chore(deps): bump shell-quote and concurrently

[dependabot]

Bumps shell-quote to 1.9.0 and updates ancestor dependency concurrently. These dependencies need to be updated together.

Updates shell-quote from 1.8.4 to 1.9.0

Changelog

Sourced from shell-quote's changelog.

v1.9.0 - 2026-06-24

Commits

• [New] add types dca6e21
• [Dev Deps] update eslint 9aa9e8f
• [Fix] parse: finalize tokens in linear time (GHSA-395f-4hp3-45gv) 7ff5488
• [actions] update workflows 75e8497
• [actions] Windows + node 4/6/7: pin eslint to 9 before install, since npm 2/3 cannot stage eslint 10@types/esrecurse 3fb739d
• [actions] retry npm install on Windows to survive npm 2/3 staging-rename flake abe0163
• [actions] Windows + node 5/7: install deps with a modern node b4bafa2
• [Fix] quote: escape leading ~ to prevent shell tilde-expansion 7a76c1a
• [Dev Deps] update auto-changelog, tape 7184b44
• [Dev Deps] apparently jackspeak is no longer in the graph 9ba368a

Commits

• db09fc7 v1.9.0
• 7ff5488 [Fix] parse: finalize tokens in linear time (GHSA-395f-4hp3-45gv)
• b4bafa2 [actions] Windows + node 5/7: install deps with a modern node
• 3fb739d [actions] Windows + node 4/6/7: pin eslint to 9 before install, since npm 2/3...
• abe0163 [actions] retry npm install on Windows to survive npm 2/3 staging-rename flake
• 7a76c1a [Fix] quote: escape leading ~ to prevent shell tilde-expansion
• 75e8497 [actions] update workflows
• dca6e21 [New] add types
• 9aa9e8f [Dev Deps] update eslint
• 9ba368a [Dev Deps] apparently jackspeak is no longer in the graph
• Additional commits viewable in compare view

Updates concurrently from 10.0.3 to 10.0.4

Release notes

Sourced from concurrently's releases.

v10.0.4

What's Changed

• deps: upgrade shell-quote to 1.9.0 by @​Mayvis in open-cli-tools/concurrently#599
• fix: avoid kill timeout exit delays by @​rajanpanth in open-cli-tools/concurrently#601

New Contributors

• @​Mayvis made their first contribution in open-cli-tools/concurrently#599
• @​rajanpanth made their first contribution in open-cli-tools/concurrently#601

Full Changelog: open-cli-tools/concurrently@v10.0.3...v10.0.4

Commits

• 2524b65 10.0.4
• 1080199 fix: avoid kill timeout exit delays (#601)
• e668211 ci: publish to latest only on npm
• 163b60f chore: sync @​types/node with current min version
• bcde2f5 chore: remove @​types/shell-quote
• 49f7eb4 deps: upgrade shell-quote to 1.9.0 (#599)
• See full diff in compare view

[zbigniewsobiecki]

@dependabot rebase

[nhopeatall]

LGTM — clean Dependabot dev-dependency bump.

Summary

Approve. Low-risk, dev-only dependency update with a security upside; no source code touched.

Verification

• Scope: only package.json (+1 −1) and package-lock.json (+8 −8) changed.
• concurrently is a devDependency (used solely by the dev:all local convenience script), bumped ^10.0.3 → ^10.0.4.
• shell-quote is a purely transitive dep pulled in by concurrently — no direct import/require('shell-quote') anywhere in src/. Bumped 1.8.4 → 1.9.0, which includes the parse linear-time fix for GHSA-395f-4hp3-45gv (ReDoS). A welcome hardening even though the package is dev-only.
• Lockfile consistency: single resolved version of each package (no stale duplicate pins), concurrently@10.0.4 pins shell-quote@1.9.0 matching the top-level entry, integrity hashes intact, and no new/tightened engine constraints (concurrently stays node >=22).
• CI: 5/5 checks passing.

🕵️ claude-code · claude-opus-4-8 · run details