From 94fbf22f5a0ceb32deadd6013a03577f789f5f13 Mon Sep 17 00:00:00 2001 From: Blake Gentry Date: Tue, 21 Jul 2026 21:32:10 -0500 Subject: [PATCH] override vulnerable shell-quote Dependabot cannot resolve GHSA-395f-4hp3-45gv because `concurrently@10.0.3` pins vulnerable `shell-quote@1.8.4`, and the bot's only automatic path would downgrade `concurrently`. Override the transitive dependency with the compatible patched release line. This resolves `shell-quote@1.10.0` while keeping `concurrently` unchanged and limits lockfile churn to that one package. --- package-lock.json | 6 +++--- package.json | 1 + 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index 02848b1..1b56be1 100644 --- a/package-lock.json +++ b/package-lock.json @@ -7771,9 +7771,9 @@ } }, "node_modules/shell-quote": { - "version": "1.8.4", - "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.4.tgz", - "integrity": "sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ==", + "version": "1.10.0", + "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.10.0.tgz", + "integrity": "sha512-w1aiOKwKuRgtwAReIIj89puqg+I7GvX4IbLrvmhXbzQsj1+Zwi4VO3+fa6ZF91TWSjIxoEkKnMeHcLEODK5ZXA==", "dev": true, "license": "MIT", "engines": { diff --git a/package.json b/package.json index c18adbf..b14a4dc 100644 --- a/package.json +++ b/package.json @@ -72,6 +72,7 @@ "vitest": "^4.1.9" }, "overrides": { + "shell-quote": "^1.9.0", "storybook": "$storybook" }, "scripts": {