music21 v10.5.2

Security release. These problems affect v10.5.1 and every earlier version of music21; only v10 gets the fix, so everyone should upgrade to 10.5.2 (pip install --upgrade music21, Python 3.11 or newer) or the latest v11 master branch (which is g

• On shared Unix machines, another user could plant files in music21's temp/cache folder or settings file and run code as you. music21 now uses only a temp folder you own that no one else can write to. (Linux and other Unixes have never been officially supported, and problems like these are exactly why, but many, many users run music21 on them.)
• Titles and lyrics written to LilyPond are now fully escaped, and LilyPond is run without a shell.
• Clercq-Temperley text passed to parseData() is no longer opened as a file path.
• converter.parse() no longer reads a file from data such as 'tinyNotation: ...' that contains /.. segments (#2109).

Behavior changes:

• On Unix accounts without a writable home folder (common for web servers), settings are kept in the private music21 temp folder. Settings saved earlier to /tmp/.music21rc are no longer read. Check your existing file for vulnerabilities and recreate it at the path shown by music21.environment.Environment().getSettingsPath() (normally /tmp/music21/.music21rc or /tmp/music21-userid-<uid>/.music21rc).
• common.cleanpath() no longer collapses .. after a folder that does not exist.
• ConverterClercqTemperley.parseData() raises on strings that are not Clercq-Temperley data; use converter.parse(path) for files.

Details: GHSA-hg64-r575-qhjj

Full Changelog: v10.5.1...v10.5.2