- Replace eval with getent passwd to prevent command injection
- Use glob array instead of parsing ls output for .deb detection
- Handle multiple .deb files by selecting the newest one
- Add fstab duplicate check to prevent duplicate entries on re-run
- Validate mount point (must be absolute path) and filesystem type
- Handle mount -a failure gracefully instead of killing the script
- Add set -o pipefail
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
