chore(deps): bump string-argv from 0.3.2 to 0.4.0

[dependabot]

Bumps string-argv from 0.3.2 to 0.4.0.

Release notes

Sourced from string-argv's releases.

v0.4.0

Parsing Behavior Changes (thanks to @​TooTallNate via [PR #24](mccormicka/string-argv#24))

• Rewrote the parser as a character-by-character state machine instead of the previous regex, so adjacent quoted and unquoted segments are treated as a single argument, matching bash word-splitting
• Quote characters are now always stripped, including word-internal and key=value positions:
  • --foo="bar"'baz' -> --foo=barbaz
  • a" b" -> a b
  • "a"b -> ab
  • run:silent["echo 1"]["echo 2"] -> run:silent[echo 1][echo 2]
  • --name='Phil Taylor' -> --name=Phil Taylor
• Fixes #20 (word-internal quotes were not stripped)
• Fixes #23 (unquoted tail after a quoted section was split into a separate argument)
• Known differences from bash, unchanged by this release: backslash escapes are not processed, $variables/globs are left literal, and an unclosed quote consumes the rest of the input instead of raising an error
• Security dependency bumps: minimatch 3.1.5 via #25, brace-expansion 1.1.16 via #27

Build / Breaking Changes

• Update TypeScript to 7.0.2 (requires Node.js >=16.20)
• Drop CommonJS support: the package is now ESM-only (import only). The commonjs/ build, the require export condition, and the module/main CJS entry points have been removed — main and exports now point to the single ESM build (./index.js)
• Consolidate to a single build: removed tsconfig.base.json and tsconfig.commonjs.json; tsconfig.json is now self-contained (target ES2022, module ESNext, strict, declaration) and npm run build runs a single tsc -p .. Note: TypeScript 7 no longer accepts the old target ES3 (hence the ES2022 baseline)
• Minimum Node.js version is now >=16.20.0 (engines updated accordingly)
• Tests: removed the CJS require() spec (test/Index.spec.cjs); test/config.json now runs *[sS]pec.js only

Requires Node.js >=16.20.0. ESM-only — use import, not require().

Changelog

Sourced from string-argv's changelog.

v0.4.0 (2026-09-28)

Parsing Behavior Changes (thanks to @​TooTallNate via [PR #24](mccormicka/string-argv#24))

• Rewrote the parser as a character-by-character state machine instead of the previous regex, so adjacent quoted and unquoted segments are treated as a single argument, matching bash word-splitting
• Quote characters are now always stripped, including word-internal and key=value positions:
  • --foo="bar"'baz' -> --foo=barbaz
  • a" b" -> a b
  • "a"b -> ab
  • run:silent["echo 1"]["echo 2"] -> run:silent[echo 1][echo 2]
  • --name='Phil Taylor' -> --name=Phil Taylor
• Fixes #20 (word-internal quotes were not stripped)
• Fixes #23 (unquoted tail after a quoted section was split into a separate argument)
• Known differences from bash, unchanged by this release: backslash escapes are not processed, $variables/globs are left literal, and an unclosed quote consumes the rest of the input instead of raising an error
• Security dependency bumps: minimatch 3.1.5 via #25, brace-expansion 1.1.16 via #27 Build / Breaking Changes
• Update TypeScript to 7.0.2 (requires Node.js >=16.20)
• Drop CommonJS support: the package is now ESM-only (import only). The commonjs/ build, the require export condition, and the module/main CJS entry points have been removed — main and exports now point to the single ESM build (./index.js)
• Consolidate to a single build: removed tsconfig.base.json and tsconfig.commonjs.json; tsconfig.json is now self-contained (target ES2022, module ESNext, strict, declaration) and npm run build runs a single tsc -p .. Note: TypeScript 7 no longer accepts the old target ES3 (hence the ES2022 baseline)
• Minimum Node.js version is now >=16.20.0 (engines updated accordingly)
• Tests: removed the CJS require() spec (test/Index.spec.cjs); test/config.json now runs *[sS]pec.js only

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: b868755e-3e99-4b9c-bdf0-a04f2c9c60e5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}