fix(lifecycle): replace shell-quote with shlex #9695
Conversation
There was a problem hiding this comment.
Pull Request Overview
This PR replaces the previous use of shell-quote with shlex for quoting command arguments, aligning dependency declarations and tests with the new library.
- Swapped imports and dependency entries from
shell-quotetoshlex - Updated test expectations to match
shlex.joinbehavior (removal of=escaping) - Removed obsolete type packages and updated change log
Reviewed Changes
Copilot reviewed 9 out of 10 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| worker/src/index.ts | Replaced shell-quote import with shlex.join |
| exec/lifecycle/src/runLifecycleHook.ts | Same import replacement for lifecycle hook quoting |
| worker/package.json | Swapped dependency from shell-quote to shlex |
| exec/lifecycle/package.json | Swapped dependency from shell-quote to shlex |
| pnpm/test/run.ts | Adjusted regex for new quoting semantics |
| exec/lifecycle/test/index.ts | Updated expected output to match shlex.join |
| pnpm-workspace.yaml | Updated catalog entries to use shlex |
| cspell.json | Added “shlex” to the custom dictionary |
| .changeset/tired-points-brake.md | Documented the migration to shlex |
Files not reviewed (1)
- pnpm-lock.yaml: Language not supported
Comments suppressed due to low confidence (3)
worker/src/index.ts:11
- [nitpick] Aliasing
shlex.joinasshellQuotecan confuse readers. Rename the import alias to something likeshlexJoinorjoinArgsto better reflect its origin and purpose.
import { join as shellQuote } from 'shlex'
exec/lifecycle/src/runLifecycleHook.ts:9
- [nitpick] Update the surrounding comment or add a note to clarify that
shlex.joinis now used instead ofshell-quotefor argument quoting to keep docs accurate.
import { join as shellQuote } from 'shlex'
worker/package.json:46
- The new dependency
shlexdoes not include TypeScript declarations. Consider adding@types/shlexor bundling type definitions to prevent compilation errors.
"shlex": "catalog:"
|
IMO pnpm adds pnpm should care more about dependency security. |
It solves the bug. |
|
The version of shlex is locked in the lockfile. If it will have a new version, we can review it before upgrading. We also have |
fixes #9381