shell-quote
1.12.0 · 2 Oct 2026MIT96.3M / weekRepositorynpmAtom feed
1.12.0 is the newest release of 1.x.
In short
2 fixed9 changed4 internal
Security
1 advisory affects 1.10.0; 1.11.0 fixes them
- Criticalshell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` tokenGHSA-pqg4-j6r4-53mv · 6 Oct 2026Fixed in 1.11.0
Release note
Merged
parse: add opt-insplitUnquotedoption for shell field-splitting of unquoted expansions#1
Commits
parse: match nested${...}braces so nested parameter expansion is consumed as one substitutionc0842c8Remove the space in js code fences so evalmd evaluates them
2116fa3Document that
quoteoutputs POSIX quoting, notcmd.exe/PowerShell100e96eDocument
parse's supported parameter-expansion subsete1c75cdparse: a backslash inside single quotes must not escape the closing quote5d460a3Fix stale example outputs
2de86f5quote: use output verbatim; do not re-quote it (#11)1b36468parse: fix swappedSINGLE_QUOTE/DOUBLE_QUOTEvariable names801af5cFix an error TS v6 ignores but v7 fails on
59bbf8bUpdate
@arethetypeswrong/cli,evalmda04d475Update
@arethetypeswrong/ci,eslintd390f9a