fix(bundler): quote CLI args

lib/manager/bundler/artifacts.ts

+import { quote } from 'shlex';
 import { BUNDLER_INVALID_CREDENTIALS } from '../../constants/error-messages';
 import { logger } from '../../logger';
 import { platform } from '../../platform';
@@ -97,7 +98,7 @@ export async function updateArtifacts(
     if (config.isLockFileMaintenance) {
       cmd = 'bundle lock';
     } else {
-      cmd = `bundle lock --update ${updatedDeps.join(' ')}`;
+      cmd = `bundle lock --update ${updatedDeps.map(quote).join(' ')}`;
     }
 
     let bundlerVersion = '';
@@ -105,7 +106,7 @@ export async function updateArtifacts(
     if (bundler) {
       if (isValid(bundler)) {
         logger.debug({ bundlerVersion: bundler }, 'Found bundler version');
-        bundlerVersion = ` -v ${bundler}`;
+        bundlerVersion = ` -v ${quote(bundler)}`;
       } else {
         logger.warn({ bundlerVersion: bundler }, 'Invalid bundler version');
       }