v2.6.18

Two secret-protection false positives are fixed: Python comments no longer change how inline code is read, and .env templates named by suffix are no longer blocked.

Fixed

• Fixed standard mode blocking inline Python whose # comment contains an apostrophe or a bracket, such as # don't follow links or # mark names (not contents). A Python comment is no longer read as code, so a name like .env used only as data stays allowed. Strict and paranoid modes still scan comment text for secret file names. (#285, #287)
• Fixed secret.pattern.env-variant blocking committed env templates named by suffix, such as .env.local.example, .env.production.sample, .env.local.template, and .env.staging.tpl. Any .env.* name ending in .example, .sample, .template, or .tpl is now treated as a template. A plain variant such as .env.local, a backup such as .env.local.example.bak, and a template inside a protected home directory such as ~/.ssh/.env.tpl stay protected. (#286, #288)