Vulnerabilities in semantic-release software