shell-quote
1.12.0 · 2 Oct 2026MIT96.3M / weekRepositorynpmAtom feed
Upgrading shell-quote From 1.8.1 to 1.8.2
1 release in betweenevery note read
Reading releases, release notes and advisories…
Security
2 advisories still affect 1.8.2
- shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)high · GHSA-395f-4hp3-45gv
- shell-quote quote() does not escape newlines in object .op valuescritical · GHSA-w7jw-789q-3m8p
Upgrading to 1.9.0 clears them.
Release by release
6 other lines we could not sort, mostly version bumps
- 1.8.2
Split out node 10-20, and 20+
819bd84 - 1.8.2
Update
@ljharb/eslint-config,auto-changelog,npmignore,tapefc56408 - 1.8.2
Update npm for windows tests
fdeb0fd - 1.8.2
Update
@ljharb/eslint-config,aud,tapeb8a4a3b - 1.8.2
Exclude more files from the package
4044e7f - 1.8.2
Pin
jackspeaksince 2.1.2+ depends on npm aliases, which kill the install process in npm < 680322ed
1 internal line (docs, tests, tooling) left out.