fix(scripts): resolve CodeQL command-injection findings in generate-patch

[jeffreylouden]

Description

Fixes the two js/indirect-command-line-injection findings CodeQL raises on scripts/generate-patch.ts: the since ref taken from argv was interpolated into shell command strings (git show ${since}:${filePath}, git diff --name-status ${since} HEAD). All three git invocations in the file now use execFileSync with argument arrays, so no shell is involved — the same treatment format-yaml.ts received on #627.

Verified by re-running the CodeQL security-extended suite locally: both injection alerts are gone. The one remaining finding (js/file-system-race in enrich-io.ts) is a check-then-write on a local interactive CLI editing a repo file — not a real risk, recommend dismissing it on the code-scanning page rather than contorting the code.

Type of Change

• New software/plugin entry
• New hardware entry
• New manufacturer entry
• Update to existing entry
• Bug fix
• Schema or script change

Checklist

• I have run pnpm validate and it passes
• YAML files follow the existing format (no data files touched)
• Manufacturer exists (or I'm adding it in this PR) — n/a
• Categories and formats are from the schema files — n/a
• Identifiers are accurate, if provided (bundle IDs, etc.) — n/a

Additional Notes

pnpm typecheck, pnpm lint, and pnpm test (174 tests) all pass; the two lint warnings are pre-existing on main. No changeset: scripts-only, no data change.

🤖 Generated with Claude Code

https://claude.ai/code/session_01GmHrQEQmpYthrHhmV2cB2c

---

Generated by Claude Code

[changeset-bot]

⚠️ No Changeset found

Latest commit: 6686c1c

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your current included review allowance is based on your included PR review attempts over the past 7 days.

Next review available in: 17 minutes

Limit details: You’ve used the included review currently available. Your 106 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

You’re in a promotional period — use the checkbox below to run this review for free:

• Run review for free

_{On-demand reviews are free for the next 31 days. After that, they cost $0.25 per reviewed file.}

How can I continue?

Run this review now using the option above, or comment @coderabbitai review --use-credits.

You can also wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 3627f170-e20f-4fd1-be9d-6f02b4c5f1c0

📥 Commits

Reviewing files that changed from the base of the PR and between 0845026 and 6686c1c.

📒 Files selected for processing (1)

• scripts/generate-patch.ts

---

_{Comment @coderabbitai help to get the list of available commands.}