shell-quote
1.12.0 · 2 Oct 2026MIT96.3M / weekRepositorynpmAtom feed
Upgrading shell-quote From 1.9.0 to 1.11.0
2 releases in betweenevery note read
Reading releases, release notes and advisories…
- 0
- changes to make
- 1
- advisory fixed
- 1
- new
- 4
- fixes
Security
Fixes 1 advisory affecting 1.9.0
- shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` tokencritical · GHSA-pqg4-j6r4-53mv
Release by release
20 other lines we could not sort, mostly version bumps
- 1.11.0
quote: reject line terminators in tokens after acomment6002b2e - 1.11.0
parse: preserve text after special shell parameters81b08a5 - 1.11.0
parse: an escaped backslash does not escape the character after itd708019 - 1.11.0
quote: preserve!in arguments that also contain'ad39927 - 1.11.0
parse: treat$_nameas a variable name, not$_followed by text28f88cd - 1.11.0
quote: preserve empty glob patterns35c9b97 - 1.11.0
quote: escape~in glob patterns to prevent shell tilde-expansion239d49c - 1.11.0
Update
@ljharb/eslint-config,auto-changelog,eslint,evalmdb1e406e - 1.11.0
Npmignore some files
ebfc308 - 1.11.0
Set least-privilege
cache-mode36f2394
4 internal lines (docs, tests, tooling) left out.