FileUtils::escape_filename mishandles a filename of '0'

Status: reasoned from code

lib/Dancer2/FileUtils.pm:67:

my $filename = shift or return;

Returns empty for any falsy-but-valid name — "0" or "".

Not reachable from session IDs (encode_base64url(pack("N6",...)) always yields 32 characters), but this is a published utility in a package called FileUtils, so callers may reasonably pass "0".

Suggested fix

my $filename = shift;
return unless defined $filename && length $filename;

Start in lib/Dancer2/FileUtils.pm at line 67 and trace how escape_filename handles its argument. Confirm that the utility preserves the valid filename "0" while still treating an empty name as empty, then verify the relevant test coverage or add a regression check if the existing tests do not cover this case.