fix: sanitize subprocess call in install.py#12430

Open

orbisai0security wants to merge 794 commits into

mindsdb:developfrom

orbisai0security:fix-v-001-subprocess-command-injection-install

This pull request is big! We're only showing the most recent 250 commits

Commits on Feb 27, 2026

Commits on Mar 5, 2026

Commits on Mar 10, 2026

Commits on Mar 12, 2026

Commits on Mar 16, 2026

Commits on Mar 17, 2026

Fix wrong JSON exception type in Postgres subscribe path (#12254)
ianu82
authored

Commits on Mar 20, 2026

Commits on Mar 25, 2026

Bump picomatch in /docs
dependabot[bot]
authored

Commits on Mar 26, 2026

Update Elasticsearch handler: fix array support, add Data Catalog, and add to CI

richardokonicha
authored and
ea-rus
committed
Bump pyjwt from 2.10.1 to 2.12.0 in /requirements (#12293)

dependabot[bot]
authored and
ea-rus
committed
Bump nltk from 3.9.1 to 3.9.3 in /mindsdb/integrations/handlers/huggingface_handler (#12276)

dependabot[bot]
authored and
ea-rus
committed
Bump basic-ftp from 5.1.0 to 5.2.0 in /docs (#12247)

dependabot[bot]
authored and
ea-rus
committed
Bump protobuf from 4.25.8 to 5.29.6 in /mindsdb/integrations/handlers/lindorm_handler (#12201)

dependabot[bot]
authored and
ea-rus
committed
Bump ajv from 8.17.1 to 8.18.0 in /docs (#12240)

dependabot[bot]
authored and
ea-rus
committed
Fix BigQuery test (#12313)

StpMax
authored and
ea-rus
committed
Fix Postgres column stats UnboundLocalError on errors (#12253)

ianu82
authored and
ea-rus
committed
Fix DataBricks handler test (#12315)

StpMax
authored and
ea-rus
committed
fix
ea-rus
committed
Update strapi handler to support v5 (#11862)

committed
Rename icons for better naming consistency. (#12316)

ritwickrajmakhal
authored and
ea-rus
committed
chore: remove elasticsearch from HANDLERS_TO_INSTALL in unit test workflow

richardokonicha
authored and
ea-rus
committed
Bump werkzeug from 3.0.6 to 3.1.6 in /requirements (#12244)

dependabot[bot]
authored and
ea-rus
committed
Del unused callbacks (#12314)

StpMax
authored and
ea-rus
committed
Fix snowflake error message (#12312)
ea-rus
committed
Fix upload xlsx files (#12306)
ea-rus
committed
Faiss in CI and default vector db (#12265)
ea-rus
committed
fix: correct isinstance check for redirect_url in database endpoints (#12279)

jnMetaCode
authored and
ea-rus
committed
Remove litellm from CI (#12325)
ea-rus
committed
Check agent parameters (#12291)

ea-rus
and
martyna-mindsdb
committed
MCP server update (#12274)

StpMax
authored and
ea-rus
committed
Added CLA signers from the CLa branch

C1ARKGABLE
authored and
ea-rus
committed
Fix SQLQuery on_error step number handling (#12331)

StpMax
authored and
ea-rus
committed
Add hubpost oauth connection helper

tino097
authored and
ea-rus
committed
Update the oauth flow

tino097
authored and
ea-rus
committed
Update the authentication code flow

tino097
authored and
ea-rus
committed
Improve the oauth handling

tino097
authored and
ea-rus
committed
Fix: `check_connection` and enhance the authorization URL (#12298)

setohe0909
authored and
ea-rus
committed
FQE-2165 - Add an endpoint for extracting default vector stores (#12283)

setohe0909
authored and
ea-rus
committed
feat: Show all schemas by default in database tree view (#11234)

buallen
authored and
ea-rus
committed
Bump flask from 3.0.3 to 3.1.3 in /requirements (#12238)

authored and
ea-rus
committed
Docs - BYOM fix predict example (#12033)

committed
KB unit tests (#12321)
ea-rus
committed
ruff
ea-rus
committed

Commits on Mar 29, 2026

Change trigger branch from 'develop' to 'main' (#12131)

lucas-koontz
and
hamishfagg
authored

Commits on Mar 30, 2026

Commits on Mar 31, 2026

security(utilities): harden path traversal validation in safe_extract
Syeda-Anshrah-Gillani
committed

Commits on Apr 3, 2026

Commits on Apr 6, 2026

Commits on Apr 7, 2026

Fix security issues in deps (#12334)

hamishfagg
and
lucas-koontz
authored

Commits on Apr 8, 2026

docs: fix Ollama engine name from ollama_engine to ollama (#12362)
singhvishalkr
authored

Commits on Apr 13, 2026

Commits on Apr 15, 2026

Commits on Apr 16, 2026

Cleanup tests from other PRs (#12389)
tino097
authored

Commits on Apr 17, 2026

Commits on Apr 20, 2026

Cleanup docker bake (#12395)
tino097
authored

Commits on Apr 21, 2026

fix mcp oauth in docker (#12397)
StpMax
authored

Commits on Apr 22, 2026

Commits on Apr 23, 2026

Release 26.1.0 (#12249)
StpMax
authored

Commits on Apr 28, 2026

Release 26.2.0 (#12402)

authored

Commits on Apr 29, 2026

Fixes missing permissions in staging workflow (#12418)
lucas-koontz
authored

Commits on Apr 30, 2026

Commits on May 6, 2026

fix: V-001 security vulnerability
orbisai0security
committed