security/flawfinder 2.0.19nb1 NetBSD

2.0.20 Fix unlikely vulnerabilities (involving malicious filenames/text in analyzed systems) and implement various improvements * Fix security vulnerabilities found by Gemini: - Terminal injection in standard output: apply strip_controls() to level and category in show(). - Terminal injection in CSV output: apply strip_controls() to all untrusted fields in show_csv() (category, name, warning, suggestion, note, context_text). - XML injection in SonarQube output: use quoteattr() for all XML attributes in output_sonar(). - Defense-in-depth: restrict setattr in Hit.__init__ to an allowlist of known keys used by rule definitions, countering pickle attacks. We previously warned to not load untrusted pickle files, but …