chore(deps): mvdan.cc/sh/v3 (patch → v3.13.1) by gh-worker-campaigns-3e9aa4[bot] · Pull Request #197 · DataDog/rshell

gh-worker-campaigns-3e9aa4 · 2026-04-23T12:59:50Z

Summary: Dependency update — 1 package upgraded (patch changes only)

Manifests changed:

. (go)

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
mvdan.cc/sh/v3	v3.13.0	v3.13.1	patch	Direct	-

Packages marked with "-" are updated due to dependency constraints.

Compatibility note

This PR also includes a small rshell compatibility shim in interp/runner_expand.go because the mvdan.cc/sh/v3 patch upgrade changed expand.Fields behavior for escaped left braces.

With v3.13.0, rshell matched bash for inputs such as:

echo \{
printf '<%s>\n' \{a,b}

After upgrading to v3.13.1, escaped { could be treated as an unmatched brace by syntax.SplitBraces, causing the backslash to be preserved or brace expansion to run when bash would treat the brace as quoted. The shim preserves bash-compatible behavior by protecting odd-backslash-escaped left braces before delegating to expand.Fields.

Coverage added:

Unit tests in interp/runner_expand_test.go
Bash-compared scenario coverage in tests/scenarios/shell/var_expand/quoting/escaped_left_brace.yaml

Review Checklist

Standard review:

Review changes for compatibility with your code
Check for breaking changes in release notes
Run tests locally or wait for CI
Approve and merge this PR

Update Mode: Routine Update

🤖 Generated by DataDog Automated Dependency Management System

gh-worker-campaigns-3e9aa4 · 2026-04-28T07:16:04Z

Auto-rebase complete

Branch is up to date with main — rebased onto 4a6a947.

_{Auto-Rebase · Add no-auto-rebase to opt out}

Co-authored-by: dd-octo-sts-03ec73[bot] <256648721+dd-octo-sts-03ec73[bot]@users.noreply.github.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f17690cf66

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c0c3334880

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 21df8d6aa4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

AlexandreYang · 2026-04-28T22:01:10Z

@codex review this PR

AlexandreYang

Review Summary

Reviewed the mvdan.cc/sh bump and the escaped-left-brace compatibility workaround. Overall assessment: needs fixes.

#	Priority	File	Finding
1		`interp/runner_expand.go:406`	Escaped commas/right braces inside the brace form are treated as syntax, producing output that differs from bash

Coverage

Code path	Scenario test	Go test	Status
escaped left brace disables expansion	`tests/scenarios/shell/var_expand/quoting/escaped_left_brace.yaml`	`interp/runner_expand_test.go`	Covered
escaped comma/right brace inside `\{{...}}` forms	—	—	Missing

AlexandreYang · 2026-04-28T22:03:59Z

Iteration 1 self-review result: P0=0, P1=1, P2=0, P3=0. Summary: found a bash-compatibility regression in the escaped-left-brace workaround when commas or right braces inside the brace candidate are themselves backslash-escaped; requested changes with an inline comment.

Preserve bash quote state for escaped brace metacharacters before mvdan SplitBraces runs, including commas, right braces, and sequence dots. Add regression coverage for escaped delimiters and sequence cases.

AlexandreYang · 2026-04-28T22:12:40Z

@codex review this PR

AlexandreYang

Review Summary

Reviewed the updated escaped brace metacharacter handling after inspecting mvdan/sh master. Overall assessment: safe to merge.

No P0/P1/P2/P3 findings. The workaround now aligns with mvdan/expand's pipeline (FieldsSeq calls syntax.SplitBraces before wordFields quote removal) by quoting backslash-escaped brace metacharacters before SplitBraces, while preserving valid unescaped nested/sequence brace expansions. Regression coverage was added for escaped commas, right braces, sequence dots, and bash comparison passes locally.

Coverage

Code path	Scenario test	Go test	Status
escaped left brace disables expansion	`tests/scenarios/shell/var_expand/quoting/escaped_left_brace.yaml`	`interp/runner_expand_test.go`	Covered
escaped delimiter after escaped left brace	`tests/scenarios/shell/var_expand/quoting/escaped_left_brace_composite.yaml`	`interp/runner_expand_test.go`	Covered
valid sequence after escaped left brace	`tests/scenarios/shell/var_expand/quoting/escaped_left_brace_composite.yaml`	`interp/runner_expand_test.go`	Covered
escaped comma/right brace/dot in regular brace expansion	—	`interp/runner_expand_test.go`	Covered

AlexandreYang · 2026-04-28T22:12:54Z

Iteration 2 self-review result: P0=0, P1=0, P2=0, P3=0. Summary: reviewed the updated implementation against mvdan/sh master (FieldsSeq/SplitBraces/wordFields) and bash behavior; no findings.

Use strings.Index, which is already allowed for interp, instead of introducing strings.Contains in the escaped brace preprocessor.

AlexandreYang · 2026-04-28T22:15:23Z

@codex review this PR

AlexandreYang

Review Summary

Reviewed the current diff against main, including the mvdan/sh expansion flow (FieldsSeq → syntax.SplitBraces → wordFields) and the local escaped-brace preprocessing. Overall assessment: safe to merge.

No P0/P1/P2/P3 findings. The latest CI fix avoids adding a new interp allowlist symbol, and the escaped brace metacharacter tests cover the changed paths.

Coverage

Code path	Scenario test	Go test	Status
escaped left brace disables brace expansion	`tests/scenarios/shell/var_expand/quoting/escaped_left_brace.yaml`	`interp/runner_expand_test.go`	Covered
escaped left brace across nested/empty alternatives and parameters	`tests/scenarios/shell/var_expand/quoting/escaped_left_brace_composite.yaml`	`interp/runner_expand_test.go`	Covered
escaped comma/right brace/dot metacharacters	`tests/scenarios/shell/var_expand/quoting/escaped_left_brace_composite.yaml`	`interp/runner_expand_test.go`	Covered
interp allowed-symbol compliance for string search	—	`analysis` allowlist tests	Covered

AlexandreYang · 2026-04-28T22:16:13Z

Iteration 3 self-review result: P0=0, P1=0, P2=0, P3=0. Summary: reviewed current HEAD (including the interp allowed-symbol fix) against mvdan/sh expansion flow and bash-compatibility coverage; no findings.

AlexandreYang · 2026-04-28T22:17:00Z

@codex review this PR

AlexandreYang

Review Summary

Iteration 4 self-review of current HEAD. Overall assessment: safe to merge.

No P0/P1/P2/P3 findings. Re-ran targeted coverage for escaped brace expansion and interp allowed-symbol compliance; all passed.

AlexandreYang · 2026-04-28T22:17:18Z

Iteration 4 self-review result: P0=0, P1=0, P2=0, P3=0. Summary: targeted escaped-brace and allowlist checks passed; no findings.

AlexandreYang · 2026-04-28T22:17:56Z

@codex review this PR

AlexandreYang

Review Summary

Iteration 5 self-review of current HEAD. Overall assessment: safe to merge.

No P0/P1/P2/P3 findings. The diff is unchanged since the previous clean review; escaped brace handling and CI allowlist coverage remain adequate.

AlexandreYang · 2026-04-28T22:18:09Z

Iteration 5 self-review result: P0=0, P1=0, P2=0, P3=0. Summary: diff unchanged from prior clean review; no findings.

AlexandreYang · 2026-04-28T22:19:02Z

@codex review this PR

AlexandreYang

Review Summary

Iteration 6 self-review of current HEAD. Overall assessment: safe to merge.

No P0/P1/P2/P3 findings. CI is green at the time of review, the branch is unchanged, and prior escaped-brace/allowlist verification remains valid.

AlexandreYang · 2026-04-28T22:19:10Z

Iteration 6 self-review result: P0=0, P1=0, P2=0, P3=0. Summary: CI is green, branch unchanged, no findings.

AlexandreYang · 2026-04-28T22:20:00Z

Review-Fix Loop Summary

PR: chore(deps): mvdan.cc/sh/v3 (patch → v3.13.1) #197 (chore(deps): mvdan.cc/sh/v3 (patch → v3.13.1) #197)
Iterations completed: 6
Final status: CLEAN

Iteration log

#	Fixes applied	CI status
1	1 fixed (`[iter 1] Fix escaped brace meta expansion`)	No failing checks (pending)
2	1 fixed (`[iter 2] Fix interp symbol allowlist failure`)	No failing checks (pending)
3	—	No failing checks (pending)
4	—	No failing checks (pending)
5	—	Passing
6	—	Passing

Final state

Unresolved threads: 0 (authors: none)
CI: Passing (failing checks: none)

Remaining issues (if any)

None

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ae68608f55

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-04-28T22:27:34Z

+			parts = append(parts, word.Parts[:i]...)
+		}
+		if parts != nil {
+			parts = append(parts, litParts...)


Preserve unchanged literals after protected braces

When a word has a protected escaped brace before a non-literal part and then a normal literal, e.g. X=x; printf '<%s>\n' \{${X}foo, the first literal makes parts non-nil, but the later unchanged foo literal has changed == false and litParts == nil, so this append drops it. Bash expands that word to {xfoo}, while this commit returns {x}, so suffix literals after parameter/quoted/command substitutions are silently lost.

Useful? React with 👍 / 👎.

AlexandreYang · 2026-04-28T22:46:14Z

Upstream follow-up opened to move the escaped-brace compatibility fix into mvdan/sh itself: mvdan/sh#1330

If that lands in a future mvdan.cc/sh/v3 release, rshell should be able to drop most/all of the local escaped-brace preprocessing shim in interp/runner_expand.go.

gh-worker-campaigns-3e9aa4 Bot added campaigner-automated-change adms-mode-all-updates adms-patch-update adms-go adms-dependency-update labels Apr 23, 2026

AlexandreYang approved these changes Apr 28, 2026

View reviewed changes

dd-octo-sts-03ec73 Bot force-pushed the engraver-auto-version-upgrade/minorpatch/go/3-1776949180 branch from 272844f to 55dfc10 Compare April 28, 2026 07:16

Executing automated changes

1c5380e

Co-authored-by: dd-octo-sts-03ec73[bot] <256648721+dd-octo-sts-03ec73[bot]@users.noreply.github.com>

dd-octo-sts-26fcfa Bot force-pushed the engraver-auto-version-upgrade/minorpatch/go/3-1776949180 branch from 55dfc10 to 1c5380e Compare April 28, 2026 07:23

fix escaped brace expansion

cfb88e2

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

AlexandreYang self-requested a review April 28, 2026 07:29

test escaped brace expansion

f17690c

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

AlexandreYang marked this pull request as ready for review April 28, 2026 07:42

AlexandreYang requested review from astuyve, julesmcrt, matt-dz, thieman and val06 as code owners April 28, 2026 07:42

expand escaped brace test coverage

9f9488f

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

chatgpt-codex-connector Bot reviewed Apr 28, 2026

View reviewed changes

Comment thread interp/runner_expand.go Outdated

fix escaped brace expansion with empty alternatives

c0c3334

chatgpt-codex-connector Bot reviewed Apr 28, 2026

View reviewed changes

Comment thread interp/runner_expand.go Outdated

Fix escaped brace expansion alternatives

21df8d6

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

chatgpt-codex-connector Bot reviewed Apr 28, 2026

View reviewed changes

Comment thread interp/runner_expand.go Outdated

AlexandreYang and others added 2 commits April 28, 2026 23:55

Handle escaped brace expansions across word parts

bac4e35

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

Avoid sort dependency in brace expansion

69e7be7

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

AlexandreYang requested changes Apr 28, 2026

View reviewed changes

Comment thread interp/runner_expand.go

[iter 1] Fix escaped brace meta expansion

124a557

Preserve bash quote state for escaped brace metacharacters before mvdan SplitBraces runs, including commas, right braces, and sequence dots. Add regression coverage for escaped delimiters and sequence cases.

AlexandreYang approved these changes Apr 28, 2026

View reviewed changes

[iter 2] Fix interp symbol allowlist failure

ae68608

Use strings.Index, which is already allowed for interp, instead of introducing strings.Contains in the escaped brace preprocessor.

AlexandreYang approved these changes Apr 28, 2026

View reviewed changes

chatgpt-codex-connector Bot reviewed Apr 28, 2026

View reviewed changes

AlexandreYang mentioned this pull request Apr 28, 2026

syntax: honor escaped brace metacharacters mvdan/sh#1330

Open

Conversation

gh-worker-campaigns-3e9aa4 Bot commented Apr 23, 2026 • edited by AlexandreYang Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Updates

Compatibility note

Review Checklist

Uh oh!

gh-worker-campaigns-3e9aa4 Bot commented Apr 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Auto-rebase complete

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

AlexandreYang commented Apr 28, 2026

Uh oh!

AlexandreYang left a comment

Choose a reason for hiding this comment

Review Summary

Coverage

Uh oh!

Uh oh!

AlexandreYang commented Apr 28, 2026

Uh oh!

AlexandreYang commented Apr 28, 2026

Uh oh!

AlexandreYang left a comment

Choose a reason for hiding this comment

Review Summary

Coverage

Uh oh!

AlexandreYang commented Apr 28, 2026

Uh oh!

AlexandreYang commented Apr 28, 2026

Uh oh!

AlexandreYang left a comment

Choose a reason for hiding this comment

Review Summary

Coverage

Uh oh!

AlexandreYang commented Apr 28, 2026

Uh oh!

AlexandreYang commented Apr 28, 2026

Uh oh!

AlexandreYang left a comment

Choose a reason for hiding this comment

Review Summary

Uh oh!

AlexandreYang commented Apr 28, 2026

Uh oh!

AlexandreYang commented Apr 28, 2026

Uh oh!

AlexandreYang left a comment

Choose a reason for hiding this comment

Review Summary

Uh oh!

AlexandreYang commented Apr 28, 2026

Uh oh!

AlexandreYang commented Apr 28, 2026

Uh oh!

AlexandreYang left a comment

Choose a reason for hiding this comment

Review Summary

Uh oh!

AlexandreYang commented Apr 28, 2026

Uh oh!

AlexandreYang commented Apr 28, 2026

Review-Fix Loop Summary

gh-worker-campaigns-3e9aa4 Bot commented Apr 23, 2026 •

edited by AlexandreYang

Loading

gh-worker-campaigns-3e9aa4 Bot commented Apr 28, 2026 •

edited

Loading