization: harden writes a patch instead of editing legacy; make map/security guidance language-agnostic
22a1b25 Harden code-modernization plugin from a real CardDemo dry run
7188181 Fix code-modernization plugin: align README with commands, fix pipeline gaps
45896c8 Make Scan Plugins a viable required check; auto-dispatch on bump PRs (#1815)
7f6f5a8 Add airtable plugin (#1817)
fe8f813 Bump bump-plugin-shas action so bump commits are signed (#1814)
6196a61 Add mercadopago plugin (#1813)
480a410 Add sap-cds-mcp plugin + SAP SE author block on cds-mcp (#1778)
0ed7932 Align SAP author blocks on existing entries (#1779)
00679ae Add sap-fiori-mcp-server plugin (#1777)
76b35e9 Tighten policy scan: hook scope, telemetry, disclosure; make blocking (#1771)
ccd0c95 Remove flint from marketplace (#1769)
fcb2361 Remove optibot from marketplace (#1768)
7ce4a6f Add clickhouse plugin (#1683)
83cbef8 Add pigment plugin (#1684)
2c6fb0c Add qdrant-skills plugin (#1685)
494115a Add zilliz plugin (#1686)
89e002a Add dash0 plugin (#1641)
63aeda9 Add outputai plugin (#1709)
e324370 Remove versori-skills from marketplace (#1765)
f71a8fa Remove broken autofix-bot marketplace entry (#1047)
d26df37 Remove adspirer-ads-agent from marketplace (#1716)
ec1bcc3 Merge pull request #1712 from anthropics/devsec/pin-actions
693d467 Pin GitHub Actions to commit SHAs
95cc50d Adopt validate-plugins action suite; pin all external SHAs (#1762)
c51f5c1 Bump zapier plugin SHA to f34a785 (#1753)
9e1dad6 Update twilio-developer-kit plugin — refresh SHA, simplify entry (#1757)
Upstream Changes Detected
New commits from anthropics/claude-plugins-official:
Action Required: Review changes and sync if needed.