v1.18.1

This patch release fixes a security issue in the CLI's git handling, along with the Windows `.gitignore` crash and a set of contributor bug fixes!

## Security Fix 🔒

### Repository-Level Git Config Is No Longer Executed (GHSA-4p5g-gh74-q524)

Repomix runs `git log` in the target directory to sort files by change frequency, and `git diff` / `git log` for `--include-diffs` / `--include-logs`. Git honors settings from the repository's own `.git/config` that name an executable, such as `gpg.program`, `diff.external`, textconv drivers, and `core.fsmonitor`. A directory shipped with a crafted `.git` (for example inside a zip archive) could therefore run arbitrary commands when Repomix was invoked inside it. A normal `git clone` does not carry the remote's `.git/config`, and `--remote` removes the clone's `.git` before processing, so those paths were not affected.

All git commands Repomix runs in a target directory now disable these settings. Output for a normal repository is unchanged.

See the security advisory for details. Thanks to @kinehoo77-debug for the report! 🙏
https://github.com/yamadashy/repomix/security/advisories/GHSA-4p5g-gh74-q524

## Bug Fixes 🐛

### Windows Crash on `.gitignore` with Backslash Escapes (#1765, #1775)

On Windows, packing failed with ``path should be a `path.relative()`d string`` when a `.gitignore` mixed a backslash-escaped rule with a negation rule. The bug was in globby and is fixed in globby 16.2.3, which this release picks up. Thanks to @iki for the report and for sticking with it! 🙏

### `--remove-comments` No Longer Corrupts Shell and YAML Files (#1752)

Shell and YAML files were stripped with the Perl profile, which treats every unquoted `#` as a comment. In these languages `#` only starts a comment at the beginning of a line or after whitespace, so constructs like `${name##*/}`, `$#`, and URL fragments were being cut. Shell and YAML now use a dedicated handler that respects this rule, heredocs, and block scalars. Thanks @serhiizghama!

### `--include-full-directory-structure` Keeps Non-Included Files (#1749)

When combined with `--include`, the Directory Structure section is meant to show the whole repository tree while packing only the included files' contents. Non-included files were being dropped from the tree. Thanks @serhiizghama!

### Split Output Shows Each Part's Own Directory Tree (#1815, #1822)

With `--split-output`, every part listed the directory tree of the entire output instead of the files in that part. Each part now renders only its own files. Thanks @Elioooon!

### Remote URLs Whose Repository Name Starts with a Dot (#1772)

`https://github.com/microsoft/.github` and similar org profile repositories were rejected as invalid. Thanks @serhiizghama!

### Data URI Parameters Preserved When Truncating Base64 (#1819, #1820)

Truncating long base64 payloads kept only the last `;param` before `;base64,`, dropping the others. Thanks @cyphercodes!

### Small CLI Fixes (#1808, #1809, #1810)

- `--split-output` sizes that round down to zero bytes (such as `0.5b`) are now rejected instead of looping forever.
- Output and skill paths are classified by real directory boundaries, so a sibling directory with a matching prefix is no longer treated as inside the base.
- Remote skill names are derived from the owner and repository of GitHub URLs.

Thanks @Whxuan0701!

## How to Update

```bash
npm update -g repomix
```