Encode userId in updateUser path

updateUser interpolated payload.userId raw into the PUT path, leaving
the same path-traversal primitive open. Encode it and add a regression
test.

Author: devin-ai-integration[bot]

src/user-management/user-management.spec.ts

@@ -2033,6 +2033,20 @@ describe('UserManagement', () => {
       });
     });
 
+    it('encodes the userId so it cannot escape the route template', async () => {
+      fetchOnce(userFixture);
+
+      await workos.userManagement.updateUser({
+        userId: '../../organizations/org_01TARGET?',
+        firstName: 'Dane',
+      });
+
+      const url = new URL(fetchURL() as string);
+      expect(url.pathname).toBe(
+        '/user_management/users/..%2F..%2Forganizations%2Forg_01TARGET%3F',
+      );
+    });
+
     describe('when only one property is provided', () => {
       it('sends a updateUser request', async () => {
         fetchOnce(userFixture);

src/user-management/user-management.ts

@@ -1008,7 +1008,7 @@ export class UserManagement {
    */
   async updateUser(payload: UpdateUserOptions): Promise<User> {
     const { data } = await this.workos.put<UserResponse>(
-      `/user_management/users/${payload.userId}`,
+      `/user_management/users/${encodeURIComponent(payload.userId)}`,
       serializeUpdateUserOptions(payload),
     );