chore(deps): bump the npm_and_yarn group across 1 directory with 4 updates (#210)

Bumps the npm_and_yarn group with 4 updates in the / directory:
[handlebars](https://github.com/handlebars-lang/handlebars.js),
[proxy-addr](https://github.com/jshttp/proxy-addr),
[shell-quote](https://github.com/ljharb/shell-quote) and
[source-map-js](https://github.com/7rulnik/source-map-js).

Updates `handlebars` from 4.7.9 to 4.7.10
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/handlebars-lang/handlebars.js/releases">handlebars's
releases</a>.</em></p>
<blockquote>
<h2>v4.7.10</h2>
<ul>
<li>security: Sanitize the source map URL when minifying - f37c599</li>
<li>security: Iterate lazily in #each and strip whitespace in linear
time - 812c226</li>
<li>security: Escape <code>&lt;!--</code> and <code>&lt;script</code> in
precompiled output - 609d1b1 GHSA-xw65-4hp5-5hc7</li>
<li>security: Don't trust special properties on context data - ceec388
GHSA-p8wg-vrv2-v86f</li>
<li>security: Only compile partials that are template strings -
c28ee7a</li>
<li>security: Only dispatch known node types in the Compiler and Visitor
- 7d501a5</li>
<li>security: Validate AST values in the compiler instead of the parser
- 703fdcc GHSA-8r5x-fm3f-whwj</li>
<li>Clarify that --root does not restrict filesystem access -
0fcf25c</li>
<li>Bump minimist to ^1.2.8 - ea8ed82</li>
<li>Fix Ruby component publishing documentation - d069c1c</li>
<li>Fix Composer component definition - 6714e07</li>
</ul>
<p>Compatibility notes:</p>
<ul>
<li><code>{{#each}}</code> iterates iterables such as <code>Map</code>,
<code>Set</code> and generators lazily, like <code>for...of</code>,
instead of
copying them into an array first. Values added to the iterable while the
block renders are now visited too.</li>
</ul>
<p><a
href="https://github.com/handlebars-lang/handlebars.js/compare/v4.7.9...v4.7.10">Commits</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/handlebars-lang/handlebars.js/blob/v4.7.10/release-notes.md">handlebars's
changelog</a>.</em></p>
<blockquote>
<h2>v4.7.10 - October 5th, 2026</h2>
<ul>
<li>security: Sanitize the source map URL when minifying - f37c599</li>
<li>security: Iterate lazily in #each and strip whitespace in linear
time - 812c226</li>
<li>security: Escape <code>&lt;!--</code> and <code>&lt;script</code> in
precompiled output - 609d1b1 GHSA-xw65-4hp5-5hc7</li>
<li>security: Don't trust special properties on context data - ceec388
GHSA-p8wg-vrv2-v86f</li>
<li>security: Only compile partials that are template strings -
c28ee7a</li>
<li>security: Only dispatch known node types in the Compiler and Visitor
- 7d501a5</li>
<li>security: Validate AST values in the compiler instead of the parser
- 703fdcc GHSA-8r5x-fm3f-whwj</li>
<li>Clarify that --root does not restrict filesystem access -
0fcf25c</li>
<li>Bump minimist to ^1.2.8 - ea8ed82</li>
<li>Fix Ruby component publishing documentation - d069c1c</li>
<li>Fix Composer component definition - 6714e07</li>
</ul>
<p>Compatibility notes:</p>
<ul>
<li><code>{{#each}}</code> iterates iterables such as <code>Map</code>,
<code>Set</code> and generators lazily, like <code>for...of</code>,
instead of
copying them into an array first. Values added to the iterable while the
block renders are now visited too.</li>
</ul>
<p><a
href="https://github.com/handlebars-lang/handlebars.js/compare/v4.7.9...v4.7.10">Commits</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/commit/45ce15255e0f430ac6d19742b18e316b7539264e"><code>45ce152</code></a>
v4.7.10</li>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/commit/e47b2365d5656ab5689ae226aef90a485a90c5d8"><code>e47b236</code></a>
Update release notes</li>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/commit/f37c599de9187715eb1e9afedcb2d80c175487a0"><code>f37c599</code></a>
Sanitize the source map URL when minifying</li>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/commit/812c2260cb8794ef4ab63a7f1d946431112560ca"><code>812c226</code></a>
Iterate lazily in #each and strip whitespace in linear time</li>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/commit/609d1b11c833c9a3e00f56f2f34d22f425446725"><code>609d1b1</code></a>
Escape <code>&lt;!--</code> and <code>&lt;script</code> in precompiled
output</li>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/commit/ceec388abe1d1aac8f6369860d5f390fa71ef4fa"><code>ceec388</code></a>
Don't trust special properties on context data</li>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/commit/c28ee7adb312308e0fe26f4d435a481be5e1ff98"><code>c28ee7a</code></a>
Only compile partials that are template strings</li>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/commit/7d501a5af2ac3aa9ac788a8889dbe419849e46f1"><code>7d501a5</code></a>
Only dispatch known node types in the Compiler and Visitor</li>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/commit/703fdcc5fd6cc8d1cc0c33cc19de40c467c4b8d2"><code>703fdcc</code></a>
Validate AST values in the compiler instead of the parser</li>
<li><a
href="https://github.com/handlebars-lang/handlebars.js/commit/0fcf25c63038b43e78e17adbf029cf073e80554d"><code>0fcf25c</code></a>
Clarify that --root does not restrict filesystem access</li>
<li>Additional commits viewable in <a
href="https://github.com/handlebars-lang/handlebars.js/compare/v4.7.9...v4.7.10">compare
view</a></li>
</ul>
</details>
<br />

Updates `proxy-addr` from 2.0.7 to 2.0.8
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/jshttp/proxy-addr/releases">proxy-addr's
releases</a>.</em></p>
<blockquote>
<h2>2.0.8</h2>
<h2>Important</h2>
<ul>
<li>Fix <a
href="https://www.cve.org/CVERecord?id=CVE-2026-90711">CVE-2026-90711</a>
(<a
href="https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h">GHSA-jqcg-44mw-7w3h</a>)</li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>Add OSSF scorecard action by <a
href="https://github.com/carpasse"><code>@​carpasse</code></a> in <a
href="https://redirect.github.com/jshttp/proxy-addr/pull/27">jshttp/proxy-addr#27</a></li>
<li>Fix ci pipeline and add missing Node.JS versions by <a
href="https://github.com/carpasse"><code>@​carpasse</code></a> in <a
href="https://redirect.github.com/jshttp/proxy-addr/pull/26">jshttp/proxy-addr#26</a></li>
<li>[StepSecurity] Apply security best practices by <a
href="https://github.com/step-security-bot"><code>@​step-security-bot</code></a>
in <a
href="https://redirect.github.com/jshttp/proxy-addr/pull/29">jshttp/proxy-addr#29</a></li>
<li>build(deps): bump coverallsapp/github-action from 1.2.5 to 2.3.6 by
<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/jshttp/proxy-addr/pull/30">jshttp/proxy-addr#30</a></li>
<li>build(deps): bump github/codeql-action from 2.23.2 to 3.28.18 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/jshttp/proxy-addr/pull/31">jshttp/proxy-addr#31</a></li>
<li>build(deps-dev): bump eslint-plugin-import from 2.23.4 to 2.31.0 by
<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/jshttp/proxy-addr/pull/32">jshttp/proxy-addr#32</a></li>
<li>build(deps): bump ossf/scorecard-action from 2.0.6 to 2.4.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/jshttp/proxy-addr/pull/33">jshttp/proxy-addr#33</a></li>
<li>build(deps): bump actions/upload-artifact from 3.1.3 to 4.6.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/jshttp/proxy-addr/pull/35">jshttp/proxy-addr#35</a></li>
<li>build(deps-dev): bump deep-equal from 1.0.1 to 1.1.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/jshttp/proxy-addr/pull/34">jshttp/proxy-addr#34</a></li>
<li>build(deps-dev): bump eslint-plugin-markdown from 2.2.0 to 2.2.1 by
<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/jshttp/proxy-addr/pull/36">jshttp/proxy-addr#36</a></li>
<li>chore: add funding to package.json by <a
href="https://github.com/Phillip9587"><code>@​Phillip9587</code></a> in
<a
href="https://redirect.github.com/jshttp/proxy-addr/pull/40">jshttp/proxy-addr#40</a></li>
<li>build(deps): bump github/codeql-action from 3.28.18 to 3.29.5 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/jshttp/proxy-addr/pull/41">jshttp/proxy-addr#41</a></li>
<li>build(deps): bump github/codeql-action from 3.29.7 to 3.29.11 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/jshttp/proxy-addr/pull/43">jshttp/proxy-addr#43</a></li>
<li>build(deps): bump actions/checkout from 3.6.0 to 5.0.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/jshttp/proxy-addr/pull/42">jshttp/proxy-addr#42</a></li>
<li>build(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/jshttp/proxy-addr/pull/47">jshttp/proxy-addr#47</a></li>
<li>build(deps): bump github/codeql-action from 3.29.11 to 4.31.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/jshttp/proxy-addr/pull/46">jshttp/proxy-addr#46</a></li>
<li>build(deps): bump coverallsapp/github-action from 2.3.6 to 2.3.7 by
<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/jshttp/proxy-addr/pull/50">jshttp/proxy-addr#50</a></li>
<li>build(deps): bump github/codeql-action from 4.31.2 to 4.31.5 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/jshttp/proxy-addr/pull/49">jshttp/proxy-addr#49</a></li>
<li>build(deps): bump actions/checkout from 5.0.0 to 6.0.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/jshttp/proxy-addr/pull/48">jshttp/proxy-addr#48</a></li>
<li>build(deps): bump actions/checkout from 6.0.0 to 6.0.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/jshttp/proxy-addr/pull/56">jshttp/proxy-addr#56</a></li>
<li>build(deps): bump github/codeql-action from 4.31.5 to 4.32.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/jshttp/proxy-addr/pull/55">jshttp/proxy-addr#55</a></li>
<li>build(deps): bump github/codeql-action from 4.32.0 to 4.32.4 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/jshttp/proxy-addr/pull/57">jshttp/proxy-addr#57</a></li>
<li>build(deps): bump actions/upload-artifact from 5.0.0 to 7.0.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/jshttp/proxy-addr/pull/58">jshttp/proxy-addr#58</a></li>
<li>Fix &quot;arugment&quot; typo in README by <a
href="https://github.com/schiwekM"><code>@​schiwekM</code></a> in <a
href="https://redirect.github.com/jshttp/proxy-addr/pull/61">jshttp/proxy-addr#61</a></li>
<li>build(deps): bump github/codeql-action from 4.32.4 to 4.36.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/jshttp/proxy-addr/pull/64">jshttp/proxy-addr#64</a></li>
<li>build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/jshttp/proxy-addr/pull/63">jshttp/proxy-addr#63</a></li>
<li>build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/jshttp/proxy-addr/pull/45">jshttp/proxy-addr#45</a></li>
<li>build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 by
<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/jshttp/proxy-addr/pull/39">jshttp/proxy-addr#39</a></li>
<li>chore(ci): npm-publish via reusable workflows by <a
href="https://github.com/sheplu"><code>@​sheplu</code></a> in <a
href="https://redirect.github.com/jshttp/proxy-addr/pull/54">jshttp/proxy-addr#54</a></li>
<li>refresh CI by <a
href="https://github.com/UlisesGascon"><code>@​UlisesGascon</code></a>
in <a
href="https://redirect.github.com/jshttp/proxy-addr/pull/69">jshttp/proxy-addr#69</a></li>
<li>fix: typo by <a
href="https://github.com/UlisesGascon"><code>@​UlisesGascon</code></a>
in <a
href="https://redirect.github.com/jshttp/proxy-addr/pull/71">jshttp/proxy-addr#71</a></li>
<li>Release: 2.0.8 by <a
href="https://github.com/UlisesGascon"><code>@​UlisesGascon</code></a>
in <a
href="https://redirect.github.com/jshttp/proxy-addr/pull/70">jshttp/proxy-addr#70</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/carpasse"><code>@​carpasse</code></a>
made their first contribution in <a
href="https://redirect.github.com/jshttp/proxy-addr/pull/27">jshttp/proxy-addr#27</a></li>
<li><a
href="https://github.com/step-security-bot"><code>@​step-security-bot</code></a>
made their first contribution in <a
href="https://redirect.github.com/jshttp/proxy-addr/pull/29">jshttp/proxy-addr#29</a></li>
<li><a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
made their first contribution in <a
href="https://redirect.github.com/jshttp/proxy-addr/pull/30">jshttp/proxy-addr#30</a></li>
<li><a
href="https://github.com/Phillip9587"><code>@​Phillip9587</code></a>
made their first contribution in <a
href="https://redirect.github.com/jshttp/proxy-addr/pull/40">jshttp/proxy-addr#40</a></li>
<li><a href="https://github.com/schiwekM"><code>@​schiwekM</code></a>
made their first contribution in <a
href="https://redirect.github.com/jshttp/proxy-addr/pull/61">jshttp/proxy-addr#61</a></li>
<li><a href="https://github.com/sheplu"><code>@​sheplu</code></a> made
their first contribution in <a
href="https://redirect.github.com/jshttp/proxy-addr/pull/54">jshttp/proxy-addr#54</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/jshttp/proxy-addr/compare/v2.0.7...v2.0.8">https://github.com/jshttp/proxy-addr/compare/v2.0.7...v2.0.8</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/jshttp/proxy-addr/blob/master/HISTORY.md">proxy-addr's
changelog</a>.</em></p>
<blockquote>
<h1>2.0.8</h1>
<ul>
<li>Fix <a
href="https://www.cve.org/CVERecord?id=CVE-2026-90711">CVE-2026-90711</a>
(<a
href="https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h">GHSA-jqcg-44mw-7w3h</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/jshttp/proxy-addr/commit/a11ad82545698af5c33e59f3ed0b52eab79bf610"><code>a11ad82</code></a>
2.0.8 (<a
href="https://redirect.github.com/jshttp/proxy-addr/issues/70">#70</a>)</li>
<li><a
href="https://github.com/jshttp/proxy-addr/commit/780911d84d18e2c5fa008ed0c0d387631ec11965"><code>780911d</code></a>
fix: reject IPv4 trust via mapped IPv6 subnets with a short prefix</li>
<li><a
href="https://github.com/jshttp/proxy-addr/commit/92e103e3f3ab0467c8846cacea71f27dfc81091d"><code>92e103e</code></a>
fix(ci): use publised as release trigger event (<a
href="https://redirect.github.com/jshttp/proxy-addr/issues/71">#71</a>)</li>
<li><a
href="https://github.com/jshttp/proxy-addr/commit/3e5ac75d275d82606d33d6ac47c0ff43c2eccee9"><code>3e5ac75</code></a>
ci: merge coverage via artifacts, disable fail-fast, add Node.js 23-26
(<a
href="https://redirect.github.com/jshttp/proxy-addr/issues/69">#69</a>)</li>
<li><a
href="https://github.com/jshttp/proxy-addr/commit/4b9db8190923840eb732b752a70f3e5ff713768c"><code>4b9db81</code></a>
chore(ci): npm-publish via workflows (<a
href="https://redirect.github.com/jshttp/proxy-addr/issues/54">#54</a>)</li>
<li><a
href="https://github.com/jshttp/proxy-addr/commit/655e8950435ac457c586e8287da4d5993b7d0db5"><code>655e895</code></a>
build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 (<a
href="https://redirect.github.com/jshttp/proxy-addr/issues/39">#39</a>)</li>
<li><a
href="https://github.com/jshttp/proxy-addr/commit/50ce4d09132a4c34f5485b52740ce879a9223b1f"><code>50ce4d0</code></a>
build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 (<a
href="https://redirect.github.com/jshttp/proxy-addr/issues/45">#45</a>)</li>
<li><a
href="https://github.com/jshttp/proxy-addr/commit/0fd347f5b342e7502da58a512dc998d4a59cea24"><code>0fd347f</code></a>
build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (<a
href="https://redirect.github.com/jshttp/proxy-addr/issues/63">#63</a>)</li>
<li><a
href="https://github.com/jshttp/proxy-addr/commit/6a517fa25c741cc107a90019df458b34f580ce55"><code>6a517fa</code></a>
build(deps): bump github/codeql-action from 4.32.4 to 4.36.0 (<a
href="https://redirect.github.com/jshttp/proxy-addr/issues/64">#64</a>)</li>
<li><a
href="https://github.com/jshttp/proxy-addr/commit/0d45e2a88e82a2faf1148956b6457e3a6c99ebcd"><code>0d45e2a</code></a>
Fix &quot;arugment&quot; typo in README (<a
href="https://redirect.github.com/jshttp/proxy-addr/issues/61">#61</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/jshttp/proxy-addr/compare/v2.0.7...v2.0.8">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for proxy-addr since your current version.</p>
</details>
<br />

Updates `shell-quote` from 1.10.0 to 1.12.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md">shell-quote's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/ljharb/shell-quote/compare/v1.11.0...v1.12.0">v1.12.0</a>
- 2026-10-02</h2>
<h3>Fixed</h3>
<ul>
<li>[New] <code>parse</code>: support here-documents
(<code>&amp;lt;&amp;lt;</code>) <a
href="https://redirect.github.com/ljharb/shell-quote/issues/31"><code>[#31](https://github.com/ljharb/shell-quote/issues/31)</code></a></li>
</ul>
<h3>Commits</h3>
<ul>
<li>[New] <code>parse</code>: support tab-stripping here-documents
(<code>&amp;lt;&amp;lt;-</code>) <a
href="https://github.com/ljharb/shell-quote/commit/dbfac376d4065d37539d3abdb5e76847f93797d3"><code>dbfac37</code></a></li>
<li>[New] <code>parse</code>: support output process substitution
(<code>&amp;gt;(</code>) <a
href="https://github.com/ljharb/shell-quote/commit/20533154bb57809c80f55318b8493aef49505f4e"><code>2053315</code></a></li>
<li>[New] <code>parse</code>: support the <code>case</code> test-next
terminator (<code>;;&amp;</code>) <a
href="https://github.com/ljharb/shell-quote/commit/7d688b9bec1917a22cccd4d4c887128a9c66e8a0"><code>7d688b9</code></a></li>
<li>[New] <code>parse</code>: support the <code>case</code> fall-through
terminator (<code>;&amp;</code>) <a
href="https://github.com/ljharb/shell-quote/commit/f27010ed04bcd925795b350afb1c49e36bbd1ba3"><code>f27010e</code></a></li>
<li>[New] <code>parse</code>: support redirecting output despite
<code>noclobber</code> (<code>&amp;gt;|</code>) <a
href="https://github.com/ljharb/shell-quote/commit/b78d19c14da6356cc12c46b3478203247ab8a295"><code>b78d19c</code></a></li>
<li>[New] <code>parse</code>: support opening a file for reading and
writing (<code>&amp;lt;&amp;gt;</code>) <a
href="https://github.com/ljharb/shell-quote/commit/21cc333eb0ce5bf094f595b7fdc01b3447ffd4b0"><code>21cc333</code></a></li>
<li>[New] <code>parse</code>: support redirecting stdout and stderr
(<code>&amp;&amp;gt;</code>) <a
href="https://github.com/ljharb/shell-quote/commit/6ad6cd215f89adcc29dd601e085fa54083c2f911"><code>6ad6cd2</code></a></li>
<li>[New] <code>parse</code>: support appending stdout and stderr
(<code>&amp;&amp;gt;&amp;gt;</code>) <a
href="https://github.com/ljharb/shell-quote/commit/90cde9cfd8af30fcb65e9fd2cb2f9e181d3f103b"><code>90cde9c</code></a></li>
<li>[Dev Deps] update <code>@ljharb/eslint-config</code> <a
href="https://github.com/ljharb/shell-quote/commit/3a7b4ae3960c3ff4413932e276c5b0ecb3a2b456"><code>3a7b4ae</code></a></li>
</ul>
<h2><a
href="https://github.com/ljharb/shell-quote/compare/v1.10.0...v1.11.0">v1.11.0</a>
- 2026-09-29</h2>
<h3>Fixed</h3>
<ul>
<li>[Refactor] <code>quote</code>: drop a replace that can never match
in the single-quote branch <a
href="https://redirect.github.com/ljharb/shell-quote/issues/15"><code>[#15](https://github.com/ljharb/shell-quote/issues/15)</code></a></li>
<li>[New] <code>parse</code>: support bash ANSI-C quoting
(<code>$'...'</code>) <a
href="https://redirect.github.com/ljharb/shell-quote/issues/32"><code>[#32](https://github.com/ljharb/shell-quote/issues/32)</code></a></li>
</ul>
<h3>Commits</h3>
<ul>
<li>[Fix] <code>quote</code>: reject line terminators in tokens after a
<code>comment</code> <a
href="https://github.com/ljharb/shell-quote/commit/6002b2ed90c6b83095eb272b6b0adaf3a172b0bc"><code>6002b2e</code></a></li>
<li>[Fix] <code>parse</code>: preserve text after special shell
parameters <a
href="https://github.com/ljharb/shell-quote/commit/81b08a532e898a3627f9305fa13d643ffa82a9d3"><code>81b08a5</code></a></li>
<li>[Fix] <code>parse</code>: an escaped backslash does not escape the
character after it <a
href="https://github.com/ljharb/shell-quote/commit/d708019016ce26e1a8a05af4b296e35ef8095c9e"><code>d708019</code></a></li>
<li>[Fix] <code>quote</code>: preserve <code>!</code> in arguments that
also contain <code>'</code> <a
href="https://github.com/ljharb/shell-quote/commit/ad399279dbbbd086967d2040c1558b4888b074e6"><code>ad39927</code></a></li>
<li>[Fix] <code>parse</code>: treat <code>$_name</code> as a variable
name, not <code>$_</code> followed by text <a
href="https://github.com/ljharb/shell-quote/commit/28f88cd422ae4046aca9556c4b74ca90b0ea7f6b"><code>28f88cd</code></a></li>
<li>[Fix] <code>quote</code>: preserve empty glob patterns <a
href="https://github.com/ljharb/shell-quote/commit/35c9b97a744211091b772f145bef0b6a5562b68e"><code>35c9b97</code></a></li>
<li>[Fix] <code>quote</code>: escape <code>~</code> in glob patterns to
prevent shell tilde-expansion <a
href="https://github.com/ljharb/shell-quote/commit/239d49cae6d231436ea4e676850037018c790c49"><code>239d49c</code></a></li>
<li>[Dev Deps] update <code>@ljharb/eslint-config</code>,
<code>auto-changelog</code>, <code>eslint</code>, <code>evalmd</code> <a
href="https://github.com/ljharb/shell-quote/commit/b1e406ed4287a134cc649db47b9a59e21b304472"><code>b1e406e</code></a></li>
<li>[meta] npmignore some files <a
href="https://github.com/ljharb/shell-quote/commit/ebfc3080cf5f68db5edfddfba49dc8c4ccacd2d5"><code>ebfc308</code></a></li>
<li>[actions] add permissions <a
href="https://github.com/ljharb/shell-quote/commit/3429b0d349211786765e9e68478e029d96ad44e9"><code>3429b0d</code></a></li>
<li>[actions] set least-privilege <code>cache-mode</code> <a
href="https://github.com/ljharb/shell-quote/commit/36f23944db50dd3f0df4da9c7cba0bb63df05f64"><code>36f2394</code></a></li>
<li>[Dev Deps] update <code>eslint</code> <a
href="https://github.com/ljharb/shell-quote/commit/6de9a41ecfc4fe9f9546df08866c8ead039f8909"><code>6de9a41</code></a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/ljharb/shell-quote/commit/6ecb8aa618ba6dc6c3b087fce6d7660320d2adeb"><code>6ecb8aa</code></a>
v1.12.0</li>
<li><a
href="https://github.com/ljharb/shell-quote/commit/3a7b4ae3960c3ff4413932e276c5b0ecb3a2b456"><code>3a7b4ae</code></a>
[Dev Deps] update <code>@ljharb/eslint-config</code></li>
<li><a
href="https://github.com/ljharb/shell-quote/commit/7d688b9bec1917a22cccd4d4c887128a9c66e8a0"><code>7d688b9</code></a>
[New] <code>parse</code>: support the <code>case</code> test-next
terminator (<code>;;&amp;</code>)</li>
<li><a
href="https://github.com/ljharb/shell-quote/commit/f27010ed04bcd925795b350afb1c49e36bbd1ba3"><code>f27010e</code></a>
[New] <code>parse</code>: support the <code>case</code> fall-through
terminator (<code>;&amp;</code>)</li>
<li><a
href="https://github.com/ljharb/shell-quote/commit/90cde9cfd8af30fcb65e9fd2cb2f9e181d3f103b"><code>90cde9c</code></a>
[New] <code>parse</code>: support appending stdout and stderr
(<code>&amp;&gt;&gt;</code>)</li>
<li><a
href="https://github.com/ljharb/shell-quote/commit/6ad6cd215f89adcc29dd601e085fa54083c2f911"><code>6ad6cd2</code></a>
[New] <code>parse</code>: support redirecting stdout and stderr
(<code>&amp;&gt;</code>)</li>
<li><a
href="https://github.com/ljharb/shell-quote/commit/20533154bb57809c80f55318b8493aef49505f4e"><code>2053315</code></a>
[New] <code>parse</code>: support output process substitution
(<code>&gt;(</code>)</li>
<li><a
href="https://github.com/ljharb/shell-quote/commit/b78d19c14da6356cc12c46b3478203247ab8a295"><code>b78d19c</code></a>
[New] <code>parse</code>: support redirecting output despite
<code>noclobber</code> (<code>&gt;|</code>)</li>
<li><a
href="https://github.com/ljharb/shell-quote/commit/21cc333eb0ce5bf094f595b7fdc01b3447ffd4b0"><code>21cc333</code></a>
[New] <code>parse</code>: support opening a file for reading and writing
(<code>\&lt;&gt;</code>)</li>
<li><a
href="https://github.com/ljharb/shell-quote/commit/dbfac376d4065d37539d3abdb5e76847f93797d3"><code>dbfac37</code></a>
[New] <code>parse</code>: support tab-stripping here-documents
(<code>&lt;&lt;-</code>)</li>
<li>Additional commits viewable in <a
href="https://github.com/ljharb/shell-quote/compare/v1.10.0...v1.12.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `source-map-js` from 1.2.1 to 1.2.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/7rulnik/source-map-js/releases">source-map-js's
releases</a>.</em></p>
<blockquote>
<h2>v1.2.2</h2>
<ul>
<li>
<p>Fix crash when executing in browser with CSP script-src that don't
permit unsafe-eval (<a
href="https://redirect.github.com/7rulnik/source-map-js/pull/29">#29</a>)
<a href="https://github.com/xfournet"><code>@​xfournet</code></a></p>
</li>
<li>
<p>Fix denial of service from malicious indexed source maps
(CVE-2026-93749) (<a
href="https://redirect.github.com/7rulnik/source-map-js/pull/79">#79</a>)</p>
<p>Reported by <a
href="https://github.com/waydeshi"><code>@​waydeshi</code></a> in <a
href="https://redirect.github.com/7rulnik/source-map-js/issues/76">#76</a>.
A fix was also proposed by <a
href="https://github.com/aniebiet"><code>@​aniebiet</code></a> in <a
href="https://redirect.github.com/7rulnik/source-map-js/pull/78">#78</a>.</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md">source-map-js's
changelog</a>.</em></p>
<blockquote>
<h2>1.2.2</h2>
<ul>
<li>
<p>Fix crash when executing in browser with CSP script-src that don't
permit unsafe-eval (<a
href="https://redirect.github.com/7rulnik/source-map-js/pull/29">#29</a>)
<a href="https://github.com/xfournet"><code>@​xfournet</code></a></p>
</li>
<li>
<p>Fix denial of service from malicious indexed source maps
(CVE-2026-93749) (<a
href="https://redirect.github.com/7rulnik/source-map-js/pull/79">#79</a>)</p>
<p>Reported by <a
href="https://github.com/waydeshi"><code>@​waydeshi</code></a> in <a
href="https://redirect.github.com/7rulnik/source-map-js/issues/76">#76</a>.
A fix was also proposed by <a
href="https://github.com/aniebiet"><code>@​aniebiet</code></a> in <a
href="https://redirect.github.com/7rulnik/source-map-js/pull/78">#78</a>.</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/7rulnik/source-map-js/commit/0a1d334fd1e55a47df97fcd60a7915d46df3b08a"><code>0a1d334</code></a>
1.2.2</li>
<li><a
href="https://github.com/7rulnik/source-map-js/commit/4c6fa26d77419bd8e48ec92844866cce7d9ae739"><code>4c6fa26</code></a>
Update changelog</li>
<li><a
href="https://github.com/7rulnik/source-map-js/commit/cf7658058ceeaa8619d5ae0ec90be6905209d016"><code>cf76580</code></a>
Fix denial of service from malicious indexed source maps
(CVE-2026-93749) (<a
href="https://redirect.github.com/7rulnik/source-map-js/issues/79">#79</a>)</li>
<li><a
href="https://github.com/7rulnik/source-map-js/commit/7899a86615c630f4fc220273ff9fe2e8e49a56df"><code>7899a86</code></a>
Fix crash when executing browser with CSP script-src that don't permit
unsafe...</li>
<li>See full diff in <a
href="https://github.com/7rulnik/source-map-js/compare/v1.2.1...v1.2.2">compare
view</a></li>
</ul>
</details>
<br />

yarn.lock

@@ -5432,11 +5432,11 @@ graphemer@^1.4.0:
   integrity sha512-EtKwoO6kxCL9WO5xipiHTZlSzBm7WLT627TqC/uVRd0HKmq8NXyebnNYxDoBi7wt8eTWrUrKXCOVaFq9x1kgag==
 
 handlebars@^4.7.8:
-  version "4.7.9"
+  version "4.7.10"
-  resolved "https://registry.yarnpkg.com/handlebars/-/handlebars-4.7.9.tgz#6f139082ab58dc4e5a0e51efe7db5ae890d56a0f"
+  resolved "https://registry.yarnpkg.com/handlebars/-/handlebars-4.7.10.tgz#12419ea1b41391b3ffcf003f2164dcbce090c417"
-  integrity sha512-4E71E0rpOaQuJR2A3xDZ+GM1HyWYv1clR58tC8emQNeQe3RH7MAzSbat+V0wG78LQBo6m6bzSG/L4pBuCsgnUQ==
+  integrity sha512-P5VJMVM7qgBn6vjXMw8WG9uVI+ncf2pi72j4de4yz5ZULLj2RGqLYaKOYGsgyrViQ0tePOVlN1tDCCXXtFqXKg==
   dependencies:
-    minimist "^1.2.5"
+    minimist "^1.2.8"
     neo-async "^2.6.2"
     source-map "^0.6.1"
     wordwrap "^1.0.0"
@@ -6984,7 +6984,7 @@ minimatch@~3.0.3:
   dependencies:
     brace-expansion "^1.1.7"
 
-minimist@^1.2.0, minimist@^1.2.5, minimist@^1.2.6, minimist@^1.2.8:
+minimist@^1.2.0, minimist@^1.2.6, minimist@^1.2.8:
   version "1.2.8"
   resolved "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz"
   integrity sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==
@@ -7995,9 +7995,9 @@ proto-list@~1.2.1:
   integrity sha512-vtK/94akxsTMhe0/cbfpR+syPuszcuwhqVjJq26CuNDgFGj682oRBXOP5MJpv2r7JtE8MsiepGIqvvOTBwn2vA==
 
 proxy-addr@~2.0.7:
-  version "2.0.7"
+  version "2.0.8"
-  resolved "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz"
+  resolved "https://registry.yarnpkg.com/proxy-addr/-/proxy-addr-2.0.8.tgz#624e760fd8ab06b1b8320c2f8506d4422cf8e932"
-  integrity sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==
+  integrity sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==
   dependencies:
     forwarded "0.2.0"
     ipaddr.js "1.9.1"
@@ -8707,9 +8707,9 @@ shebang-regex@^3.0.0:
   integrity sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==
 
 shell-quote@^1.8.1:
-  version "1.10.0"
+  version "1.12.0"
-  resolved "https://registry.yarnpkg.com/shell-quote/-/shell-quote-1.10.0.tgz#482033e192e4f5c07151521ffa03400ec71b1b0f"
+  resolved "https://registry.yarnpkg.com/shell-quote/-/shell-quote-1.12.0.tgz#e98fdfd2e921d8a58ae2820f4fc0f75c39f09675"
-  integrity sha512-w1aiOKwKuRgtwAReIIj89puqg+I7GvX4IbLrvmhXbzQsj1+Zwi4VO3+fa6ZF91TWSjIxoEkKnMeHcLEODK5ZXA==
+  integrity sha512-PcByqNyT/38F2kDNi006HAMRJaULuBzq/FOsw3qdZvX/GA9W/jamDaRskgHjubHiftXK5sIFxLNkvrXUwcof6Q==
 
 side-channel@^1.0.4:
   version "1.0.5"
@@ -8848,9 +8848,9 @@ sorted-object@~2.0.0:
   integrity sha512-oKAAs26HeTu3qbawzUGCkTOBv/5MRrcuJyRWwbfEnWdpXnXsj+WEM3HTvarV73tMcf9uBEZNZoNDVRL62VLxzA==
 
 source-map-js@^1.0.2, source-map-js@^1.2.0, source-map-js@^1.2.1:
-  version "1.2.1"
+  version "1.2.2"
-  resolved "https://registry.yarnpkg.com/source-map-js/-/source-map-js-1.2.1.tgz#1ce5650fddd87abc099eda37dcff024c2667ae46"
+  resolved "https://registry.yarnpkg.com/source-map-js/-/source-map-js-1.2.2.tgz#79fb88d97535a21cb27162cb05d211b67acea4ab"
-  integrity sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==
+  integrity sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==
 
 source-map-support@0.5.13:
   version "0.5.13"