shell-quote
1.12.0 · 2 Oct 2026MIT96.3M / weekRepositorynpmAtom feed
Upgrading shell-quote From 1.2.0 to 1.3.0
1 release in betweenevery note read
Reading releases, release notes and advisories…
- 0
- changes to make
- 0
- advisories fixed
- 0
- new
- 0
- fixes
Security
3 advisories still affect 1.3.0
- shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)high · GHSA-395f-4hp3-45gv
- Potential Command Injection in shell-quotecritical · GHSA-qg8p-v9q4-gh34
- shell-quote quote() does not escape newlines in object .op valuescritical · GHSA-w7jw-789q-3m8p
Upgrading to 1.9.0 clears them.
8 other lines we could not sort, mostly version bumps
- 1.3.0
Hacky tokenizer is much simpler
7e91b18 - 1.3.0
Nearly passing with a clunky state env parser, array issues
d6d6416 - 1.3.0
Test for functional env expansion
666395f - 1.3.0
Upgrade travis versions, tape
f6f8bd6 - 1.3.0
1.3.0, document env() lookups
041c5da - 1.3.0
First half of functional env() works
7a0cf79 - 1.3.0
env() objects even work inside quote strings
16139f5 - 1.3.0
Another check just to make sure env() works
914a1a9