release: v1.41.4 - #1649

* fix(security): quote subfolder paths in remediation commands

* fix(security): quote override remediation paths

(cherry picked from commit 4d6e38f)

Yarn 1.22 records an alias as "util-lib@npm:lodash@4.17.20". The classic
parser kept the text before the final @, so a scan queried
util-lib@npm:lodash and reported no advisories for the lodash that was
actually installed.

Co-authored-by: Alex Powell <alex-powell@users.noreply.github.com>
(cherry picked from commit 8b4800c)

Version bump only. The three security fixes are already in this branch, carried over from main.

…config

npm run and npx export a project's own .npmrc registry to the scanner as
lowercase npm_config_registry, which was treated as an explicit user setting
and granted private access. The lowercase spelling, and any spelling on
Windows, is now trusted only when it is the public registry or matches the
user's home config.

…ry fetch

…try is blocked

A project registry takes precedence over the user's home config, so
pointing users at their home config alone does not unblock a scan.

* fix(npm): resolve registry identities for overrides and peerDependencies aliases

* fix(npm): gate peer alias resolution and extract alias module

Also corrects the 1.41.1 release date and its upgrade note, which told
users to set the registry in their user-level config without saying the
project's own config has to drop it first.

* fix(security): add a check for names that are unsafe in any common shell

shellQuote is POSIX single-quote quoting. cmd.exe ignores single quotes and
PowerShell reads the POSIX escape for a quote differently, so a name with
& | < > ^ % ! quotes, a backtick or a control character can still act there.
isSafeInEveryShell flags those, and npmLsCommand returns no command for them.

* fix(security): withhold fix commands that are unsafe to paste in some shell

A target whose package, version or workspace name fails the check gets no
command and each affected finding is listed as skipped with the reason,
under its own package so a parent-update target cannot hide the child. A
folder name that fails the check withholds every command for that folder.

* fix(security): withhold unsafe inspection, phantom and override commands

The npm ls hints, the PD001 and PD002 install commands and the override
--fix command give a plain instruction instead of a command when the
package or folder name is not safe to paste into every shell.

* test: expect no command for names unsafe in some shell

Names that only POSIX quoting can neutralise now get no command; the
real-shell execution checks stay for the rest.

* test: pin which names withhold a command and how skips are reported

Covers the shell check on both sides, an unsafe package next to a safe one,
an unsafe folder naming each affected package including a child refreshed
through its parent, a folder with only a space, and the override command.

* test: fill the override context fields the shell quoting test omitted

The context was missing three fields and passed possibly-undefined
details to a string helper; both were type errors carried from the test's
original version, which the CI check now counts because this branch edits
the file.

…1493)

* Update shellQuote function for token quoting

Modify shellQuote function to force quote tokens starting with '-' to prevent misinterpretation as options.

* Export buildApplyCommands and add isOptionShaped function

* Add tests for option-shaped package names in commands

* Refactor command handling and shell quoting logic

Refactor shellQuote function to simplify token validation and adjust command handling for option-shaped names.

* Add suppressedCount to notAutoApplied object

* Add suppressedCount to FixExecutionResult

Added suppressedCount to track suppressed findings and updated related logic.

* Implement test for npm alias option suppression

Add test to suppress fix command for npm alias resembling an option

* Fix import paths and update test cases

Updated import paths to use .js extensions and fixed a typo in the test case.

* Update src/utils/fix-runner.ts

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

* Add check for option-shaped command package names

* Refactor imports and export commandPackageName function

* Refactor option handling in fix-runner.ts

* Fix typo in test assertion from 'tBeNull' to 'toBeNull'

* Update package count logic and summary output

Refactor package count calculation to exclude suppressed targets and update summary message accordingly.

* Check for suppressed targets in fix command plan

* Remove isOptionShapedName function

Removed isOptionShapedName function to simplify command handling.

* Change condition check from isOptionShaped to isOptionShapedName

* Implement isOptionShapedName function

Add a function to check if a package name is option-shaped.

* Enhance suggested fix command plan output logic

* Update fix-commands.ts

* Make suppressedCount optional and update checks

* Add validation for target command flags

Ensure target commands do not include registry or ignore-scripts flags.

* Reorder imports in printers.ts for clarity

* Refactor imports and clean up unused function

Reorder imports and remove unused commandPackageName function.

* Reorder imports in fix-runner.ts

* Implement commandPackageName function

Add commandPackageName function to determine package name based on command type.

* Export formatFixCommandSummary function

* Refactor command return values in fix-commands.ts

Update command handling to return empty string or null based on conditions.

* Fix formatting issues in fix-runner.ts

* Add tests for command plan and summary formatting

* Add newline at end of runner-option-injection test file

Fix missing newline at end of runner-option-injection.test.ts

* Change return type of buildSectionTitle and buildCommandForTargets

* Update assertions for solo command in tests

* Refactor fix application logic and update note message

Updated condition to check runnable targets and modified note message for clarity.

* Change test expectation for suppressed count

Update the test to check for a specific note message instead of suppressed count.

* Clean up runner-option-injection test formatting

Remove unnecessary blank line in test case.

* Refactor command plan checks in printers.ts

Removed unnecessary checks for suppressed targets in command plan handling.

* Refactor fix command logic for option-shaped names

Removed references to commandPackageName for option-shaped names to prevent offering fix commands for them.

* Replace suppressedCount with optionShapedNameCount

* Refactor fix-runner to remove suppressedCount

* Add optionShapedNameCount to test cases

* Remove unused variable 'hasSuppressedTargets'

Removed unused variable 'hasSuppressedTargets' from multiple locations in printers.ts.

* Refactor command functions to return strings

* Refactor noFixCount calculation in fix-runner.ts

* Fix test for validateOptions with createPr option

* Update severity levels in test cases

* Rename test for npm alias option suppression

* Remove test for option-shaped target omission

Removed test case for omitting option-shaped targets from the displayed plan.

* Update function return types to include null

* Refactor upsertTarget to manage command-shaped names

Refactor upsertTarget function to handle command-shaped package names and update related logic for skipped targets.

* Add checks for option-shaped names in yarn commands

* Add test for unused recommendation not skipping fix

* Add test for yarn workspace command behavior

* Add loop to process ordered findings

* Clean up test case by removing blank line

Remove unnecessary blank line in test case for npm alias.

* Refactor buildCommandForTargets function

Remove early return for empty targets array.

* Add tests for option-shaped skips in summary

* Update axios version and enhance npm alias tests

Updated targetChildVersion for axios and adjusted expectations in tests to reflect the new version. Added tests to skip npm operations when names resemble command-line options.

* Remove yarn workspace command tests for invalid names

Removed test cases that check for yarn workspace command generation with names starting with '-'

* Simplify yarn handling in fix-runner.ts

Remove unnecessary checks for option-shaped names in yarn package manager handling.

* Update notAutoApplied structure in test cases

Added 'optionShapedNameCount' to notAutoApplied object in multiple test cases.

* Fix test case for option-shaped skip counting

* Update tests/fix-runner-summary.test.ts

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

* fix: make optionShapedNameCount optional so fixtures match main

The field is only set by categorizeUnappliedTargets, so readers treat an
absent value as 0. That lets create-pr.test.ts and fix-result-json.test.ts
stay exactly as they are on main, keeping this PR to the option-shaped
name guard.

* test: cover single-dash option-shaped names such as -rf

Every existing case used a double-dash name, so a check narrowed to
startsWith("--") would still pass. Adds -rf at the planner and argv
levels so that mutation fails.

---------

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>