serve_dir stripped '..' and leading slashes but could still be steered
outside the dist folder ('/..//etc/passwd' left '//etc/passwd', which
join treats as absolute); it now keeps only normal path components. Each
connection's thread blocked forever on a silent client and thread creation
failure panicked; reads now time out and a failed spawn drops the
connection. import-cert.sh wrote the signing bundle to a predictable path
that another user could pre-create; mktemp makes it new and private. The
audio probe test trusted a predictable, possibly pre-existing scratch dir
for executables on PATH; it now creates a fresh private one. Ease Presets
looked up each loaded preset name in the whole list (quadratic); a name
set replaces it.
CodeRabbit and FredApps both flagged that the preflight probed only the plain
PKG_CONFIG variable, while the pkg-config crate alsa-sys pins resolves the
target-scoped variants first and falls back pkg-config -> pkgconf; on a host
with only pkgconf the ci stage failed a build that would succeed. The probe
now goes through the same crate (0.3.34, already pinned via alsa-sys), so the
semantics match by construction, and a probe that ran but said no stays
distinct from one that could not run.
Also from review: audio_backend_hint is gated to Linux (bflatastic: dead code
on Windows/macOS under -D warnings), the fake-tool regression runs the real
xtask audio-backend task in a child process with a controlled environment
(pkgconf-only host, a probe that says no, one that cannot run, a HOST_PKG_CONFIG
override), the rerun-if-env lines stay out of the ci log, and CONTRIBUTING.md
asks for a usable alsa.pc and runtime library rather than development headers.
Dylan M. Taylor