v9 branch upgrade shell-quote to 1.9.0

[wxchenxueqi]

Describe the bug

Hi Colleagues,
Could PR #599 downport to v9 branch to fix CWE-407 and release a new version?
Thanks.

[fish-can]

I’m running into the same issue in a pnpm workspace.

As a temporary workaround, I’m forcing concurrently’s transitive shell-quote dependency to 1.9.0:

overrides:
  'concurrently@10.0.3>shell-quote': '^1.9.0'

This works as an emergency mitigation, but it would be better to have an official patch release so downstream projects don’t need package-manager-specific overrides.

Could the shell-quote@1.9.0 upgrade be backported to the v9 release line and published as a patch release?