Skip to content

[Snyk] Security upgrade shell-quote from 1.8.3 to 1.9.0 #102

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
factory-service-snyk wants to merge 1 commit into
base: dev
Choose a base branch
from
+1 −1
Open

[Snyk] Security upgrade shell-quote from 1.8.3 to 1.9.0 #102

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@
"@octokit/graphql": "^8.2.2",
"@octokit/rest": "^21.1.1",
"@octokit/webhooks-types": "^7.6.1",
"shell-quote": "^1.8.3",
"shell-quote": "^1.9.0",

@factory-droid factory-droid Bot Jul 1, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[P1] Upgrade shell-quote where the action actually runs (base-action)

This PR bumps shell-quote only in the repo-root package.json, but action.yml installs and runs ${GITHUB_ACTION_PATH}/base-action (with its own package.json and lockfiles) and that package still pins shell-quote@^1.8.3. As a result, the code that imports shell-quote at runtime (for example base-action/src/run-droid.ts) will continue to use the old version unless base-action/package.json (and its lockfiles) are updated too.

@factory-droid factory-droid Bot Jul 1, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[P1] [security] Regenerate lockfiles so the upgrade is actually installed

Even with the package.json range bumped, the lockfiles in this repo still resolve shell-quote@1.8.3 (root bun.lock / package-lock.json, plus base-action/ lockfiles). Please re-run installs and commit the updated lockfiles for the package(s) that CI installs (${GITHUB_ACTION_PATH} and ${GITHUB_ACTION_PATH}/base-action) so shell-quote@1.9.0 is what actually gets shipped/installed.

"zod": "^3.24.4"
},
"devDependencies": {
Expand Down
Loading