[From nobody Wed May 27 08:49:05 2026 Received: (at 1137372-close) by bugs.debian.org; 27 May 2026 07:47:46 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-113.1 required=4.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FVGT_m_MULTI_ODD,HAS_BUG_NUMBER, MD5_SHA1_SUM,PGPSIGNATURE,RCVD_IN_DNSWL_MED,SPF_HELO_PASS,SPF_PASS, USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 85; hammy, 150; neutral, 152; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo., 0.000-+--H*MI:fasolo Return-path: <envelope@ftp-master.debian.org> Received: from mitropoulos.debian.org ([2001:648:2ffc:deb:216:61ff:fe9d:958d]:46116) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1wS8zR-009bPb-2v for 1137372-close@bugs.debian.org; Wed, 27 May 2026 07:47:46 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by mitropoulos.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1wS8zQ-00446C-2j for 1137372-close@bugs.debian.org; Wed, 27 May 2026 07:47:44 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=d5rvVCvmaQPBKyBA4TfvDl0ld0K8DzbxsYh8nIx6dnw=; b=eWslaApyTIGHP/8yQsejdFLBHZ aQZtJghIOzCa0qWeEdI2hn1fL6mWNEZiSFAw+BXsf+bFCFGAw31yKG+aG3mdivxTqdDyNEGktKCE0 8Zo5TkPjkG5lRgLN7oauXJ4q/UBgDdT+WltZEoI+Y4+7F/y1iBdG22TYRm0IqOXvKTRwDBE7/hoi5 axJb1XnJKSbU2yp0KdBYaA2/QimroTLmdjNJJW3MBWgpRvyP9GbNg8tI+6pDjn2nE/6sf2yaiJQTM zZ0pSjd4SV62pQxVd/eKYd+jTp6xjSfsIyLLCglnisrDwp8Rk0arAOTHTf8HYzpUKP1xezN2+9VmD B13hAdjQ==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1wS8zP-0000000BdsM-2q5P; Wed, 27 May 2026 07:47:43 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: Xavier Guimard <yadd@debian.org> To: 1137372-close@bugs.debian.org X-DAK: dak process-policy X-Debian: DAK X-Debian-Package: node-shell-quote Debian: DAK Debian-Changes: node-shell-quote_1.7.4+~1.7.1-1+deb13u1_amd64.changes Debian-Source: node-shell-quote Debian-Version: 1.7.4+~1.7.1-1+deb13u1 Debian-Architecture: source all Debian-Suite: proposed-updates Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1137372: fixed in node-shell-quote 1.7.4+~1.7.1-1+deb13u1 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============1141267663338870318==" Message-Id: <E1wS8zP-0000000BdsM-2q5P@fasolo.debian.org> Date: Wed, 27 May 2026 07:47:43 +0000 --===============1141267663338870318== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: node-shell-quote Source-Version: 1.7.4+~1.7.1-1+deb13u1 Done: Xavier Guimard <yadd@debian.org> We believe that the bug you reported is fixed in the latest version of node-shell-quote, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1137372@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Xavier Guimard <yadd@debian.org> (supplier of updated node-shell-quote packag= e) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 23 May 2026 11:56:08 +0200 Source: node-shell-quote Binary: node-shell-quote Architecture: source all Version: 1.7.4+~1.7.1-1+deb13u1 Distribution: trixie-security Urgency: medium Maintainer: Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.= debian.org> Changed-By: Xavier Guimard <yadd@debian.org> Description: node-shell-quote - quote and parse shell commands Closes: 1137372 Changes: node-shell-quote (1.7.4+~1.7.1-1+deb13u1) trixie-security; urgency=3Dmedium . * Team upload * Validate object-token shapes (Closes: #1137372, CVE-2026-9277) Checksums-Sha1: 06d6437c1318825aee9802ee458eed6b70b64e7f 2508 node-shell-quote_1.7.4+~1.7.1-= 1+deb13u1.dsc 2d059091214a02c29f003f591032172b2aff77e8 2241 node-shell-quote_1.7.4+~1.7.1.= orig-types-shell-quote.tar.gz 526309c375cb6d9dff84f04d6bf6cb21038339db 15359 node-shell-quote_1.7.4+~1.7.1= .orig.tar.gz fc4f30284db6b94ccc078704e3a8a7c2e97e0792 5312 node-shell-quote_1.7.4+~1.7.1-= 1+deb13u1.debian.tar.xz 4aba226178c57d9f1520c89a3af8023723bd212d 14708 node-shell-quote_1.7.4+~1.7.1= -1+deb13u1_all.deb 7d0bd5102f6674fb9302abb4806a220f30070bcc 15667 node-shell-quote_1.7.4+~1.7.1= -1+deb13u1_amd64.buildinfo Checksums-Sha256: 388b10223d59c4987004ca20443e1393d88e64992b8f5fa72154382eea0e99fe 2508 node-s= hell-quote_1.7.4+~1.7.1-1+deb13u1.dsc 732c849a97ba0778c6bd224b09895b95f7ba0bcdeb41658dfbefbd6fcb48c42d 2241 node-s= hell-quote_1.7.4+~1.7.1.orig-types-shell-quote.tar.gz c47d07f375e52ef8c5b27382a9fdc0018e1a50954a3480b13fc96c8bb0314967 15359 node-= shell-quote_1.7.4+~1.7.1.orig.tar.gz 79cf60ec14fe1827d76b93d68b67aab3bed3edb6c8d9a385794be3d3568d4276 5312 node-s= hell-quote_1.7.4+~1.7.1-1+deb13u1.debian.tar.xz 161242962f90a23816168b1c0f23d3e5734603cc4d9d753ce386abef8ebe4525 14708 node-= shell-quote_1.7.4+~1.7.1-1+deb13u1_all.deb 43122ea96568d6c760d399b0f64828f28ed68205c1e760edddfb3a58ff76c890 15667 node-= shell-quote_1.7.4+~1.7.1-1+deb13u1_amd64.buildinfo Files: 878e03acb8ecff2faf131394b80405a4 2508 javascript optional node-shell-quote_1= .7.4+~1.7.1-1+deb13u1.dsc c932ae6cdd4e3244131b099713a03457 2241 javascript optional node-shell-quote_1= .7.4+~1.7.1.orig-types-shell-quote.tar.gz 7af11564f75bafc25260ad455fb2a0b9 15359 javascript optional node-shell-quote_= 1.7.4+~1.7.1.orig.tar.gz 8ab9ed99edc68e760de34d2091cf2b2e 5312 javascript optional node-shell-quote_1= .7.4+~1.7.1-1+deb13u1.debian.tar.xz 45d5006a6aa40fb029b79d1ea6b6eea1 14708 javascript optional node-shell-quote_= 1.7.4+~1.7.1-1+deb13u1_all.deb 39e54fafe6814f252fcba075d4bea32b 15667 javascript optional node-shell-quote_= 1.7.4+~1.7.1-1+deb13u1_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmoRg7YACgkQ9tdMp8mZ 7unmOA/+MgQEM6GwC6g5KgVu1BuznRYDlQp6ius1a9I65idi3d1DHqgvoLRJmnXq jF9lYu3oAqvlyRDzLnhR9bQobg1naNmH8eDHtaytRW8DYsMrukLtK1QTehIvpYRn YowkwlHwOtwurQFjGzy8ay2KeqSqICcHIsjJ+KAo0HlMTNAnU5H0YNItrvr2j32P liVQnDIYX7Z83l5ZrWG9phoQBJkOINI456EhJzwoT97ke9aIS0hYC6rkVvUu5eRm TMM4JRPw7fyKmk4n690qL3wVA+8UI2yl6cCDfeUNHXde6dhlaYtLyrX6rfJxK/pt 87d8B3TxBQgrrk83aHbjAAobRxzQRMn8ysS2liiklcHBl+dOS0IGUaI76x7yf7Iy I9wjMhvCVWoqljcZ3D+qoF0qLK8eDR/eqqpKY3yPjoWAhj9yAYRzEaKvF05KkLux IPSa5Ga7Dt4xLGnE+4igZWfYzOQmuFUvXTSTgLt1gQOdgHcsTMscnZysQvwXEjK3 xQGByJw/y/vpd/4AJvN5gh577biiqkJ2rtsm+Sf68klyyqoxVVg29iQSlBVuo+Qf Q/jgvvBFpPvj0nEEjeNkHMbVUvkoAv5YgtAN1XPlr5wmnyzgTziaCPtTA86rLTBv LPGFKKfI2yWoAso5OoKrcXQ8Q+HFDUO7AbB+Tzn2lol6n+ujUIs=3D =3DvptJ -----END PGP SIGNATURE----- --===============1141267663338870318== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCahahnwAKCRCb9qggYcy5 IYfjAP9H0lWEhLwwXHDAnPNcsYMydhlxGzu/oEEbfDVGPY1JTwEAniJMG/SXqfU1 3O1SbsFdu9LVbKB4h3ANtk1lMbanLgY= =Zv9s -----END PGP SIGNATURE----- --===============1141267663338870318==-- ]