All pull requests

Pull requests

• chore(deps): update github-actions

  dependencies
  #306·27b-renovate-bot[bot] opened Oct 29, 2026Bot·1 task·

  ·
  2

  

• ci: bump the github-actions group across 1 directory with 6 updates

  dependenciesgithub_actions
  #305·dependabot[bot] opened Oct 16, 2026Bot·

  ·
  2

• chore(deps): update dependency pytest to v9 [security]

  dependenciessecurity
  #299·27b-renovate-bot[bot] opened Sep 28, 2026Bot·1 task·

  ·
  2

  

• fix(validator): validate an unquoted shell heredoc body as the program bash runs (LAB-4801)

  #298·27Bslash6 opened Sep 27, 2026Collaborator·

  ·
  2

• fix(parser): walk substitutions inside ${…} bodies with the top-level checks (LAB-4846)

  #297·27Bslash6 opened Sep 27, 2026Collaborator·

  ·
  2

• fix(validator): refuse an unreadable interpreter heredoc and read a CRLF quoted one (LAB-4588)

  #296·27Bslash6 opened Sep 27, 2026Collaborator·

  ·
  2

• fix(substitution): an assignment-only substitution runs no program (LAB-5649)

  #295·27Bslash6 opened Sep 27, 2026Collaborator·

  ·
  2

• fix(rules): rate glued truncating redirects as file_truncation (LAB-5564)

  #291·27Bslash6 opened Sep 27, 2026Collaborator·

  ·
  3

• fix(validator): rate awk system() outside BEGIN as HIGH (LAB-5804)

  #290·27Bslash6 opened Sep 27, 2026Collaborator·

  ·
  2

• fix(validator): refuse a heredoc whose terminator ShellCheck cannot see (LAB-5815)

  #289·27Bslash6 opened Sep 27, 2026Collaborator·

  ·
  2

• fix(parser): stop quoting the command in parse-error denies and logs (LAB-5733)

  #285·27Bslash6 opened Sep 27, 2026Collaborator·

  ·
  2

• fix(git): block --exec-path=DIR global option at both tiers (LAB-5731)

  #284·27Bslash6 opened Sep 27, 2026Collaborator·

  ·
  8

• fix(rules): rate the pass clip flag only as a whole word (LAB-5794)

  #282·27Bslash6 opened Sep 27, 2026Collaborator·

  ·
  2

• feat(tests): sandboxed bash oracle for candidate commands (LAB-5765)

  #280·27Bslash6 opened Sep 27, 2026Collaborator·

  ·
  8

• chore(main): release schlock 0.9.6

  autorelease: pending
  #278·27b-release-please[bot] opened Sep 27, 2026Bot·

  ·
  2

• fix(validator): deny past the quoted-substitution body budget inline (LAB-5359)

  #276·27Bslash6 opened Sep 27, 2026Collaborator·

  ·
  2

• ci(security): scan with the pinned gitleaks CLI and load its default rules (LAB-5028)

  #274·27Bslash6 opened Sep 27, 2026Collaborator·

  ·
  2

• test(parser): un-shadow the parse-budget tests and correct the two-timer comments (LAB-5688)

  #273·27Bslash6 opened Sep 27, 2026Collaborator·

  ·
  2

• fix(rules): rate find write flags aimed at sensitive paths (LAB-4258)

  #270·27Bslash6 opened Sep 27, 2026Collaborator·8 tasks done·

  ·
  2

• fix(substitution): deny a process substitution used as a shell's script (LAB-4808)

  #269·27Bslash6 opened Sep 26, 2026Collaborator·

  ·
  2

• fix(validator): read a heredoc body joined as bash reads it, and refuse a split $' (LAB-5318)

  #266·27Bslash6 opened Sep 26, 2026Collaborator·

  ·
  1

• fix(substitution): deny substitutions nested past the depth cap (LAB-5653)

  #263·27Bslash6 opened Sep 26, 2026Collaborator·

  ·
  3

• test(native-bridge): fake binary reads stdin before acting (LAB-5655)

  #262·27Bslash6 opened Sep 26, 2026Collaborator·

  ·
  3

• fix(validator): rate the git config keys that persisting arms (LAB-4282)

  #256·27Bslash6 opened Sep 26, 2026Collaborator·

  ·
  2

• fix(substitution): match git config keys case-insensitively and across subsections (LAB-4283)

  #255·27Bslash6 opened Sep 26, 2026Collaborator·

  ·
  2