From 53799657e9e80911ce4b72566f77e130053c460b Mon Sep 17 00:00:00 2001
From: Yaacov Rydzinski <yaacovCR@gmail.com>
Date: Tue, 8 Jul 2025 22:11:27 +0300
Subject: [PATCH 1/2] avoid spawn with shell: true and arguments

spawn with shell: true and arguments leads to the below deprecation warning

[DEP0190] DeprecationWarning: Passing args to a child process with shell option true can lead to security vulnerabilities, as the arguments are not escaped, only concatenated.

This does not appear to presently cause us any security concerns as this is used only with safe input from our own integration scripts, but we can avoid the use of the shell entirely and protect from removal of this functionality in a later version, while still preserving win32 compatibility.
---
 resources/utils.ts | 34 ++++++++++++++--------------------
 1 file changed, 14 insertions(+), 20 deletions(-)

diff --git a/resources/utils.ts b/resources/utils.ts
index 559947d58c..b7339b6026 100644
--- a/resources/utils.ts
+++ b/resources/utils.ts
@@ -33,41 +33,35 @@ interface NPMOptions extends SpawnOptions {
 }
 
 export function npm(options?: NPMOptions) {
-  const globalOptions = options?.quiet === true ? ['--quiet'] : [];
-
-  // `npm` points to an executable shell script; so it doesn't require a shell per se.
-  // On Windows `shell: true` is required or `npm` will be picked rather than `npm.cmd`.
-  // This could alternatively be handled by manually selecting `npm.cmd` on Windows.
+  let npmCmd;
+  let globalOptions = options?.quiet === true ? ['--quiet'] : [];
   // See: https://github.com/nodejs/node/issues/3675 and in particular
   // https://github.com/nodejs/node/issues/3675#issuecomment-308963807.
-  const npmOptions = { shell: true, ...options };
+  if (process.platform === 'win32') {
+    npmCmd = 'cmd';
+    globalOptions = ['/c', 'npm.cmd', ...globalOptions];
+  } else {
+    npmCmd = 'npm';
+  }
 
   return {
     run(...args: ReadonlyArray<string>): void {
-      spawn('npm', [...globalOptions, 'run', ...args], npmOptions);
+      spawn(npmCmd, [...globalOptions, 'run', ...args], options);
     },
     install(...args: ReadonlyArray<string>): void {
-      spawn('npm', [...globalOptions, 'install', ...args], npmOptions);
+      spawn(npmCmd, [...globalOptions, 'install', ...args], options);
     },
     ci(...args: ReadonlyArray<string>): void {
-      spawn('npm', [...globalOptions, 'ci', ...args], npmOptions);
+      spawn(npmCmd, [...globalOptions, 'ci', ...args], options);
     },
     exec(...args: ReadonlyArray<string>): void {
-      spawn('npm', [...globalOptions, 'exec', ...args], npmOptions);
+      spawn(npmCmd, [...globalOptions, 'exec', ...args], options);
     },
     pack(...args: ReadonlyArray<string>): string {
-      return spawnOutput(
-        'npm',
-        [...globalOptions, 'pack', ...args],
-        npmOptions,
-      );
+      return spawnOutput(npmCmd, [...globalOptions, 'pack', ...args], options);
     },
     diff(...args: ReadonlyArray<string>): string {
-      return spawnOutput(
-        'npm',
-        [...globalOptions, 'diff', ...args],
-        npmOptions,
-      );
+      return spawnOutput(npmCmd, [...globalOptions, 'diff', ...args], options);
     },
   };
 }

From 5023b5c6a3d234a0cb979cfeb28a982e3f255ae1 Mon Sep 17 00:00:00 2001
From: Yaacov Rydzinski <yaacovCR@gmail.com>
Date: Tue, 8 Jul 2025 22:13:50 +0300
Subject: [PATCH 2/2] f

---
 resources/utils.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/resources/utils.ts b/resources/utils.ts
index b7339b6026..d94ad76b0f 100644
--- a/resources/utils.ts
+++ b/resources/utils.ts
@@ -35,8 +35,8 @@ interface NPMOptions extends SpawnOptions {
 export function npm(options?: NPMOptions) {
   let npmCmd;
   let globalOptions = options?.quiet === true ? ['--quiet'] : [];
-  // See: https://github.com/nodejs/node/issues/3675 and in particular
-  // https://github.com/nodejs/node/issues/3675#issuecomment-308963807.
+
+  // See: https://github.com/nodejs/node/issues/3675.
   if (process.platform === 'win32') {
     npmCmd = 'cmd';
     globalOptions = ['/c', 'npm.cmd', ...globalOptions];