You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
0Signal: worth watching, 1 to 5
ElsewhereArea: what it touches
ImprovementsKind: in v2.1.223,
ImprovementsSection of the release
What
Diagnostics restored from a replayed attachment are now sanitized, so a malformed or crafted payload cannot reach the renderer.
Details
a new sanitizeDiagnosticFiles static drops non-array payloads and logs once per payload shape
file entries are dropped unless they have a string uri and an array of diagnostics; individual diagnostics are dropped unless they have a string message and numeric range start line and character
missing ranges are normalized, and the count of dropped files and diagnostics is logged once per payload
severity strings map through an explicit table (error, warning, info, information, hint), and getSeveritySymbol now uses Object.hasOwn and rejects non-string input, so a crafted severity cannot reach an inherited property
Evidence
Dropped a ${o} diagnostics files payload from a replayed attachment, diagnostics files payload from a replayed attachment
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
