fix(sources): use shared yamlEscape in release frontmatter

src/sources/releases.ts

@@ -2,6 +2,7 @@
  * GitHub release notes fetching via GitHub API (preferred) with ungh.cc fallback
  */
 
+import { yamlEscape } from '../core/yaml.ts'
 import { ghApiPaginated, isoDate } from './github-common.ts'
 import { $fetch, fetchGitHubRaw } from './utils.ts'
 
@@ -201,12 +202,12 @@ function formatRelease(release: GitHubRelease, packageName?: string): string {
 
   const fm = [
     '---',
-    `tag: ${release.tag}`,
-    `version: ${version}`,
+    `tag: ${yamlEscape(release.tag)}`,
+    `version: ${yamlEscape(version)}`,
     `published: ${date}`,
   ]
   if (release.name && release.name !== release.tag)
-    fm.push(`name: "${release.name.replace(/"/g, '\\"')}"`)
+    fm.push(`name: ${yamlEscape(release.name)}`)
   fm.push('---')
 
   return `${fm.join('\n')}\n\n# ${release.name || release.tag}\n\n${release.markdown}`
@@ -236,7 +237,7 @@ export function generateReleaseIndex(releasesOrOpts: GitHubRelease[] | ReleaseIn
   const fm = [
     '---',
     `total: ${total}`,
-    `latest: ${releases[0]?.tag || 'unknown'}`,
+    `latest: ${yamlEscape(releases[0]?.tag || 'unknown')}`,
     '---',
   ]
 

test/unit/releases.test.ts

@@ -1,6 +1,6 @@
 import type { GitHubRelease } from '../../src/sources/releases'
 import { describe, expect, it } from 'vitest'
-import { isChangelogRedirectPattern, isPrerelease, isStubRelease, selectReleases } from '../../src/sources/releases'
+import { generateReleaseIndex, isChangelogRedirectPattern, isPrerelease, isStubRelease, selectReleases } from '../../src/sources/releases'
 
 function makeRelease(tag: string, markdown: string, prerelease = false): GitHubRelease {
   return { id: 1, tag, name: tag, prerelease, createdAt: '2024-01-01T00:00:00Z', publishedAt: '2024-01-01T00:00:00Z', markdown }
@@ -198,6 +198,24 @@ describe('isChangelogRedirectPattern', () => {
   })
 })
 
+describe('generateReleaseIndex', () => {
+  it('escapes special YAML characters in tag names', () => {
+    const releases = [
+      makeRelease('v3.0.0: breaking', 'notes'),
+    ]
+    const index = generateReleaseIndex(releases)
+    expect(index).toContain('latest: "v3.0.0: breaking"')
+  })
+
+  it('handles normal tags without quoting', () => {
+    const releases = [
+      makeRelease('v1.0.0', 'notes'),
+    ]
+    const index = generateReleaseIndex(releases)
+    expect(index).toContain('latest: v1.0.0')
+  })
+})
+
 describe('isStubRelease', () => {
   it('detects stub with CHANGELOG.md reference', () => {
     expect(isStubRelease(makeRelease('v4.5.0', 'Please refer to CHANGELOG.md for details.'))).toBe(true)