shell-quote
1.12.0 · 2 Oct 2026MIT96.3M / weekRepositorynpmAtom feed
Upgrading shell-quote From 1.8.3 to 1.8.4
1 release in betweenevery note read
Reading releases, release notes and advisories…
- 0
- changes to make
- 1
- advisory fixed
- 0
- new
- 0
- fixes
Security
2 advisories still affect 1.8.4
- shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)high · GHSA-395f-4hp3-45gv
- shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` tokencritical · GHSA-pqg4-j6r4-53mv
Upgrading to 1.11.0 clears them.
Fixes 1 advisory affecting 1.8.3
- shell-quote quote() does not escape newlines in object .op valuescritical · GHSA-w7jw-789q-3m8p
4 other lines we could not sort, mostly version bumps
- 1.8.4
quote: validate object-token shapes4378a6e - 1.8.4
Update
@ljharb/eslint-config,auto-changelog,eslint,npmignore22ebec0 - 1.8.4
Replace runkit CI badge with shields.io check-runs badge
3344a04 - 1.8.4
Update
@ljharb/eslint-config699c511
1 internal line (docs, tests, tooling) left out.