Bump shell-quote from 1.8.3 to 1.10.0 in /pulumi

[dependabot]

Bumps shell-quote from 1.8.3 to 1.10.0.

Changelog

Sourced from shell-quote's changelog.

v1.10.0 - 2026-07-10

Merged

• [New] parse: add opt-in splitUnquoted option for shell field-splitting of unquoted expansions [#1](https://github.com/ljharb/shell-quote/issues/1)

Commits

• [Fix] parse: match nested ${...} braces so nested parameter expansion is consumed as one substitution c0842c8
• [Tests] parse: pin single-quote literalness and unmatched-quote handling a0d03e3
• [readme] remove the space in js code fences so evalmd evaluates them 2116fa3
• [Tests] quote: pin conservative escaping of =, @, ^, ,, :, ! (#11) 1c36f3f
• [readme] document that quote outputs POSIX quoting, not cmd.exe/PowerShell 100e96e
• [readme] document parse's supported parameter-expansion subset e1c75cd
• [Fix] parse: a backslash inside single quotes must not escape the closing quote 5d460a3
• [readme] fix stale example outputs 2de86f5
• [Tests] quote: pin that a backslash with whitespace is not doubled in single quotes (#14) 190e236
• [readme] quote: use output verbatim; do not re-quote it (#11) 1b36468
• [Refactor] parse: fix swapped SINGLE_QUOTE/DOUBLE_QUOTE variable names 801af5c
• [types] fix an error TS v6 ignores but v7 fails on 59bbf8b
• [Dev Deps] update @arethetypeswrong/cli, evalmd a04d475
• [Dev Deps] update @arethetypeswrong/ci, eslint d390f9a
• [Tests] quote: the tilde test escapes every ~, not just a leading one (#9) 617d119

v1.9.0 - 2026-06-24

Commits

• [New] add types dca6e21
• [Dev Deps] update eslint 9aa9e8f
• [Fix] parse: finalize tokens in linear time (GHSA-395f-4hp3-45gv) 7ff5488
• [actions] update workflows 75e8497
• [actions] Windows + node 4/6/7: pin eslint to 9 before install, since npm 2/3 cannot stage eslint 10@types/esrecurse 3fb739d
• [actions] retry npm install on Windows to survive npm 2/3 staging-rename flake abe0163
• [actions] Windows + node 5/7: install deps with a modern node b4bafa2
• [Fix] quote: escape leading ~ to prevent shell tilde-expansion 7a76c1a
• [Dev Deps] update auto-changelog, tape 7184b44
• [Dev Deps] apparently jackspeak is no longer in the graph 9ba368a

v1.8.4 - 2026-05-22

Commits

• [Fix] quote: validate object-token shapes 4378a6e
• [Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, npmignore 22ebec0
• [Tests] increase coverage 9f3caa3
• [readme] replace runkit CI badge with shields.io check-runs badge 3344a04
• [Dev Deps] update @ljharb/eslint-config 699c511

Commits

• 64988d9 v1.10.0
• 617d119 [Tests] quote: the tilde test escapes every ~, not just a leading one (#9)
• 59bbf8b [types] fix an error TS v6 ignores but v7 fails on
• 190e236 [Tests] quote: pin that a backslash with whitespace is not doubled in singl...
• a04d475 [Dev Deps] update @arethetypeswrong/cli, evalmd
• b9545b3 [New] parse: add opt-in splitUnquoted option for shell field-splitting of...
• 1b36468 [readme] quote: use output verbatim; do not re-quote it (#11)
• 1c36f3f [Tests] quote: pin conservative escaping of =, @, ^, ,, :, ! (#11)
• e1c75cd [readme] document parse's supported parameter-expansion subset
• c0842c8 [Fix] parse: match nested ${...} braces so nested parameter expansion is ...
• Additional commits viewable in compare view

[github-actions]

🍹 preview on andymeier/prod

Pulumi report

View in Pulumi Cloud

  Previewing update (prod)

View Live: https://app.pulumi.com/meiermade/andymeier/prod/previews/15b2d97c-e261-4c63-902e-c4a1d595dd62

pulumi:pulumi:Stack: (same)
  [urn=urn:pulumi:prod::andymeier::pulumi:pulumi:Stack::andymeier-prod]
Resources:
  13 unchanged
  

[minniemeierdev]

Approved: the change is limited to the Pulumi lockfile dependency update for shell-quote 1.8.3 to 1.10.0, with benign lockfile duplicate-key cleanup. GitHub checks are green, and I also verified the PR lockfile is reproducible with npm install --package-lock-only plus npm ci and npm run check in pulumi. Release/advisory context looks security-positive because 1.9.0 includes the GHSA-395f-4hp3-45gv parse DoS fix; 1.10.0 keeps MIT licensing, no added dependencies, and node >= 0.4. Not merging as part of this review task.

[minniemeierdev]

Approved current head b9c5f70: the diff is now limited to the shell-quote package-lock entry in pulumi, updating 1.8.3 to 1.10.0. GitHub Preview and Test checks are green. I also re-ran local verification on the current head: npm install --package-lock-only produced no changes, npm ci succeeded, and npm run check passed in pulumi. Release/advisory context remains security-positive because 1.9.0 includes the GHSA-395f-4hp3-45gv parse DoS fix, and 1.10.0 keeps MIT licensing, no added dependencies, and node >= 0.4. Not merging as part of this review task.

[dependabot]

Looks like shell-quote is up-to-date now, so this is no longer needed.