fix(security): drop stale shell-quote 1.9.0 resolution

[GioDavid]

Summary

Removes the root resolutions pin "shell-quote": "1.9.0", so shell-quote resolves normally to the patched 1.12.0.

The pin was added in #236 to fix an earlier shell-quote advisory. Since then, 1.9.0 has itself become affected by a critical advisory:

Advisory	Severity	Affected	Fixed
GHSA-pqg4-j6r4-53mv: quote() command injection through a line terminator in a token after a { comment } token	critical	>=1.8.4 <1.11.0	1.11.0

Both consumers already declare ranges that include the patched versions, so no override is needed:

• example → @react-native-community/cli-tools → launch-editor@2.14.1 (shell-quote@^1.8.4)
• example → react-native@0.84.0 → react-devtools-core@6.1.5 (shell-quote@^1.6.1)

Removing the pin instead of bumping it means it can't become outdated the way the 1.9.0 pin did.

Changes

• package.json: remove "shell-quote": "1.9.0" from resolutions
• yarn.lock: one entry changes, shell-quote 1.9.0 → 1.12.0. No other packages change.

Compatibility

• shell-quote 1.12.0 has the same module shape, exports and engines as 1.9.0, and no dependencies. The changes are the security fix in quote() plus recognition of extra shell operators.
• At runtime, shell-quote is only loaded by launch-editor, which calls parse() on the editor command (react-devtools-core's dist files don't require it). On editor-command inputs, parse() and quote() output was identical between 1.9.0 and 1.12.0 (23 cases).
• The library's published package and runtime dependencies are unchanged; this only affects the example app's dev tooling.

Test plan

Run locally on Node 22 and 24 (the CI matrix):

• yarn install --immutable
• yarn compile
• yarn lint (output identical to main)
• yarn build
• yarn test:ci: 22/22 passed
• yarn why shell-quote: both paths resolve 1.12.0
• yarn workspace example react-native config loads, and launch-editor editor-command parsing works
• yarn npm audit --all --recursive: 37 → 36 findings (shell-quote resolved, nothing new)

The minimatch fix is in a separate PR (fix/security-minimatch).

🤖 Generated with Claude Code