fix: upgrade shell-quote to 1.8.4 (CVE-2026-9277)

[anupamme]

Summary

Upgrade shell-quote from 1.8.3 to 1.8.4 to fix CVE-2026-9277.

Vulnerability

Field	Value
ID	CVE-2026-9277
Severity	CRITICAL
Scanner	trivy
Rule	CVE-2026-9277
File	pnpm-lock.yaml (dependency: shell-quote)
Assessment	Present in dependency tree, not confirmed reachable

Description: shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators

Evidence

Scanner confirmation: trivy rule CVE-2026-9277 flagged this pattern.

Changes

• package.json
• pnpm-lock.yaml

Behavior Preservation

The change is scoped to 2 files on the vulnerable path; it only tightens handling of untrusted input and leaves valid inputs unaffected.

---

This change addresses a pattern flagged by static analysis. The code path handles user-influenced input and the fix reduces the attack surface against both manual and automated exploitation.

---

Automated security fix by OrbisAI Security

[builder-io-integration]

Builder reviewed your changes and found 1 potential issue 🟡

Review Details

Code Review Summary

PR #3413 adds a root pnpm override and updates the lockfile so both transitive shell-quote consumers resolve to a patched release instead of 1.8.3. The lockfile is internally consistent, and the dependency-only change does not introduce application-code or UI behavior changes. I classified this as high risk because it addresses a critical command-injection vulnerability, so compatibility and remediation scope were reviewed closely.

Key Findings

🟡 MEDIUM: The PR description and title describe an upgrade to 1.8.4, but the manifest actually forces 1.9.0 globally. That is a broader version change applied to unrelated transitive consumers and should either be explicitly validated/documented or narrowed to the intended fixed release.

The override is consistently reflected in the lockfile, with no remaining 1.8.3 snapshots. No additional confirmed security, lockfile, or dependency-graph issues were found.

🧪 Browser testing: Skipped — PR only modifies dependency metadata and lockfile, with no UI impact.

[builder-io-integration]

🟡 Override resolves 1.9.0 rather than the claimed fixed 1.8.4

The PR description says this is a narrowly scoped upgrade from 1.8.3 to the CVE fix in 1.8.4, but the added override forces every shell-quote consumer to 1.9.0. Since this global override applies to both transitive consumers, 1.9.0's additional release changes should be explicitly compatibility-validated and documented, or the override should pin the intended 1.8.4 release.