---
title: "shell-quote 1.12.0"
description: "Latest published version of shell-quote is 1.12.0, licensed MIT. Current as of our last registry check."
url: https://inlinr.com/packages/shell-quote
lang: en
---

[Packages](https://inlinr.com/packages)

# shell-quote

1.12.0 · 2 Oct 2026 MIT 96.3M / week [Repository](https://github.com/ljharb/shell-quote) [npm](https://www.npmjs.com/package/shell-quote) [Atom feed](https://inlinr.com/packages/feed/shell-quote)

Your version 

## Where each line stands

[Plan an upgrade](https://inlinr.com/packages/shell-quote/upgrade)

LineNewestSecurity

- 1.x 1.12.0 Safe from 1.11.0 Latest line
- 0.1.x and older 0.1.1 4 open advisories, worst critical  · last release Apr 2013, no longer updated [To 1.12.0](https://inlinr.com/packages/shell-quote/upgrade/0.1.1-1.12.0)

## Latest releases

[All 34 releases](https://inlinr.com/packages/shell-quote/releases)

1. ### [1.12.0](https://inlinr.com/packages/shell-quote/releases/1.12.0 "Open this release") [](https://github.com/ljharb/shell-quote/blob/HEAD/CHANGELOG.md "Read this release where it was published")  
2 Oct 2026

  - `parse`: support here-documents (`<<`) [#31](https://github.com/ljharb/shell-quote/issues/31 "https://github.com/ljharb/shell-quote/issues/31")
  - `parse`: support tab-stripping here-documents (`<<-`) [dbfac37](https://github.com/ljharb/shell-quote/commit/dbfac376d4065d37539d3abdb5e76847f93797d3 "https://github.com/ljharb/shell-quote/commit/dbfac376d4065d37539d3abdb5e76847f93797d3")
  - `parse`: support output process substitution (`>(`) [2053315](https://github.com/ljharb/shell-quote/commit/20533154bb57809c80f55318b8493aef49505f4e "https://github.com/ljharb/shell-quote/commit/20533154bb57809c80f55318b8493aef49505f4e")
2. ### [1.11.0](https://inlinr.com/packages/shell-quote/releases/1.11.0 "Open this release") [](https://github.com/ljharb/shell-quote/blob/HEAD/CHANGELOG.md "Read this release where it was published")  
29 Sep 2026

  - `quote`: drop a replace that can never match in the single-quote branch [#15](https://github.com/ljharb/shell-quote/issues/15 "https://github.com/ljharb/shell-quote/issues/15")
  - `parse`: support bash ANSI-C quoting (`$'...'`) [#32](https://github.com/ljharb/shell-quote/issues/32 "https://github.com/ljharb/shell-quote/issues/32")
  - `quote`: reject line terminators in tokens after a `comment` [6002b2e](https://github.com/ljharb/shell-quote/commit/6002b2ed90c6b83095eb272b6b0adaf3a172b0bc "https://github.com/ljharb/shell-quote/commit/6002b2ed90c6b83095eb272b6b0adaf3a172b0bc")
3. ### [1.10.0](https://inlinr.com/packages/shell-quote/releases/1.10.0 "Open this release") [](https://github.com/ljharb/shell-quote/blob/HEAD/CHANGELOG.md "Read this release where it was published")  
10 Jul 2026

  - `parse`: add opt-in `splitUnquoted` option for shell field-splitting of unquoted expansions [#1](https://github.com/ljharb/shell-quote/pull/1 "https://github.com/ljharb/shell-quote/pull/1")
  - `parse`: match nested `${...}` braces so nested parameter expansion is consumed as one substitution [c0842c8](https://github.com/ljharb/shell-quote/commit/c0842c8a7a034066da2496a75e91cbe500ff736c "https://github.com/ljharb/shell-quote/commit/c0842c8a7a034066da2496a75e91cbe500ff736c")
  - Remove the space in js code fences so evalmd evaluates them [2116fa3](https://github.com/ljharb/shell-quote/commit/2116fa36aeea77fe8d561b0db46b1f9b26b8cf1b "https://github.com/ljharb/shell-quote/commit/2116fa36aeea77fe8d561b0db46b1f9b26b8cf1b")

Dependency tracking · free for 3 projects

## Know when your own dependencies move

shell-quote had 3 security advisories in the last 12 months. inlinr emails you the day one touches a project of yours, with the version that fixes it.

- Advisories reach you  
An email when a critical or high advisory affects a project, before the next install.
- Upgrades checked first  
Peer ranges, Node, ESM-only and types changes read before you bump.
- Only what matters  
Majors and breaking notes stay; patches and sibling bumps fold into one line.

[How dependency tracking works](https://inlinr.com/dependencies)

## Security

[All 5](https://inlinr.com/packages/shell-quote/security)

- [shell-quote: \`quote()\` command injection via a line terminator in a token after a \`{ comment }\` token](https://inlinr.com/advisories/GHSA-pqg4-j6r4-53mv) Critical · fixed in 1.11.0
- [shell-quote quote() does not escape newlines in object .op values](https://inlinr.com/advisories/GHSA-w7jw-789q-3m8p) Critical · fixed in 1.8.4
- [Improper Neutralization of Special Elements used in a Command in Shell-quote](https://inlinr.com/advisories/GHSA-g4rg-993r-mgx7) Critical · fixed in 1.7.3

## Health

[Details](https://inlinr.com/packages/shell-quote/security#signals)

- **Provenance**:
- **Publisher**:
- **Maintainers**:
- **Scorecard**:
- **Size**:

## Weekly downloads

Reading releases, release notes and advisories…

Registry facts last checked 4 Nov 2026\. Releases and advisories last read 4 Nov 2026.