Escape package name before using in spawn

Preventing shell expansion using single quotes did not work on Windows
as the cmd prompt version of `npm show` would use the quote marks in the
api call.

The closest specification of npm package names comes from the docs where
it says that it must be usable as part of a URL. We don't use
encodeURIComponent() as that would escape @ and / as well, so encodeURI
is enough.

https://docs.npmjs.com/cli/v10/configuring-npm/package-json#name

Author: weirdwater

packages/pluggable-widgets-tools/CHANGELOG.md

@@ -9,6 +9,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 ### Fixed
 
 -   We fixed an issue on Windows where the generated `.mpk` was missing the widget's `.xml` files and icon/tile PNGs.
+-   We fixed an error thrown by the `audit` command on windows. It would fail when looking up available versions for vulnerable packages.
 
 ### Changed
 

packages/pluggable-widgets-tools/src/commands/audit.ts

@@ -97,7 +97,8 @@ interface UpdateablePackage {
  * Using the ^ version range avoids this, as the version is specific enough for npm.
  */
 async function findSafeVersion({ name, range }: NpmAudit.Dependency): Promise<UpdateablePackage> {
-    const versions = await promisify(exec)(`npm show '${name}' versions --json`).then(
+    const escapedName = encodeURI(name); // npm package names must be usable as part of a URL
+    const versions = await promisify(exec)(`npm show ${escapedName} versions --json`).then(
         ({ stdout }) => JSON.parse(stdout) as string[]
     );