Skip to content

Fix NPM package URL template in cli-version-checker to prevent backtick injection #3359

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pelikhan merged 2 commits into from
Nov 6, 2025
Merged

Fix NPM package URL template in cli-version-checker to prevent backtick injection #3359

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d5dd859
Initial plan
Copilot Nov 6, 2025
15e309a
Fix NPM package URL template formatting in cli-version-checker
Copilot Nov 6, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion .github/workflows/cli-version-checker.lock.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

7 changes: 6 additions & 1 deletion .github/workflows/cli-version-checker.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,9 +94,14 @@ Include for each updated CLI:
- **Release Timeline**: dates and intervals
- **Changes**: Categorized as Breaking/Features/Fixes/Security/Performance
- **Impact Assessment**: Risk level, affected features, migration notes
- **Changelog Links**: NPM/GitHub release notes
- **Changelog Links**: Use plain URLs without backticks
- **CLI Changes**: New commands, flags, or removed features discovered via help

**URL Formatting Rules**:
- Use plain URLs: `https://www.npmjs.com/package/@package-name`
Copy link

Copilot AI Nov 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The example URL uses backticks around the URL, which contradicts the instruction 'Do NOT use backticks in URLs' on line 102. This should show the URL without any backticks to be consistent with the formatting rules being described.

Suggested change
- Use plain URLs: `https://www.npmjs.com/package/@package-name`
- Use plain URLs: https://www.npmjs.com/package/@package-name

Copilot uses AI. Check for mistakes.
- Do NOT use backticks in URLs
- Package names in URLs should not be wrapped in backticks

Template structure:
```
# Update [CLI Name]
Expand Down
Loading