security: force shell-quote >= 1.8.4 (GHSA-w7jw-789q-3m8p, critical) (#21372)
## What `shell-quote <= 1.8.3` is affected by [GHSA-w7jw-789q-3m8p](https://github.com/advisories/GHSA-w7jw-789q-3m8p) / CVE-2026-9277 (**critical**): `quote()` backslash-escapes `.op` characters with `/(.)/g`, which doesn't match line terminators (`\n`, `\r`, U+2028/2029). A line terminator in an object token's `.op` value passes through unescaped, and POSIX shells treat a literal `\n` as a command separator — enabling shell command injection in callers that pass attacker-influenced object tokens to `quote()`. First patched in **1.8.4**. This is Dependabot alert #1434 on the root `yarn.lock`. ## How The root lockfile resolved two vulnerable versions: - `1.8.1` — via the `^1.6.1` / `^1.7.3` / `^1.8.1` ranges - `1.8.3` — **hard-pinned** by `concurrently@9.2.1` (used in `twenty-companion`) `yarn up -R shell-quote` only re-resolves the ranged dependents; the exact `1.8.3` pin from `concurrently` stays. So I added a `shell-quote: "^1.8.4"` entry to root `resolutions`, matching the existing `tmp` / `chokidar` / `tar` security overrides. Every consumer now resolves to the patched `1.8.4`. ## Scope - `package.json`: +1 resolution line. - `yarn.lock`: two vulnerable entries collapse to a single `shell-quote@1.8.4`. - `1.8.4` is a semver-compatible patch over `1.8.3`; latest `concurrently` (10.x) already depends on `1.8.4`. - Verified no `shell-quote <= 1.8.3` remains in any lockfile across the repo.
This commit is contained in:
Charles Bochet
@@ -46,7 +46,7 @@
|
||||
"@timfish/forge-externals-plugin": "^0.2.1",
|
||||
"axios": "^1.16.0",
|
||||
"codemirror": "^6.0.1",
|
||||
"concurrently": "^9.2.1",
|
||||
"concurrently": "^10.0.0",
|
||||
"dotenv": "^16.5.0",
|
||||
"easymde": "^2.20.0",
|
||||
"electron-squirrel-startup": "^1.0.1",
|
||||
|
||||
@@ -30126,6 +30126,13 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"chalk@npm:5.6.2, chalk@npm:^5.6.0, chalk@npm:^5.6.2":
|
||||
version: 5.6.2
|
||||
resolution: "chalk@npm:5.6.2"
|
||||
checksum: 10c0/99a4b0f0e7991796b1e7e3f52dceb9137cae2a9dfc8fc0784a550dc4c558e15ab32ed70b14b21b52beb2679b4892b41a0aa44249bcb996f01e125d58477c6976
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"chalk@npm:^2.3.0, chalk@npm:^2.4.1":
|
||||
version: 2.4.2
|
||||
resolution: "chalk@npm:2.4.2"
|
||||
@@ -30137,13 +30144,6 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"chalk@npm:^5.6.0, chalk@npm:^5.6.2":
|
||||
version: 5.6.2
|
||||
resolution: "chalk@npm:5.6.2"
|
||||
checksum: 10c0/99a4b0f0e7991796b1e7e3f52dceb9137cae2a9dfc8fc0784a550dc4c558e15ab32ed70b14b21b52beb2679b4892b41a0aa44249bcb996f01e125d58477c6976
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"change-case-all@npm:1.0.15":
|
||||
version: 1.0.15
|
||||
resolution: "change-case-all@npm:1.0.15"
|
||||
@@ -31342,6 +31342,23 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"concurrently@npm:^10.0.0":
|
||||
version: 10.0.3
|
||||
resolution: "concurrently@npm:10.0.3"
|
||||
dependencies:
|
||||
chalk: "npm:5.6.2"
|
||||
rxjs: "npm:7.8.2"
|
||||
shell-quote: "npm:1.8.4"
|
||||
supports-color: "npm:10.2.2"
|
||||
tree-kill: "npm:1.2.2"
|
||||
yargs: "npm:18.0.0"
|
||||
bin:
|
||||
conc: dist/bin/index.js
|
||||
concurrently: dist/bin/index.js
|
||||
checksum: 10c0/59a4d9a7946fdbfbfa380543e5e5a40eb5b993cde18862126e8c7fe117813ebd26d67aa67b64781543c0e357eb23fb551f303b622e439354398ff0d7d71735b6
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"concurrently@npm:^8.2.2":
|
||||
version: 8.2.2
|
||||
resolution: "concurrently@npm:8.2.2"
|
||||
@@ -31362,23 +31379,6 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"concurrently@npm:^9.2.1":
|
||||
version: 9.2.1
|
||||
resolution: "concurrently@npm:9.2.1"
|
||||
dependencies:
|
||||
chalk: "npm:4.1.2"
|
||||
rxjs: "npm:7.8.2"
|
||||
shell-quote: "npm:1.8.3"
|
||||
supports-color: "npm:8.1.1"
|
||||
tree-kill: "npm:1.2.2"
|
||||
yargs: "npm:17.7.2"
|
||||
bin:
|
||||
conc: dist/bin/concurrently.js
|
||||
concurrently: dist/bin/concurrently.js
|
||||
checksum: 10c0/da37f239f82eb7ac24f5ddb56259861e5f1d6da2ade7602b6ea7ad3101b13b5ccec02a77b7001402d1028ff2fdc38eed55644b32853ad5abf30e057002a963aa
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"conf@npm:^15.0.2":
|
||||
version: 15.0.2
|
||||
resolution: "conf@npm:15.0.2"
|
||||
@@ -53318,17 +53318,10 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"shell-quote@npm:1.8.3, shell-quote@npm:^1.8.3":
|
||||
version: 1.8.3
|
||||
resolution: "shell-quote@npm:1.8.3"
|
||||
checksum: 10c0/bee87c34e1e986cfb4c30846b8e6327d18874f10b535699866f368ade11ea4ee45433d97bf5eada22c4320c27df79c3a6a7eb1bf3ecfc47f2c997d9e5e2672fd
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"shell-quote@npm:^1.6.1, shell-quote@npm:^1.7.3, shell-quote@npm:^1.8.1":
|
||||
version: 1.8.1
|
||||
resolution: "shell-quote@npm:1.8.1"
|
||||
checksum: 10c0/8cec6fd827bad74d0a49347057d40dfea1e01f12a6123bf82c4649f3ef152fc2bc6d6176e6376bffcd205d9d0ccb4f1f9acae889384d20baff92186f01ea455a
|
||||
"shell-quote@npm:1.8.4, shell-quote@npm:^1.6.1, shell-quote@npm:^1.7.3, shell-quote@npm:^1.8.1, shell-quote@npm:^1.8.3":
|
||||
version: 1.8.4
|
||||
resolution: "shell-quote@npm:1.8.4"
|
||||
checksum: 10c0/86c93678bc394cb81f5ddcdc87df9c95d279ef9652775cd1cd1eed361404169a8d8cbaacaeed232ab09919e36ee1e5363863570390d78571f8c22b7f6312fb40
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
@@ -54882,16 +54875,7 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"supports-color@npm:8.1.1, supports-color@npm:^8.0.0, supports-color@npm:^8.1.0, supports-color@npm:^8.1.1, supports-color@npm:~8.1.1":
|
||||
version: 8.1.1
|
||||
resolution: "supports-color@npm:8.1.1"
|
||||
dependencies:
|
||||
has-flag: "npm:^4.0.0"
|
||||
checksum: 10c0/ea1d3c275dd604c974670f63943ed9bd83623edc102430c05adb8efc56ba492746b6e95386e7831b872ec3807fd89dd8eb43f735195f37b5ec343e4234cc7e89
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"supports-color@npm:^10.0.0":
|
||||
"supports-color@npm:10.2.2, supports-color@npm:^10.0.0":
|
||||
version: 10.2.2
|
||||
resolution: "supports-color@npm:10.2.2"
|
||||
checksum: 10c0/fb28dd7e0cdf80afb3f2a41df5e068d60c8b4f97f7140de2eaed5b42e075d82a0e980b20a2c0efd2b6d73cfacb55555285d8cc719fa0472220715aefeaa1da7c
|
||||
@@ -54916,6 +54900,15 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"supports-color@npm:^8.0.0, supports-color@npm:^8.1.0, supports-color@npm:^8.1.1, supports-color@npm:~8.1.1":
|
||||
version: 8.1.1
|
||||
resolution: "supports-color@npm:8.1.1"
|
||||
dependencies:
|
||||
has-flag: "npm:^4.0.0"
|
||||
checksum: 10c0/ea1d3c275dd604c974670f63943ed9bd83623edc102430c05adb8efc56ba492746b6e95386e7831b872ec3807fd89dd8eb43f735195f37b5ec343e4234cc7e89
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"supports-hyperlinks@npm:^1.0.1":
|
||||
version: 1.0.1
|
||||
resolution: "supports-hyperlinks@npm:1.0.1"
|
||||
@@ -56205,7 +56198,7 @@ __metadata:
|
||||
"@vercel/webpack-asset-relocator-loader": "npm:^1.7.3"
|
||||
axios: "npm:^1.16.0"
|
||||
codemirror: "npm:^6.0.1"
|
||||
concurrently: "npm:^9.2.1"
|
||||
concurrently: "npm:^10.0.0"
|
||||
css-loader: "npm:^6.11.0"
|
||||
dotenv: "npm:^16.5.0"
|
||||
easymde: "npm:^2.20.0"
|
||||
@@ -60266,18 +60259,17 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"yargs@npm:17.7.2, yargs@npm:^17.0.0, yargs@npm:^17.0.1, yargs@npm:^17.3.1, yargs@npm:^17.5.1, yargs@npm:^17.6.2, yargs@npm:^17.7.2":
|
||||
version: 17.7.2
|
||||
resolution: "yargs@npm:17.7.2"
|
||||
"yargs@npm:18.0.0, yargs@npm:^18.0.0":
|
||||
version: 18.0.0
|
||||
resolution: "yargs@npm:18.0.0"
|
||||
dependencies:
|
||||
cliui: "npm:^8.0.1"
|
||||
cliui: "npm:^9.0.1"
|
||||
escalade: "npm:^3.1.1"
|
||||
get-caller-file: "npm:^2.0.5"
|
||||
require-directory: "npm:^2.1.1"
|
||||
string-width: "npm:^4.2.3"
|
||||
string-width: "npm:^7.2.0"
|
||||
y18n: "npm:^5.0.5"
|
||||
yargs-parser: "npm:^21.1.1"
|
||||
checksum: 10c0/ccd7e723e61ad5965fffbb791366db689572b80cca80e0f96aad968dfff4156cd7cd1ad18607afe1046d8241e6fb2d6c08bf7fa7bfb5eaec818735d8feac8f05
|
||||
yargs-parser: "npm:^22.0.0"
|
||||
checksum: 10c0/bf290e4723876ea9c638c786a5c42ac28e03c9ca2325e1424bf43b94e5876456292d3ed905b853ebbba6daf43ed29e772ac2a6b3c5fb1b16533245d6211778f3
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
@@ -60315,17 +60307,18 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"yargs@npm:^18.0.0":
|
||||
version: 18.0.0
|
||||
resolution: "yargs@npm:18.0.0"
|
||||
"yargs@npm:^17.0.0, yargs@npm:^17.0.1, yargs@npm:^17.3.1, yargs@npm:^17.5.1, yargs@npm:^17.6.2, yargs@npm:^17.7.2":
|
||||
version: 17.7.2
|
||||
resolution: "yargs@npm:17.7.2"
|
||||
dependencies:
|
||||
cliui: "npm:^9.0.1"
|
||||
cliui: "npm:^8.0.1"
|
||||
escalade: "npm:^3.1.1"
|
||||
get-caller-file: "npm:^2.0.5"
|
||||
string-width: "npm:^7.2.0"
|
||||
require-directory: "npm:^2.1.1"
|
||||
string-width: "npm:^4.2.3"
|
||||
y18n: "npm:^5.0.5"
|
||||
yargs-parser: "npm:^22.0.0"
|
||||
checksum: 10c0/bf290e4723876ea9c638c786a5c42ac28e03c9ca2325e1424bf43b94e5876456292d3ed905b853ebbba6daf43ed29e772ac2a6b3c5fb1b16533245d6211778f3
|
||||
yargs-parser: "npm:^21.1.1"
|
||||
checksum: 10c0/ccd7e723e61ad5965fffbb791366db689572b80cca80e0f96aad968dfff4156cd7cd1ad18607afe1046d8241e6fb2d6c08bf7fa7bfb5eaec818735d8feac8f05
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
|
||||
Reference in New Issue
Block a user