Bump shell-quote from 1.8.3 to 1.10.0

[dependabot]

Bumps shell-quote from 1.8.3 to 1.10.0.

Changelog

Sourced from shell-quote's changelog.

v1.10.0 - 2026-07-10

Merged

• [New] parse: add opt-in splitUnquoted option for shell field-splitting of unquoted expansions [#1](https://github.com/ljharb/shell-quote/issues/1)

Commits

• [Fix] parse: match nested ${...} braces so nested parameter expansion is consumed as one substitution c0842c8
• [Tests] parse: pin single-quote literalness and unmatched-quote handling a0d03e3
• [readme] remove the space in js code fences so evalmd evaluates them 2116fa3
• [Tests] quote: pin conservative escaping of =, @, ^, ,, :, ! (#11) 1c36f3f
• [readme] document that quote outputs POSIX quoting, not cmd.exe/PowerShell 100e96e
• [readme] document parse's supported parameter-expansion subset e1c75cd
• [Fix] parse: a backslash inside single quotes must not escape the closing quote 5d460a3
• [readme] fix stale example outputs 2de86f5
• [Tests] quote: pin that a backslash with whitespace is not doubled in single quotes (#14) 190e236
• [readme] quote: use output verbatim; do not re-quote it (#11) 1b36468
• [Refactor] parse: fix swapped SINGLE_QUOTE/DOUBLE_QUOTE variable names 801af5c
• [types] fix an error TS v6 ignores but v7 fails on 59bbf8b
• [Dev Deps] update @arethetypeswrong/cli, evalmd a04d475
• [Dev Deps] update @arethetypeswrong/ci, eslint d390f9a
• [Tests] quote: the tilde test escapes every ~, not just a leading one (#9) 617d119

v1.9.0 - 2026-06-24

Commits

• [New] add types dca6e21
• [Dev Deps] update eslint 9aa9e8f
• [Fix] parse: finalize tokens in linear time (GHSA-395f-4hp3-45gv) 7ff5488
• [actions] update workflows 75e8497
• [actions] Windows + node 4/6/7: pin eslint to 9 before install, since npm 2/3 cannot stage eslint 10@types/esrecurse 3fb739d
• [actions] retry npm install on Windows to survive npm 2/3 staging-rename flake abe0163
• [actions] Windows + node 5/7: install deps with a modern node b4bafa2
• [Fix] quote: escape leading ~ to prevent shell tilde-expansion 7a76c1a
• [Dev Deps] update auto-changelog, tape 7184b44
• [Dev Deps] apparently jackspeak is no longer in the graph 9ba368a

v1.8.4 - 2026-05-22

Commits

• [Fix] quote: validate object-token shapes 4378a6e
• [Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, npmignore 22ebec0
• [Tests] increase coverage 9f3caa3
• [readme] replace runkit CI badge with shields.io check-runs badge 3344a04
• [Dev Deps] update @ljharb/eslint-config 699c511

Commits

• 64988d9 v1.10.0
• 617d119 [Tests] quote: the tilde test escapes every ~, not just a leading one (#9)
• 59bbf8b [types] fix an error TS v6 ignores but v7 fails on
• 190e236 [Tests] quote: pin that a backslash with whitespace is not doubled in singl...
• a04d475 [Dev Deps] update @arethetypeswrong/cli, evalmd
• b9545b3 [New] parse: add opt-in splitUnquoted option for shell field-splitting of...
• 1b36468 [readme] quote: use output verbatim; do not re-quote it (#11)
• 1c36f3f [Tests] quote: pin conservative escaping of =, @, ^, ,, :, ! (#11)
• e1c75cd [readme] document parse's supported parameter-expansion subset
• c0842c8 [Fix] parse: match nested ${...} braces so nested parameter expansion is ...
• Additional commits viewable in compare view

---

Note

Low Risk
Lockfile-only transitive dependency bump with security fixes in shell quoting; no direct application code changes, though quoting behavior could shift slightly for tooling that uses shell-quote.

Overview
Updates the lockfile so the shared shell-quote dependency resolves to 1.10.0 (from 1.8.3). No application source changes—only package-lock.json, including a small lockfile cleanup under @chain-registry/utils.

The newer shell-quote releases bring security and correctness fixes for shell quoting/parsing (e.g. parse performance fix GHSA-395f-4hp3-45gv, quote tilde and special-character escaping, nested ${...} parsing). The package is pulled in transitively (e.g. via launch-editor, react-devtools-core), so this mainly affects dev/tooling paths that quote shell arguments—not direct app API changes.

^{Reviewed by Cursor Bugbot for commit 42459f6. Bugbot is set up for automated code reviews on this repo. Configure here.}