Snider bf1f8e51ad fix: Codex review round 2 — path traversal, shutdown order, races ... High: - embed.Extract: safePath validates all rendered paths stay under targetDir - embed.path: reject .. traversal on arbitrary fs.FS - ServiceShutdown: drain background tasks BEFORE stopping services Medium: - cli.Run: command lookup holds registry RLock (race fix) - NewWithFactories: propagate factory/registration failures Co-Authored-By: Virgil <virgil@lethean.io>		2026-03-20 17:35:09 +00:00
..
core	fix: Codex review round 2 — path traversal, shutdown order, races	2026-03-20 17:35:09 +00:00