upgrading-dbt-core

This module does not show clear embedded malware behaviors (no backdoor/exfiltration/obfuscated payloads). The dominant security concern is supply-chain and execution risk: it downloads and executes dbt-autofix at runtime via uvx using a git+https source, and it may provision/install dbt-core and adapter dependencies via uv pip install without observable immutable pinning here. It also writes hardcoded database credentials to a temporary profiles.yml for parsing. Treat as a potentially risky automation tool in strict environments and apply pinning/allowlisting and least-privilege controls.