Skip to content

doc: clarify that any truthy value of shell is part of DEP0190 #62249

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
aduh95 wants to merge 2 commits into
base: main
Choose a base branch
from
+3 −2
Open

doc: clarify that any truthy value of shell is part of DEP0190 #62249

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7df18dd
doc: clarify that any truthy value of `shell` is part of DEP0190
aduh95 Mar 14, 2026
dbe55c4
Update doc/api/deprecations.md
aduh95 Mar 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions doc/api/deprecations.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4175,7 +4175,7 @@ Type: Documentation-only
`process.features.tls_alpn`, `process.features.tls_ocsp`, and `process.features.tls_sni` are
deprecated, as their values are guaranteed to be identical to that of `process.features.tls`.

### DEP0190: Passing `args` to `node:child_process` `execFile`/`spawn` with `shell` option `true`
### DEP0190: Passing `args` to `node:child_process` `execFile`/`spawn` with `shell` option

<!-- YAML
changes:
Expand All @@ -4192,7 +4192,8 @@ changes:
Type: Runtime

When an `args` array is passed to [`child_process.execFile`][] or [`child_process.spawn`][] with the option
`{ shell: true }`, the values are not escaped, only space-separated, which can lead to shell injection.
`{ shell: true }` or `{ shell: '/path/to/shell' }`, the values are not escaped, only space-separated,
which can lead to shell injection.

### DEP0191: `repl.builtinModules`

Expand Down
Loading