…ion)

_module_comgen_words_and_files() fed untrusted text (module names read
off disk, LOADEDMODULES, MODULEPATH) straight into `compgen -W`, which
performs a full unquoted-word expansion on its wordlist -- including
command substitution -- as a normal, documented part of its behavior.
A module name, loaded-module entry, or MODULEPATH component containing
e.g. `$(...)` therefore ran arbitrary shell code the moment a user
pressed Tab.

Fix: never hand candidate text to `compgen -W`. The new
_module_comgen_words() splits the candidate list with `read -r -d ''`
(pure IFS word-splitting, no expansion of any kind) and does the
prefix match itself; _module_comgen_words_and_files() now layers the
nospace-for-directory-entries behavior on top of it. Every call site
that previously built a compgen -W wordlist from LOADEDMODULES,
MODULEPATH, or a stash/save collection name now goes through one of
these two functions instead.

Fixes CVE-2026-85013

Assisted-by: Claude:claude-sonnet-5
Signed-off-by: Xavier Delaruelle <xavier.delaruelle@cea.fr>

Update gitlog2changelog.py script with recent changes made on it in its
upstream repository (https://github.com/networkupstools/nut/, commit
e4739b9).

Keep our local adaptation:
* TextWrapper specific configuration

Signed-off-by: Xavier Delaruelle <xavier.delaruelle@cea.fr>

Signed-off-by: Xavier Delaruelle <xavier.delaruelle@cea.fr>