fix(version): Extract shared validation and fix generated formatting#375
fix(version): Extract shared validation and fix generated formatting#375cameroncooke wants to merge 1 commit intomainfrom
Conversation
Extract VERSION_REGEX and validateVersion into a shared module used by the generator and validation tests, so regex updates only happen in one place. Switch generated src/version.ts literals back to single quotes to align with Prettier and remove the eslint ignore carve-out for that generated file. Fixes #368 Fixes #369 Co-Authored-By: OpenAI Codex <codex@openai.com>
commit: |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit beb6e1b. Configure here.
| `export const macOSTemplateVersion = '${pkg.macOSTemplateVersion}';\n` + | ||
| `export const packageName = '${pkg.name}';\n` + | ||
| `export const repositoryOwner = '${repo.owner}';\n` + | ||
| `export const repositoryName = '${repo.name}';\n`; |
There was a problem hiding this comment.
Unescaped interpolation of unvalidated values into generated code
Medium Severity
The switch from JSON.stringify(...) to single-quote template literal interpolation removes escaping for pkg.name, repo.owner, and repo.name — none of which are validated by validateVersion(). If any of these values contain a single quote, backslash, or other special character, the generated src/version.ts would contain broken or injectable TypeScript. The prior JSON.stringify defense-in-depth was deliberate and its corresponding tests have also been removed.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit beb6e1b. Configure here.
1 participant
Extract the version regex and validation into a shared module, then reuse it from both the version generator script and its validation test.
This removes duplicate semver validation logic that previously had to be kept in sync manually, and it closes the follow-up maintainability gap left after #289.
The generated
src/version.tsoutput now uses single-quoted literals again instead ofJSON.stringify(...)output. That resolves the Prettier formatting conflict directly, so the temporaryeslintignore forsrc/version.tsis removed.Fixes #368
Fixes #369