lgtm,codescanning
* The `js/tainted-path` query now recognizes the `cwd` option to shell invocations as a sink.