fix: reject package/image names starting with '-' to prevent argument injection (#23070)#23045

Merged

pelikhan merged 3 commits intomainfrom

copilot/fix-package-validation-injection

Mar 26, 2026

Commits on Mar 26, 2026

fix: reject package/image names starting with '-' to prevent argument injection

Copilot
and
pelikhan
authored
fix: consistent error message format for pip argument injection guard

Copilot
and
pelikhan
authored
test: add argument injection prevention tests

Copilot
and
pelikhan
authored