shell-quote
1.12.0 · 2 Oct 2026MIT96.3M / weekRepositorynpmAtom feed
Upgrading shell-quote From 0.1.1 to 1.0.0
1 release in betweenevery note read
Reading releases, release notes and advisories…
The note of 1.0.0 lists no breaking change or deprecation, which is rare for a major.
- ?
- changes to make
- 0
- advisories fixed
- 0
- new
- 0
- fixes
Security
2 advisories still affect 1.0.0
- shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)high · GHSA-395f-4hp3-45gv
- Potential Command Injection in shell-quotecritical · GHSA-qg8p-v9q4-gh34
Upgrading to 1.9.0 clears them.
17 other lines we could not sort, mostly version bumps
- 1.0.0
Document ops, op example
a6381e6 - 1.0.0
Some more passing double-char op tests
fbc6e5c - 1.0.0
Labeled regex states
8c008b2 - 1.0.0
Refactored the chunker regex into a string
0331c7f - 1.0.0
Simple failing double-char op test
e51fa90 - 1.0.0
Failing expanded single-op tests for ; and ()
710bb24 - 1.0.0
Now passing all the single-char op tests
e3e9ac1 - 1.0.0
Using the control ops directly from the docs
f535987 - 1.0.0
First part of op parsing works
e6f9199 - 1.0.0
Failing redirect tests
cb94c10
1 internal line (docs, tests, tooling) left out.