prefix-dev · pull · Jun 16, 2026 · Jun 15, 2026 · Jun 15, 2026 · Jun 15, 2026
diff --git a/Tools/SandboxTest.ps1 b/Tools/SandboxTest.ps1
@@ -23,6 +23,7 @@ param(
     [Parameter(HelpMessage = 'The folder to map in the Sandbox.')]
     [ValidateScript({
             if (-not (Test-Path -Path $_ -PathType Container)) { throw "$_ is not a folder." }
+            if ($_ -match '[''"<>&]') { throw "MapFolder path contains forbidden characters (' `" < > &): $_" }
             return $true
         })]
     [String] $MapFolder = $pwd,
@@ -31,6 +32,41 @@ param(
     [string] $WinGetVersion,
     # WinGetOptions
     [Parameter(HelpMessage = 'Additional options for WinGet')]
+    [ValidateScript({
+            # Parse allowed flags only from flag definition lines in winget install --help
+            # These lines start with whitespace followed by a dash (e.g., "  -h,--silent  ...")
+            if (-not (Get-Command 'winget.exe' -ErrorAction SilentlyContinue)) {
+                Write-Warning 'WinGet is not installed on the host. Skipping WinGetOptions validation.'
+                return $true
+            }
+            $helpLines = winget install --help 2>&1 | Where-Object { $_ -match '^\s+-' }
+            $allowedFlags = @()
+            foreach ($line in $helpLines) {
+                # Extract the flag portion before the description (everything up to two consecutive spaces)
+                $flagPart = ($line.Trim() -split '\s{2,}')[0]
+                $parsedTokens = $flagPart -split ',' | ForEach-Object { $_.Trim() }
+                Write-Debug "WinGetOptions: Parsed line '$($line.Trim())' -> flags: $($parsedTokens -join ', ')"
+                $allowedFlags += $parsedTokens
+            }
+            $allowedFlags = $allowedFlags | Where-Object { $_ } | Select-Object -Unique
+            if (-not $allowedFlags) {
+                throw 'Could not parse winget install flags from --help output. Ensure winget is installed.'
+            }
+            Write-Debug "WinGetOptions: Allow-list ($($allowedFlags.Count) flags): $($allowedFlags -join ', ')"
+            $tokens = $_ -split '\s+'
+            foreach ($token in $tokens) {
+                if ($token.StartsWith('-')) {
+                    $isAllowed = $token -in $allowedFlags
+                    Write-Debug "WinGetOptions: Checking token '$token' -> $(if ($isAllowed) { 'ALLOWED' } else { 'BLOCKED' })"
+                    if (-not $isAllowed) {
+                        throw "WinGetOptions contains disallowed flag: $token. Allowed flags: $($allowedFlags -join ', ')"
+                    }
+                } else {
+                    Write-Debug "WinGetOptions: Skipping value token '$token'"
+                }
+            }
+            return $true
+        })]
     [string] $WinGetOptions,
     # Switches
     [switch] $SkipManifestValidation,
@@ -872,19 +908,23 @@ Pop-Location
 # Create the WSB file
 # Although this could be done using the native XML processor, it's easier to just write the content directly as a string
 Write-Verbose 'Creating WSB file for launching the sandbox'
+$escapedTestDataFolder = [System.Security.SecurityElement]::Escape($script:TestDataFolder)
+$escapedPrimaryMappedFolder = [System.Security.SecurityElement]::Escape($script:PrimaryMappedFolder)
+$escapedSandboxWorkingDirectory = [System.Security.SecurityElement]::Escape($script:SandboxWorkingDirectory)
+$escapedSandboxBootstrapFile = [System.Security.SecurityElement]::Escape($script:SandboxBootstrapFile)
 @"
 <Configuration>
   <Networking>Enable</Networking>
   <MappedFolders>
     <MappedFolder>
-      <HostFolder>$($script:TestDataFolder)</HostFolder>
+      <HostFolder>$($escapedTestDataFolder)</HostFolder>
     </MappedFolder>
     <MappedFolder>
-      <HostFolder>$($script:PrimaryMappedFolder)</HostFolder>
+      <HostFolder>$($escapedPrimaryMappedFolder)</HostFolder>
     </MappedFolder>
   </MappedFolders>
   <LogonCommand>
-  <Command>PowerShell Start-Process PowerShell -WindowStyle Maximized -WorkingDirectory '$($script:SandboxWorkingDirectory)' -ArgumentList '-ExecutionPolicy Bypass -NoExit -NoLogo -File $($script:SandboxBootstrapFile)'</Command>
+  <Command>PowerShell Start-Process PowerShell -WindowStyle Maximized -WorkingDirectory '$($escapedSandboxWorkingDirectory)' -ArgumentList '-ExecutionPolicy Bypass -NoExit -NoLogo -File $($escapedSandboxBootstrapFile)'</Command>
   </LogonCommand>
   <AudioInput>Disable</AudioInput>
   <VideoInput>Disable</VideoInput>

diff --git a/manifests/a/AmN/yasb/2.0.4/AmN.yasb.installer.yaml b/manifests/a/AmN/yasb/2.0.4/AmN.yasb.installer.yaml
@@ -0,0 +1,27 @@
+# Created using wingetcreate 1.12.8.0
+# yaml-language-server: $schema=https://aka.ms/winget-manifest.installer.1.12.0.schema.json
+
+PackageIdentifier: AmN.yasb
+PackageVersion: 2.0.4
+InstallerLocale: en-US
+InstallerType: msi
+Installers:
+- Architecture: x64
+  InstallerUrl: https://github.com/amnweb/yasb/releases/download/v2.0.4/yasb-2.0.4-x64.msi
+  InstallerSha256: 85E41D377E994F37EEB2CFCB38943BCC0204CC10F85822EAF0856FF903359345
+  ProductCode: '{0524DE13-FAAF-4DF5-BEE3-A13A479EEA97}'
+  AppsAndFeaturesEntries:
+  - DisplayName: YASB Reborn
+    ProductCode: '{0524DE13-FAAF-4DF5-BEE3-A13A479EEA97}'
+    UpgradeCode: '{3F620CF5-07B5-47FD-8E37-9CA8AD14B608}'
+- Architecture: arm64
+  InstallerUrl: https://github.com/amnweb/yasb/releases/download/v2.0.4/yasb-2.0.4-aarch64.msi
+  InstallerSha256: 5583F0355BEC890DB5CDE5285B92BB50A094B47B2EF3ECD76F031507579540A1
+  ProductCode: '{A370D0AA-AFD0-4E45-AFB8-E8D912EF93B9}'
+  AppsAndFeaturesEntries:
+  - DisplayName: YASB Reborn
+    ProductCode: '{A370D0AA-AFD0-4E45-AFB8-E8D912EF93B9}'
+    UpgradeCode: '{3F620CF5-07B5-47FD-8E37-9CA8AD14B608}'
+ManifestType: installer
+ManifestVersion: 1.12.0
+ReleaseDate: 2026-06-15
diff --git a/manifests/a/AmN/yasb/2.0.4/AmN.yasb.locale.en-US.yaml b/manifests/a/AmN/yasb/2.0.4/AmN.yasb.locale.en-US.yaml
@@ -0,0 +1,28 @@
+# Created using wingetcreate 1.12.8.0
+# yaml-language-server: $schema=https://aka.ms/winget-manifest.defaultLocale.1.12.0.schema.json
+
+PackageIdentifier: AmN.yasb
+PackageVersion: 2.0.4
+PackageLocale: en-US
+Publisher: AmN
+PublisherUrl: https://github.com/amnweb
+PublisherSupportUrl: https://github.com/amnweb/yasb/issues
+Author: AmN
+PackageName: yasb
+PackageUrl: https://github.com/amnweb/yasb
+License: MIT License
+LicenseUrl: https://github.com/amnweb/yasb/blob/HEAD/LICENSE
+Copyright: Copyright 2024 AmN. All rights reserved.
+CopyrightUrl: https://github.com/amnweb/yasb/blob/main/LICENSE
+ShortDescription: A configurable Windows status bar.
+Description: A configurable Windows status bar.
+Tags:
+- status bar
+- topbar
+ReleaseNotesUrl: https://github.com/amnweb/yasb/releases/tag/v2.0.4
+InstallationNotes: https://github.com/amnweb/yasb
+Documentations:
+- DocumentLabel: Wiki
+  DocumentUrl: https://github.com/amnweb/yasb/wiki
+ManifestType: defaultLocale
+ManifestVersion: 1.12.0
diff --git a/...e/4.708/EmoteInteractive.RemoteMouse.yaml → manifests/a/AmN/yasb/2.0.4/AmN.yasb.yaml b/...e/4.708/EmoteInteractive.RemoteMouse.yaml → manifests/a/AmN/yasb/2.0.4/AmN.yasb.yaml
@@ -1,8 +1,8 @@
-# Automatically updated by the winget bot at 2026/May/26
+# Created using wingetcreate 1.12.8.0
 # yaml-language-server: $schema=https://aka.ms/winget-manifest.version.1.12.0.schema.json
 
-PackageIdentifier: EmoteInteractive.RemoteMouse
-PackageVersion: '4.708'
+PackageIdentifier: AmN.yasb
+PackageVersion: 2.0.4
 DefaultLocale: en-US
 ManifestType: version
 ManifestVersion: 1.12.0
diff --git a/manifests/a/AppByTroye/KoodoReader/2.3.7/AppByTroye.KoodoReader.installer.yaml b/manifests/a/AppByTroye/KoodoReader/2.3.7/AppByTroye.KoodoReader.installer.yaml
@@ -0,0 +1,48 @@
+# Created with YamlCreate.ps1 Dumplings Mod
+# yaml-language-server: $schema=https://aka.ms/winget-manifest.installer.1.12.0.schema.json
+
+PackageIdentifier: AppByTroye.KoodoReader
+PackageVersion: 2.3.7
+InstallerType: nullsoft
+InstallerSwitches:
+  Upgrade: --updated
+FileExtensions:
+- azw
+- azw3
+- cb7
+- cbr
+- cbt
+- cbz
+- epub
+- fb2
+- mobi
+- pdf
+ProductCode: 233610fa-2bda-5a09-a37b-75e0bafa7920
+ReleaseDate: 2026-06-15
+Installers:
+- Architecture: x64
+  Scope: user
+  InstallerUrl: https://dl.koodoreader.com/v2.3.7/Koodo-Reader-2.3.7-x64.exe
+  InstallerSha256: 4FADFE6DD441E77F758943230A293914DAD185D0A71C153AD46995B11883BBE6
+  InstallerSwitches:
+    Custom: /currentuser
+- Architecture: x64
+  Scope: machine
+  InstallerUrl: https://dl.koodoreader.com/v2.3.7/Koodo-Reader-2.3.7-x64.exe
+  InstallerSha256: 4FADFE6DD441E77F758943230A293914DAD185D0A71C153AD46995B11883BBE6
+  InstallerSwitches:
+    Custom: /allusers
+- Architecture: arm64
+  Scope: user
+  InstallerUrl: https://dl.koodoreader.com/v2.3.7/Koodo-Reader-2.3.7-arm64.exe
+  InstallerSha256: 6C755D23957A990E6C003C9EB54D3EE705BBC34928958F658DD0CD8AEBB572AC
+  InstallerSwitches:
+    Custom: /currentuser
+- Architecture: arm64
+  Scope: machine
+  InstallerUrl: https://dl.koodoreader.com/v2.3.7/Koodo-Reader-2.3.7-arm64.exe
+  InstallerSha256: 6C755D23957A990E6C003C9EB54D3EE705BBC34928958F658DD0CD8AEBB572AC
+  InstallerSwitches:
+    Custom: /allusers
+ManifestType: installer
+ManifestVersion: 1.12.0
diff --git a/manifests/a/AppByTroye/KoodoReader/2.3.7/AppByTroye.KoodoReader.locale.en-US.yaml b/manifests/a/AppByTroye/KoodoReader/2.3.7/AppByTroye.KoodoReader.locale.en-US.yaml
@@ -0,0 +1,73 @@
+# Created with YamlCreate.ps1 Dumplings Mod
+# yaml-language-server: $schema=https://aka.ms/winget-manifest.defaultLocale.1.12.0.schema.json
+
+PackageIdentifier: AppByTroye.KoodoReader
+PackageVersion: 2.3.7
+PackageLocale: en-US
+Publisher: App by Troye
+PublisherUrl: https://www.koodoreader.com/
+PublisherSupportUrl: https://www.koodoreader.com/en/support
+PrivacyUrl: https://www.koodoreader.com/en/privacy
+Author: Troye
+PackageName: Koodo Reader
+PackageUrl: https://www.koodoreader.com/
+License: AGPL-3.0
+LicenseUrl: https://github.com/koodo-reader/koodo-reader/blob/HEAD/LICENSE
+Copyright: © 2026 App by Troye. All rights reserved.
+CopyrightUrl: https://www.koodoreader.com/en/term
+ShortDescription: All-in-one ebook reader
+Description: Koodo Reader is an all-in-one eBook reader for Windows, macOS, Linux, and the web, supporting over 15 formats.
+Moniker: koodoreader
+Tags:
+- ebook
+- ebook-reader
+- epub
+- pdf
+- reader
+ReleaseNotes: |-
+  New Features
+  - The window title bar will display a black theme in Dark Mode
+  - Support for searching and matching book covers and metadata online
+  - Support for syncing notes and highlights with Siyuan Notes; Siyuan Notes must be running with the network serving feature enabled
+  - Support for importing books via URL using the book's download link
+  - Browser extension support for clipping web pages from the web and saving them to your library
+  - Support for importing articles via URL links from the web
+  - Web version now supports restoring the book library and full-screen reading
+  - Added automatic sync feature after importing books
+  - Support for returning to the previous reading position after clicking notes, highlights, bookmarks, or table of contents
+  - Added 6 preset book layouts
+  - (Mobile) Support for searching and matching book covers and metadata online
+  - (Mobile) Supports syncing notes and highlights with Siyuan Notes; Siyuan Notes must be running with network serving enabled
+  - (Mobile) Added automatic sync feature after importing books
+  - (Mobile version) Added 6 new preset book layouts
+  - (Mobile) Added scheduled sync feature with customizable sync intervals; go to Settings > Sync Options
+  - (Mobile) Support for syncing reading progress with KOReader. Go to Settings > Sync Options
+  - (Mobile) Support for syncing new vocabulary to Eudic and Anki. Go to Settings > Sync Options
+  - (Mobile) Support for swiping the screen to turn pages after disabling page-turn animations
+  - (Mobile) Free users can now use OPDS and reading statistics features
+  - (Mobile) iOS now supports update notifications
+  - (Mobile) Page-turning animations are now supported when volume buttons are enabled for page turning
+  - (Mobile) Send to Kindle now displays uploading progress
+  - (Mobile) Support for backing up and restoring the book library; go to Settings and scroll to the bottom
+  Fixes
+  - Fixed an issue where the text being read aloud did not sync with the current position while listening to TTS
+  - Fixed an issue where the password-protected page would pop up repeatedly in certain situations
+  - Fixed an issue where books, notes, and highlights links could not be opened when the app was not running
+  - (Mobile) Fixed an issue where the narration did not sync with the current position while using TTS
+  - (Mobile) Fixed an issue where the TTS feature malfunctioned in certain situations
+  - (Mobile) Fixed an issue where page-turning animations were not disabled in E-ink mode
+  - (Mobile) Fixed an error when sending files to Kindle that were too large
+  - (Mobile) Fixed an issue where changes to TTS settings did not take effect immediately
+  - (Mobile) Fixed an issue where importing large books via sharing or as a default opening method caused an error
+  - (Mobile) Fixed an issue where books could not be imported or opened on older versions of iOS (caused by WebView compatibility issues)
+  - (Mobile) TTS stopped unexpectedly after locking the screen
+  [!NOTE]
+  This version has been selected as the stable release candidate. It should work fine in most cases. If you have any concerns, please download the previous stable version
+  [!TIP]
+  You can also download the installation package for this version from the our self-hosted mirror.
+ReleaseNotesUrl: https://github.com/koodo-reader/koodo-reader/releases/tag/v2.3.7
+Documentations:
+- DocumentLabel: Document
+  DocumentUrl: https://www.koodoreader.com/en/document
+ManifestType: defaultLocale
+ManifestVersion: 1.12.0
diff --git a/manifests/a/AppByTroye/KoodoReader/2.3.7/AppByTroye.KoodoReader.locale.zh-CN.yaml b/manifests/a/AppByTroye/KoodoReader/2.3.7/AppByTroye.KoodoReader.locale.zh-CN.yaml
@@ -0,0 +1,67 @@
+# Created with YamlCreate.ps1 Dumplings Mod
+# yaml-language-server: $schema=https://aka.ms/winget-manifest.locale.1.12.0.schema.json
+
+PackageIdentifier: AppByTroye.KoodoReader
+PackageVersion: 2.3.7
+PackageLocale: zh-CN
+PublisherUrl: https://www.koodoreader.com/zh
+PublisherSupportUrl: https://www.koodoreader.com/zh/support
+PrivacyUrl: https://www.koodoreader.com/zh/privacy
+PackageUrl: https://www.koodoreader.com/zh
+CopyrightUrl: https://www.koodoreader.com/zh/term
+ShortDescription: 开源电子阅读解决方案
+Description: Koodo Reader 是一个开源的电子书阅读器，支持多达 15 种主流电子书格式，内置笔记、高亮、翻译功能，助力高效书籍阅读和学习。
+Tags:
+- epub
+- pdf
+- 电子书
+- 电子书阅读器
+- 阅读器
+ReleaseNotes: |-
+  新增
+  - 窗口标题栏在黑夜模式下将显示为黑色
+  - 支持从网络上搜索和匹配图书封面和元数据，请在图书上右键，编辑图书
+  - 支持将笔记和高亮同步思源笔记，需要保持思源笔记处于运行状态，并开启了网络伺服功能
+  - 支持通过图书的下载链接从 URL 导入图书
+  - 浏览器扩展支持从网络上剪藏网页保存到书库
+  - 支持通过网络上的文章链接从 URL 导入文章
+  - 网页版支持恢复图书库和全屏阅读功能
+  - 导入图书之后新增自动同步功能
+  - 点击笔记、高亮、书签、目录跳转之后，支持点击返回按钮返回之前的阅读位置
+  - 新增 6 个预设的图书排版
+  -（移动版）支持从网络上搜索和匹配图书封面和元数据
+  -（移动版）支持将笔记和高亮同步思源笔记，需要保持思源笔记处于运行状态，并开启了网络伺服功能
+  -（移动版）导入图书之后新增自动同步功能
+  -（移动版）新增 6 个预设的图书排版
+  -（移动版）新增定时同步功能，支持自定义同步间隔，请前往设置-同步选项
+  -（移动版）支持和 KOReader 之间同步图书阅读进度，请前往设置-同步选项
+  -（移动版）支持同步生词到欧路词典和 Anki，请前往设置-同步选项
+  -（移动版）关闭翻页动画之后，支持滑动屏幕翻页
+  -（移动版）免费用户支持使用 OPDS 和阅读统计功能
+  -（移动版）iOS 支持更新提示
+  -（移动版）开启音量键翻页之后支持翻页动画
+  -（移动版）发送到 Kindle 支持展示上传进度
+  -（移动版）支持备份和恢复图书库，请前往设置-滑动到底部
+  修复
+  - 修复听书时朗读的内容和当前位置不同步的问题
+  - 修复部分情况下密码保护页面重复弹出的问题
+  - 修复软件不处于运行状态时，无法打开图书、笔记、高亮外链的问题
+  - 修复无法备份图书库到百度网盘和阿里云盘的问题
+  -（移动版）修复听书时朗读的内容和当前位置不同步的问题
+  -（移动版）修复部分情况下听书功能的异常问题
+  -（移动版）修复墨水屏模式下翻页动画未关闭的问题
+  -（移动版）修复发送到 Kindle，文件体积太大时的报错
+  -（移动版）修复修改听书配置之后，没有立即生效的问题
+  -（移动版）修复通过分享和作为打开方式导入大体积图书时的异常
+  -（移动版）修复低版本 iOS 上无法导入和打开图书的问题（Webview 的兼容性问题导致的）
+  -（移动版）修复锁屏时听书的中断问题
+  [!NOTE]
+  此版本由于功能已经稳定，bug 也基本修复，被选为下个稳定版候选。如果您对此有任何顾虑，可以下载上一个稳定版.
+  [!TIP]
+  我们还提供了高速下载镜像，您也可以从 自托管镜像 下载此版本的安装包
+ReleaseNotesUrl: https://github.com/koodo-reader/koodo-reader/releases/tag/v2.3.7
+Documentations:
+- DocumentLabel: 帮助文档
+  DocumentUrl: https://www.koodoreader.com/zh/document
+ManifestType: locale
+ManifestVersion: 1.12.0
diff --git a/manifests/a/AppByTroye/KoodoReader/2.3.7/AppByTroye.KoodoReader.yaml b/manifests/a/AppByTroye/KoodoReader/2.3.7/AppByTroye.KoodoReader.yaml
@@ -0,0 +1,8 @@
+# Created with YamlCreate.ps1 Dumplings Mod
+# yaml-language-server: $schema=https://aka.ms/winget-manifest.version.1.12.0.schema.json
+
+PackageIdentifier: AppByTroye.KoodoReader
+PackageVersion: 2.3.7
+DefaultLocale: en-US
+ManifestType: version
+ManifestVersion: 1.12.0
diff --git a/manifests/a/AquaSecurity/Trivy/0.71.1/AquaSecurity.Trivy.installer.yaml b/manifests/a/AquaSecurity/Trivy/0.71.1/AquaSecurity.Trivy.installer.yaml
@@ -0,0 +1,21 @@
+# Created with komac v2.16.0
+# yaml-language-server: $schema=https://aka.ms/winget-manifest.installer.1.12.0.schema.json
+
+PackageIdentifier: AquaSecurity.Trivy
+PackageVersion: 0.71.1
+InstallerLocale: en-US
+InstallerType: zip
+NestedInstallerType: portable
+NestedInstallerFiles:
+- RelativeFilePath: trivy.exe
+Commands:
+- trivy
+FileExtensions:
+- trivyignore
+ReleaseDate: 2026-06-15
+Installers:
+- Architecture: x64
+  InstallerUrl: https://github.com/aquasecurity/trivy/releases/download/v0.71.1/trivy_0.71.1_windows-64bit.zip
+  InstallerSha256: BA67DAF06923F52938812D1AF134B3193E22B3BC7A525743B9F2A3DED7AB5904
+ManifestType: installer
+ManifestVersion: 1.12.0