Andrew

yash: Traps do not persist across subshells.

lksh: Unknown trap, subshell support. Predates bash. Implementation retrofitted using mksh. No interactive support. Traps do not persist across subshell boundaries.

fish, ion, PowerShell: Lack of scoped subshells, although command interpolated incidental subshells may be available. Traps may not persist across interpolated incidental subshell boundaries. ion appears to lack traps for...

Note also that the ERR is not a POSIX signal for use when configuring traps. https://www.shellcheck.net/wiki/SC3047

Note that interpolated strings (both dollar paren and backtick) introduce subshells, but not arithmetic expressions.

Note that a pipe also creates a subshell. Unknown whether the three operators `;`, `&&` and/or `||` technically create subshells or not. Ditching checking for subshells entirely. A modern shell...

Reopening. Plan to mark all classic POSIX traps as risky due to implicit reset behavior.

direnv does this with `direnv allow`, and has no issue with silently ignoring file changes. Also, direnv loudly complains when there is an untrusted configuration file in the search path.

Raw JAR files are named inconsistently, and their contents are inconsistent as well. However, you could reasonably check hashes of the archive against hashes of vulnerable version artifacts.

ripgrep has too many, confusing mechanisms to manage exclusion patterns.