update

node_modules/shell-quote/.github/workflows/nodejs.yml

@@ -0,0 +1,35 @@
+name: Node CI
+
+on: [push, pull_request]
+
+jobs:
+  test:
+    strategy:
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+        node-version: ['0.8', '0.10', '0.12', '4.x', '6.x', '8.x', '10.x', '12.x']
+        exclude:
+          - os: windows-latest
+            node-version: '0.8'
+
+    runs-on: ${{matrix.os}}
+
+    steps:
+    - uses: actions/checkout@v1
+    - name: Use Node.js ${{ matrix.node-version }}
+      uses: actions/setup-node@v1
+      with:
+        node-version: ${{ matrix.node-version }}
+    - name: Disable strict SSL checks
+      uses: allenevans/set-env@v1.0.0
+      with:
+        NPM_CONFIG_STRICT_SSL: 'false'
+      if: matrix.node-version == '0.8'
+    - name: Upgrade npm to latest available version
+      run: |
+        curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.35.1/install.sh | bash
+        source $HOME/.nvm/nvm.sh
+        nvm install-latest-npm
+      if: matrix.os != 'windows-latest'
+    - run: npm install
+    - run: npm test

node_modules/shell-quote/CHANGELOG.md

@@ -4,6 +4,10 @@ All notable changes to this project will be documented in this file.
 
 This project adheres to [Semantic Versioning](http://semver.org/).
 
+## 1.7.3
+* Fix a security issue where the regex for windows drive letters allowed some shell meta-characters
+to escape the quoting rules. (CVE-2021-42740)
+
 ## 1.7.2
 * Fix a regression introduced in 1.6.3. This reverts the Windows path quoting fix. ([144e1c2](https://github.com/substack/node-shell-quote/commit/144e1c20cd57549a414c827fb3032e60b7b8721c))
 

node_modules/shell-quote/index.js

@@ -10,7 +10,7 @@ exports.quote = function (xs) {
             return '"' + s.replace(/(["\\$`!])/g, '\\$1') + '"';
         }
         else {
-            return String(s).replace(/([A-z]:)?([#!"$&'()*,:;<=>?@\[\\\]^`{|}])/g, '$1\\$2');
+            return String(s).replace(/([A-Za-z]:)?([#!"$&'()*,:;<=>?@\[\\\]^`{|}])/g, '$1\\$2');
         }
     }).join(' ');
 };

node_modules/shell-quote/package.json

@@ -1,32 +1,32 @@
 {
   "_args": [
     [
-      "shell-quote@1.7.2",
-      "/mnt/Foxconn/Digitalent/Deverloper/liff-push_2series"
+      "shell-quote@1.7.3",
+      "/home/node/nuxt"
     ]
   ],
-  "_from": "shell-quote@1.7.2",
-  "_id": "shell-quote@1.7.2",
+  "_from": "shell-quote@1.7.3",
+  "_id": "shell-quote@1.7.3",
   "_inBundle": false,
-  "_integrity": "sha512-mRz/m/JVscCrkMyPqHc/bczi3OQHkLTqXHEFu0zDhK/qfv3UcOA4SVmRCLmos4bhjr9ekVQubj/R7waKapmiQg==",
+  "_integrity": "sha512-Vpfqwm4EnqGdlsBFNmHhxhElJYrdfcxPThu+ryKS5J8L/fhAwLazFZtq+S+TWZ9ANj2piSQLGj6NQg+lKPmxrw==",
   "_location": "/shell-quote",
   "_phantomChildren": {},
   "_requested": {
     "type": "version",
     "registry": true,
-    "raw": "shell-quote@1.7.2",
+    "raw": "shell-quote@1.7.3",
     "name": "shell-quote",
     "escapedName": "shell-quote",
-    "rawSpec": "1.7.2",
+    "rawSpec": "1.7.3",
     "saveSpec": null,
-    "fetchSpec": "1.7.2"
+    "fetchSpec": "1.7.3"
   },
   "_requiredBy": [
     "/launch-editor"
   ],
-  "_resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.7.2.tgz",
-  "_spec": "1.7.2",
-  "_where": "/mnt/Foxconn/Digitalent/Deverloper/liff-push_2series",
+  "_resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.7.3.tgz",
+  "_spec": "1.7.3",
+  "_where": "/home/node/nuxt",
   "author": {
     "name": "James Halliday",
     "email": "mail@substack.net",
@@ -56,5 +56,5 @@
   "scripts": {
     "test": "tape test/*.js"
   },
-  "version": "1.7.2"
+  "version": "1.7.3"
 }

node_modules/shell-quote/readme.markdown

@@ -46,7 +46,7 @@ output
 [ 'beep', '--boop=/home/robot' ]
 ```
 
-## parse with custom escape charcter
+## parse with custom escape character
 
 ``` js
 var parse = require('shell-quote').parse;

node_modules/shell-quote/security.md

@@ -0,0 +1,11 @@
+# Security Policy
+
+## Supported Versions
+
+Only the latest major version is supported at any given time.
+
+## Reporting a Vulnerability
+
+To report a security vulnerability, please use the
+[Tidelift security contact](https://tidelift.com/security).
+Tidelift will coordinate the fix and disclosure.

node_modules/shell-quote/test/quote.js

@@ -40,3 +40,9 @@ test('quote windows paths', { skip: 'breaking change, disabled until 2.x' }, fun
 
     t.end()
 })
+
+test("chars for windows paths don't break out", function (t) {
+    var x = '`:\\a\\b'
+    t.equal(quote([x]), '\\`\\:\\\\a\\\\b')
+    t.end()
+})