[bgentry]

Raise the existing shell-quote override to ^1.11.0 and lock 1.11.0, fixing GHSA-pqg4-j6r4-53mv. concurrently and all other package versions remain unchanged.

The patched release rejects line terminators in string tokens following a comment token, preventing quoted output from escaping the shell comment.

[bgentry]

@brandur fast tracking this one to clear the security alert.

[bgentry]

🤖 Codex review: The dependency security gate is clear, and exact-head local compatibility checks pass. Comment-only because this PR is authored by the authenticated account. CI status is recorded below.

Upgrade

• shell-quote: 1.10.0 → 1.11.0; raise the existing override floor from ^1.9.0 to ^1.11.0.
• Reviewed head: 1fc79f0002f7bc5b20cca32b59546fa59b8bef44.
• Base: 74822e08092768c1b33c099c62011fae39d28525.
• The complete PR diff changes only the override and one canonical npm lock entry. No other versions, graph edges, lifecycle hooks, bins, native packages, registry sources, or same-version integrity values change.

Security review

• Independent read-only supply-chain review compares the actual old/new published tarballs, complete runtime source diff, upstream release commits, package manifests, and regression coverage. Downloaded SHA-512 values match registry metadata and both lock identities; npm ECDSA signatures verify. The new quote.js and parse.js match source at the declared upstream commit.
• Publisher, maintainers, repository, and license remain consistent. No runtime dependencies, install hooks, new executable payloads, network/filesystem access, process execution, dynamic evaluation, or credential harvesting are introduced. Neither release advertises SLSA build provenance; that verification is unavailable rather than assumed.
• 1.11.0 fixes GHSA-pqg4-j6r4-53mv by rejecting all four line terminators in strings following a comment token. Also reviewed the ordinary ANSI-C quoting, escaping, and special-variable parser fixes for compatibility and added execution surfaces.
• Reused the exact signed artifact/source-pair evidence, then independently bound it to this PR's current base, head, manifests, and integrity values. No security delta or blocking finding remains.

Compatibility verification

Completed in an isolated checkout of this exact tree using Node 24.21.0 / npm 11.19.0:

• npm ci --no-audit --no-fund — passed; manifests and lockfile remain unchanged.
• npm ls shell-quote concurrently — resolves shell-quote@1.11.0 beneath unchanged concurrently@10.0.5.
• Focused pure quote/parse regression checks — passed for LF, CR, U+2028, U+2029, nonadjacent later strings, parse-produced comment tokens, safe boundary cases, roundtrips, and River's watch strings. No generated shell payload is executed.
• npm exec -- concurrently --raw --success all 'node --version' 'node --version' — passed.
• CI=true npm run test:once — 35 files / 243 tests passed.
• CI=true npm run lint — passed.
• CI=true npm run build — TypeScript and production build passed.
• CI=true STORYBOOK_DISABLE_TELEMETRY=1 npm run build-storybook -- --disable-telemetry — passed.
• npm audit --json — the shell-quote/concurrently advisory chain is removed; the separate unchanged selector-parser finding remains and is addressed by #709.

CI and merge status

All required GitHub checks pass on this head. CI passes the full Go/PostgreSQL matrix, Go lint, sqlc verification, frontend checks, and release builds. Both architecture builds and manifest jobs pass for open-source Docker and Pro Docker; CodeQL checks also pass. The non-release registry-prefetch job is skipped and is not counted as compatibility evidence.

Residual risk / cleanup

• No blocking issue identified in this version pair. The package's intentional quote/parse bug fixes change behavior for the affected edge cases; no npm build-provenance attestation is available.
• Reassess this existing override when upgrading concurrently. Remove it once every consumer resolves to a patched shell-quote release without the override, then inspect the regenerated lockfile and rerun affected checks.
• This comment records the security and compatibility decision on the reviewed head; no merge or protection override is performed in this review pass.