fix(setup): stop Node's DEP0190 warning when npm runs on Windows (#1057)

Windows runs npm.cmd through a shell, and passing an argument array with `shell: true` is deprecated in Node 24 (DEP0190). Every `npm run doctor` and every Pinokio install on Windows printed the warning. npmProcessSpec now takes the npm arguments and, on Windows, joins them into the command string; the arguments are fixed subcommands (`--version`, `ci`). Unix behavior is unchanged.
This commit is contained in:
quanticsoul4772 authored and GitHub committed 2026-10-16 15:28:39 -07:00
1 parent ec7823daad
commit 3c3ea269a9
4 files changed
+31 -12

No files matched your search

+4
View File
@@ -0,0 +1,4 @@
- On Windows, `npm run doctor` and the Pinokio install no longer print Node's
DEP0190 warning ("Passing args to a child process with shell option true can
lead to security vulnerabilities"): npm.cmd's fixed subcommand is now part of
the shell command string instead of an argument array (quanticsoul4772, #1057).