From 4438943f63f71701d57ddf699f8a28a04d28f169 Mon Sep 17 00:00:00 2001
From: Pierre Jeanjacquot <26487010+PierreJeanjacquot@users.noreply.github.com>
Date: Mon, 5 Oct 2026 13:57:54 +0200
Subject: [PATCH] fix(publish-npm): pass version input through env to prevent
 template injection

---
 .github/workflows/publish-npm.yml | 4 +++-
 publish-npm/workflow-sha256       | 2 +-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml
index 44ae026..ad991b6 100644
--- a/.github/workflows/publish-npm.yml
+++ b/.github/workflows/publish-npm.yml
@@ -135,8 +135,10 @@ jobs:
       - name: Override version
         if: ${{ inputs.version != '' }}
         working-directory: ${{ inputs.working-directory }}
+        env:
+          INPUTS_VERSION: ${{ inputs.version }}
         run: |
-          npm pkg set version="${{ inputs.version }}"
+          npm pkg set version="${INPUTS_VERSION}"
 
       - name: Run build
         working-directory: ${{ inputs.working-directory }}
diff --git a/publish-npm/workflow-sha256 b/publish-npm/workflow-sha256
index 60c2bc9..2a1ca59 100644
--- a/publish-npm/workflow-sha256
+++ b/publish-npm/workflow-sha256
@@ -1 +1 @@
-a0f982d67bdbbede205a42f52391604ce973c8c2b83598c2f4a12b8673bcc4ba
+57406f36c10a4c1def8a5efb291aa13e157f314410abab918104873d4ee452f7