shell-quote
1.12.0 · 2 Oct 2026MIT96.3M / weekRepositorynpmAtom feed
1.12.0 is the newest release of 1.x.
In short
1 new2 fixed11 changed
Security
Fixes 1 advisory that affected 1.10.0
- Criticalshell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` tokenGHSA-pqg4-j6r4-53mv · 6 Oct 2026Fixed in 1.11.0
Release note
Fixed
quote: drop a replace that can never match in the single-quote branch#15parse: support bash ANSI-C quoting ($'...')#32
Commits
quote: reject line terminators in tokens after acomment6002b2eparse: preserve text after special shell parameters81b08a5parse: an escaped backslash does not escape the character after itd708019quote: preserve!in arguments that also contain'ad39927parse: treat$_nameas a variable name, not$_followed by text28f88cdquote: preserve empty glob patterns35c9b97quote: escape~in glob patterns to prevent shell tilde-expansion239d49cUpdate
@ljharb/eslint-config,auto-changelog,eslint,evalmdb1e406eNpmignore some files
ebfc308Add permissions
3429b0dSet least-privilege
cache-mode36f2394Update
eslint6de9a41