fix(deps): bump shell-quote to 1.12.0 to address CVE-2026-102422

lib/command-parser/expand-arguments.spec.ts

@@ -26,6 +26,15 @@ it('argument placeholder is replaced and quoted properly', () => {
     expect(parser.parse(commandInfo)).toEqual({ ...commandInfo, command: "echo 'foo bar'" });
 });
 
+it('argument placeholder with single quote and exclamation mark is quoted properly', () => {
+    const parser = new ExpandArguments(["it's great!"]);
+    const commandInfo = createCommandInfo('echo {1}');
+    expect(parser.parse(commandInfo)).toEqual({
+        ...commandInfo,
+        command: `echo 'it'"'"'s great!'`,
+    });
+});
+
 it('multiple single argument placeholders are replaced', () => {
     const parser = new ExpandArguments(['foo', 'bar']);
     const commandInfo = createCommandInfo('echo {2} {1}');

package.json

@@ -53,7 +53,7 @@
   "dependencies": {
     "chalk": "5.6.2",
     "rxjs": "7.8.2",
-    "shell-quote": "1.9.0",
+    "shell-quote": "1.12.0",
     "supports-color": "10.2.2",
     "tree-kill": "1.2.2",
     "yargs": "18.0.0"