You'll noticeTier: how much it should matter to you
3Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
SandboxArea: what it touches
ImprovementsKind: in v2.1.224,
ImprovementsSection of the release
What
The sandbox's forwarding of AWS credentials via credentials.awsPairs now resolves conflicts predictably and warns about risky setups. Later entries override earlier ones with the same target, each environment variable can fill only one slot, and the losing slot is disabled with a placeholder rather than silently taking the wrong value.
Details
Deliberately empty "suppressor" entries are preserved so they keep implicit AWS auto-pairing switched off.
Pairs whose key id or secret are not masked as whole values are either dropped or forwarded with a warning.
New warning when SigV4 re-signing is configured without injectHosts, because the real secret is then in scope at every entry in network.allowedDomains.
New warning when a session token belonging to a forwarded pair is not itself forwarded.
Evidence
SigV4 re-signing with the real secret is in scope at EVERY host in network.allowedDomains
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
