[From nobody Sun Oct 11 12:55:10 2026 Received: (at 1149713-close) by bugs.debian.org; 11 Oct 2026 11:52:18 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-113.7 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FVGT_m_MULTI_ODD, HAS_BUG_NUMBER,MD5_SHA1_SUM,MONEY,PGPSIGNATURE,SPF_HELO_PASS,SPF_PASS, USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 84; hammy, 150; neutral, 175; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo., 0.000-+--H*MI:fasolo Return-path: <envelope@ftp-master.debian.org> Received: from mailly.debian.org ([2001:41b8:202:deb:6564:a62:52c3:4b72]:32894) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xFs6F-00AmHP-0G for 1149713-close@bugs.debian.org; Sun, 11 Oct 2026 11:52:18 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by mailly.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xFs6D-002Yz8-0X for 1149713-close@bugs.debian.org; Sun, 11 Oct 2026 11:52:17 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=mOBNNFV5J/S+zqYFCtwBuP1x94Iiia5pOciB4ZYRsxI=; b=Tzq0wKajHtRdK3FmBU3LhdA821 rUVmyqsYUlRJEMKVosibXFCpr6M+NBEdrJNMv3Iv+DRh/BU+eAVZhBGOGNj9t+QhZ9995Z748wpT1 vdYuWOIbx+72hXsn38JX2bKytF5xAd+k4ESECorjUJQOA93cxNY3kCUCxOJnkpYhdDTY6IX/SMAHE +ZEHnZRD39LK5w6r/IHCarH0XfYFYjoHvMFhrq9dq2SauwsZwwLQQOYVVLdFH5R1CLHEwqq+9vNjb Z8E07lAW8HY0n5HJfpWhceb/Z3L7buGALxdtTCVCPqtbbIHAjniUWpPVoABHt3huYP8eLoVgTGYeQ alFYznqA==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1xFs6C-00000007Gn8-1GdW; Sun, 11 Oct 2026 11:52:16 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: Xavier Guimard <yadd@debian.org> To: 1149713-close@bugs.debian.org X-DAK: dak process-policy X-Debian: DAK X-Debian-Package: node-shell-quote Debian: DAK Debian-Changes: node-shell-quote_1.7.4+~1.7.1-1+deb13u2_amd64.changes Debian-Source: node-shell-quote Debian-Version: 1.7.4+~1.7.1-1+deb13u2 Debian-Architecture: source all Debian-Suite: proposed-updates Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1149713: fixed in node-shell-quote 1.7.4+~1.7.1-1+deb13u2 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============1920516252598506871==" Message-Id: <E1xFs6C-00000007Gn8-1GdW@fasolo.debian.org> Date: Sun, 11 Oct 2026 11:52:16 +0000 --===============1920516252598506871== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: node-shell-quote Source-Version: 1.7.4+~1.7.1-1+deb13u2 Done: Xavier Guimard <yadd@debian.org> We believe that the bug you reported is fixed in the latest version of node-shell-quote, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1149713@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Xavier Guimard <yadd@debian.org> (supplier of updated node-shell-quote packag= e) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 06 Oct 2026 11:29:23 +0200 Source: node-shell-quote Binary: node-shell-quote Architecture: source all Version: 1.7.4+~1.7.1-1+deb13u2 Distribution: trixie-security Urgency: medium Maintainer: Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.= debian.org> Changed-By: Xavier Guimard <yadd@debian.org> Description: node-shell-quote - quote and parse shell commands Closes: 1140921 1149713 Changes: node-shell-quote (1.7.4+~1.7.1-1+deb13u2) trixie-security; urgency=3Dmedium . * Team upload * Reject line terminators in tokens after a comment (Closes: #1149713, CVE-2026-102422) * Finalize parse tokens in linear time (Closes: #1140921, CVE-2026-13311) Checksums-Sha1: d624fa6b3e79ba505373d3b5b656a464587a97a2 2508 node-shell-quote_1.7.4+~1.7.1-= 1+deb13u2.dsc 2d059091214a02c29f003f591032172b2aff77e8 2241 node-shell-quote_1.7.4+~1.7.1.= orig-types-shell-quote.tar.gz 526309c375cb6d9dff84f04d6bf6cb21038339db 15359 node-shell-quote_1.7.4+~1.7.1= .orig.tar.gz 0701418069953755f62d07373d3f37791846370a 6836 node-shell-quote_1.7.4+~1.7.1-= 1+deb13u2.debian.tar.xz c9e2ad8ea36fc34a06b53eb01337dc0a63e3a976 15432 node-shell-quote_1.7.4+~1.7.1= -1+deb13u2_all.deb 27d2f749e95eed643e517e57e876d442e1d53c51 15839 node-shell-quote_1.7.4+~1.7.1= -1+deb13u2_amd64.buildinfo Checksums-Sha256: 4d46dadf65a436b75babf9eacd9c731e4b017e8001c3c96693397478cd906737 2508 node-s= hell-quote_1.7.4+~1.7.1-1+deb13u2.dsc 732c849a97ba0778c6bd224b09895b95f7ba0bcdeb41658dfbefbd6fcb48c42d 2241 node-s= hell-quote_1.7.4+~1.7.1.orig-types-shell-quote.tar.gz c47d07f375e52ef8c5b27382a9fdc0018e1a50954a3480b13fc96c8bb0314967 15359 node-= shell-quote_1.7.4+~1.7.1.orig.tar.gz df1f9e73127e331cee3d852080d54ea3c04fe98f00a578eaa3736b1806c6d866 6836 node-s= hell-quote_1.7.4+~1.7.1-1+deb13u2.debian.tar.xz 873ff44532e895891919d7868321f87160658e71d6e729d0f16d002037940f3a 15432 node-= shell-quote_1.7.4+~1.7.1-1+deb13u2_all.deb 3058814d9e18f2a2f67c94357876b3bff78599ef7052f09a7123e24bd44f1156 15839 node-= shell-quote_1.7.4+~1.7.1-1+deb13u2_amd64.buildinfo Files: 9957de293c9084c211dc07b1453f6690 2508 javascript optional node-shell-quote_1= .7.4+~1.7.1-1+deb13u2.dsc c932ae6cdd4e3244131b099713a03457 2241 javascript optional node-shell-quote_1= .7.4+~1.7.1.orig-types-shell-quote.tar.gz 7af11564f75bafc25260ad455fb2a0b9 15359 javascript optional node-shell-quote_= 1.7.4+~1.7.1.orig.tar.gz ec0abcb997a15c5de0ba7265ce325c06 6836 javascript optional node-shell-quote_1= .7.4+~1.7.1-1+deb13u2.debian.tar.xz 5226927e8759a676d84a405751a68374 15432 javascript optional node-shell-quote_= 1.7.4+~1.7.1-1+deb13u2_all.deb 010518e6c4b209c2e63f219a02be9d2a 15839 javascript optional node-shell-quote_= 1.7.4+~1.7.1-1+deb13u2_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmrExU4ACgkQ9tdMp8mZ 7um/pA//RzYgLFbh8RgWUDkjzPKmtucBMKOfLzHBS3wanCbfhOwCYUYpYTB7fxiQ yomO96TZJr767TTE6CrIC7/gTZ8L6ck0+kfrQ9Umt2m/uvk9zIw3STIM4zfvGidY C4tv8+o+ne3dCj1fj/LzRWmn079Q5iZavEUYKu4cqpY3baoJ4l2QA8J73OYdeUgk YiBobFNhvcO5/EyKCmMCkHk8myRYOU+NmMZGsIDyd124INN/JdOKAz4fNbhuv261 p3Wdrnc+CS9gTMeevspo50jsxSaN4QCR3lSobEdDiAlJjEiw3nXLx+PSKM0ZayoV 3tKcbqRhCla88T04fuOjeAAo667+F5iBj47OcMjGH+SmHv6WiC/BvjKLWWU+yAsc yZ9jHOOXzo5cxuvqJHAFlTdsdzjNQduAiKSp6Gg7JenRfL5Jz3dgKREUR77nrNUi i8hNFZB/yozlxAA+iXB85ZExzgxN7sfFZk3UcD0oax7zd3X+gqI2vcbBhqliQ6us 7IeWo6iUkTfiiWu3QDY0OGoQtDKcDzH1slz6qcvHAc4kCt+uhcv4QVAr4nO85ptH +sgvBAaKDyYLFX8VlNStuSd01eM3CVojnIBxlPdmUNSavkoOiBx6C3sEdmauhssf FzKowVPeJHeB6ssaMzZbFHNnWyDqvwInApmau7O9cXky7Kjvfuo=3D =3DwAgI -----END PGP SIGNATURE----- --===============1920516252598506871== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCast4cAAKCRCb9qggYcy5 IXm6AQDXgLvWOzgU7Jk8E6GmN/2vEXjOlL8A8JeEWWlkl6bZqAD/Rm3cYQMwCQUw 7jtleUTESOe9Yk/+a8D3k+v1VdioGQ4= =D0xM -----END PGP SIGNATURE----- --===============1920516252598506871==-- ]