Skip to content

Embed arguments in command string when shell is true

Starting in Node.js 24, the args parameter has been removed from the spawn and execFile functions when the shell option is true. (See https://github.com/nodejs/node/issues/57143). This was supposedly done in the name of security, but that's highly suspect. Regardless, the API has changed and we need to adjust accordingly to ensure compatibility. Fortunately, the arguments can still be passed through the command string.

The change required in this helper when the shell option is set is to join the arguments on a space, append them to the base call (offsetting the joined arguments from the base call with a space), then passing the result as the command to the execFile and spawn functions. This is precisely what was happening before inside the Node.js function. In code, that will translate to:

const p = opts.shell
  ? spawn(args.length ? cmd0 + ' ' + args.join(' ') : cmd0, opts)
  : spawn(cmd0, args, opts)

Note that the helper already properly escapes the arguments, so joining them on a space and passing them to the base call is safe.

Edited by Dan Allen
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information