You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
Admin SettingsArea: what it touches
ImprovementsKind: in v2.1.260,
ImprovementsSection of the release
A new urlWithSchemeCoercion refinement rejects URLs whose authority contains userinfo (user:pass@) or a backslash, replacing the old bare .url() check. Managed config settings that take a URL now fail validation with the message URL must not contain credentials or a backslash in the authority instead of silently accepting a credentialed or spoofable URL.
