/ Claude Code v2.1.117

Fixed git sha parameter injection by adding input validation that rejects sha values starting with "-" (search for "Invalid sha")
Fixed git clone argument injection by adding -- separator to prevent URL and ref arguments from being interpreted as flags (search for "A.push('--', H, $)")
Fixed git remote HEAD reference validation to verify that detected references actually exist before using them (search for "refs/heads/" in remote HEAD check)
Fixed cache directory path sanitization to prevent . and .. from being used as path components (search for "z === \".\" || z === \"..\"")
Fixed cursor state display logic to properly update cursor state instead of only handling specific opposite-pair transitions (cursor state handling)
Fixed damage rectangle merging to properly expand bounds in all directions when new damage extends beyond existing bounds
Added -- argument separator in sed safety validation to prevent sed expression injection attacks (search for "aI9" — new sed expression extractor at line ~303347)
Fixed handling of broken symlinks during directory copy operations, now skips them with a warning (search for "copyDir: skipping broken symlink")
Fixed symlink escape detection during directory copy to prevent following symlinks outside the source tree (search for "copyDir: skipping symlink escaping source tree")