From 428915998b68d879eb73dc6b0eff281e564974fd Mon Sep 17 00:00:00 2001 From: taylanbakircioglu Date: Mon, 15 Jun 2026 14:24:14 +0300 Subject: [PATCH] fix(deps): bump shell-quote to 1.8.4 (GHSA-w7jw-789q-3m8p) Patches the critical shell-quote advisory (quote() does not escape newlines in object .op values, CVSS 8.1). shell-quote is a dev/build-only transitive dependency (react-dev-utils / launch-editor) and is not present in the production image or the browser bundle, so there is no runtime exposure; this clears the alert and the dev-time risk. Lockfile-only change verified to install with shell-quote resolving to 1.8.4. --- frontend/package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/frontend/package-lock.json b/frontend/package-lock.json index d8ced9a..1a785ee 100644 --- a/frontend/package-lock.json +++ b/frontend/package-lock.json @@ -20347,9 +20347,9 @@ } }, "node_modules/shell-quote": { - "version": "1.8.3", - "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.3.tgz", - "integrity": "sha512-ObmnIF4hXNg1BqhnHmgbDETF8dLPCggZWBjkQfhZpbszZnYur5DUljTcCHii5LC3J5E0yeO/1LIMyH+UvHQgyw==", + "version": "1.8.4", + "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.4.tgz", + "integrity": "sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ==", "dev": true, "license": "MIT", "engines": {