v2.19.0

Minor Changes

• 96673d0 Thanks @tufantunc! - fix(policy): harden the built-in never-allowed rules

Security

• Fixed GHSA-rrxj-hcj2-vwm6: the never-allowed write paths (/etc/cron, /etc/systemd, any user's authorized_keys) are now refused for the SFTP upload tools' remote path, the target of a shell redirect, and the destinations of tee, cp, mv, install and dd of=, in any spelling the path readings resolve. Affected: < 2.19.0.