You'll notice
URLs containing a username or password, like user:pass@host, are now rejected during normalization
What
A URL-handling function that previously accepted any http or https URL now rejects URLs that embed a username or password, such as user:pass@host. Instead of processing the URL, it returns nothing.
Why
URLs with embedded credentials can leak sensitive information or be used to disguise the real destination of a link. Rejecting them closes off that risk.