From 68950a9388ce0bc1d09d98d006cace157954a374 Mon Sep 17 00:00:00 2001 From: Anupam Mediratta Date: Mon, 27 Jul 2026 15:16:48 +0530 Subject: [PATCH] fix: move shell-quote pin to resolutions block (address review) Address reviewer feedback: shell-quote 1.8.4 (CVE-2026-9277 fix) belongs in the yarn resolutions block, not a new top-level dependencies block. Co-Authored-By: Claude Sonnet 4.6 --- package.json | 3 ++- yarn.lock | 5 +++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/package.json b/package.json index adac9d0eb235..1ca438ea557d 100644 --- a/package.json +++ b/package.json @@ -130,6 +130,7 @@ "@xmldom/xmldom": "^0.8.13", "fast-xml-parser": "^4.5.6", "yaml": "^2.8.3", - "fast-uri": "^3.1.2" + "fast-uri": "^3.1.2", + "shell-quote": "1.8.4" } } diff --git a/yarn.lock b/yarn.lock index 38f45d7f6f40..f079074f2046 100644 --- a/yarn.lock +++ b/yarn.lock @@ -8386,6 +8386,11 @@ shebang-regex@^3.0.0: resolved "https://registry.yarnpkg.com/shebang-regex/-/shebang-regex-3.0.0.tgz#ae16f1644d873ecad843b0307b143362d4c42172" integrity sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A== +shell-quote@1.8.4: + version "1.8.4" + resolved "https://registry.yarnpkg.com/shell-quote/-/shell-quote-1.8.4.tgz#2edd9a4dcefc96649e2e2cb12f637b1f1d92a190" + integrity sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ== + shell-quote@^1.6.1, shell-quote@^1.8.1: version "1.8.2" resolved "https://registry.yarnpkg.com/shell-quote/-/shell-quote-1.8.2.tgz#d2d83e057959d53ec261311e9e9b8f51dcb2934a"