fix: upgrade shell-quote to 1.8.4 (CVE-2026-9277)

[anupamme]

Summary

Upgrade shell-quote from 1.8.3 to 1.8.4 to fix CVE-2026-9277.

Vulnerability

Field	Value
ID	CVE-2026-9277
Severity	CRITICAL
Scanner	trivy
Rule	CVE-2026-9277
File	pnpm-lock.yaml
Assessment	Likely exploitable

Description: shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators

Evidence

Scanner confirmation: trivy rule CVE-2026-9277 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This is a Node.js library - vulnerabilities affect downstream consumers who use this package.

Changes

• package.json
• pnpm-lock.yaml

Behavior Preservation

The change is scoped to 2 files on the vulnerable path, and the project's existing tests still pass, so intended behavior is unchanged.

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

This change addresses a pattern flagged by static analysis. The code path handles user-influenced input and the fix reduces the attack surface against both manual and automated exploitation.

---

Automated security fix by OrbisAI Security

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 438a5005-c7db-4283-a3e2-5427334549c0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[themez]

Thanks for reporting this. We confirmed that CVE-2026-9277 is valid, but upgrading to shell-quote@1.8.4 is no longer sufficient: GHSA-395f-4hp3-45gv affects versions through 1.8.4 and is fixed in 1.9.0 or later.

We have already upgraded shell-quote to 1.10.0, and the update will be included in this repository through our regular sync process. Therefore we do not plan to merge this PR as-is.

Thank you for bringing the original vulnerability to our attention.

[anupamme]

Thanks for the pointer; updated the PR to bump directly to shell-quote@1.10.0, which covers both CVE-2026-9277 and GHSA-395f-4hp3-45gv. Since it's already in your sync pipeline, feel free to close this instead if that's easier; just wanted to leave a mergeable version in case it saves you a step.