DEP0190 warning on Node 24 during project creation

[beeman]

We see a deprecation warning when running create-solana-dapp on Node 24.

Repro

bun x create-solana-dapp@latest sandbox-app

Observed output

(node:13978) [DEP0190] DeprecationWarning: Passing args to a child process with shell option true can lead to security vulnerabilities, as the arguments are not escaped, only concatenated.

Cause

I traced this to the automatic git initialization path in create-solana-dapp, where it does:

spawn("git", args, { shell: true, ... })

Node.js marked this as a documentation-only deprecation in v22.15.0, and it became a runtime deprecation in v24.0.0, which is why it now prints by default on Node 24.

Suggested fix

• Remove shell: true from the git spawn(...) call
• Pass git args as a normal array
• For commit, use ["commit", "-m", message] instead of embedding quotes in a single arg

Scaffolding still succeeds, but the warning adds noisy output on Node 24+ and points to a subprocess pattern that Node now deprecates.