Bash command deny-rule checking now unions prefix variants and, when a deny target is passed, expands the check set with additional command variants, broadening what a single deny rule can catch. The scan only runs at all when the tool has deny rules configured, narrowing when the check runs.
Dangerous rm/deny-rule matching now also checks additional command variants
Bash deny rules now match more command variants, and the scan only runs when deny rules are configured.
You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
PermissionsArea: what it touches
ImprovementsKind: in v2.1.257,
ImprovementsSection of the release