Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: ljharb/shell-quote
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: v1.8.3
Choose a base ref
...
head repository: ljharb/shell-quote
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: v1.8.4
Choose a head ref
  • 6 commits
  • 6 files changed
  • 1 contributor

Commits on Jul 12, 2025

  1. [Dev Deps] update @ljharb/eslint-config

    @ljharb
    ljharb committed Jul 12, 2025
    Configuration menu
    Copy the full SHA
    699c511 View commit details
    Browse the repository at this point in the history

Commits on Jan 13, 2026

  1. [readme] replace runkit CI badge with shields.io check-runs badge

    @ljharb
    ljharb committed Jan 13, 2026
    Configuration menu
    Copy the full SHA
    3344a04 View commit details
    Browse the repository at this point in the history

Commits on Mar 15, 2026

  1. [Tests] increase coverage

    @ljharb
    ljharb committed Mar 15, 2026
    Configuration menu
    Copy the full SHA
    9f3caa3 View commit details
    Browse the repository at this point in the history

Commits on May 21, 2026

  1. [Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint… 

    …, `npmignore`
    @ljharb
    ljharb committed May 21, 2026
    Configuration menu
    Copy the full SHA
    22ebec0 View commit details
    Browse the repository at this point in the history

Commits on May 22, 2026

  1. [Fix] quote: validate object-token shapes 

    The per-character `.op` escape (`/(.)/g`) did not match line terminators
(`\n`, `\r`, U+2028, U+2029),
so a literal newline in `.op` passed through unescaped and acted as a shell command separator.
Replace the regex with strict shape validation:

- `{ op }`: `.op` must match the parser's control-operator allowlist
- `{ op: 'glob', pattern }`: `.pattern` must be a string without line terminators; glob metas pass through, shell-special chars are escaped
  (Previously the field was discarded and the literal `\g\l\o\b` was emitted)
- `{ comment }`: `.comment` must be a string without line terminators
  (Previously `quote` crashed on `{ comment }` tokens that `parse` emits)
- Any other object shape: `TypeError`
    @ljharb
    ljharb committed May 22, 2026
    Configuration menu
    Copy the full SHA
    4378a6e View commit details
    Browse the repository at this point in the history

  2. v1.8.4

    @ljharb
    ljharb committed May 22, 2026
    Configuration menu
    Copy the full SHA
    ff166e2 View commit details
    Browse the repository at this point in the history
Loading