v1.41.3 - Withhold copyable commands that are unsafe in Windows shells

Upgrade note. This release contains one security fix and nothing else.

Security

• A copyable command is no longer printed for a package, workspace or folder name that would still run something if pasted into Windows cmd.exe or PowerShell. The quoting added in 1.41.1 and 1.41.2 only protects POSIX shells such as bash, zsh and sh, so a name containing &, |, <, >, ^, %, !, a quote, a backtick or a control character now gets no command in the fix plan, the npm ls hints, the PD001 and PD002 install hints or the override --fix command; the finding is listed as skipped with the reason, and the fix count drops to match. Ordinary names, including folder names with spaces, are unchanged (GHSA-x5r8-cxwg-fhm4).

Validation

• npm test
• npm run build