hotfix: safe .env parsing in deploy script

RELEASE_NOTES_v2.2.83.md

@@ -0,0 +1,14 @@
+# Release Notes v2.2.83
+
+Dato: 2026-05-04
+
+## Hotfix
+
+- `updateto.sh` loader nu `.env` sikkert uden `source`.
+- Deploy fejler ikke laengere med shell-fejl som fx `Hub: command not found` ved ugyldige tekstlinjer i `.env`.
+- Scriptet giver nu tydelig linjenummer-fejl ved ugyldige `.env` linjer.
+
+## Berorte filer
+
+- `updateto.sh`
+- `VERSION`

VERSION

@@ -1 +1 @@
-2.2.82
+2.2.83

updateto.sh

@@ -68,10 +68,58 @@ if grep -q '^STACK_NAME=' .env; then
     sed -i.bak '/^STACK_NAME=/d' .env
 fi
 
-# Load environment variables (DB credentials)
+# Load environment variables safely (without executing arbitrary shell from .env)
-set -a
+load_env_file() {
-source .env
+    local env_file="$1"
-set +a
+    local line=""
+    local trimmed=""
+    local key=""
+    local value=""
+    local first_char=""
+    local last_char=""
+    local line_no=0
+
+    while IFS= read -r line || [ -n "$line" ]; do
+        line_no=$((line_no + 1))
+        line="${line%$'\r'}"
+        trimmed="${line#"${line%%[![:space:]]*}"}"
+
+        if [ -z "$trimmed" ] || [[ "$trimmed" == \#* ]]; then
+            continue
+        fi
+
+        if [[ "$line" != *=* ]]; then
+            echo "❌ Fejl: Ugyldig linje i .env ($line_no): $line"
+            echo "   Forventet format: KEY=VALUE"
+            exit 1
+        fi
+
+        key="${line%%=*}"
+        value="${line#*=}"
+
+        # Trim whitespace around key only.
+        key="${key#"${key%%[![:space:]]*}"}"
+        key="${key%"${key##*[![:space:]]}"}"
+
+        if [[ ! "$key" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]]; then
+            echo "❌ Fejl: Ugyldigt variabelnavn i .env ($line_no): $key"
+            exit 1
+        fi
+
+        # Remove one level of wrapping quotes from value.
+        if [ "${#value}" -ge 2 ]; then
+            first_char="${value:0:1}"
+            last_char="${value: -1}"
+            if { [ "$first_char" = '"' ] && [ "$last_char" = '"' ]; } || { [ "$first_char" = "'" ] && [ "$last_char" = "'" ]; }; then
+                value="${value:1:${#value}-2}"
+            fi
+        fi
+
+        export "$key=$value"
+    done < "$env_file"
+}
+
+load_env_file .env
 
 STACK_NAME="${STACK_NAME:-$DEFAULT_STACK_NAME}"
 POSTGRES_CONTAINER="bmc-hub-postgres-${STACK_NAME}"