From 5da4c76ddeb0fad381fd36a43ffdf84508cf9f52 Mon Sep 17 00:00:00 2001 From: Dhaval Doshi <37418489+doshidhaval@users.noreply.github.com> Date: Sat, 15 Aug 2026 05:16:34 +0530 Subject: [PATCH] fix: bump shell-quote to 1.8.4 to remediate CVE-2026-9277 (#1557) shell-quote 1.8.3 (root and base-action dependency) is affected by CVE-2026-9277, a CRITICAL severity vulnerability. 1.8.4 contains the fix. Co-authored-by: Ashwin Bhat --- base-action/bun.lock | 2 +- base-action/package-lock.json | 8 ++++---- base-action/package.json | 2 +- bun.lock | 2 +- package.json | 2 +- 5 files changed, 8 insertions(+), 8 deletions(-) diff --git a/base-action/bun.lock b/base-action/bun.lock index ec1b434a..f5873ce6 100644 --- a/base-action/bun.lock +++ b/base-action/bun.lock @@ -223,7 +223,7 @@ "shebang-regex": ["shebang-regex@3.0.0", "", {}, "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A=="], - "shell-quote": ["shell-quote@1.8.3", "", {}, "sha512-ObmnIF4hXNg1BqhnHmgbDETF8dLPCggZWBjkQfhZpbszZnYur5DUljTcCHii5LC3J5E0yeO/1LIMyH+UvHQgyw=="], + "shell-quote": ["shell-quote@1.8.4", "", {}, "sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ=="], "side-channel": ["side-channel@1.1.0", "", { "dependencies": { "es-errors": "^1.3.0", "object-inspect": "^1.13.3", "side-channel-list": "^1.0.0", "side-channel-map": "^1.0.1", "side-channel-weakmap": "^1.0.2" } }, "sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw=="], diff --git a/base-action/package-lock.json b/base-action/package-lock.json index fb44af35..c5027f45 100644 --- a/base-action/package-lock.json +++ b/base-action/package-lock.json @@ -9,7 +9,7 @@ "version": "1.0.0", "dependencies": { "@actions/core": "^1.10.1", - "shell-quote": "^1.8.3" + "shell-quote": "^1.8.4" }, "devDependencies": { "@types/bun": "^1.2.12", @@ -139,9 +139,9 @@ } }, "node_modules/shell-quote": { - "version": "1.8.3", - "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.3.tgz", - "integrity": "sha512-ObmnIF4hXNg1BqhnHmgbDETF8dLPCggZWBjkQfhZpbszZnYur5DUljTcCHii5LC3J5E0yeO/1LIMyH+UvHQgyw==", + "version": "1.8.4", + "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.4.tgz", + "integrity": "sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ==", "license": "MIT", "engines": { "node": ">= 0.4" diff --git a/base-action/package.json b/base-action/package.json index 33498a57..1bc2ec26 100644 --- a/base-action/package.json +++ b/base-action/package.json @@ -12,7 +12,7 @@ "dependencies": { "@actions/core": "^1.10.1", "@anthropic-ai/claude-agent-sdk": "^0.3.233", - "shell-quote": "^1.8.3" + "shell-quote": "^1.8.4" }, "devDependencies": { "@types/bun": "^1.2.12", diff --git a/bun.lock b/bun.lock index f783d1e6..b8fac9e2 100644 --- a/bun.lock +++ b/bun.lock @@ -275,7 +275,7 @@ "shebang-regex": ["shebang-regex@3.0.0", "", {}, "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A=="], - "shell-quote": ["shell-quote@1.8.3", "", {}, "sha512-ObmnIF4hXNg1BqhnHmgbDETF8dLPCggZWBjkQfhZpbszZnYur5DUljTcCHii5LC3J5E0yeO/1LIMyH+UvHQgyw=="], + "shell-quote": ["shell-quote@1.8.4", "", {}, "sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ=="], "side-channel": ["side-channel@1.1.0", "", { "dependencies": { "es-errors": "^1.3.0", "object-inspect": "^1.13.3", "side-channel-list": "^1.0.0", "side-channel-map": "^1.0.1", "side-channel-weakmap": "^1.0.2" } }, "sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw=="], diff --git a/package.json b/package.json index f05c7316..f02a796b 100644 --- a/package.json +++ b/package.json @@ -18,7 +18,7 @@ "@octokit/rest": "^21.1.1", "@octokit/webhooks-types": "^7.6.1", "node-fetch": "^3.3.2", - "shell-quote": "^1.8.3", + "shell-quote": "^1.8.4", "zod": "^3.24.4" }, "devDependencies": {