@ckeditor/ckeditor5-dev-release-tools 42.1.0 → 43.0.0

package/lib/tasks/commitandtag.js

@@ -8,6 +8,7 @@
 const { tools } = require( '@ckeditor/ckeditor5-dev-utils' );
 const { toUnix } = require( 'upath' );
 const { glob } = require( 'glob' );
+const shellEscape = require( 'shell-escape' );
 
 /**
  * Creates a commit and a tag for specified version.
@@ -34,9 +35,10 @@ module.exports = async function commitAndTag( { version, files, cwd = process.cw
 
 	// Run the command separately for each file to avoid exceeding the maximum command length on Windows, which is 32767 characters.
 	for ( const filePath of filePathsToAdd ) {
-		await tools.shExec( `git add ${ filePath }`, shExecOptions );
+		await tools.shExec( `git add ${ shellEscape( [ filePath ] ) }`, shExecOptions );
 	}
 
-	await tools.shExec( `git commit --message "Release: v${ version }." --no-verify`, shExecOptions );
-	await tools.shExec( `git tag v${ version }`, shExecOptions );
+	const escapedVersion = shellEscape( [ version ] );
+	await tools.shExec( `git commit --message "Release: v${ escapedVersion }." --no-verify`, shExecOptions );
+	await tools.shExec( `git tag v${ escapedVersion }`, shExecOptions );
 };

package/lib/tasks/push.js

@@ -6,6 +6,7 @@
 'use strict';
 
 const { tools } = require( '@ckeditor/ckeditor5-dev-utils' );
+const shellEscape = require( 'shell-escape' );
 
 /**
  * Push the local changes to a remote server.
@@ -23,7 +24,7 @@ module.exports = async function push( options ) {
 		cwd = process.cwd()
 	} = options;
 
-	const command = `git push origin ${ releaseBranch } v${ version }`;
+	const command = `git push origin ${ shellEscape( [ releaseBranch ] ) } v${ shellEscape( [ version ] ) }`;
 
 	return tools.shExec( command, { cwd, verbosity: 'error', async: true } );
 };

package/lib/tasks/reassignnpmtags.js

@@ -13,6 +13,7 @@ const chalk = require( 'chalk' );
 const columns = require( 'cli-columns' );
 const { tools } = require( '@ckeditor/ckeditor5-dev-utils' );
 const util = require( 'util' );
+const shellEscape = require( 'shell-escape' );
 const exec = util.promisify( require( 'child_process' ).exec );
 const assertNpmAuthorization = require( '../utils/assertnpmauthorization' );
 
@@ -37,7 +38,8 @@ module.exports = async function reassignNpmTags( { npmOwner, version, packages }
 	counter.start();
 
 	const updateTagPromises = packages.map( async packageName => {
-		const updateLatestTagRetryable = retry( () => exec( `npm dist-tag add ${ packageName }@${ version } latest` ) );
+		const command = `npm dist-tag add ${ shellEscape( [ packageName ] ) }@${ shellEscape( [ version ] ) } latest`;
+		const updateLatestTagRetryable = retry( () => exec( command ) );
 		await updateLatestTagRetryable()
 			.then( response => {
 				if ( response.stdout ) {

package/lib/utils/checkversionavailability.js

@@ -6,6 +6,7 @@
 'use strict';
 
 const { tools } = require( '@ckeditor/ckeditor5-dev-utils' );
+const shellEscape = require( 'shell-escape' );
 
 /**
  * Checks if the provided version for the package exists in the npm registry.
@@ -18,7 +19,9 @@ const { tools } = require( '@ckeditor/ckeditor5-dev-utils' );
  * @returns {Promise}
  */
 module.exports = async function checkVersionAvailability( version, packageName ) {
-	return tools.shExec( `npm show ${ packageName }@${ version } version`, { verbosity: 'silent', async: true } )
+	const command = `npm show ${ shellEscape( [ packageName ] ) }@${ shellEscape( [ version ] ) } version`;
+
+	return tools.shExec( command, { verbosity: 'silent', async: true } )
 		.then( result => {
 			// Explicit check for npm < 8.13.0, which does not return anything (an empty result) and it exits with a zero status code when
 			// the version for the provided package does not exist in the npm registry.

package/lib/utils/isversionpublishablefortag.js

@@ -5,6 +5,7 @@
 
 const { tools } = require( '@ckeditor/ckeditor5-dev-utils' );
 const semver = require( 'semver' );
+const shellEscape = require( 'shell-escape' );
 
 /**
  * This util aims to verify if the given `packageName` can be published with the given `version` on the `npmTag`.
@@ -15,7 +16,8 @@ const semver = require( 'semver' );
  * @return {Promise.<Boolean>}
  */
 module.exports = async function isVersionPublishableForTag( packageName, version, npmTag ) {
-	const npmVersion = await tools.shExec( `npm view ${ packageName }@${ npmTag } version --silent`, { async: true, verbosity: 'silent' } )
+	const command = `npm view ${ shellEscape( [ packageName ] ) }@${ shellEscape( [ npmTag ] ) } version --silent`;
+	const npmVersion = await tools.shExec( command, { async: true, verbosity: 'silent' } )
 		.then( value => value.trim() )
 		// An `npmTag` does not exist.
 		.catch( () => null );

package/package.json

@@ -1,14 +1,29 @@
 {
   "name": "@ckeditor/ckeditor5-dev-release-tools",
-  "version": "42.1.0",
+  "version": "43.0.0",
   "description": "Tools used for releasing CKEditor 5 and related packages.",
   "keywords": [],
+  "author": "CKSource (http://cksource.com/)",
+  "license": "GPL-2.0-or-later",
+  "homepage": "https://github.com/ckeditor/ckeditor5-dev/tree/master/packages/ckeditor5-dev-release-tools",
+  "bugs": "https://github.com/ckeditor/ckeditor5/issues",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/ckeditor/ckeditor5-dev.git",
+    "directory": "packages/ckeditor5-dev-release-tools"
+  },
+  "engines": {
+    "node": ">=18.0.0",
+    "npm": ">=5.7.1"
+  },
   "main": "lib/index.js",
+  "files": [
+    "lib"
+  ],
   "dependencies": {
-    "@ckeditor/ckeditor5-dev-utils": "^42.1.0",
+    "@ckeditor/ckeditor5-dev-utils": "^43.0.0",
     "@octokit/rest": "^19.0.0",
     "chalk": "^4.0.0",
-    "cli-table": "^0.3.1",
     "cli-columns": "^4.0.0",
     "compare-func": "^2.0.0",
     "concat-stream": "^2.0.0",
@@ -16,32 +31,14 @@
     "conventional-commits-filter": "^3.0.0",
     "conventional-commits-parser": "^4.0.0",
     "date-fns": "^2.30.0",
-    "diff": "^5.0.0",
-    "fs-extra": "^9.1.0",
+    "fs-extra": "^11.2.0",
     "git-raw-commits": "^3.0.0",
     "glob": "^10.2.5",
     "inquirer": "^7.1.0",
     "lodash": "^4.17.15",
     "minimatch": "^3.0.4",
-    "mkdirp": "^1.0.4",
-    "parse-github-url": "^1.0.2",
     "semver": "^7.5.3",
+    "shell-escape": "^0.2.0",
     "upath": "^2.0.1"
-  },
-  "engines": {
-    "node": ">=18.0.0",
-    "npm": ">=5.7.1"
-  },
-  "files": [
-    "lib"
-  ],
-  "author": "CKSource (http://cksource.com/)",
-  "license": "GPL-2.0-or-later",
-  "homepage": "https://github.com/ckeditor/ckeditor5-dev/tree/master/packages/ckeditor5-dev-release-tools",
-  "bugs": "https://github.com/ckeditor/ckeditor5/issues",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/ckeditor/ckeditor5-dev.git",
-    "directory": "packages/ckeditor5-dev-release-tools"
   }
 }