[Bug]: TextReportFormatter vulnerable to String.format injection via filenames

[Splatcrafter]

AI REVIEWED

Module: cli
File: cli/report/TextReportFormatter.java (~line 85)
Severity: Medium

Summary

String.format() is used with user-supplied file names and type strings. If a filename contains % characters (e.g., file%d.json), String.format() throws MissingFormatArgumentException.

return String.format("Migration: %s [%s] v%d -> v%d (%dms)",
    fileName, type, fromVersion, toVersion, duration.toMillis());

Suggested Fix

Use string concatenation instead of format:

return "Migration: " + fileName + " [" + type + "] v" + fromVersion
    + " -> v" + toVersion + " (" + duration.toMillis() + "ms)";