Major bump: improved security & POSIX compatiblity

Eval is not used anymore so no 'user' code is ever ran (except in pre-post scripts).
POSIX compatibility: tested in dash, zsh and bash