deps: update shell-quote to 1.12.0

[Abicodexi]

Closes #626

Updates shell-quote from 1.9.0 to 1.12.0 and refreshes pnpm-lock.yaml to address CVE-2026-102422.

The vulnerability allows command injection through quote() when a comment token is followed by a string containing a line terminator. Version 1.11.0 fixes this by rejecting line terminators in tokens following a comment.

Validation

• Ran pnpm test --run
• Added a test in lib/command-parser/expand-arguments.spec.ts for an argument with both ' and !. It passes with 1.12.0 and fails with 1.9.0. Credit to @Mayvis for the test.

[coveralls]

coverage: 98.83%. remained the same — Abicodexi:update-shell-quote into open-cli-tools:main

[mdumakurtas]

👍

[Abicodexi]

Upgrading the version to 1.11.0 will suffice to fix the reported vulnerability, but I can bump the version to 1.12.0 and include a test if needed.

[Mayvis]

Hi @Abicodexi, I opened #625 for the same CVE without noticing this PR first, so I'm closing mine in favor of this one.

It included a regression test that also applies to 1.11.0, in case it's useful here: efe9536

It covers a passthrough argument containing both ' and ! (it's great!). That's the only quote() output concurrently can hit that differs from 1.9.0: 1.11.0 returns 'it'"'"'s great!', while 1.9.0 returned "it's great\!", which leaves a stray backslash in sh/bash. The test passes with 1.11.0 and fails with 1.9.0.

There's also #626 tracking the CVE, if you'd like to add Closes #626 to the description.

[Abicodexi]

Hi @Abicodexi, I opened #625 for the same CVE without noticing this PR first, so I'm closing mine in favor of this one.

It included a regression test that also applies to 1.11.0, in case it's useful here: efe9536

It covers a passthrough argument containing both ' and ! (it's great!). That's the only quote() output concurrently can hit that differs from 1.9.0: 1.11.0 returns 'it'"'"'s great!', while 1.9.0 returned "it's great\!", which leaves a stray backslash in sh/bash. The test passes with 1.11.0 and fails with 1.9.0.

There's also #626 tracking the CVE, if you'd like to add Closes #626 to the description.

Hi @Mayvis, I appreciate that. I can include the regression test here if you don't mind?

[Mayvis]

Not at all, please go ahead! Cherry-picking efe9536 should apply cleanly, since it only touches lib/command-parser/expand-arguments.spec.ts. Thanks for picking it up!

[gustavohenke]

Thanks, folks!

[MassimilianoLattanzio]

@gustavohenke thanks for merging this. What about releasing a new version of the package? In this way, we can update our dependency as well

[gustavohenke]

Yup, it's published on v10.0.6/v9.2.5! Laptop battery died during merge and I forgot to get back to it 🤦