You'll noticeTier: how much it should matter to you
3Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
WindowsArea: what it touches
New FeaturesKind: in v2.1.232,
New FeaturesSection of the release
What
Also on Windows only, a previously-approved command is bumped back to an approval prompt when its first word is a shell such as bash, sh, zsh, dash, ksh, mksh or busybox, because the security scan cannot see into the code that shell will run from a string. Over-long commands and commands packed with redirects are re-asked for the same reason.
Details
Message shown: This previously-approved command runs shell code from a string its security scan cannot see into; on Windows its writes cannot be checked for Cygwin symlink redirection and need human review.
New pattern matching pulls redirect targets (<, >, >>, &>, >|, >&) straight out of raw command text when the command could not be parsed into a syntax tree.
Existing interpreter sets still apply; the shell list above is new.
The cd-compound case gets its own separate explanation.
Evidence
This previously-approved command runs shell code from a string its security scan cannot see into; on Windows its writes cannot be checked for Cygwin symlink redirection and need human review.
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
