shell-quote
1.12.0 · 2 Oct 2026MIT96.3M / weekRepositorynpmAtom feed
Your version
1.12.0 is the newest release of 1.x.
In short
2 new3 fixed6 changed1 internal
Security
2 advisories affect 1.8.2; 1.9.0 fixes them
- Criticalshell-quote quote() does not escape newlines in object .op valuesGHSA-w7jw-789q-3m8p · 9 Jun 2026Fixed in 1.8.4
- Highshell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)GHSA-395f-4hp3-45gv · 20 Jul 2026Fixed in 1.9.0
Release note
Fixed
quote: preserve empty strings#18
Commits
Fix changelog tags
0fb9fd8Split out node 10-20, and 20+
819bd84Update
@ljharb/eslint-config,auto-changelog,npmignore,tapefc56408Update npm for windows tests
fdeb0fdUpdate
@ljharb/eslint-config,aud,tapeb8a4a3bPrevent node 14 on ARM mac from failing
9eecafcExclude more files from the package
4044e7fAdd missing
engines.node843820eAdd missing peer dep
4c3b88dPin
jackspeaksince 2.1.2+ depends on npm aliases, which kill the install process in npm < 680322ed