Repository navigation
Upgrade shell-quote to patched release - #11
Merged
Merged
Conversation
|
VdustR
marked this pull request as ready for review
October 14, 2026 02:43
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The documentation toolchain locked shell-quote 1.10.0, which allows a line terminator after a comment token to escape quoting. Pin the official patched 1.11.0 through the existing workspace override convention and regenerate only the affected lock entries.
Closes #10. Addresses shell-quote alert.
The regression resolves shell-quote through Docusaurus → webpack-dev-server → launch-editor. It rejects LF, CR, U+2028 and U+2029 after comments and preserves normal quoting/editor-command parsing. Before the update, the four safety cases fail and a harmless marker executes in
/bin/sh; they pass after the update and fail again with the old resolution restored. This verifies the dependency defect; a g2d user-path exploit is not established, and launch-editor uses parse(), not quote().Validation: frozen install; all 41 tests; root and docs type checks; code/package and Docusaurus production builds; git diff --check. Independent adversarial review recorded before submission.
The separate http-cache-semantics alert has no patched primary advisory and remains excluded. Its historical grouped Dependabot run remains failed; this PR does not claim to repair the updater service. No npm version bump is needed: this dependency belongs to the docs development toolchain, is absent from generated core/CLI packages, and main automatically rebuilds/deploys Pages.