[Auto release] release 1.3.1

[github-actions]

No description provided.

To fix the problem, we should avoid constructing the shell command as a single string that the shell interprets. Instead, we should use the execFileSync or spawnSync functions with an array of arguments to pass the dynamic parts separately. This prevents the shell from misinterpreting special characters or spaces in the paths or message.

1. Replace the spawnSync call on line 34 with a call to execFileSync or spawnSync that passes the command and arguments separately.
2. Similarly, replace the spawnSync call on line 50 with a call that passes the command and arguments separately.
3. Ensure that the message and bumpType variables are properly sanitized or escaped if necessary.

To fix the problem, we should avoid constructing the shell command as a single string and instead pass the command and its arguments separately to child_process.spawnSync. This way, the shell does not interpret the arguments, and we avoid issues with special characters in paths.

• Replace the dynamic command string with an array of arguments.
• Use child_process.spawnSync without the sh -c option to directly execute the command with the provided arguments.

To fix the problem, we should avoid constructing the command string dynamically and instead pass the command and its arguments separately to spawnSync. This approach ensures that the arguments are not interpreted by the shell, thus preventing potential injection attacks.

We will modify the spawnSync calls to use execFileSync instead, passing the command and arguments as separate parameters. This change will be made in both instances where spawnSync is used.

To fix the problem, we should avoid constructing the command string dynamically and instead pass the command and its arguments separately to spawnSync. This approach ensures that the arguments are not interpreted by the shell, preventing any possibility of command injection.

• Replace the dynamically constructed command string with separate command and arguments.
• Use spawnSync with the prettier command and the -w argument followed by the pkgJsonPath.

To fix the problem, we need to ensure that the htmlRestore function unescapes the ampersand (&) last. This will prevent any issues with double unescaping, ensuring that other entities are correctly decoded before the ampersand is processed.

• Change the order of the replacements in the htmlRestore function.
• Specifically, move the line result = result.replace(/&/g, '&'); to the end of the function.

To fix the problem, we need to remove the ambiguity in the regular expression. The main issue is with the .* and .+ patterns, which can match overlapping parts of the input string. We can replace .* with a more specific pattern that matches any character except a double quote, ensuring that the regular expression remains efficient.

• Replace .* with [^"]* to match any character except a double quote.
• Ensure that the regular expression still matches the intended input strings without causing performance issues.

To fix the problem, we need to ensure that the name property from applicationMeta cannot be used to modify Object.prototype. We can achieve this by checking if name is one of the special properties (__proto__, constructor, prototype) and rejecting it if so. This will prevent prototype pollution while maintaining the existing functionality.

To fix the problem, we need to ensure that the applicationName parameter cannot be used to modify the Object.prototype. This can be achieved by validating the applicationName to ensure it does not contain any special property names like __proto__, constructor, or prototype.

The best way to fix this without changing existing functionality is to add a validation check at the beginning of the setTaskNode method. If the applicationName is one of the restricted property names, we should throw an error or handle it appropriately.