Issues

• SC1028 false positive: grouping parens inside $(( )) inside [ ] (residual of #243)

  class:fprelease:7.5.0
  paiml/bashrs#454 · Filter by author noahgift opened on Oct 14, 2026

• bashrs pulls unsafe-libyaml (RUSTSEC-2024-0449) through its serde_yaml_ng build-dependency

  class:debtrelease:7.5.0
  paiml/bashrs#453 · Filter by author noahgift opened on Oct 13, 2026

• RUSTSEC-2024-0449 still reached via bashrs-oracle -> aprender 0.26.3 -> serde_yaml_ng -> unsafe-libyaml (cargo deny red on main)

  class:debtrelease:7.5.0
  paiml/bashrs#451 · Filter by author noahgift opened on Oct 13, 2026

• RUSTSEC-2024-0449: replace serde_yaml_ng (unsafe-libyaml) with pure-Rust serde-saphyr in rash build.rs

  class:debtrelease:7.5.0
  paiml/bashrs#450 · Filter by author noahgift opened on Oct 12, 2026

• bashrs build-depends on serde_yaml_ng → unsafe-libyaml (RUSTSEC-2024-0449) for every consumer; build.rs only reads a sibling-checkout file

  class:debtrelease:7.5.0
  paiml/bashrs#449 · Filter by author noahgift opened on Oct 12, 2026

• test_INSTALLER_CLI_007_keyring_list races keyring_init on the real $HOME keyring: red release-gate on the v7.4.2 cut

  class:cirelease:7.5.0
  paiml/bashrs#444 · Filter by author noahgift opened on Oct 10, 2026

• SC2180 false positive: jq index syntax inside single quotes is reported as a bash multidimensional array

  class:fprelease:7.5.0
  paiml/bashrs#440 · Filter by author noahgift opened on Oct 10, 2026

• SC2168 (and SC2151/SC2152) match the keyword anywhere in the line, not at command position (false errors in Makefile recipes)

  class:fprelease:7.5.0
  paiml/bashrs#438 · Filter by author noahgift opened on Oct 9, 2026
  1

• SC1066: pin the echo "... $p=$v ..." line that refused a forjar apply on 7.4.1 (fixed by #392, no fixture)

  class:fprelease:7.5.0
  paiml/bashrs#437 · Filter by author noahgift opened on Oct 8, 2026

• MAKE005 fires on a $(call) template, and its := advice empties every call

  class:fprelease:7.5.0
  paiml/bashrs#436 · Filter by author noahgift opened on Oct 7, 2026

• False positives: REL001 on rm inside a trap string; SC2297/SC2317 after '|| { …; exit; }'

  class:fprelease:7.5.0
  paiml/bashrs#435 · Filter by author noahgift opened on Oct 7, 2026

• BRS0009 false positive: a '>' inside a quoted string is counted as a stdout redirection

  class:fprelease:7.5.0
  paiml/bashrs#431 · Filter by author noahgift opened on Oct 6, 2026

• SEC012 variable-flow check: known misses (+=, mid-string, quoted ')', backtick curl, multi-line, source of a tainted var)

  class:fnrelease:7.5.0
  paiml/bashrs#429 · Filter by author noahgift opened on Oct 6, 2026

• bashrs nightly CI green

  epicrelease:7.5.0
  paiml/bashrs#426 · Filter by author noahgift opened on Oct 6, 2026

• Nightly Full Gate is red every night it runs: wasm latency budgets are measured on an opt-level 0 build

  class:cirelease:7.5.0
  paiml/bashrs#425 · Filter by author noahgift opened on Oct 5, 2026

• lint: ${var##*/} raises false SC1099 and SC2125 (prefix-strip operator read as a comment and a glob)

  class:fprelease:7.5.0
  paiml/bashrs#424 · Filter by author noahgift opened on Oct 5, 2026

• nightly: build the darwin legs on the self-hosted mac

  class:cirelease:7.5.0
  paiml/bashrs#421 · Filter by author noahgift opened on Oct 4, 2026

• make quality-gate cannot fail: the gate reads reports from a path the recipe does not write, in a schema pmat does not emit, passes a missing or unparseable report, and the recipe adds || true and an unconditional ✅

  class:cirelease:7.5.0
  paiml/bashrs#420 · Filter by author noahgift opened on Oct 4, 2026

• cargo install bashrs also installs quality-dashboard, quality-gate and rash-metrics; none handles --version, and quality-dashboard writes docs/quality-dashboard.md into the current directory

  class:enhancementrelease:7.5.0
  paiml/bashrs#419 · Filter by author noahgift opened on Oct 4, 2026

• keyring CLI tests run with the caller's HOME: cargo test rewrites the real ~/.config/bashrs/installer/keyring.json, and test_INSTALLER_CLI_007_keyring_init/_list race on it (EOF parse failure)

  class:cirelease:7.5.0
  paiml/bashrs#418 · Filter by author noahgift opened on Oct 4, 2026

• bashrs lint: BRS0012 (SC2117) and SC2317 report unreachable code after an exit/return that is here-document body text

  class:fprelease:7.5.0
  paiml/bashrs#417 · Filter by author noahgift opened on Oct 4, 2026

• SC2199 and SC2198 decide "array" from the variable name: they fire on scalars ending in s, and are silent on a real "${arr[@]}"

  class:fprelease:7.5.0
  paiml/bashrs#415 · Filter by author noahgift opened on Oct 4, 2026

• SC2053 false positive: brackets inside a single-quoted awk program are read as a [ ] test (the #244/#412 class, in a third rule)

  class:fprelease:7.5.0
  paiml/bashrs#414 · Filter by author noahgift opened on Oct 3, 2026

• SC1004 false positive: an apostrophe inside a double-quoted string makes a later line continuation "literal in single quotes" (the #235 class, in a second rule)

  class:fprelease:7.5.0
  paiml/bashrs#413 · Filter by author noahgift opened on Oct 3, 2026

• SC2136 false positive: 'if … do' inside a single-quoted argument is linted as shell

  class:fprelease:7.5.0
  paiml/bashrs#412 · Filter by author noahgift opened on Sep 30, 2026