You'll noticeTier: how much it should matter to you
3Useful: my rating, 1 to 5
3Signal: worth watching, 1 to 5
SandboxArea: what it touches
ImprovementsKind: in v2.1.247,
ImprovementsSection of the release
What
When a denied path is a symlink chain, the sandbox now denies the directories crossed along the way, not just the final target. Applies to everyone; on Windows no hop set is computed.
Details
The walk is capped by a hop budget and stops on anything other than the expected missing-or-not-a-directory errors.
A new resolver handles dangling paths before the old parent-directory fallback.
Evidence
hopDirectories
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
