Update module github.com/mattn/go-shellwords to v1.0.13

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

go.mod

@@ -37,7 +37,7 @@ require (
 	github.com/kevinburke/ssh_config v1.5.0
 	github.com/klauspost/pgzip v1.2.6
 	github.com/linuxkit/virtsock v0.0.0-20241009230534-cb6a20cc0422
-	github.com/mattn/go-shellwords v1.0.12
+	github.com/mattn/go-shellwords v1.0.13
 	github.com/mattn/go-sqlite3 v1.14.39
 	github.com/mdlayher/vsock v1.2.1
 	github.com/moby/docker-image-spec v1.3.1

go.sum

@@ -233,8 +233,8 @@ github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWE
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-runewidth v0.0.20 h1:WcT52H91ZUAwy8+HUkdM3THM6gXqXuLJi9O3rjcQQaQ=
 github.com/mattn/go-runewidth v0.0.20/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
-github.com/mattn/go-shellwords v1.0.12 h1:M2zGm7EW6UQJvDeQxo4T51eKPurbeFbe8WtebGE2xrk=
-github.com/mattn/go-shellwords v1.0.12/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y=
+github.com/mattn/go-shellwords v1.0.13 h1:DC0OMEpGjm6LfNFU4ckYcvbQKyp2vE8atyFGXNtDcf4=
+github.com/mattn/go-shellwords v1.0.13/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y=
 github.com/mattn/go-sqlite3 v1.14.39 h1:sIwSjlJGOaRJjw44/HXaeTblZMjseqr6OOio1tz/+JI=
 github.com/mattn/go-sqlite3 v1.14.39/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/mdlayher/packet v1.1.2 h1:3Up1NG6LZrsgDVn6X4L9Ge/iyRyxFEFD9o6Pr3Q1nQY=

vendor/github.com/mattn/go-shellwords/shellwords.go

@@ -136,6 +136,12 @@ loop:
 	for _, r := range line {
 		i++
 		if escaped {
+			if r == 't' {
+				r = '\t'
+			}
+			if r == 'n' {
+				r = '\n'
+			}
 			buf += string(r)
 			escaped = false
 			got = argSingle
@@ -194,23 +200,49 @@ loop:
 				backtick = ""
 				backQuote = !backQuote
 			}
+
 		case ')':
 			if !singleQuoted && !doubleQuoted && !backQuote {
 				if p.ParseBacktick {
-					if dollarQuote {
-						out, err := shellRun(backtick, p.Dir)
-						if err != nil {
-							return nil, err
-						}
-						buf = buf[:len(buf)-len(backtick)-2] + out
+					// Security fix:
+					// A bare ')' must never open dollarQuote state.
+					// Preserve prior behavior by rejecting unmatched ')'
+					// when command substitution parsing is enabled.
+					if !dollarQuote {
+						return nil, errors.New("invalid command line string")
 					}
+
+					out, err := shellRun(backtick, p.Dir)
+					if err != nil {
+						return nil, err
+					}
+
+					// Defensive guard: valid $(...) implies the buffer must contain
+					// the "$(" prefix plus the collected command body.
+					if len(buf) < len(backtick)+2 {
+						return nil, errors.New("invalid command line string")
+					}
+
+					buf = buf[:len(buf)-len(backtick)-2] + out
 					backtick = ""
-					dollarQuote = !dollarQuote
+					dollarQuote = false
 					continue
 				}
+
+				// Backtick parsing disabled:
+				// A bare ')' is a syntax error, consistent with '(' handling.
+				// Only close an already-open $(...) region.
+				if !dollarQuote {
+					return nil, errors.New("invalid command line string")
+				}
+
+				buf += string(r)
 				backtick = ""
-				dollarQuote = !dollarQuote
+				dollarQuote = false
+				got = argSingle
+				continue
 			}
+
 		case '(':
 			if !singleQuoted && !doubleQuoted && !backQuote {
 				if !dollarQuote && strings.HasSuffix(buf, "$") {
@@ -221,6 +253,7 @@ loop:
 					return nil, errors.New("invalid command line string")
 				}
 			}
+
 		case '"':
 			if !singleQuoted && !dollarQuote {
 				if doubleQuoted {
@@ -229,6 +262,7 @@ loop:
 				doubleQuoted = !doubleQuoted
 				continue
 			}
+
 		case '\'':
 			if !doubleQuoted && !dollarQuote {
 				if singleQuoted {
@@ -237,6 +271,7 @@ loop:
 				singleQuoted = !singleQuoted
 				continue
 			}
+
 		case ';', '&', '|', '<', '>':
 			if !(escaped || singleQuoted || doubleQuoted || backQuote || dollarQuote) {
 				if r == '>' && len(buf) > 0 {

vendor/github.com/mattn/go-shellwords/util_posix.go

@@ -1,3 +1,4 @@
+//go:build !windows
 // +build !windows
 
 package shellwords

vendor/github.com/mattn/go-shellwords/util_windows.go

@@ -1,3 +1,4 @@
+//go:build windows
 // +build windows
 
 package shellwords

vendor/modules.txt

@@ -381,7 +381,7 @@ github.com/manifoldco/promptui/screenbuf
 # github.com/mattn/go-runewidth v0.0.20
 ## explicit; go 1.20
 github.com/mattn/go-runewidth
-# github.com/mattn/go-shellwords v1.0.12
+# github.com/mattn/go-shellwords v1.0.13
 ## explicit; go 1.13
 github.com/mattn/go-shellwords
 # github.com/mattn/go-sqlite3 v1.14.39