{"version":"2.1.117","anchor":"bug-fixes","canonical_anchor":"bug-fixes","heading":"","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.117\/e\/bug-fixes","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.117","markdown":"- Fixed git sha parameter injection by adding input validation that rejects sha values starting with \"-\" (search for `\"Invalid sha\"`)\n- Fixed git clone argument injection by adding `--` separator to prevent URL and ref arguments from being interpreted as flags (search for `\"A.push('--', H, $)\"`)\n- Fixed git remote HEAD reference validation to verify that detected references actually exist before using them (search for `\"refs\/heads\/\"` in remote HEAD check)\n- Fixed cache directory path sanitization to prevent `.` and `..` from being used as path components (search for `\"z === \\\".\\\" || z === \\\"..\\\"\"`)\n- Fixed cursor state display logic to properly update cursor state instead of only handling specific opposite-pair transitions (cursor state handling)\n- Fixed damage rectangle merging to properly expand bounds in all directions when new damage extends beyond existing bounds\n- Added `--` argument separator in `sed` safety validation to prevent sed expression injection attacks (search for `\"aI9\"` \u2014 new sed expression extractor at line ~303347)\n- Fixed handling of broken symlinks during directory copy operations, now skips them with a warning (search for `\"copyDir: skipping broken symlink\"`)\n- Fixed symlink escape detection during directory copy to prevent following symlinks outside the source tree (search for `\"copyDir: skipping symlink escaping source tree\"`)"}