From 084cefe023f067a89984f97e41e6127a64c15f41 Mon Sep 17 00:00:00 2001 From: Andreas Reinhold / reini Date: Thu, 23 Jul 2026 11:31:58 +0200 Subject: [PATCH] Force patched shell-quote via npm override Clears the last outstanding advisory (GHSA-395f-4hp3-45gv, quadratic complexity DoS in shell-quote's parse()). npm audit now reports 0 vulnerabilities, down from 3 before this branch. concurrently pins "shell-quote": "1.8.4" exactly, and the maintainers patched only the 9.x line (9.2.4 ships shell-quote 1.9.0) while 10.x still carries 1.8.4. npm's only offered remedy was therefore a downgrade to concurrently@9.2.4. The override keeps concurrently at 10.0.3 and resolves shell-quote to 1.10.0 instead. Overriding a deliberate exact pin warrants checking concurrently still works, so this was verified functionally in node:24-alpine rather than assumed: quoted and escaped arguments parse correctly (the shell-quote code path), named prefixes render, and --kill-others-on-fail still propagates a non-zero exit. npm install, npm ci and npm run build all succeed, build hashes are unchanged, and the PHP suite passes 123 tests. Co-Authored-By: Claude Opus 4.8 (1M context) --- package-lock.json | 7 +++---- package.json | 3 +++ 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/package-lock.json b/package-lock.json index 8c795e6..d7de449 100644 --- a/package-lock.json +++ b/package-lock.json @@ -4,7 +4,6 @@ "requires": true, "packages": { "": { - "name": "app", "dependencies": { "@tailwindcss/vite": "^4.3.3", "alpinejs": "^3.15.12", @@ -1450,9 +1449,9 @@ } }, "node_modules/shell-quote": { - "version": "1.8.4", - "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.4.tgz", - "integrity": "sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ==", + "version": "1.10.0", + "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.10.0.tgz", + "integrity": "sha512-w1aiOKwKuRgtwAReIIj89puqg+I7GvX4IbLrvmhXbzQsj1+Zwi4VO3+fa6ZF91TWSjIxoEkKnMeHcLEODK5ZXA==", "license": "MIT", "engines": { "node": ">= 0.4" diff --git a/package.json b/package.json index edb818b..72341d9 100644 --- a/package.json +++ b/package.json @@ -20,6 +20,9 @@ "@tailwindcss/oxide-linux-x64-gnu": "^4.0.1", "lightningcss-linux-x64-gnu": "^1.29.1" }, + "overrides": { + "shell-quote": "^1.9.0" + }, "devDependencies": { "chokidar": "^5.0.0" }