Function validatePackageName

packages/bumpy/src/core/bump-file.ts:17–27

* Reject package names that contain characters which could cause injection * when used in git tags, markdown, URLs, or shell-quoted strings. * Intentionally permissive — we don't enforce npm naming rules because * bumpy may be used with other registries or non-JS packages.

(name: string)

 * bumpy may be used with other registries or non-JS packages.
 */
function validatePackageName(name: string): boolean {
  if (!name || name.length > 214) return false;
  // disallow control chars
  // eslint-disable-next-line no-control-regex
  if (/[\u0000-\u001f\u007f]/.test(name)) return false;
  // disallow HTML/shell metacharacters and whitespace
  if (/[<>"'`&;|$(){}[\]\\!#%\s]/.test(name)) return false;
  // must not start with - (could be interpreted as a CLI flag)
  if (name.startsWith('-')) return false;
  return true;
}

export interface ReadBumpFilesResult {
  bumpFiles: BumpFile[];