Ensure unqualified program names are present on PATH before executing them.

[chrisgavin]

This avoids some potential issues when executing unqualified program names by using a custom library (which you can review here) to resolve them against the PATH variable first.

Merge / deployment checklist

• Confirm this change is backwards compatible with existing workflows.
• Confirm the readme has been updated if necessary.

[robertbrignull]

The new dependency looks fine (the code looks good, and we got confirmation that using your library is fine). The rest of the code changes are pretty minimal. I've also reproduced the vulnerability and then that using your branch fixes it.