Unrestricted shell escape for package automation versus restricted mode in CI pipelines
Context Modern LaTeX workflows often require unrestricted shell escape (–shell-escape) to support packages such as minted , epstopdf-auto , or latexmk ’s automatic dependency resolution. At the same time, continuous-integration pipelines and shared build servers must limit the attack surface of untrusted source files. Constraint TeX Live and MiKTeX ship with