Skip to content

v9 branch upgrade shell-quote to 1.9.0 #600

Closed

Description

@wxchenxueqi

Describe the bug

Hi Colleagues,
Could PR #599 downport to v9 branch to fix CWE-407 and release a new version?
Thanks.

Activity

  1. fish-can commented on Jul 2, 2026

    @fish-can

    I’m running into the same issue in a pnpm workspace.

    As a temporary workaround, I’m forcing concurrently’s transitive shell-quote dependency to 1.9.0:

    overrides:
      'concurrently@10.0.3>shell-quote': '^1.9.0'

    This works as an emergency mitigation, but it would be better to have an official patch release so downstream projects don’t need package-manager-specific overrides.

    Could the shell-quote@1.9.0 upgrade be backported to the v9 release line and published as a patch release?

  2. gustavohenke commented on Jul 11, 2026

    @gustavohenke
    Member
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions