shell-quote
1.12.0 · 2 Oct 2026MIT96.3M / weekRepositorynpmAtom feed
0.1.1 is the newest release of 0.1.x.
In short
1 fixed19 changed2 internal
Security
2 advisories affect 0.1.0; 1.9.0 fixes them
- CriticalPotential Command Injection in shell-quoteGHSA-qg8p-v9q4-gh34 · 18 Feb 2019Fixed in 1.6.1
- Highshell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)GHSA-395f-4hp3-45gv · 20 Jul 2026Fixed in 1.9.0
Release note
Commits
Externalize the regex declaration
37d6058Modernize the readme
24106f5Factor out interpolation
1b21b01Half the env tests are working with basic interpolation
5891471Env parse example
5757c42Denormalize the interpolate logic to make room for special cases
c669d2eCleaner implementation recursing on the double quote case
adae66fOne test was wrong, checking for pre escapes
42b5f83Finally passing all the tests
efa4084One more test passing with quote recursion
e9537b9Use tape everywhere
ed0c1c6Some extra metacharacter tests just to be sure
a6782aeMinor fix to an env test
601b340Document parse env
cc0efbaBetter parse recursion to capture the containing quotes
8467961Now just 2 tests failing with a subtle regex reordering
5448a02Pass another test by using "" as the undefined
46e6cf4Fixed a failing env test
17d1fdaActually the test was wrong, module works fine
9d7b727Another test to be even more sure
5afd47b