Upgrade to v1.0.12

[EXLOUD]

[1.0.12] — 2026-03-05

Fixed

• Stylesheet parse errors — RefinedDivider, QTextEdit, QScrollArea, and
  hover-state widgets emitted Qt warnings Could not parse stylesheet.
  Root cause: closing }} in plain (non-f) string literals was passed literally to
  the CSS parser instead of being collapsed to }.
  Fixed 7 occurrences across RefinedDivider.__init__, _create_log_panel,
  RefinedFolderDialog.__init__, and on_file_item_hover.

Security

• B314 (Medium) — XML injection — replaced import xml.etree.ElementTree as ET
  with import defusedxml.ElementTree as ET across all XML parsing calls
  (TranslationManager.load_language, get_language_name_from_xml).
  The standard library parser is vulnerable to Billion Laughs and XXE attacks
  (CWE-20); defusedxml mitigates both.
• B110 (Low) × 3 — Silent exception suppression — replaced bare except: pass
  blocks with explicit error handling:
  • get_language_name_from_xml — prints a warning with filename and exception message
  • UniversalPEPatcher.patch_all IAT fallthrough — emits log_iat_parse_failed via
    log_emitter
  • FileProcessorWorker.run PE metadata read — prints a warning with exception message

Code Quality

• too-many-lines — added module-level disable (2 400-line single-file GUI is an
  accepted constraint)
• attribute-defined-outside-init × 27 — pre-declared all 27 PEPatcherGUI UI
  attributes as None in __init__ before setup_ui() call
• redefined-outer-name × 8 — renamed shadowing parameters:
  lang_code → language_code / file_lang_code / selected_code,
  show_dialog → show_again, translator → tr
• too-many-nested-blocks — extracted IAT scanning logic from patch_all into two
  helpers: _apply_iat_replacements() and _scan_iat_entries(), reducing nesting from
  9 to ≤ 5 levels
• invalid-name × 4 — added method-level disables for Qt-mandated camelCase event
  overrides (mousePressEvent, mouseMoveEvent, mouseReleaseEvent, closeEvent)
• too-few-public-methods × 6 — added class-level disables for intentionally minimal
  Qt signal/widget subclasses (PatcherLogEmitter, FileProcessorWorker,
  RefinedContainer, RefinedSplitter, RefinedDivider, AboutDialog)
• too-many-instance-attributes × 3 — added class-level disables for
  SwipeableFileItem, RefinedFolderDialog, PEPatcherGUI
• too-many-* (statements/locals/branches) × 7 — added method-level disables for
  patch_all, PatcherWorker.run, LanguageDialog.__init__,
  SwipeableFileItem.__init__, RefinedFolderDialog.__init__, setup_ui,
  _create_settings_panel, AboutDialog.setup_ui, patching_done
• too-many-public-methods — added class-level disable for PEPatcherGUI
• c-extension-no-member — added inline disable for lief.PE.MACHINE_TYPES.AMD64
• line-too-long (CSS block) — wrapped REFINED_STYLESHEET with
  pylint: disable/enable=line-too-long; added inline disable for Monero address
  (hash is immutable)
• wrong-import-order — moved glob before third-party imports; moved defusedxml
  into the third-party block alongside lief
• missing-final-newline — added trailing newline at EOF

Dependencies

• Added defusedxml to requirements.txt

Tooling

• Added run.sh — Unix equivalent of run.bat: creates venv, installs dependencies,
  launches main.py