You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
0Signal: worth watching, 1 to 5
Code ReviewArea: what it touches
Bug FixesKind: in v2.1.219,
Bug FixesSection of the release
What
Repository names read back from published review artifacts could be . or .., a path-traversal risk; they are now rejected.
Details
The regex used to validate PR review anchors and the review JSON schema changed from /^[A-Za-z0-9._-]{1,100}$/ to a form with a leading negative lookahead
A repo named . or .. now fails with "anchor.repo is not a valid repository name"
Evidence
anchor.repo is not a valid repository name
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
