cuthbertLab / music21

93%

master: 93%

LAST BUILD ON BRANCH fix/security/command-injection-via-subprocess-run-in-

branch: fix/security/command-injection-via-subprocess-run-in-

CHANGE BRANCH

x

Reset

• fix/security/command-injection-via-subprocess-run-in-
• 2025-jan-misc
• 5.0.3a1
• 9.6beta
• COC-clarify
• TimFelixBeyer-patch-1
• abc-cleanup
• activeSiteOnly_next
• add-memories
• addIdentificationToMetadata
• agents-post-pycon2026
• ai-contributions
• allow_finale_musicxml
• allow_wedges_to_pass_with_warning
• alphaDir
• anyNotLen
• approximation_error
• audioSearch_FreqHotfix
• aug6_scaledegree
• backport_v9
• braille-quote
• braille_updates
• branch_clean
• capitalize-python-docstrings
• change_half_diminished
• check_imports_before_tests
• chord-rotation-deque
• chord_getitem_simplify
• chord_symbol_rt
• chord_typehints
• chordify_preserve_pitches
• chordify_speed
• claude/ecstatic-sammet-0d61c2
• claude/elastic-maxwell-b4b3e0
• claude/pensive-lamport-d844ca
• claude/vibrant-keller-64c8ab
• cleanup-stream
• cleanup_braille
• cleanup_pre_6.3
• cleanup_roman
• clear-bools
• clear_eof
• code-style-ai
• codespace
• collect-metronomemark
• commonExpandFP
• configure
• configure_fixes
• corpusRefactor
• custom-word-separator
• deepcopyPickle
• define_cpus_early
• dependabot/uv/bleach-6.4.0
• dependabot/uv/cryptography-48.0.1
• dependabot/uv/idna-3.15
• dependabot/uv/jupyter-server-2.18.0
• dependabot/uv/jupyter-server-2.20.0
• dependabot/uv/jupyterlab-4.5.7
• dependabot/uv/jupyterlab-4.5.9
• dependabot/uv/mistune-3.2.1
• dependabot/uv/notebook-7.5.6
• dependabot/uv/tornado-6.5.6
• dependabot/uv/tornado-6.5.7
• dependabot/uv/urllib3-2.7.0
• dependabot/uv/uv-0.11.15
• deprecations-gone2
• deprecations_in_tests
• deriveByDegree
• dict-environment
• doctest_lints
• documentation
• dummy-pr
• edit
• efficient-roman
• elementTree
• expressions_fixes_and_repeat_finder
• faq_build_docs
• fb_1738
• fb_sentinels
• feat/midi-add-end-delay
• features_improve
• filepath
• filters_return_new_iterators
• fix-beams-4
• fix-copybutton
• fix-leading-zeros-after-equals
• fix-pyproject
• fix-roman-key-cache-mode
• fix-tremolo-tuplet-bracket
• fixNBConvert
• fixStreamShow
• fixTesting
• fix_articulation_typing
• fix_docs
• fix_flakey
• fix_midi_lints
• fix_musicxml_png_output
• fix_posixPath_metadata_bundles
• fix_prebase_id_repr
• fix_search_base
• github-uv
• github_CI
• github_coverage
• gitignore-clean
• grammar_misc
• graph3d-configuration
• gregc/badOctaveTranspose
• gregc/betterPedalMarks
• gregc/clefWithoutNumberIsNotInAllStaves
• gregc/forwardIsHiddenRestOnlyForFinale
• gregc/makeRestsShouldSplitThem
• gregc/moreAccurateSpannerStartStop
• gregc/musicXmlWriterFixes
• gregc/no_enclosure
• gregc/pedalmarks
• gregc/pendingSpannerAssignmentWithOffset
• happy-2026
• happy-new-year-2025
• humdrum-chord-duration
• humdrum-grace-notes
• humdrum-kern-regex
• humdrum-typing
• improve-lily-open-windows
• improve-upload
• init_refactor
• instrument-abbrev
• interval-transpose
• intervalRewrite
• ipython-project
• isTwelveTone-speed
• j-wolf-o
• jeremy9959-1791
• jtw/extend-duration-opFrac
• jtw/tuplet-follow-ups
• jtw/uncompress-logs
• lint_figured_bass
• lintfix
• linting_2019-07
• lyricSearcher
• m21-3
• m21-6.3-release
• m21-py-3.14
• m21-v10.5.0
• m21_2
• m21_3
• m21_3-alpha0
• m21_4
• m21_5
• m21_9_py3.14
• m21_9_wolf
• m21_v10_pre-release
• makeMeasures_trailing_zero_length
• marmio-support
• master
• measureRests
• metadata_primitives
• meter-reapply-memory
• meter-speed-2026
• mid-jupyter-instruments
• midi-try-two
• midi_refactor
• midi_translate_type_simplify
• midi_typing
• midi_typing_2
• midilyrics
• misc-spineParser
• more-deprecation-remove
• moreTimespans
• music21-v9.9
• musicxmlET
• mypy-1.16
• new-in-v-consistency
• new_finale_archives
• no-cover-defaultlist
• no-empty-exceptions
• no-requirements-dev
• no-symlink-license
• no-utf-8-marker
• no_repr
• nodeTreeMerge
• note_typos
• noteflight-bug
• notehash_with_reference
• num-dot
• numpy2
• offsetsInStream
• opfrac
• overzealous_style_xml
• patch-1
• pep8
• percussion-chord-docs
• piano_endings
• pickleStoreMetadata
• pitch_docs
• post-1905
• post_typing-common_3-12-cleanup
• pr-bend
• preview_location
• py312_typevar
• pygame-2.0
• pylint_raise_from
• pytest-compat
• pyupgrader-upgrades
• random-2025-10
• random-typing
• readthedocs-elsewhere
• refactor_serial
• rem_lgpl
• remove_json_freezer
• repeat_expander
• requirements_38
• retire_defaultlist
• romanTextFixes
• roman_vii07
• romantext_unprocessed
• rst-backticks
• search_lyricist
• sieve_typos
• small_spelling_changes
• sorttuple-3.12
• speedups
• splitCommon
• start-v10
• stream-iterator-improvements
• stream-metadata-midi-url
• stream-not-flat
• streamCore
• streamCoreNoDuration
• streamIter
• streamIterator
• stream_replace_recurse
• t.Self
• tab-typing
• test_lint
• test_pr
• test_py38
• transposePitch_reverse
• tree-examples
• tree-grammar
• trees
• tuple-int-fix
• type-core
• type-spans
• type_chord
• typed_sort_tuple
• typing_abc
• typing_capella
• typing_common
• typing_features
• typing_figuredbass
• typing_humdrum
• typing_misc
• typing_pitch
• typing_scale
• typing_search
• typing_small_folders
• typos
• underHood
• update-install-locations
• update-templates
• update_beethoven
• update_editorial_docs
• urop_meng_fixes
• use_ruff
• user-guide-typos
• usersGuide-text-corrections
• v.2.1.2
• v.2.2.1
• v.5.1.0
• v10.3
• v11
• v2.0.0
• v2.0.10
• v2.0.5
• v2.0.8
• v2.1.0
• v3.0.3-alpha
• v3.0.6-beta
• v3.1.0
• v4.0.4-beta
• v4.0.6-beta
• v4.1.0
• v5.0.3a1
• v5.0.5a2
• v5.0.6b1
• v5.3.0
• v5.5
• v5.7.0
• v5.7.1
• v5.7.2
• v6-near-push
• v6.1.0
• v6.3.0
• v6a1-release
• v6a3_try2
• v9.5
• v9.7
• v9.7-b
• v9.7.1
• version2
• version21
• vlq-defined
• worktree-claude+graph-typing
• worktree-ellipses
• worktree-explicit_cast
• worktree-no_311
• worktree-remove_vexflow
• worktree-type_midi
• worktree-v11-deprecation
• worktreeignore

Build # 28006202168

Build Type

Pull #1951

github

Committed by web-flow

Commit Message

Merge 4f13ef0aa into 1c36641fa

Pull Request Pull Request #1951: Security: Command Injection via subprocess.run in upload.py

Coverage Stats

81683 of 87713 relevant lines covered (93.13%)

0.93 hits per line