diff --git a/CHANGELOG.md b/CHANGELOG.md
index 84d032f9..64620595 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -23,6 +23,7 @@ the archive; if it broke production, it belongs in `docs/incidents/`. See
 
 ## [Unreleased]
 
+- **CI** — shell-quote 1.10.0 → 1.12.0 (critical GHSA-pqg4-j6r4-53mv; dev-only, under react-native's react-devtools-core), lockfile-only — deps
 - **Reader** — highlights on the phone now paint on their words anywhere in a chapter; since April they were drawn `scrollY` px above (off screen) below the first screen, because the overlay svg moved with the page and was also shifted by the scroll — mobile
 - **Reader** — a font change at open, during the restore, no longer leaves a window where back or backgrounding saves the chapter top: once a stale restore ack arrives, position reports stop opening the write gate, and only the re-ask's ack or the 4 s deadline opens it; a truly lost ack still opens by position — mobile
 - **Reader (R4)** — a rebuild or font change during the open restore keeps the saved place (non-default typography no longer reopens at the top and saves 0); typography changed before the page loads is applied, also after "Read as text"; a PDF reopens on the device page inside the chapter, not the chapter start; the foreground newer-position check runs after a background renderer kill; restore acks carry the landing position, so a tiny restore is not booked as reading; reflow/rebuild acks never reset the "has the reader moved" baseline — mobile · [ADR-019](docs/01-architecture/adr/ADR-019-reader-position-rules.md) · [details](docs/changelog-archive/2026-H2.md#2026-10-06-reader-r4-and-adr-019)
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 851b5d6f..6f00d71c 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -4653,8 +4653,8 @@ packages:
     resolution: {integrity: sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==}
     engines: {node: '>=8'}
 
-  shell-quote@1.10.0:
-    resolution: {integrity: sha512-w1aiOKwKuRgtwAReIIj89puqg+I7GvX4IbLrvmhXbzQsj1+Zwi4VO3+fa6ZF91TWSjIxoEkKnMeHcLEODK5ZXA==}
+  shell-quote@1.12.0:
+    resolution: {integrity: sha512-PcByqNyT/38F2kDNi006HAMRJaULuBzq/FOsw3qdZvX/GA9W/jamDaRskgHjubHiftXK5sIFxLNkvrXUwcof6Q==}
     engines: {node: '>= 0.4'}
 
   siginfo@2.0.0:
@@ -9914,7 +9914,7 @@ snapshots:
 
   react-devtools-core@6.1.5:
     dependencies:
-      shell-quote: 1.10.0
+      shell-quote: 1.12.0
       ws: 7.5.13
     transitivePeerDependencies:
       - bufferutil
@@ -10353,7 +10353,7 @@ snapshots:
 
   shebang-regex@3.0.0: {}
 
-  shell-quote@1.10.0: {}
+  shell-quote@1.12.0: {}
 
   siginfo@2.0.0: {}