Packages

shell-quote

1.12.0 · 2 Oct 2026MIT96.3M / weekRepositorynpmAtom feed

Upgrading shell-quote From 1.7.2 to 1.9.0

8 releases in betweenevery note read

Reading releases, release notes and advisories…

Other targets from 1.7.2Newest 1.x, Latest1.12.0
  1. 1.7.2yours
  2. 1.7.3security
  3. 1.7.4
  4. 1.8.0
  5. 1.8.1
  6. 1.8.2
  7. 1.8.3
  8. 1.8.4
  9. 1.9.0target
0
changes to make
3
advisories fixed
9
new
7
fixes

Security

1 advisory still affects 1.9.0

Upgrading to 1.11.0 clears it.

Fixes 3 advisories affecting 1.7.2

  • parse: finalize tokens in linear time (GHSA-395f-4hp3-45gv) 7ff5488

    1.9.0

  • Fix a security issue where the regex for windows drive letters allowed some shell meta-characters to escape the quoting rules. (CVE-2021-42740)

    1.7.3

Release by release

  1. 1.9.0

    Security fix25 Jun 20261 new
    • security

      parse: finalize tokens in linear time (GHSA-395f-4hp3-45gv) 7ff5488

    • new

      Add types dca6e21

  2. 1.8.4nothing new or fixed in the note

  3. 1.8.3

    2 Jun 20251 fix
    • fixed

      Remove unnecessary backslash escaping in single quotes #15

  4. 1.8.2

    27 Nov 20242 new · 3 fixes
    • new

      Add missing engines.node 843820e

    • new

      Add missing peer dep 4c3b88d

    • fixed

      quote: preserve empty strings #18

    • fixed

      Fix changelog tags 0fb9fd8

    • fixed

      Prevent node 14 on ARM mac from failing 9eecafc

  5. 1.8.1

    7 Apr 20232 fixes
    • fixed

      parse: preserve whitespace in comments #6

    • fixed

      Properly support the escape option #5

  6. 1.8.0

    31 Jan 20231 new
    • new

      Add support for here strings (<<<) 9802fb3

  7. 1.7.4

    13 Oct 20225 new · 1 fix
    • new

      Add node_modules to .gitignore #48

    • new

      Add auto-changelog 497fca5

    • new

      Add reusable workflows 4763c36

    • new

      Add eslint 6ee1437

    • new

      Add safe-publish-latest 18cadf9

    • fixed

      Fix indentation and whitespace aaa9d1f

  8. 1.7.3

    Security fix21 Oct 2021
    • security

      Fix a security issue where the regex for windows drive letters allowed some shell meta-characters to escape the quoting rules. (CVE-2021-42740)

35 other lines we could not sort, mostly version bumps

  • Update eslint 9aa9e8f

    1.9.0

  • Update workflows 75e8497

    1.9.0

  • Windows + node 4/6/7: pin eslint to 9 before install, since npm 2/3 cannot stage eslint 10@types/esrecurse 3fb739d

    1.9.0

  • Retry npm install on Windows to survive npm 2/3 staging-rename flake abe0163

    1.9.0

  • Windows + node 5/7: install deps with a modern node b4bafa2

    1.9.0

  • quote: escape leading ~ to prevent shell tilde-expansion 7a76c1a

    1.9.0

  • Update auto-changelog, tape 7184b44

    1.9.0

  • Apparently jackspeak is no longer in the graph 9ba368a

    1.9.0

  • quote: validate object-token shapes 4378a6e

    1.8.4

  • Update @ljharb/eslint-config, auto-changelog, eslint, npmignore 22ebec0

    1.8.4

6 internal lines (docs, tests, tooling) left out.