What probably matters to youSection of the release
What
The matcher that decides whether a file path matches a read or write permission rule has been restructured. Rules are now grouped by their root path and by which "source" (layer) they came from, and a negated pattern (one starting with !) is now tracked and removed from earlier layers rather than just being another pattern. A bare ! pattern on its own is now specifically recognized and logged as "a negation of every path." Path lookups also gained an option to match targets case-insensitively.
Why
This makes it possible to actually negate a previously granted permission pattern, including blanket-negating everything with !, and layers rules by where they came from so negations apply correctly across sources.
