rizsotto/Bear 4.1.4 on GitHub

What's Changed

Intercept pclose (#698). pclose is now in the exported symbol list, so the popen/pclose pair is intercepted as a unit. Fixes the hardened_popen_after_unsetenv test on FreeBSD.
Report nested exec* on musl / s390x (#705). Bear now intercepts musl's __execvpe, so commands launched by a nested exec are captured on musl-based systems (observed on linux/s390x).
Do not lose the last compile on collector shutdown (#704). The TCP collector now drains its backlog on shutdown instead of racing the final event, so the last compilation is no longer dropped (observed on linux/s390x).
Use sh instead of bash (#703). Build and test scripting no longer assumes bash; the project targets POSIX sh. This unblocks environments where bash is absent.

Drop the bash dependency project-wide: test fixtures, the Dockerfile pipe, the coverage check, and documentation code fences all moved from bash to POSIX sh.
Refresh workspace dependency constraints for the release. Each declared floor stays at-or-below what Fedora rawhide ships, so packagers need no substitution patches: clap/clap_complete 4.5 -> 4.6, tempfile 3.19 -> 3.27, assert_cmd 2.0 -> 2.2 (dev-dep), and serde-saphyr 0.0.24 -> 0.0.27 (upstream patch fixes; the crate is not packaged in Fedora). insta is deliberately held at 1.46 because rawhide does not yet carry 1.47.
Bump the devcontainer base image to Fedora 44.
Add regression guards for precompiled-header source recognition (#601), --append performance on large databases (#532), and non-UTF-8 argv interception (#506).
Issue/PR tooling: add labels.yml as the source of truth for labels, convert the bug report to a structured issue form, disable blank issues, and link Discussions from the issue picker.

Document the libsandbox env-clear preload conflict as a known limitation (#699, #675). When Bear's suite runs inside a sandbox (e.g. Gentoo's emerge), libsandbox.so strips Bear's library from LD_PRELOAD after an env -i, so the env-clear tests are not intercepted. This is not a Bear defect; the packaging-side fix is RESTRICT="test" or FEATURES="-sandbox -usersandbox".
New requirement proposals: @file response-file inlining (#701), an events file as an external interchange format (#644), and C++20 module recognition (#637).
Spell out the three-place sync required when adding a new intercept in intercept-preload.

#705 - LD_PRELOAD does not report nested exec* on musl linux/s390x
#704 - source_directory_filter_config loses last compile on linux/s390x (TCP collector shutdown race)
#702 - ld.so: object '/usr/$LIB/bear/libexec.so' from LD_PRELOAD cannot be preloaded
#699 - some tests are failing (documented as a sandbox/libsandbox limitation, not a Bear defect)

Full Changelog: 4.1.3...4.1.4