Updates CHANGELOG to enhance description of optional avatar URL template for custom remotes, detailing security measures and user approval process.

(#5155)

Author: sergeibbb

CHANGELOG.md

@@ -7,7 +7,7 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/) and this p
 ## [Unreleased]
 
 ### Added
-- Adds an optional `avatar` URL template to custom remotes in the `gitlens.remotes` setting — enables corporate and self-hosted setups to resolve commit-author avatars via a templated URL with `${email}`, `${name}`, `${domain}`, and `${size}` tokens ([#302](https://github.com/gitkraken/vscode-gitlens/issues/302)) — thanks to [PR #1636](https://github.com/gitkraken/vscode-gitlens/pull/1636) by Tmk ([@tmkx](https://github.com/tmkx))
+- Adds an optional `avatar` URL template to custom remotes in the `gitlens.remotes` setting — enables corporate and self-hosted setups to resolve commit-author avatars via a templated URL with `${email}`, `${emailName}`, `${domain}`, and `${size}` tokens; identity values are component-encoded before interpolation to keep attacker-controllable commit emails from injecting URL-structural characters, and templates configured via workspace settings require explicit user approval on first use in a trusted workspace (revocable via _GitLens: Reset > Approved Avatar URL Templates..._) ([#302](https://github.com/gitkraken/vscode-gitlens/issues/302), [#5155](https://github.com/gitkraken/vscode-gitlens/pull/5155)) — thanks to [PR #1636](https://github.com/gitkraken/vscode-gitlens/pull/1636) by Tmk ([@tmkx](https://github.com/tmkx))
 
 ## [18.0.0] - 2026-05-27