[roomote-conceal-network]

​Created by Roomote. Follow up by mentioning @roomote, in the web UI, or in Discord.

What changed

Lockfile-only bump of the dev-scope transitive dependency shell-quote from 1.10.0 to 1.11.0 in package-lock.json. The shell-quote: ^1.9.0 override in package.json already permits 1.11.0, so no manifest change was needed. The diff touches only the single node_modules/shell-quote entry (version, resolved URL, integrity).

Why this change was made

Dependabot alert #36 flags shell-quote 1.10.0 against GHSA-pqg4-j6r4-53mv / CVE-2026-102422 (critical): quote() command injection via a line terminator in a comment token. The first patched version is 1.11.0, whose changelog confirms the fix (quote: reject line terminators in tokens after a comment) alongside backward-compatible parse/quote fixes.

Impact

No runtime behavior change for the published package — shell-quote is a development-scope transitive (pulled in by react-devtools-core). The lockfile now resolves shell-quote to 1.11.0, clearing the vulnerable range >= 1.8.4, < 1.11.0 and the alert. The js-yaml alert (#33) is intentionally untouched here; it is already covered by open PR #8.

Validated with a fresh npm ci (installs shell-quote 1.11.0) and the repository's CI gates: npm run lint, npm run check, and npm run cpp all pass. No other dependency versions changed. This repo has no test script, and no live-service runtime surface is affected by this dev-scope bump.

[roomote-conceal-network]

No code issues found. See task

_{Reviewed c30d665}