shell-quote breaking changes

1.11.0

1 breaking change, first published September 29, 2026.

• Behavior changed quote
  Tokens after a comment containing line terminators are now rejected by quote. Code that passes such tokens must strip the line terminators first. github.com

1.10.0

1 breaking change, first published July 10, 2026.

• Behavior changed parse
  Inside single quotes, a backslash is now treated as a literal character, so input that relied on the old escaping will parse differently. Review any single-quoted strings containing backslashes. github.com

1.9.0

7 breaking changes, first published June 25, 2026.

• Behavior changed quote
  quote output changes for strings starting with ~, which are now escaped. Code that relies on the previous unescaped output may need updating. github.com
• Signature changed ControlOperator
  Was type ControlOperator = "||" | "&&" | ";;" | "|&" | "<(" | ">>" | ">&" | "&" | ";" | "(" | ")" | "|" | "<" | ">"; now type ControlOperator = parse.ControlOperator. npmjs.com
• Signature changed parse
  Was function parse(cmd: string, env?: {readonly [key: string]: string | undefined}, opts?: ParseOptions): ParseEntry[] function parse<T extends object | string>(cmd: string, env: (key: string) => T | undefined, opts?: ParseOptions)... npmjs.com
• Signature changed ParseEntry
  Was type ParseEntry = | string | {op: ControlOperator} | {op: "glob"; pattern: string} | {comment: string}; now type ParseEntry = parse.ParseEntry. npmjs.com
• Signature changed ParseOptions
  Was interface ParseOptions; now type ParseOptions = parse.ParseOptions. npmjs.com
• Signature changed ParseOptions.escape
  Was escape?: string | undefined; now escape?: string. npmjs.com
• Signature changed quote
  Was function quote(args: readonly string[]): string; now function quote(args: readonly parse.ParseEntry[]): string. npmjs.com

1.8.4

1 breaking change, first published May 22, 2026.

• Behavior changed quote
  quote now validates object-token shapes, so malformed object tokens that were previously accepted may now be rejected. Check that any object tokens passed to quote are well-formed. github.com

Check your code

These are the changes. To see which of them reach your code, scan a public repository, or have your coding agent call check_code with your manifest or lockfile over MCP. The API reads every change in every version, not only the newest. On Team and up, a fix pull request opens for the changes that reach a connected repository. Nothing merges or deploys.