Under the hoodTier: how much it should matter to you
2Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
ArtifactsArea: what it touches
ImprovementsKind: in v2.1.234,
ImprovementsSection of the release
What
The scanners that look for script tags in artifact pages, both in-page and in the CLI, were reworked as a matching pair so hand-crafted markup can no longer slip past them.
Details
A comment-open followed by a script-open, which would leave the HTML tokenizer in an escaped state, is now refused outright.
Tag-end scanning walks attributes, so a > inside a quoted attribute value no longer looks like the end of the tag.
Whitespace skipping uses only the five ASCII whitespace bytes HTML defines, instead of JavaScript's broader String.trim().
Evidence
KEEP-IN-SYNC: goCp isFrameAssetInjection
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
