docs: add backslash-continuation TODO for bundle-manifests loader

Multi-line manifest entries with trailing \ silently break the one-line-per-entry
loader (rest becomes \, submodule path %5C, 404). Track the fix; workaround is a
one-lined openvino entry on the VM.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

1 files changed, 2 insertions, 1 deletions

diff --git a/TODO.md b/TODO.md
index 16c0e37..24d3c2a 100644
--- a/TODO.md
+++ b/TODO.md
@@ -13,4 +13,5 @@
  - [ ] verify md5 against the manifest `SHA256`: cross-check the downloaded file's sha256 against the manifest entry before writing MD5SUM (integrity check)
  - [ ] config validation command (e.g. `--check-config`): sanity-check nvchecker.toml sections, bundle-manifests URLs, phantom-deps file, and that configured paths exist
  - [ ] batch `--check` summary report at the end: counts of updated / bundled-deps bumped / skipped, instead of only per-package interleaved output
- - [ ] check if package ships an nvchecker stanza and use that instead in case our functions would simply print the stub when adding the .hint file.
\ No newline at end of file
+ - [ ] check if package ships an nvchecker stanza and use that instead in case our functions would simply print the stub when adding the .hint file.
+ - [ ] **backslash-continuation in bundle-manifests loader.** `load_bundle_manifests` reads one physical line per entry, so a long sha-mode line (openvino: 8 `name=path` deps) can't be split across lines for readability: a trailing `\` silently breaks parsing (only the first physical line is read, `rest` becomes `\` → submodule path `%5C` → GitHub contents API 404). Fix: join `\<newline><whitespace>` → single space before parsing (shell-style continuation). Test: a continued sha-mode line parses identically to the one-line form (mode, dep count, each `name=path`). Workaround in place: openvino entry one-lined by hand on the VM.
\ No newline at end of file