Bump shell-quote and concurrently in /samples/demo

[dependabot]

Bumps shell-quote to 1.9.0 and updates ancestor dependency concurrently. These dependencies need to be updated together.

Updates shell-quote from 1.8.3 to 1.9.0

Changelog

Sourced from shell-quote's changelog.

v1.9.0 - 2026-06-24

Commits

• [New] add types dca6e21
• [Dev Deps] update eslint 9aa9e8f
• [Fix] parse: finalize tokens in linear time (GHSA-395f-4hp3-45gv) 7ff5488
• [actions] update workflows 75e8497
• [actions] Windows + node 4/6/7: pin eslint to 9 before install, since npm 2/3 cannot stage eslint 10@types/esrecurse 3fb739d
• [actions] retry npm install on Windows to survive npm 2/3 staging-rename flake abe0163
• [actions] Windows + node 5/7: install deps with a modern node b4bafa2
• [Fix] quote: escape leading ~ to prevent shell tilde-expansion 7a76c1a
• [Dev Deps] update auto-changelog, tape 7184b44
• [Dev Deps] apparently jackspeak is no longer in the graph 9ba368a

v1.8.4 - 2026-05-22

Commits

• [Fix] quote: validate object-token shapes 4378a6e
• [Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, npmignore 22ebec0
• [Tests] increase coverage 9f3caa3
• [readme] replace runkit CI badge with shields.io check-runs badge 3344a04
• [Dev Deps] update @ljharb/eslint-config 699c511

Commits

• db09fc7 v1.9.0
• 7ff5488 [Fix] parse: finalize tokens in linear time (GHSA-395f-4hp3-45gv)
• b4bafa2 [actions] Windows + node 5/7: install deps with a modern node
• 3fb739d [actions] Windows + node 4/6/7: pin eslint to 9 before install, since npm 2/3...
• abe0163 [actions] retry npm install on Windows to survive npm 2/3 staging-rename flake
• 7a76c1a [Fix] quote: escape leading ~ to prevent shell tilde-expansion
• 75e8497 [actions] update workflows
• dca6e21 [New] add types
• 9aa9e8f [Dev Deps] update eslint
• 9ba368a [Dev Deps] apparently jackspeak is no longer in the graph
• Additional commits viewable in compare view

Updates concurrently from 9.2.1 to 9.2.4

Release notes

Sourced from concurrently's releases.

v9.2.4

• upgrade shell-quote to 1.9.0 - #597, #600

Full Changelog: open-cli-tools/concurrently@v9.2.3...v9.2.4

v9.2.3

• Address vulnerability in shell-quote - #591, #596

v9.2.2

Not published to npm.

Commits

• 6c27ec0 9.2.4
• 3beb683 deps: upgrade shell-quote to 1.9.0 (#599)
• e63e702 9.2.3
• 7a7d6c3 ci: fix publish syntax
• 5b6e5f1 9.2.2
• 520d928 ci: publish to latest only from main
• d947273 ci: use node 24 in the release workflow
• 51e542b ci: configure trusted publisher flow
• 47dfb64 deps: bump shell-quote
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for concurrently since your current version.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/concurrently	9.2.4	Unknown	Unknown
npm/shell-quote	1.9.0	🟢 5	Details Check Score Reason Security-Policy 🟢 10 security policy file detected Maintained 🟢 10 30 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Code-Review ⚠️ 0 Found 1/30 approved changesets -- score normalized to 0 Packaging ⚠️ -1 packaging workflow not detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• samples/demo/package-lock.json