From 1fc79f0002f7bc5b20cca32b59546fa59b8bef44 Mon Sep 17 00:00:00 2001
From: Blake Gentry <blakesgentry@gmail.com>
Date: Thu, 22 Oct 2026 09:06:13 -0500
Subject: [PATCH] raise shell-quote override to 1.11.0

The shell-quote version used by concurrently can expose shell input when a
line terminator follows a comment token in `quote()` output.

Raise the existing override floor to the patched 1.11.0 release and lock
that artifact while keeping concurrently and the rest of the dependency
graph unchanged. Reject the vulnerable token sequence before a quoted
command can be executed.
---
 package-lock.json | 6 +++---
 package.json      | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 423b7159..872c941b 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -7828,9 +7828,9 @@
       }
     },
     "node_modules/shell-quote": {
-      "version": "1.10.0",
-      "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.10.0.tgz",
-      "integrity": "sha512-w1aiOKwKuRgtwAReIIj89puqg+I7GvX4IbLrvmhXbzQsj1+Zwi4VO3+fa6ZF91TWSjIxoEkKnMeHcLEODK5ZXA==",
+      "version": "1.11.0",
+      "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.11.0.tgz",
+      "integrity": "sha512-JdxDPD0DBTyu08pq0kPC0xSNet/qsU07qT6IsX1AS8oO2ICNRY4ldNa8OAI6PuwAH8tG3lxEhbqmyp4Dw4036g==",
       "dev": true,
       "license": "MIT",
       "engines": {
diff --git a/package.json b/package.json
index 3493d67d..c8442754 100644
--- a/package.json
+++ b/package.json
@@ -73,7 +73,7 @@
   },
   "overrides": {
     "@babel/runtime": "^7.26.10",
-    "shell-quote": "^1.9.0",
+    "shell-quote": "^1.11.0",
     "storybook": "$storybook"
   },
   "scripts": {