The Pinned Commit Was a Branch. Check Your Git Host.
Plugin4Shell broke SHA pinning in Claude Code, Codex, Copilot CLI and the Gemini CLI. Two shipped client fixes; the control covering everyone else is a Git host naming rule that GitHub and GitLab enforce and Bitbucket and self-hosted servers do not.
September 20, 2026 · 12 min read