fix(deps): replace npm-run-all with npm-run-all2 to fix shell-quote CVE-2026-9277

[yasinmiran]

Fixes Dependabot alert #118 (shell-quote, critical, CVE-2026-9277).

Why

shell-quote@1.8.1 is pulled in transitively by npm-run-all (dev-only). Its quote() does not escape newlines in object .op values (GHSA-w7jw-789q-3m8p). npm-run-all is unmaintained (last release 2018), so there is no upstream bump.

Change

Swap npm-run-all for the maintained fork npm-run-all2@9.x, which depends on shell-quote ^1.8.4. The patched version is pulled in at the source, so no pnpm.overrides entry is needed. npm-run-all2 ships drop-in npm-run-all / run-s / run-p binaries, so the build and dev:build scripts are unchanged.

Verification

• pnpm why shell-quote -> 1.8.4 (was 1.8.1)
• astro check + astro build: 0 errors, 0 warnings
• node scripts/check-slugs.mjs: all names valid
• node scripts/test-pages.mjs: 182/182 pages, 185/185 assets OK

Diff is just package.json (one devDependency) + pnpm-lock.yaml.

[Copilot]

Pull request overview

This PR addresses a critical shell-quote vulnerability (CVE-2026-9277 / GHSA-w7jw-789q-3m8p) by replacing the unmaintained npm-run-all with the maintained fork npm-run-all2, so the patched shell-quote is pulled in transitively without relying on overrides.

Changes:

• Replaced npm-run-all with npm-run-all2@^9.0.2 in devDependencies.
• Updated pnpm-lock.yaml to reflect the new dependency graph, including shell-quote@1.8.4.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
package.json	Swaps npm-run-all to npm-run-all2 while keeping scripts using the npm-run-all binary.
pnpm-lock.yaml	Updates the lockfile to the new resolved tree, pulling in shell-quote@1.8.4.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Comments suppressed due to low confidence (1)

package.json:52

• npm-run-all2@9.0.2 (as resolved in pnpm-lock.yaml) requires Node ^22.22.2 || ^24.15.0 || >=26.0.0, but package.json currently allows >=24.0.0 (which includes 24.0–24.14). This mismatch can produce engine warnings or break installs when using early 24.x releases; consider bumping the project Node engine floor to >=24.15.0 (and ensure the Node version used in CI/dev matches).

    "npm-run-all2": "^9.0.2",
    "pagefind": "^1.5.0"
  },
  "engines": {
    "node": ">=24.0.0"

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.