shell-quote
1.12.0 · 2 Oct 2026MIT96.3M / weekRepositorynpmAtom feed
Upgrading shell-quote From 1.3.1 to 1.3.2
1 release in betweenevery note read
Reading releases, release notes and advisories…
- 0
- changes to make
- 0
- advisories fixed
- 0
- new
- 1
- fix
Security
3 advisories still affect 1.3.2
- shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)high · GHSA-395f-4hp3-45gv
- Potential Command Injection in shell-quotecritical · GHSA-qg8p-v9q4-gh34
- shell-quote quote() does not escape newlines in object .op valuescritical · GHSA-w7jw-789q-3m8p
Upgrading to 1.9.0 clears them.
Release by release
7 other lines we could not sort, mostly version bumps
- 1.3.2
Tests for setting env vars
f44b039 - 1.3.2
Factored out single and double quote regex
de9e0a5 - 1.3.2
Updated set env test, already passes
7d5636b - 1.3.2
Ops fixed
2b4e1b1 - 1.3.2
Passing all tests
44177e3 - 1.3.2
Backreferences in negated capture groups don't actually work
e189d9d - 1.3.2
Another crazy ridiculous passing parse test
d1beb6b
2 internal lines (docs, tests, tooling) left out.