shell-quote
1.12.0 · 2 Oct 2026MIT96.3M / weekRepositorynpmAtom feed
Your version
1.12.0 is the newest release of 1.x.
In short
4 changed1 internal
Security
Fixes 1 advisory that affected 1.8.3
- Criticalshell-quote quote() does not escape newlines in object .op valuesGHSA-w7jw-789q-3m8p · 9 Jun 2026Fixed in 1.8.4
2 advisories affect 1.8.4; 1.11.0 fixes them
- Criticalshell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` tokenGHSA-pqg4-j6r4-53mv · 6 Oct 2026Fixed in 1.11.0
- Highshell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)GHSA-395f-4hp3-45gv · 20 Jul 2026Fixed in 1.9.0
Release note
Commits
quote: validate object-token shapes4378a6eUpdate
@ljharb/eslint-config,auto-changelog,eslint,npmignore22ebec0Replace runkit CI badge with shields.io check-runs badge
3344a04Update
@ljharb/eslint-config699c511