chore(deps)(deps): bump shell-quote from 1.8.4 to 1.10.0 - #216
chore(deps)(deps): bump shell-quote from 1.8.4 to 1.10.0#216dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [shell-quote](https://github.com/ljharb/shell-quote) from 1.8.4 to 1.10.0. - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.8.4...v1.10.0) --- updated-dependencies: - dependency-name: shell-quote dependency-version: 1.10.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Security review: no high-confidence vulnerabilities found
Verdict: This PR does not introduce or expose exploitable vulnerabilities. It is a security-positive lockfile-only dependency bump.
Scope reviewed
- Changed files:
package-lock.jsononly (shell-quote1.8.4 → 1.10.0). - Application code: No changes to runtime logic, auth, input handling, or shell execution paths.
Dependency context
shell-quote is a transitive dependency:
@spotlightjs/astro → @spotlightjs/sidecar → launch-editor → shell-quote
The only observed call site is launch-editor/guess.js, which invokes shellQuote.parse(specifiedEditor) when a custom editor command is provided. This is dev-time tooling (Sentry Spotlight sidecar), not production user-facing request handling.
Threat checklist
| Area | Result |
|---|---|
| Injection (SQL/command/template/path) | No new injection surface; no app code changes. |
| Authn/authz bypass | Not applicable. |
| Secrets / token leakage | Not applicable. |
| Deserialization / SSRF / XSS / CSRF | Not applicable. |
| Supply-chain risk | Reduced — upgrade addresses CVE-2026-13311 (quadratic-complexity DoS in parse(), fixed in ≥1.8.5). Base already had 1.8.4, which includes the CVE-2026-9277 command-injection fix. |
Residual exposure (informational, not blocking)
Even on 1.8.4, practical exploitability of CVE-2026-13311 here would require attacker-controlled input reaching launch-editor's parse() path (e.g. via LAUNCH_EDITOR / EDITOR env or a caller-supplied specifiedEditor). That is a local dev configuration surface, not remote production traffic. The bump to 1.10.0 further reduces that residual risk.
Recommendation
Safe to merge from a security standpoint.
Sent by Cursor Automation: Find vulnerabilities
Bumps shell-quote from 1.8.4 to 1.10.0.
Changelog
Sourced from shell-quote's changelog.
Commits
64988d9v1.10.0617d119[Tests]quote: the tilde test escapes every~, not just a leading one (#9)59bbf8b[types] fix an error TS v6 ignores but v7 fails on190e236[Tests]quote: pin that a backslash with whitespace is not doubled in singl...a04d475[Dev Deps] update@arethetypeswrong/cli,evalmdb9545b3[New]parse: add opt-insplitUnquotedoption for shell field-splitting of...1b36468[readme]quote: use output verbatim; do not re-quote it (#11)1c36f3f[Tests]quote: pin conservative escaping of=,@,^,,,:,!(#11)e1c75cd[readme] documentparse's supported parameter-expansion subsetc0842c8[Fix]parse: match nested${...}braces so nested parameter expansion is ...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.