fix: SQL injection vulnerability in Neon cache provider table names

[Copilot]

Table names were being directly interpolated into SQL queries without sanitization, creating an SQL injection vector if table names come from untrusted sources.

Changes

• Added quoteIdentifier function to validate and quote PostgreSQL identifiers:

  • Validates against whitelist pattern: [a-zA-Z_$][a-zA-Z0-9_$]*
  • Supports schema-qualified names (schema.table)
  • Quotes using PostgreSQL double-quote syntax with proper escape handling

• Updated NeonCacheTagsProvider to pre-validate and quote table names in constructor, using quoted names in all SQL queries

Example

Before:

await this.sql.query(`INSERT INTO ${this.table} VALUES ...`);
// Vulnerable if table = "users; DROP TABLE sensitive_data;"

After:

this.quotedTable = quoteIdentifier(table); // Validates and quotes
await this.sql.query(`INSERT INTO ${this.quotedTable} VALUES ...`);
// Rejects invalid names, quotes valid ones: "users" or "schema"."table"

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[github-actions]

🎉 This PR is included in version 3.0.0-next.11 🎉

The release is available on:

• npm package (@next dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[github-actions]

🎉 This PR is included in version 3.0.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀