You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
0Signal: worth watching, 1 to 5
Bash ToolArea: what it touches
ImprovementsKind: in v2.1.223,
ImprovementsSection of the release
What
Repository references passed to gh commands go through a new validator that checks each path segment against a conservative character class, so malformed or hostile-looking refs are rejected before a command is built.
Details
Each segment must match the allowed character class; segments starting with - are rejected outright, as are segments equal to . or ...
Applied when parsing both the owner/name and the host/owner/name forms.
Active for everyone, no gate.
Evidence
protocol.file.allow=never
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
