Ljharb Shell-quote vulnerabilities

• ljharb shell-quote shell-quote parse() is quadratic in token count, enabling denial of service CVE-2026-13311 Fix available 8.7 HighJune 25, 2026