Bump shell-quote from 1.8.1 to 1.9.0

[dependabot]

Bumps shell-quote from 1.8.1 to 1.9.0.

Changelog

Sourced from shell-quote's changelog.

v1.9.0 - 2026-06-24

Commits

• [New] add types dca6e21
• [Dev Deps] update eslint 9aa9e8f
• [Fix] parse: finalize tokens in linear time (GHSA-395f-4hp3-45gv) 7ff5488
• [actions] update workflows 75e8497
• [actions] Windows + node 4/6/7: pin eslint to 9 before install, since npm 2/3 cannot stage eslint 10@types/esrecurse 3fb739d
• [actions] retry npm install on Windows to survive npm 2/3 staging-rename flake abe0163
• [actions] Windows + node 5/7: install deps with a modern node b4bafa2
• [Fix] quote: escape leading ~ to prevent shell tilde-expansion 7a76c1a
• [Dev Deps] update auto-changelog, tape 7184b44
• [Dev Deps] apparently jackspeak is no longer in the graph 9ba368a

v1.8.4 - 2026-05-22

Commits

• [Fix] quote: validate object-token shapes 4378a6e
• [Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, npmignore 22ebec0
• [Tests] increase coverage 9f3caa3
• [readme] replace runkit CI badge with shields.io check-runs badge 3344a04
• [Dev Deps] update @ljharb/eslint-config 699c511

v1.8.3 - 2025-06-01

Fixed

• [Fix] remove unnecessary backslash escaping in single quotes [#15](https://github.com/ljharb/shell-quote/issues/15)

v1.8.2 - 2024-11-27

Fixed

• [Fix] quote: preserve empty strings [#18](https://github.com/ljharb/shell-quote/issues/18)

Commits

• [meta] fix changelog tags 0fb9fd8
• [actions] split out node 10-20, and 20+ 819bd84
• [Dev Deps] update @ljharb/eslint-config, auto-changelog, npmignore, tape fc56408
• [actions] update npm for windows tests fdeb0fd
• [Dev Deps] update @ljharb/eslint-config, aud, tape b8a4a3b
• [actions] prevent node 14 on ARM mac from failing 9eecafc
• [meta] exclude more files from the package 4044e7f
• [Tests] replace aud with npm audit 8cfdbd8
• [meta] add missing engines.node 843820e
• [Dev Deps] add missing peer dep 4c3b88d
• [Dev Deps] pin jackspeak since 2.1.2+ depends on npm aliases, which kill the install process in npm < 6 80322ed

Commits

• db09fc7 v1.9.0
• 7ff5488 [Fix] parse: finalize tokens in linear time (GHSA-395f-4hp3-45gv)
• b4bafa2 [actions] Windows + node 5/7: install deps with a modern node
• 3fb739d [actions] Windows + node 4/6/7: pin eslint to 9 before install, since npm 2/3...
• abe0163 [actions] retry npm install on Windows to survive npm 2/3 staging-rename flake
• 7a76c1a [Fix] quote: escape leading ~ to prevent shell tilde-expansion
• 75e8497 [actions] update workflows
• dca6e21 [New] add types
• 9aa9e8f [Dev Deps] update eslint
• 9ba368a [Dev Deps] apparently jackspeak is no longer in the graph
• Additional commits viewable in compare view

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
react-sdk-demo	Ready	Preview, Comment	Jun 25, 2026 11:57pm

[changeset-bot]

⚠️ No Changeset found

Latest commit: 73f9a75

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 7 package(s) with unknown licenses.

See the Details below.

License Issues

package-lock.json

Package	Version	License	Issue Type
packages/fcl	1.21.11	Null	Unknown License
packages/fcl-core	1.30.3	Null	Unknown License
packages/fcl-ethereum-provider	0.1.3	Null	Unknown License
packages/fcl-rainbowkit-adapter	0.3.3	Null	Unknown License
packages/fcl-react-native	1.22.2	Null	Unknown License
packages/fcl-wagmi-adapter	0.1.3	Null	Unknown License
packages/fcl-wc	6.0.23	Null	Unknown License

OpenSSF Scorecard

Package	Version	Score	Details
npm/packages/fcl	1.21.11	Unknown	Unknown
npm/packages/fcl-core	1.30.3	Unknown	Unknown
npm/packages/fcl-ethereum-provider	0.1.3	Unknown	Unknown
npm/packages/fcl-rainbowkit-adapter	0.3.3	Unknown	Unknown
npm/packages/fcl-react-native	1.22.2	Unknown	Unknown
npm/packages/fcl-wagmi-adapter	0.1.3	Unknown	Unknown
npm/packages/fcl-wc	6.0.23	Unknown	Unknown
npm/shell-quote	1.9.0	🟢 4.3	Details Check Score Reason Security-Policy 🟢 10 security policy file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Code-Review ⚠️ 0 Found 2/30 approved changesets -- score normalized to 0 Packaging ⚠️ -1 packaging workflow not detected Maintained 🟢 4 3 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 4 Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• package-lock.json

[dependabot]

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

[jribbink]

@dependabot rebase