dependency-manager

• I am on the latest Poet

How are you running Renovate?

WhiteSource Renovate hosted app on github.com

If you're self-hosting Renovate, tell us what version of Renovate you run.

No response

Please select which platform you are using if self-hosting.

github.com

If you're self-hosting Renovate, tell us what version of the platform you run.

No response

Describe the bug

`helm

Describe the bug
CodeQL show that we are logging paths directly. We should instead escape and then log them.

To Reproduce
Results are shown here: https://github.com/gomods/athens/pull/1748/checks?check_run_id=4567576462

Expected behavior

We can simply log escaped paths provided by net/url: https://pkg.go.dev/net/url#URL.EscapedPath

Additional context
Add an

If CPM_SOURCE_CACHE is set to an empty string, CPM fails with file DOWNLOAD error: cannot create directory '/cpm' - Specify file by full.

We currently don't support compiler options which are two parameters, like -encoding UTF-8, and commas also seem to be invalid in parameters, presumably excluded by some regex...