Under the hood
URLs shown in logs now have most query-string values redacted
What
A new helper redacts the query string of any URL before it's logged or displayed: it keeps the path, but replaces the value of each query parameter with ***, unless the parameter's name is on an allowed list (ref, branch, tag, path, file, file_path, version, format) and its value looks like a safe, path-like string.
Why
This reduces the chance that sensitive data passed in a URL's query string (like tokens or identifiers) ends up exposed in logs, while still keeping harmless, useful values like a git ref or file path visible for debugging.