You'll noticeTier: how much it should matter to you
3Useful: my rating, 1 to 5
0Signal: worth watching, 1 to 5
PermissionsArea: what it touches
ImprovementsKind: in v2.1.223,
ImprovementsSection of the release
What
The sanitizer behind command rendering in the approval path now defends against bidi spoofing and malformed text, not just control characters.
Details
the old char-by-char helper that replaced C0/C1 controls with U+FFFD was removed
the replacement iterates code points, drops emoji variation selectors entirely, and replaces control characters, bidi/isolate format controls and lone surrogates with U+FFFD
a final normalization step runs afterwards, with an optional extra pass
Evidence
\uFFFD
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
