Skip to content

Conflict between child_process API guidance and DEP0190 #58735

Description

@ericcornelissen

Affected URL(s)

https://nodejs.org/docs/latest-v24.x/api/child_process.html#spawning-bat-and-cmd-files-on-windows

Description of the problem

The suggestions here include using spawn with shell: true, however doing so is deprecated with DEP0190. This conflicting messaging is confusing and makes this difficult-to-use-safely API even more confusing to use for non-experts.

I don't know what the right call is here. My guess is that DEP0190 was created to nudge people away from using spawn with shell: true by either using it safely or explicitly using the insecure exec command. Since the only alternative in the documentation is exec I'd suggest removing the suggestion to use spawn with shell: true entirely.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    docIssues and PRs related to Node.js documentation.

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions