fix(update): validate package names in updateAllPackages

AS
4mo ago
+16-4

Summary

  • reuse the existing npm package-name validation logic via a shared helper
  • filter invalid package names out of updateAllPackages() before building shell commands
  • bail out early when no valid packages remain, avoiding an empty package-manager invocation

Problem

updateAllPackages() was interpolating package names from checkForUpdates() directly into execSync() commands, while updateSinglePackage() already validated names first. That left a command-injection gap between the two code paths.

Notes

This keeps the fix intentionally small and follows the validation pattern already used in updateSinglePackage().

Fixes #1205

Summary by cubic

Validate package names in updateAllPackages() to close a command-injection gap and avoid empty package-manager runs. Reuses a shared regex helper and returns early when no valid packages remain.

  • Bug Fixes
    • Add shared isValidPackageName helper and use it in updateAllPackages().
    • Filter invalid names before building shell commands; skip updates if none are valid.
    • Update updateSinglePackage() to use the shared helper for consistency.

Summary by CodeRabbit

  • Bug Fixes
    • Improved package update validation to skip invalid package names.
    • When no valid packages are available for an update, the update flow now fails clearly instead of proceeding.
    • Single-package updates continue to reject invalid names with the same early-return behavior.