{"version":"2.1.219","anchor":"pr-review-anchor-repo-names-reject-and","canonical_anchor":"pr-review-anchor-repo-names-reject-and","heading":"PR-review anchor repo names reject \".\" and \"..\"","tier":"notice","area":"Code Review","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.219\/e\/pr-review-anchor-repo-names-reject-and","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.219","markdown":"### PR-review anchor repo names reject \".\" and \"..\"\n\nPR review artifacts now reject repository names like \".\" or \"..\" that could escape paths.\n\n**What**\n\nRepository names read back from published review artifacts could be `.` or `..`, a path-traversal risk; they are now rejected.\n\n**Details**\n\n- The regex used to validate PR review anchors and the review JSON schema changed from `\/^[A-Za-z0-9._-]{1,100}$\/` to a form with a leading negative lookahead\n- A repo named `.` or `..` now fails with \"anchor.repo is not a valid repository name\"\n\n**Evidence**\n\n`anchor.repo is not a valid repository name`\n\n- Area: Code Review\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 0\/5"}