You'll noticeTier: how much it should matter to you
3Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
SandboxArea: what it touches
Internal ChangesKind: in v2.1.224,
Internal ChangesSection of the release
What
On Linux, sandbox write paths have trailing slashes stripped before binding, with a bare / preserved, and allowed write paths are matched against both their literal and fully resolved forms so symlinked directories are shadowed consistently.
Details
Applies to the bubblewrap sandbox only.
The path lists, including directories considered for read-denial, are now computed on demand rather than upfront.
Evidence
allowedWritePathsBothForms
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
