From 0efc92b3f3b15f33ee949f3a319556eab957622d Mon Sep 17 00:00:00 2001
From: "Abdullah." <125115953+mabdullahabaid@users.noreply.github.com>
Date: Mon, 27 Jul 2026 12:55:09 +0500
Subject: [PATCH] fix: bump shell-quote 1.8.4 -> 1.10.0 (Dependabot) (#23331)

## Summary

Bumps **shell-quote 1.8.4 -> 1.10.0**, clearing Dependabot alert
[1769](https://github.com/twentyhq/twenty/security/dependabot/1769):
**GHSA-395f-4hp3-45gv / CVE-2026-13311** (high) - quadratic-complexity
Denial of Service in `parse()` (CWE-407), vulnerable `<= 1.8.4`, fixed
1.9.0.

Both consumers declare caret ranges - `@graphql-codegen/cli` (`^1.7.3`)
and `concurrently` (`^1.8.1`) - so a recursive `yarn up -R shell-quote`
lifts the single entry with **no resolution and no `package.json`
change**. Yarn resolves to 1.10.0, the latest in range (above the 1.9.0
fix floor).

## Verification

- `yarn install --immutable` passes.
- Diff is `yarn.lock` only; shell-quote resolves to 1.10.0, no 1.8.4
remains.
- 1.10.0 published 2026-07-10, clears the 3-day npm age gate.
---
 yarn.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/yarn.lock b/yarn.lock
index d747d86010..fdb08fb055 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -46599,9 +46599,9 @@ __metadata:
   linkType: hard
 
 "shell-quote@npm:^1.7.3, shell-quote@npm:^1.8.1":
-  version: 1.8.4
-  resolution: "shell-quote@npm:1.8.4"
-  checksum: 10c0/86c93678bc394cb81f5ddcdc87df9c95d279ef9652775cd1cd1eed361404169a8d8cbaacaeed232ab09919e36ee1e5363863570390d78571f8c22b7f6312fb40
+  version: 1.10.0
+  resolution: "shell-quote@npm:1.10.0"
+  checksum: 10c0/46ee59bfd972ce6a45500c44ed130dff2d0a7d6fbac9841e59d548518cad8060a06393c9a5dcbc0cede294ad80b2a2cd8c904679e09265f53efc0a0879f30961
   languageName: node
   linkType: hard