- Glob patterns are now expanded for deny paths on Linux
- Better handling of symlink-based deny path attacks (mounts
/dev/null) - Cleanup of bwrap mount points after sandbox teardown
- More nuanced logging for skipped deny paths
Evidence
Linux sandbox improvements (search for "Cleaned up bwrap mount point", "Expanded glob pattern", "Mounted /dev/null")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.