shell-quote

1.12.0 · 2 Oct 2026MIT96.3M / weekRepository npm Atom feed

Your version

1.9.0

25 Jun 2026Where it was published

1.12.0 is the newest release of 1.x.

In short

1 security1 new8 changed

Security

Fixes 1 advisory that affected 1.8.4

High
shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)GHSA-395f-4hp3-45gv · 20 Jul 2026
Fixed in 1.9.0

1 advisory affects 1.9.0; 1.11.0 fixes them

Critical
shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` tokenGHSA-pqg4-j6r4-53mv · 6 Oct 2026
Fixed in 1.11.0

Release note

Commits

Add types dca6e21
Update eslint 9aa9e8f
security
parse: finalize tokens in linear time (GHSA-395f-4hp3-45gv) 7ff5488
Update workflows 75e8497
Windows + node 4/6/7: pin eslint to 9 before install, since npm 2/3 cannot stage eslint 10@types/esrecurse 3fb739d
Retry npm install on Windows to survive npm 2/3 staging-rename flake abe0163
Windows + node 5/7: install deps with a modern node b4bafa2
quote: escape leading ~ to prevent shell tilde-expansion 7a76c1a
Update auto-changelog, tape 7184b44
Apparently jackspeak is no longer in the graph 9ba368a