Security patches a Bash permission bypass via prefix matching; large-prompt input lag is gone; VS Code extension gets its first update in over 10 releases.