TPTBusiness d83c020637 fix(security): replace shell=True subprocess calls with list args in env.py (B602) ...

Converted conda commands in _update_bin_path, _sync_conda_cache_with_real_envs,
_prepare_conda_env, and FTCondaEnv.prepare() to list args. Replaced pipe-based
grep with pure Python parsing. LocalEnv.Popen retains shell=True with nosec
since entry is an internal command string set by LocalEnvConf, not user input.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-04-30 19:26:29 +02:00

..

agent

feat: enable finetune llm (#1055)

2025-08-06 12:24:44 +08:00

blob

feat: add LLM-finetune scenario (#1314)

2026-03-02 19:04:10 +08:00

repo

refactor: Use file dictionaries for diff generation in feedback module (#574)

2025-02-10 09:03:13 +08:00

workflow

fix(loop): prevent step_idx advance on unhandled exceptions + fix consecutive assistant messages

2026-04-26 21:33:24 +02:00

__init__.py

fix(security): Patch 5 CodeQL path injection and weak hashing alerts (#25-#30)

2026-04-11 21:54:27 +02:00

env.py

fix(security): replace shell=True subprocess calls with list args in env.py (B602)

2026-04-30 19:26:29 +02:00

fmt.py

fix: fix the bug in the regular expression matching for stdout (#890)

2025-05-23 14:13:31 +08:00

prompts.yaml

fix: update fallback criterion (#1210)

2025-08-29 17:07:41 +08:00

qlib.py

feat: add a web UI server (#1345)

2026-03-18 14:04:52 +08:00