You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
Bash PermissionsArea: what it touches
ImprovementsKind: in v2.1.271,
ImprovementsSection of the release
What
The bash/zsh command-injection-safety analyzer now flags declare, typeset, and local when used with flags for nameref, integer, float, array, width-truncation, or case-conversion behavior as "too-complex", and also broadens export/readonly flag detection to include more flags beyond the previous set.
The zsh typeset/declare permission check that blocks silent auto-approval when eval-changing flags are present now also catches width-truncation/case-conversion flags and the -l/-u flags, not just the previous set, and applies the check per-argument instead of only to the first flag group.
Why
These flags can change how a variable is interpreted or displayed, so catching more of them closes gaps where a command could silently auto-approve when it shouldn't.
