Version strings are now validated against path-unsafe characters and traversal patterns. Strings that don't match ^[a-zA-Z0-9._+-]+$ or contain .. are rejected with clear error messages.
Evidence
Version string validation (search for "Invalid version string") — sq6 at line ~351290
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
