[cwhite911]

Fixes the 14 Bandit B307 (eval) code scanning alerts in non-vendored code. All flagged inputs are local (GRASS-shipped XML, parser tokens, model files), so this is a code quality cleanup rather than a vulnerability fix; eval is simply unnecessary at most of these sites.

• grass.temporal (temporal_algebra.py, 9 alerts): eval_datetime_str() evaluated eval(str(a < b)) for each operator, which round-trips a bool through a string; it now compares directly. The td(A) == 1 and start_day() > 5 style comparisons built Python source by string concatenation and eval'd it; they now call the same comparison helper with float(value). The one remaining eval (boolean expression string assembled from isinstance(x, bool)-checked values and grammar tokens) is documented and marked # nosec B307.
• wxGUI: menutree.py resolved <id> menu XML entries with eval("wx." + text), now getattr(wx, text) (verified: every <id> in the shipped menu XMLs resolves); gui_core/menu.py resolved menu handlers with eval, now getattr (all <handler> entries in the shipped XMLs are plain attribute names), which also removes the one pre-existing # nosec B307. The gmodeler loop-condition eval stays (a model's loop expression is authored by the model creator; evaluating it is equivalent to running the model) and is now documented and suppressed.
• i.tasscap: dispatched calc1bands<N> via eval of a formatted call string, now a globals() lookup with a normal call.

Verification: the three temporal algebra testsuites (unittests_temporal_algebra.py, unittests_temporal_raster_algebra.py, unittests_temporal_vector_algebra.py) pass against nc_spm; i.tasscap runs end-to-end on synthetic bands; bandit 1.9.4 reports no B307 findings in the touched files.

This is part of a larger effort to work through the open code scanning alerts, grouped into small PRs by issue type.

Written with the assistance of Claude Code.

[wenzeslaus]

The temporal expressions require further care and I didn't have time to explore it more fully before. The tests are still critical, but there are other issues which surfaced when I co-reviewed that with AI. See the individual comments.

[cwhite911]

Addressed in the latest push:

• Rename + alias: eval_datetime_str -> compare_values(self, left, comp, right), with eval_datetime_str kept as a .. deprecated:: 8.6.0 alias delegating to it. Added an explicit raise ValueError("Unknown comparison operator: ...") so an unrecognized operator no longer falls through to UnboundLocalError.
• Dropped the float() (and the str() round-trip): both call sites now pass the value through unchanged. t_INT/t_FLOAT already yield real int/float, so start_year(A) == 2001 and A # B == 2 stay integer-exact, matching the old eval semantics and leaving room for the t_var comp_op t_var direction in the TODO. In eval_global_var the two branches now converge on a single compare_values(...) call after the date conversion.
• Coverage / !=: added python/grass/temporal/tests/temporal_algebra_compare_values_test.py, asserting all six operators against int, float, and date values (equal and unequal), the int-exactness, and the unknown-operator raise. It builds the parser via __new__ (no DB connection needed since compare_values uses no instance state), so it stays a fast unit test. This makes the != branch observable.
• menu.py lstrip: switched to str.removeprefix("self.").
• # nosec at build_...: guarded the seed leftbool with an isinstance(..., bool) check that raises otherwise, so the "only booleans are evaluated" justification is now enforced rather than asserted, and updated the comment to match.

The except in the td/# handler dropped ValueError (no more float() to raise it) and keeps IndexError, AttributeError, TypeError.

[cwhite911]

@wenzeslaus take another look at this when you get a chance. I would like to merge or close these automated codeQL so I don't have so many open PRs.