You'll noticeTier: how much it should matter to you
1Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
Artifacts DBArea: what it touches
ImprovementsKind: in v2.1.268,
ImprovementsSection of the release
What
The field parameter used by write_db's str_replace operation used to be validated with a simple regular expression. It's now checked against an explicit length bound of 1 to 200 bytes plus a named rule: the field must name a single top-level key, with no dots, slashes, brackets, quotes, backslashes, control characters, or invisible formatting characters, and it can't be the reserved __name__ key.
Why
This closes off ways a malformed or crafted field value could reference something other than a simple top-level key, such as by using path-like separators or hidden characters.
