Force patched shell-quote via npm override

Clears the last outstanding advisory (GHSA-395f-4hp3-45gv, quadratic
complexity DoS in shell-quote's parse()). npm audit now reports 0
vulnerabilities, down from 3 before this branch.

concurrently pins "shell-quote": "1.8.4" exactly, and the maintainers
patched only the 9.x line (9.2.4 ships shell-quote 1.9.0) while 10.x still
carries 1.8.4. npm's only offered remedy was therefore a downgrade to
concurrently@9.2.4. The override keeps concurrently at 10.0.3 and resolves
shell-quote to 1.10.0 instead.

Overriding a deliberate exact pin warrants checking concurrently still
works, so this was verified functionally in node:24-alpine rather than
assumed: quoted and escaped arguments parse correctly (the shell-quote
code path), named prefixes render, and --kill-others-on-fail still
propagates a non-zero exit. npm install, npm ci and npm run build all
succeed, build hashes are unchanged, and the PHP suite passes 123 tests.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

This commit is contained in:

Andreas Reinhold / reini

2026-07-23 11:31:58 +02:00

co-authored by

Claude Opus 4.8

parent 91dc4707af

commit 084cefe023

2 changed files with 6 additions and 4 deletions

									
										package.json
									
		+3
		
												View File
												
				@@ -20,6 +20,9 @@

				        "@tailwindcss/oxide-linux-x64-gnu": "^4.0.1",

				        "lightningcss-linux-x64-gnu": "^1.29.1"

				    },

				    "overrides": {

				        "shell-quote": "^1.9.0"

				    },

				    "devDependencies": {

				        "chokidar": "^5.0.0"

				    }