[DPEDE-1784](deps): Bump shell-quote from 1.8.3 to 1.8.4

[dependabot]

Bumps shell-quote from 1.8.3 to 1.8.4.

Changelog

Sourced from shell-quote's changelog.

v1.8.4 - 2026-05-22

Commits

• [Fix] quote: validate object-token shapes 4378a6e
• [Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, npmignore 22ebec0
• [Tests] increase coverage 9f3caa3
• [readme] replace runkit CI badge with shields.io check-runs badge 3344a04
• [Dev Deps] update @ljharb/eslint-config 699c511

Commits

• ff166e2 v1.8.4
• 4378a6e [Fix] quote: validate object-token shapes
• 22ebec0 [Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, `npmig...
• 9f3caa3 [Tests] increase coverage
• 3344a04 [readme] replace runkit CI badge with shields.io check-runs badge
• 699c511 [Dev Deps] update @ljharb/eslint-config
• See full diff in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[lumn-sonarent]

SonarQube Quality Gate

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
No Duplication information

[lumen-jenkins-prod]

The CI pipeline has run successfully in https://jenkinsprod.corp.intranet:8443/job/UX-CHI/job/Productive/job/Chi/job/PR-2094/1/. ✅

[lumen-jenkins-prod]

You can check this PRs instance in https://nginx-pr-2094-ux-chi.rke-odc-test.corp.intranet (internal)

[cl-aifel-test]

🔖 aifel-verdict — AiFEL dependency-triage verdict (schema 1.1)

AiFEL verdict — 🚨 Escalate (ci-health) — human review required

Patch bump shell-quote 1.8.3→1.8.4 is security-positive (fixes one critical advisory) and carries zero code impact since the package is not imported in this repo — escalation is driven solely by critical CI running at 64% pass rate on the default branch.

TL;DR

• Merge: 🔍 review, then merge — the bump itself is safe and security-positive; confirm the critical CI failures are pre-existing and unrelated to this change before merging.
• Breaks your code? ✅ Most likely not.
• Security? ✅ this bump fixes GHSA-w7jw-789q-3m8p (CVE-2026-9277, CVSS 8.1).
• Update: shell-quote — you have 1.8.3, this PR installs 1.8.4 (patch, spans 1 release). Fixes 1 critical advisory; no code impact since the package is not imported in this repo's source.

Signal	Value	Interpretation
Bump type	patch	z-component incremented only (1.8.3→1.8.4); patch bumps are semver-compatible by convention — bug fixes, no API changes expected
Dependency risk	low	Patch bump; shell-quote is not imported anywhere in this repo's source (0 import sites confirmed across all scanned files), so no change in this release can reach your code
Security risk	low	Fixes GHSA-w7jw-789q-3m8p (CVE-2026-9277, CVSS 8.1 — see Security advisories). No advisories affect v1.8.4. Two other historical advisories (GHSA-g4rg-993r-mgx7, GHSA-qg8p-v9q4-gh34) affected only versions ≤1.7.2 and <1.6.1 respectively — neither applied to 1.8.3 or 1.8.4
CI health risk	high	28 critical runs on default branch; pass rate 64.3%, flakiness 0% → ci_confidence: low. No informational workflows were excluded.
API usage in repo	false	0 import sites found; all 4 npm import forms searched (from 'shell-quote', require('shell-quote'), dynamic import('shell-quote'), re-export from 'shell-quote') — confirmed absent from source
Cross-repo signal	standalone	No publishable root manifest found
Data completeness	complete	All 5 signals obtained

📋 Why this route + what AiFEL checked (click to expand)

Why this route?

escalate because: critical CI confidence is low — 28 critical runs on the default branch at 64.3% pass rate triggers the CI low escalation rule.

Escalation category: ci-health

Confidence breakdown — score: 0.85. List the factors that produced it:

• ✅ patch bump — semver-compatible, no breaking changes documented for this range

• ✅ no in-repo usage of shell-quote — blast radius is zero

• ✅ no advisories affect v1.8.4 — advisory_ids: [], max_cvss: null

• ✅ this bump fixes GHSA-w7jw-789q-3m8p (CVSS 8.1) — security-positive

• ✅ complete release notes for this range — patch fixes confirmed

• ✅ no cascade conflicts

• ⚠️ critical CI low (64.3% pass rate, 28 runs): −0.15

• 💡 To reach a lower route: Confirm the failing critical checks on the default branch are pre-existing and unrelated to this change. Once critical CI confidence rises to medium (≥70% pass rate), this routine patch would route to auto_eligible. Note: fixing informational workflows (e.g. Dependency Submission) will NOT change the route, since those are already excluded from CI scoring.

What AiFEL checked

1. Triage — classified patch (shell-quote 1.8.3→1.8.4).
2. Symbol extraction — none found; 0 import sites across 0 files (complete scan, all npm import patterns tried).
3. Release-notes comparator — patch changelog confirms: [Fix] quote escapes leading ~ to prevent tilde-expansion; [Fix] parse finalizes tokens in linear time; [New] TypeScript types added. No breaking changes in range.
4. CI health — 28 critical runs on default branch: pass 64.3%, flaky 0% → confidence low. No informational workflows excluded.
5. Cascade coordinator — 0 conflicts.
6. Data completeness — obtained 5/5 signals; missing: none.

Will merging break your code?

✅ Per AiFEL analysis, most likely won't impact your code. shell-quote is not imported anywhere in this repo's source, so no change in this bump — including the tilde-escaping and linear-time parse fixes — can reach your code paths.

Security advisories

✅ Nothing still affects 1.8.4

✅ Resolved by this bump (1): GHSA-w7jw-789q-3m8p (CVE-2026-9277, CVSS 8.1 critical) — quote() failed to escape newlines in object .op values, enabling command injection via crafted shell-quote objects; first patched in 1.8.4. No action needed — this bump is the fix.

The two other advisories on record were historical and never applicable to the installed version range: GHSA-g4rg-993r-mgx7 (CVE-2021-42740, CVSS 9.8, range ≥1.6.3 ≤1.7.2, fixed in 1.7.3) and GHSA-qg8p-v9q4-gh34 (CVE-2016-10541, CVSS 9.8, range <1.6.1, fixed in 1.6.1) — neither affected 1.8.3 or 1.8.4.

✅ This bump resolves all known advisories and none affect 1.8.4 — clear on the security axis.

Packages — what you have vs what this PR installs

Ecosystem	Package	You have	This PR installs	What changes for you
npm	shell-quote	1.8.3	1.8.4	routine patch — fixes GHSA-w7jw-789q-3m8p (CVSS 8.1); no code impact (package is not imported in this repo's source)

---

Machine-readable verdict

{
  "schema_version": "1.1",
  "classification": "patch",
  "risk_band": "low",
  "ci_confidence": "low",
  "decision_route": "escalate",
  "data_completeness": "complete",
  "escalate_reason": "risk",
  "missing_signals": [],
  "confidence": 0.85,
  "packages": [{"ecosystem": "npm", "name": "shell-quote", "old_version": "1.8.3", "new_version": "1.8.4"}],
  "breaking_changes": [],
  "cascade_conflicts": [],
  "summary": "Patch bump shell-quote 1.8.3→1.8.4: package unused in repo (blast radius zero), fixes GHSA-w7jw-789q-3m8p (CVSS 8.1), no advisories affect v1.8.4. Escalated on ci-health only (64.3% pass rate, 28 critical runs on default branch).",
  "upgrade_risk_note": null,
  "cross_repo_signal": "standalone",
  "api_usage_found": false,
  "advisory_ids": [],
  "max_cvss": null,
  "feedback_capture_marker": "aifel-CenturyLink-Chi-2094",
  "agent_version": "1.1.1-aw"
}

🤖 Generated by AiFEL — AI-assisted Dependabot triage. Advisory only; a human reviewer still decides and merges.
📝 Share your AiFEL experience

[dependabot]

Superseded by #2128.

[lumen-jenkins-prod]

Removed the Kubernetes allocated resources

[lumen-jenkins-prod]

Removed the Kubernetes allocated resources