Affaan Mustafa 660e0d3bad fix: security and documentation fixes ...

- fix(utils.js): prevent command injection in commandExists() by using
  spawnSync instead of execSync with string interpolation, and validate
  input to only allow alphanumeric chars, dash, underscore, dot (#42)

- fix(utils.js): add security documentation to runCommand() warning
  against passing user-controlled input

- fix(setup-package-manager.js): replace <script> and <binary> with
  [script-name] and [binary-name] to avoid XSS scanner false positives (#43)

- fix(doc-updater.md): replace invalid 'npx ts-morph' with correct
  'npx tsx scripts/codemaps/generate.ts' since ts-morph is a library,
  not a CLI tool (#51)

Fixes #42, #43, #51

2026-01-24 01:36:02 -08:00

..

hooks

feat: cross-platform support with Node.js scripts

2026-01-22 23:08:07 -08:00

lib

fix: security and documentation fixes

2026-01-24 01:36:02 -08:00

setup-package-manager.js

fix: security and documentation fixes

2026-01-24 01:36:02 -08:00