chore(deps): bump string-argv from 0.3.2 to 0.4.0 in the npm-minor group

[dependabot]

Bumps the npm-minor group with 1 update: string-argv.

Updates string-argv from 0.3.2 to 0.4.0

Release notes

Sourced from string-argv's releases.

v0.4.0

Parsing Behavior Changes (thanks to @​TooTallNate via [PR #24](mccormicka/string-argv#24))

• Rewrote the parser as a character-by-character state machine instead of the previous regex, so adjacent quoted and unquoted segments are treated as a single argument, matching bash word-splitting
• Quote characters are now always stripped, including word-internal and key=value positions:
  • --foo="bar"'baz' -> --foo=barbaz
  • a" b" -> a b
  • "a"b -> ab
  • run:silent["echo 1"]["echo 2"] -> run:silent[echo 1][echo 2]
  • --name='Phil Taylor' -> --name=Phil Taylor
• Fixes #20 (word-internal quotes were not stripped)
• Fixes #23 (unquoted tail after a quoted section was split into a separate argument)
• Known differences from bash, unchanged by this release: backslash escapes are not processed, $variables/globs are left literal, and an unclosed quote consumes the rest of the input instead of raising an error
• Security dependency bumps: minimatch 3.1.5 via #25, brace-expansion 1.1.16 via #27

Build / Breaking Changes

• Update TypeScript to 7.0.2 (requires Node.js >=16.20)
• Drop CommonJS support: the package is now ESM-only (import only). The commonjs/ build, the require export condition, and the module/main CJS entry points have been removed — main and exports now point to the single ESM build (./index.js)
• Consolidate to a single build: removed tsconfig.base.json and tsconfig.commonjs.json; tsconfig.json is now self-contained (target ES2022, module ESNext, strict, declaration) and npm run build runs a single tsc -p .. Note: TypeScript 7 no longer accepts the old target ES3 (hence the ES2022 baseline)
• Minimum Node.js version is now >=16.20.0 (engines updated accordingly)
• Tests: removed the CJS require() spec (test/Index.spec.cjs); test/config.json now runs *[sS]pec.js only

Requires Node.js >=16.20.0. ESM-only — use import, not require().

Changelog

Sourced from string-argv's changelog.

v0.4.0 (2026-09-28)

Parsing Behavior Changes (thanks to @​TooTallNate via [PR #24](mccormicka/string-argv#24))

• Rewrote the parser as a character-by-character state machine instead of the previous regex, so adjacent quoted and unquoted segments are treated as a single argument, matching bash word-splitting
• Quote characters are now always stripped, including word-internal and key=value positions:
  • --foo="bar"'baz' -> --foo=barbaz
  • a" b" -> a b
  • "a"b -> ab
  • run:silent["echo 1"]["echo 2"] -> run:silent[echo 1][echo 2]
  • --name='Phil Taylor' -> --name=Phil Taylor
• Fixes #20 (word-internal quotes were not stripped)
• Fixes #23 (unquoted tail after a quoted section was split into a separate argument)
• Known differences from bash, unchanged by this release: backslash escapes are not processed, $variables/globs are left literal, and an unclosed quote consumes the rest of the input instead of raising an error
• Security dependency bumps: minimatch 3.1.5 via #25, brace-expansion 1.1.16 via #27 Build / Breaking Changes
• Update TypeScript to 7.0.2 (requires Node.js >=16.20)
• Drop CommonJS support: the package is now ESM-only (import only). The commonjs/ build, the require export condition, and the module/main CJS entry points have been removed — main and exports now point to the single ESM build (./index.js)
• Consolidate to a single build: removed tsconfig.base.json and tsconfig.commonjs.json; tsconfig.json is now self-contained (target ES2022, module ESNext, strict, declaration) and npm run build runs a single tsc -p .. Note: TypeScript 7 no longer accepts the old target ES3 (hence the ES2022 baseline)
• Minimum Node.js version is now >=16.20.0 (engines updated accordingly)
• Tests: removed the CJS require() spec (test/Index.spec.cjs); test/config.json now runs *[sS]pec.js only

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[GitToTheHub]

This update drops CommonJS support, while cordova-android still uses require('string-argv'), causing CI to fail with ERR_PACKAGE_PATH_NOT_EXPORTED.

Migrating Cordova’s libraries to ESM would require careful compatibility work for third-party tools and plugin hooks. Dynamic import() could avoid a full migration, but this dependency is currently used by the synchronous parseBuildOptions() API.

I suggest keeping string-argv at 0.3.2 for now and considering ESM compatibility separately.

[GitToTheHub]

Closing for now because string-argv 0.4.0 drops CommonJS support. We’ll stay on 0.3.2 until we have a compatible loading approach.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml