shell-quote
1.12.0 · 2 Oct 2026MIT96.3M / weekRepositorynpmAtom feed
Your version
1.12.0 is the newest release of 1.x.
In short
1 fixed7 changed2 internal
Security
3 advisories affect 1.3.2; 1.9.0 fixes them
- Criticalshell-quote quote() does not escape newlines in object .op valuesGHSA-w7jw-789q-3m8p · 9 Jun 2026Fixed in 1.8.4
- CriticalPotential Command Injection in shell-quoteGHSA-qg8p-v9q4-gh34 · 18 Feb 2019Fixed in 1.6.1
- Highshell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)GHSA-395f-4hp3-45gv · 20 Jul 2026Fixed in 1.9.0
Release note
Commits
Tests for setting env vars
f44b039Fixed the parse test, broke the op tests
74d6686Factored out single and double quote regex
de9e0a5Updated set env test, already passes
7d5636bOps fixed
2b4e1b1Passing all tests
44177e3Backreferences in negated capture groups don't actually work
e189d9dAnother crazy ridiculous passing parse test
d1beb6b