You'll notice
No documentation found
Managed config URLs with embedded credentials or backslashes are now rejected.
A new urlWithSchemeCoercion refinement rejects URLs whose authority contains userinfo (user:pass@) or a backslash, replacing the old bare .url() check. Managed config settings that take a URL now fail validation with the message URL must not contain credentials or a backslash in the authority instead of silently accepting a credentialed or spoofable URL.
Names in the bundleurlWithSchemeCoercion