Skip to content

[Snyk] Security upgrade shell-quote from 1.8.3 to 1.8.4 #90

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
factory-service-snyk wants to merge 1 commit into
base: dev
Choose a base branch
from
Open

[Snyk] Security upgrade shell-quote from 1.8.3 to 1.8.4 #90

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion base-action/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
},
"dependencies": {
"@actions/core": "^1.10.1",
"shell-quote": "^1.8.3"
"shell-quote": "^1.8.4"
Copy link
Copy Markdown
Contributor

@factory-droid factory-droid Bot May 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[P1] Dependency bump not realized in lockfiles

base-action/package.json bumps shell-quote to ^1.8.4, but both base-action/package-lock.json and base-action/bun.lock still reference/pin shell-quote@1.8.3 (including the resolved tarball). This can break reproducible installs (e.g. npm ci will fail if the lockfile is out of sync) and also means the intended vulnerability fix may not actually be applied in installs. Update/regenerate the lockfiles so they resolve to 1.8.4.

},
"devDependencies": {
"@types/bun": "^1.2.12",
Expand Down
Loading