From 5c4620d940da74f55d764cdb5d23a2ebe207439f Mon Sep 17 00:00:00 2001 From: Hugo Nijhuis Date: Tue, 6 Jan 2026 13:55:34 +0100 Subject: [PATCH] fix: validate order of / and # in cross-repo dependency parsing MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The previous parsing logic for cross-repo dependencies (owner/repo#123) only checked if both "/" and "#" were present, but didn't verify that "/" came before "#". This could cause inputs like "#123/owner/repo" to incorrectly match the cross-repo pattern. Now explicitly check that slashIdx < hashIdx before treating as cross-repo. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 --- cmd/issues/dependencies.go | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/cmd/issues/dependencies.go b/cmd/issues/dependencies.go index 0038170..199e7ff 100644 --- a/cmd/issues/dependencies.go +++ b/cmd/issues/dependencies.go @@ -192,7 +192,10 @@ func runDependenciesRemove(ctx stdctx.Context, cmd *cli.Command) error { // - "owner/repo#123" (cross-repo) func parseDependencyArg(arg, defaultOwner, defaultRepo string) (owner, repo string, index int64, err error) { // Check for cross-repo format: owner/repo#123 - if strings.Contains(arg, "/") && strings.Contains(arg, "#") { + // Ensure "/" comes before "#" to distinguish from same-repo "#123" + slashIdx := strings.Index(arg, "/") + hashIdx := strings.Index(arg, "#") + if slashIdx != -1 && hashIdx != -1 && slashIdx < hashIdx { parts := strings.SplitN(arg, "#", 2) if len(parts) != 2 { return "", "", 0, fmt.Errorf("invalid dependency format: %s (expected owner/repo#index)", arg)