From 36642c06feac24682fb9049254808f3f70bd3cd6 Mon Sep 17 00:00:00 2001 From: svector-anu Date: Sat, 10 Oct 2026 14:06:28 +0100 Subject: [PATCH] fix(deps): bump shell-quote override past GHSA-pqg4-j6r4-53mv PR #64's override pinned shell-quote to ^1.9.0 to clear an older advisory, but that range resolves to 1.10.0 - squarely inside the critical command- injection advisory GHSA-pqg4-j6r4-53mv (1.8.4-1.10.0, CVE-2026-102422), which npm audit flags on this repo today. shell-quote only reaches this extension through web-ext's Firefox-launch chain (a devDependency), so exposure is bounded, but the override itself no longer does what it was written for. 1.11.0 (released 2026-10-06) is the first patched release per the advisory. Bumped the override there; npm ls now resolves 1.12.0 (current latest), clear of the vulnerable range. Verified: npm audit no longer flags shell-quote; npm run build, node build.js validate, node test-extension.js, and npx web-ext lint --source-dir=dist/firefox --self-hosted all pass clean (same checks PR #88 used for the adjacent brace-expansion override bump). --- opendia-extension/package-lock.json | 6 +++--- opendia-extension/package.json | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/opendia-extension/package-lock.json b/opendia-extension/package-lock.json index aa77f1c..fa511f5 100644 --- a/opendia-extension/package-lock.json +++ b/opendia-extension/package-lock.json @@ -3293,9 +3293,9 @@ } }, "node_modules/shell-quote": { - "version": "1.10.0", - "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.10.0.tgz", - "integrity": "sha512-w1aiOKwKuRgtwAReIIj89puqg+I7GvX4IbLrvmhXbzQsj1+Zwi4VO3+fa6ZF91TWSjIxoEkKnMeHcLEODK5ZXA==", + "version": "1.12.0", + "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.12.0.tgz", + "integrity": "sha512-PcByqNyT/38F2kDNi006HAMRJaULuBzq/FOsw3qdZvX/GA9W/jamDaRskgHjubHiftXK5sIFxLNkvrXUwcof6Q==", "dev": true, "license": "MIT", "engines": { diff --git a/opendia-extension/package.json b/opendia-extension/package.json index a3cbc60..60614d2 100644 --- a/opendia-extension/package.json +++ b/opendia-extension/package.json @@ -27,6 +27,6 @@ }, "overrides": { "brace-expansion": "^1.1.21", - "shell-quote": "^1.9.0" + "shell-quote": "^1.11.0" } }