[MelvinBot]

Details

Bumps transitive shell-quote 1.8.1 → 1.12.0 in package-lock.json (lockfile only; existing ^1.6.1/^1.7.3 ranges allow it). Fixes GHSA-w7jw-789q-3m8p (critical, quote() newline injection) and GHSA-395f-4hp3-45gv (high, parse() quadratic DoS).

Usage: Not imported by this library. Pulled in only via the react-native peer dependency (@react-native-community/cli-tools, react-devtools-core) — dev/CLI tooling, not shipped in dist.

Change Log

• 1.12.0 — parse: here-docs (<<, <<-), >(, ;;&, ;&, >|, <>, &>, &>>
• 1.11.0 — parse: ANSI-C quoting ($'...'), special-param and $_name fixes, escaped-backslash fix; quote: reject line terminators after comment, preserve ! with ', preserve empty globs, escape ~ in globs
• 1.10.0 — parse: opt-in splitUnquoted, nested ${...} fix, single-quote backslash fix; types fix
• 1.9.0 — add types; parse: linear-time token finalization (GHSA-395f-4hp3-45gv); quote: escape leading ~
• 1.8.4 — quote: validate object-token shapes (GHSA-w7jw-789q-3m8p)
• 1.8.3 — remove unneeded backslash escaping in single quotes
• 1.8.2 — quote: preserve empty strings; add engines.node

Full: https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md

Related Issues

https://github.com/Expensify/Expensify/issues/695888

Manual Tests

1. npm ci succeeds; npm ls shell-quote shows only 1.12.0.
2. npm run lint, npm run ts, and npm run build pass.
3. Dependabot alerts Update picomatch to 2.3.2 #51 and #60 close after merge.

Linked PRs

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[chiragsalian]

@MelvinBot post the comment - I have read the CLA Document and I hereby sign the CLA

[chiragsalian]

recheck

[chiragsalian]

Archiving this repository so closing out this PR