Problem
Sample App's development dependency tree locks shell-quote 1.9.0 through
concurrently 10.0.5. GitHub alert 111 identifies that version as affected by
GHSA-pqg4-j6r4-53mv, fixed
in 1.11.0. Dependabot cannot resolve a compatible update automatically because
the parent declares an exact older dependency.
This is development tooling. The advisory requires untrusted token text reaching
shell command quoting. No application exploit or customer impact is established.
Acceptance
- Install the fixed shell-quote through the existing npm dependency tree.
- Keep unrelated dependencies and the Workflow artifact tuple unchanged.
- Verify npm resolution, existing Node tests and frontend build.
- Pass normal repository checks, merge, delete the completed branch and verify
the updated main tree and alert state.
Problem
Sample App's development dependency tree locks shell-quote 1.9.0 through
concurrently 10.0.5. GitHub alert 111 identifies that version as affected by
GHSA-pqg4-j6r4-53mv, fixed
in 1.11.0. Dependabot cannot resolve a compatible update automatically because
the parent declares an exact older dependency.
This is development tooling. The advisory requires untrusted token text reaching
shell command quoting. No application exploit or customer impact is established.
Acceptance
the updated main tree and alert state.