- Security: replace eval-based load_branches with nameref+readarray,
remove export MYSQL_PWD (leaks to child processes), fix URL-decode
via Python's urllib.parse, fix JSON injection in notify via json.dumps,
add package.json guard before sudo rm -rf
- Portability: replace seq (external) with repeat() built-in, add
mysql/mysqldump fallback alongside mariadb, add format_size() fallback
when numfmt is unavailable, remove -maxdepth from list_sorted helper
- Robustness: add set -o pipefail, fix spinner zombie (remove disown),
wrap git_update/detect_best_branch in subshells to prevent cd leaks,
capture full mvn/yarn build output to log instead of tail, add -r to
xargs basename, make ssl-verify-server-cert configurable via .env
- UX: add --dry-run/-n flag for preview without changes
openhands