shell-quote
1.12.0 · 2 Oct 2026MIT96.3M / weekRepositorynpmAtom feed
Upgrading shell-quote From 1.9.0 to 1.10.0
1 release in betweenevery note read
Reading releases, release notes and advisories…
- 0
- changes to make
- 0
- advisories fixed
- 0
- new
- 2
- fixes
Security
1 advisory still affects 1.10.0
- shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` tokencritical · GHSA-pqg4-j6r4-53mv
Upgrading to 1.11.0 clears it.
Release by release
9 other lines we could not sort, mostly version bumps
- 1.10.0
parse: add opt-insplitUnquotedoption for shell field-splitting of unquoted expansions#1 - 1.10.0
parse: match nested${...}braces so nested parameter expansion is consumed as one substitutionc0842c8 - 1.10.0
Remove the space in js code fences so evalmd evaluates them
2116fa3 - 1.10.0
Document that
quoteoutputs POSIX quoting, notcmd.exe/PowerShell100e96e - 1.10.0
Document
parse's supported parameter-expansion subsete1c75cd - 1.10.0
parse: a backslash inside single quotes must not escape the closing quote5d460a3 - 1.10.0
parse: fix swappedSINGLE_QUOTE/DOUBLE_QUOTEvariable names801af5c - 1.10.0
Update
@arethetypeswrong/cli,evalmda04d475 - 1.10.0
Update
@arethetypeswrong/ci,eslintd390f9a
4 internal lines (docs, tests, tooling) left out.