chore: upgrade shell-quote to ^1.10.0 to address CVE-2026-13311

[linear-code]

Fixes SOU-1550

Resolves CVE-2026-13311 (HIGH), a denial-of-service in shell-quote's parse() where finalizing tokens with Array.prototype.concat as a reduce accumulator makes parsing run in O(n²). It reaches us transitively via npm-run-all and concurrently.

Both existing ranges (^1.6.1, ^1.8.4) already admit the patched release, so this is a lockfile refresh only (yarn up -R shell-quote) — no package.json change or resolutions override needed. shell-quote now resolves to 1.10.0, above the fixed 1.9.0.

---

Note

Low Risk
Lockfile-only transitive dependency upgrade with no source changes; low operational risk beyond standard dependency refresh validation.

Overview
Security dependency bump for the transitive shell-quote package (via npm-run-all / concurrently): yarn.lock now resolves shell-quote 1.10.0 instead of 1.8.4, addressing CVE-2026-13311 (DoS in parse() from O(n²) token finalization).

There is no package.json change—only a lockfile refresh. [Unreleased] in CHANGELOG.md documents the fix.

^{Reviewed by Cursor Bugbot for commit f5f39f7. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

License Audit

❌ Audit failed to produce results. Check the workflow logs for details.