The Bash command analyzer now rejects printf invocations that could execute arbitrary code via format-string substitution: printf arguments containing $, \u/\U escapes, format specifiers paired with non-numeric runtime values, or any flag other than the literal -- are no longer auto-allowed.
For double-bracket arithmetic, the diagnostic now points out that bash may run $(cmd) while reusing [['s semantics: ' contains array subscript or runtime-determined value — bash evaluates $(cmd) in subscripts and ...' operand is non-numeric — \[[\ arithmetically evaluates identifiers/subscripts (may run $(cmd)).
A new escape-line-continuation rule replaces the older one to handle even-vs-odd backslashes correctly when deciding whether a backslash-newline pair is a real line continuation.
Bash analyzer (search for "contains array subscript or runtime-determined value" and "Delimiters-only string node contains unparsed command substitution").
Strings lifted out of the shipped bundle, so the claim above can be checked against them.