Merge branch 'main' into bump-tracking/enroll-azure

.github/workflows/validate-plugins.yml

@@ -8,6 +8,20 @@ on:
       - '*/agents/**'
       - '*/skills/**'
       - '*/commands/**'
+      # Vendored plugins live TWO levels deep (plugins/<name>/, external_plugins/<name>/),
+      # and `*` doesn't cross a `/` — so the one-level patterns above never match them.
+      # Without these, a PR touching only e.g. plugins/<name>/.claude-plugin/plugin.json
+      # (a manifest version bump) fires nothing and the required `validate` check sits
+      # "Expected — Waiting for status to be reported" forever (PR #5416 hit this; same
+      # per-level spell-out as the README/assets entries below).
+      - 'plugins/*/.claude-plugin/**'
+      - 'plugins/*/agents/**'
+      - 'plugins/*/skills/**'
+      - 'plugins/*/commands/**'
+      - 'external_plugins/*/.claude-plugin/**'
+      - 'external_plugins/*/agents/**'
+      - 'external_plugins/*/skills/**'
+      - 'external_plugins/*/commands/**'
       # `validate` is a required status check, so a PR that touches ONLY workflow
       # files (e.g. an action-SHA re-pin) would otherwise never trigger validate
       # and sit "Expected — Waiting for status to be reported" forever (workflow_dispatch

plugins/claude-security/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-security",
-  "version": "0.10.1-rc7",
+  "version": "0.10.1",
   "description": "Deep vulnerability scanning of your own code, run entirely inside your Claude Code session at a chosen effort tier, with every finding challenged before it is reported and the verification tally computed in code. Turns surviving findings into targeted patches, each verified by a panel of agents, that you apply when you choose. See the plugin README for the tiers, the report format, and the trust model.",
   "author": {
     "name": "Anthropic",