Chuck 5a1a095e16 fix(install): bound subprocess output and dedupe apt update in dependency installer ...

Address coderabbitai review on PR #369:
- _run() now streams combined stdout/stderr to a temp file and returns
  only the last ERROR_TAIL_LINES lines, instead of buffering full
  output in memory (Codacy also flagged the previous capture_output
  call as a subprocess-without-static-string security issue; the new
  call is annotated as safe since cmd is built from hardcoded args).
- `apt update` now runs once in main() instead of once per package
  needing an apt fallback.

2026-06-11 12:57:30 -04:00

8.0 KiB

Raw Blame History

View Raw