This commit f6e54f7 introduces bug as it makes web server to respond 404 to urls matching

/.*entries.* /.*repository.* /.*root.* /.*tag.* /.*template.* /.*composer\.(json|lock).* 

Drupal can have urls cointaing this subword in other urls and I think this behaviour is not intended
Previous version of this file already prevent access to web.config, composer.lock and composer.json

Please correct it as it is official documentation