shell-quote 1.8.3 (root and base-action dependency) is affected by CVE-2026-9277, a CRITICAL severity vulnerability. 1.8.4 contains the fix. Co-authored-by: Ashwin Bhat <ashwin@anthropic.com>