chore(deps): Update dependency shell-quote@<1.8.4 to v1.10.0 #36

Closed

renovate wants to merge 1 commit from renovate/shell-quote-1.8.4-1.x into main

pull from: renovate/shell-quote-1.8.4-1.x

merge into: trails-cool:main

trails-cool:main

trails-cool:vitest-5-complete-set

trails-cool:caddy-mta-sts

trails-cool:chore/development-deps

trails-cool:fix/restore-openspec-1.10

trails-cool:fix/sentry-upload-loud-and-documented

Conversation 2 Commits 1 Files changed 2 +8 -6

renovate commented 2026-07-27 21:44:43 +00:00

Collaborator

Copy link

This PR contains the following updates:

Package	Change	Age	Confidence
shell-quote@<1.8.4	1.8.4 → 1.10.0

---

Release Notes

ljharb/shell-quote (shell-quote@<1.8.4)

v1.10.0

Compare Source

Merged

• [New] parse: add opt-in splitUnquoted option for shell field-splitting of unquoted expansions #1

Commits

• [Fix] parse: match nested ${...} braces so nested parameter expansion is consumed as one substitution c0842c8
• [Tests] parse: pin single-quote literalness and unmatched-quote handling a0d03e3
• [readme] remove the space in js code fences so evalmd evaluates them 2116fa3
• [Tests] quote: pin conservative escaping of =, @, ^, ,, :, ! (#​11) 1c36f3f
• [readme] document that quote outputs POSIX quoting, not cmd.exe/PowerShell 100e96e
• [readme] document parse's supported parameter-expansion subset e1c75cd
• [Fix] parse: a backslash inside single quotes must not escape the closing quote 5d460a3
• [readme] fix stale example outputs 2de86f5
• [Tests] quote: pin that a backslash with whitespace is not doubled in single quotes (#​14) 190e236
• [readme] quote: use output verbatim; do not re-quote it (#​11) 1b36468
• [Refactor] parse: fix swapped SINGLE_QUOTE/DOUBLE_QUOTE variable names 801af5c
• [types] fix an error TS v6 ignores but v7 fails on 59bbf8b
• [Dev Deps] update @arethetypeswrong/cli, evalmd a04d475
• [Dev Deps] update @arethetypeswrong/ci, eslint d390f9a
• [Tests] quote: the tilde test escapes every ~, not just a leading one (#​9) 617d119

v1.9.0

Compare Source

Commits

• [New] add types dca6e21
• [Dev Deps] update eslint 9aa9e8f
• [Fix] parse: finalize tokens in linear time (GHSA-395f-4hp3-45gv) 7ff5488
• [actions] update workflows 75e8497
• [actions] Windows + node 4/6/7: pin eslint to 9 before install, since npm 2/3 cannot stage eslint 10@types/esrecurse 3fb739d
• [actions] retry npm install on Windows to survive npm 2/3 staging-rename flake abe0163
• [actions] Windows + node 5/7: install deps with a modern node b4bafa2
• [Fix] quote: escape leading ~ to prevent shell tilde-expansion 7a76c1a
• [Dev Deps] update auto-changelog, tape 7184b44
• [Dev Deps] apparently jackspeak is no longer in the graph 9ba368a

---

Configuration

📅 Schedule: (in timezone Europe/Copenhagen)

• Branch creation
  • "before 6am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [shell-quote@<1.8.4](https://github.com/ljharb/shell-quote) | [`1.8.4` → `1.10.0`](https://renovatebot.com/diffs/npm/shell-quote@<1.8.4/1.8.4/1.10.0) |  |  | --- ### Release Notes <details> <summary>ljharb/shell-quote (shell-quote@<1.8.4)</summary> ### [`v1.10.0`](https://github.com/ljharb/shell-quote/blob/HEAD/CHANGELOG.md#v1100---2026-07-10) [Compare Source](https://github.com/ljharb/shell-quote/compare/v1.9.0...v1.10.0) ##### Merged - \[New] `parse`: add opt-in `splitUnquoted` option for shell field-splitting of unquoted expansions [`#1`](https://github.com/ljharb/shell-quote/pull/1) ##### Commits - \[Fix] `parse`: match nested `${...}` braces so nested parameter expansion is consumed as one substitution [`c0842c8`](https://github.com/ljharb/shell-quote/commit/c0842c8a7a034066da2496a75e91cbe500ff736c) - \[Tests] `parse`: pin single-quote literalness and unmatched-quote handling [`a0d03e3`](https://github.com/ljharb/shell-quote/commit/a0d03e35c8ede24016502c4433b8f5d6b3100a62) - \[readme] remove the space in js code fences so evalmd evaluates them [`2116fa3`](https://github.com/ljharb/shell-quote/commit/2116fa36aeea77fe8d561b0db46b1f9b26b8cf1b) - \[Tests] `quote`: pin conservative escaping of `=`, `@`, `^`, `,`, `:`, `!` ([#&#8203;11](https://github.com/ljharb/shell-quote/issues/11)) [`1c36f3f`](https://github.com/ljharb/shell-quote/commit/1c36f3ff77d26d200620c1027e5c271050120b8e) - \[readme] document that `quote` outputs POSIX quoting, not `cmd.exe`/PowerShell [`100e96e`](https://github.com/ljharb/shell-quote/commit/100e96e0ffadcca97d63dda15651c70b9f83507c) - \[readme] document `parse`'s supported parameter-expansion subset [`e1c75cd`](https://github.com/ljharb/shell-quote/commit/e1c75cd6e4a3c60003792c7f2802587d328622cb) - \[Fix] `parse`: a backslash inside single quotes must not escape the closing quote [`5d460a3`](https://github.com/ljharb/shell-quote/commit/5d460a332b54b83153297fe7d1964330b28fa491) - \[readme] fix stale example outputs [`2de86f5`](https://github.com/ljharb/shell-quote/commit/2de86f5d44f44d3ac9df36413d8a05f3534cdec6) - \[Tests] `quote`: pin that a backslash with whitespace is not doubled in single quotes ([#&#8203;14](https://github.com/ljharb/shell-quote/issues/14)) [`190e236`](https://github.com/ljharb/shell-quote/commit/190e236bcf1d81caa8e40e8ea3bb11998575be71) - \[readme] `quote`: use output verbatim; do not re-quote it ([#&#8203;11](https://github.com/ljharb/shell-quote/issues/11)) [`1b36468`](https://github.com/ljharb/shell-quote/commit/1b364683b1e9e8d078fd3017cde82cf10c9c04a5) - \[Refactor] `parse`: fix swapped `SINGLE_QUOTE`/`DOUBLE_QUOTE` variable names [`801af5c`](https://github.com/ljharb/shell-quote/commit/801af5c935b27d6dcda63b3975d5e92a7b6f887f) - \[types] fix an error TS v6 ignores but v7 fails on [`59bbf8b`](https://github.com/ljharb/shell-quote/commit/59bbf8b81bf3236842deb72805744d489f650eba) - \[Dev Deps] update `@arethetypeswrong/cli`, `evalmd` [`a04d475`](https://github.com/ljharb/shell-quote/commit/a04d47516e1cd5b1b4d3f720ddf97561ed0082fc) - \[Dev Deps] update `@arethetypeswrong/ci`, `eslint` [`d390f9a`](https://github.com/ljharb/shell-quote/commit/d390f9a92b97a04b1f799298634e90dc581021e6) - \[Tests] `quote`: the tilde test escapes every `~`, not just a leading one ([#&#8203;9](https://github.com/ljharb/shell-quote/issues/9)) [`617d119`](https://github.com/ljharb/shell-quote/commit/617d119795c7b44d6e49a4d41f80195c4aa5735c) ### [`v1.9.0`](https://github.com/ljharb/shell-quote/blob/HEAD/CHANGELOG.md#v190---2026-06-24) [Compare Source](https://github.com/ljharb/shell-quote/compare/v1.8.4...v1.9.0) ##### Commits - \[New] add types [`dca6e21`](https://github.com/ljharb/shell-quote/commit/dca6e21a02df4cc1a83ed1b5baa4d82df134170a) - \[Dev Deps] update `eslint` [`9aa9e8f`](https://github.com/ljharb/shell-quote/commit/9aa9e8f60991f8c4053a29e476795d891ff851ad) - \[Fix] `parse`: finalize tokens in linear time (GHSA-395f-4hp3-45gv) [`7ff5488`](https://github.com/ljharb/shell-quote/commit/7ff5488599d01c323514f02f5efb74088dd134ec) - \[actions] update workflows [`75e8497`](https://github.com/ljharb/shell-quote/commit/75e849741ffaf2d3aa53ae0e18ef6bf9929ef478) - \[actions] Windows + node 4/6/7: pin eslint to 9 before install, since npm 2/3 cannot stage eslint 10`@types/esrecurse` [`3fb739d`](https://github.com/ljharb/shell-quote/commit/3fb739de44b81c69431947d54fbfc18998dd6d72) - \[actions] retry `npm install` on Windows to survive npm 2/3 staging-rename flake [`abe0163`](https://github.com/ljharb/shell-quote/commit/abe0163293c82963fa8a16cfaa87181846d5aced) - \[actions] Windows + node 5/7: install deps with a modern node [`b4bafa2`](https://github.com/ljharb/shell-quote/commit/b4bafa2e7e58d53d9839b1c24976f61e54b43326) - \[Fix] `quote`: escape leading `~` to prevent shell tilde-expansion [`7a76c1a`](https://github.com/ljharb/shell-quote/commit/7a76c1a12d8461c2234a1c655b943cee84cbff91) - \[Dev Deps] update `auto-changelog`, `tape` [`7184b44`](https://github.com/ljharb/shell-quote/commit/7184b4458b65c17b931e126d8cb5f586c6717dc8) - \[Dev Deps] apparently `jackspeak` is no longer in the graph [`9ba368a`](https://github.com/ljharb/shell-quote/commit/9ba368a4057b9f498b0fef23b5b15543ef81b98c) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Copenhagen) - Branch creation - "before 6am on monday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yODUuMiIsInVwZGF0ZWRJblZlciI6IjQzLjI4MS4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJzZWN1cml0eS1waW4iXX0=-->

renovate added 1 commit 2026-07-27 21:44:43 +00:00

chore(deps): Update dependency shell-quote@<1.8.4 to v1.10.0 ec4ca7783c

renovate force-pushed renovate/shell-quote-1.8.4-1.x from ec4ca7783c to 4b1bbc8935 2026-07-28 07:22:04 +00:00 Compare

renovate force-pushed renovate/shell-quote-1.8.4-1.x from 4b1bbc8935 to 14a55996fd 2026-07-28 16:40:24 +00:00 Compare

ullrich added the

dependencies

label 2026-07-29 13:56:31 +00:00

renovate force-pushed renovate/shell-quote-1.8.4-1.x from 14a55996fd to cad84875fe 2026-07-29 15:21:01 +00:00 Compare

renovate added the

security-pin

label 2026-07-29 15:21:02 +00:00

renovate force-pushed renovate/shell-quote-1.8.4-1.x from cad84875fe to 961e9438d9 2026-07-30 09:14:35 +00:00 Compare

renovate force-pushed renovate/shell-quote-1.8.4-1.x from 961e9438d9 to 6c32739eae 2026-07-30 10:47:48 +00:00 Compare

ullrich referenced this pull request from a commit 2026-07-30 11:14:51 +00:00

ci(renovate): freeze the version line of pnpm.overrides security pins

ullrich referenced this pull request 2026-07-30 11:15:13 +00:00

ci(renovate): freeze the version line of pnpm.overrides security pins #56

ullrich commented 2026-07-30 11:32:43 +00:00

Owner

Copy link

Closing: superseded by #56, which freezes the version line of `pnpm.overrides` security pins (minor and major disabled, patch still flows).

This entry is a CVE floor, not a dependency — the correct value is the minimum patched version inside the range its consumers expect, not the newest release. No current advisory requires leaving the pinned line, so this change is risk without benefit. Renovate will no longer raise it.

If a future advisory can only be satisfied by crossing a minor or major, that becomes a deliberate manual change (ideally driven by osvVulnerabilityAlerts once configured).

Closing: superseded by #56, which freezes the version line of \`pnpm.overrides\` security pins (minor and major disabled, patch still flows). This entry is a CVE floor, not a dependency — the correct value is the minimum patched version inside the range its consumers expect, not the newest release. No current advisory requires leaving the pinned line, so this change is risk without benefit. Renovate will no longer raise it. If a future advisory can only be satisfied by crossing a minor or major, that becomes a deliberate manual change (ideally driven by `osvVulnerabilityAlerts` once configured).

ullrich closed this pull request 2026-07-30 11:32:44 +00:00

renovate commented 2026-07-31 07:44:38 +00:00

Author

Collaborator

Copy link

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (1.10.0). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

### Renovate Ignore Notification Because you closed this PR without merging, Renovate will ignore this update (`1.10.0`). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the `ignoreDeps` array of your Renovate config. If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

Some checks failed

Hide checks

CD Staging / Build & Push Docker Images (pull_request) Has been skipped

Details

CD Staging / Build & Push Docker Images-1 (pull_request) Has been skipped

Details

CD Staging / Deploy Staging (pull_request) Has been skipped

Details

CD Staging / Deploy PR Preview (pull_request) Has been skipped

Details

renovate/stability-days Updates have met minimum release age requirement

Details

CI / Security Scan (pull_request) Successful in 45s

Required

Details

CI / Dockerfile Package Check (pull_request) Successful in 13s

Required

Details

CI / Visual Tests (pull_request) Successful in 10m50s

Required

Details

CI / Checks (pull_request) Successful in 15m16s

Required

Details

CI / Journal Image Smoke Test (pull_request) Successful in 16m48s

Required

Details

CI / E2E Tests (pull_request) Failing after 10m10s

Required

Details

CD Staging / Tear Down PR Preview (pull_request) Successful in 42s

Details

Pull request closed

This pull request cannot be reopened because the branch was deleted.

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

dependencies

Dependency updates raised by Renovate (renovate.json5 labels)

  

major

Major version bump — always needs human review, never auto-merged

  

security-pin

Touches a pnpm.overrides CVE remediation pin, not an ordinary dependency

No labels

dependencies

major

security-pin

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

trails-cool/trails!36

No description provided.