From fa7cab069999c745595d2d50bd4f9c920047963d Mon Sep 17 00:00:00 2001
From: Tommaso Casaburi <tom@bitsocial.net>
Date: Thu, 11 Jun 2026 15:01:58 +0700
Subject: [PATCH] fix(deps): resolve shell-quote critical dependabot alert

Pin shell-quote to 1.8.4 via yarn resolutions so concurrently no longer pulls the vulnerable 1.8.3 release.
---
 package.json | 1 +
 yarn.lock    | 8 ++++----
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/package.json b/package.json
index 5e7999dc..18f91560 100644
--- a/package.json
+++ b/package.json
@@ -227,6 +227,7 @@
     "tar": "7.5.11",
     "yauzl": "3.2.1",
     "serialize-javascript": "7.0.5",
+    "shell-quote": "1.8.4",
     "@tootallnate/once": "3.0.1",
     "rollup": "2.80.0",
     "@electron/asar": "4.0.1",
diff --git a/yarn.lock b/yarn.lock
index a4adcb1b..76d24c16 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -18152,10 +18152,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"shell-quote@npm:^1.8.0":
-  version: 1.8.3
-  resolution: "shell-quote@npm:1.8.3"
-  checksum: 10c0/bee87c34e1e986cfb4c30846b8e6327d18874f10b535699866f368ade11ea4ee45433d97bf5eada22c4320c27df79c3a6a7eb1bf3ecfc47f2c997d9e5e2672fd
+"shell-quote@npm:1.8.4":
+  version: 1.8.4
+  resolution: "shell-quote@npm:1.8.4"
+  checksum: 10c0/86c93678bc394cb81f5ddcdc87df9c95d279ef9652775cd1cd1eed361404169a8d8cbaacaeed232ab09919e36ee1e5363863570390d78571f8c22b7f6312fb40
   languageName: node
   linkType: hard