gitmoji-cli icon indicating copy to clipboard operation
gitmoji-cli copied to clipboard

([DEP0190] DeprecationWarning when using node 24

Open GKyomen opened this issue 1 month ago • 1 comments

Describe the bug

Not sure if this is occurring because of node, but the only script that gave me this warning so far was the gitmoji. The warning follows:

(node:36681) [DEP0190] DeprecationWarning: Passing args to a child process with shell option true can lead to security vulnerabilities, as the arguments are not escaped, only concatenated.

Reproduction

Install gitmoji Use node 24 (I'm using --lts from nvm) use gitmoji -c place a title and confirm

System Info

System:
    OS: Linux 6.14 Ubuntu 24.04.3 LTS 24.04.3 LTS (Noble Numbat)
    CPU: (12) x64 13th Gen Intel(R) Core(TM) i5-1334U
    Memory: 4.93 GB / 15.31 GB
    Container: Yes
    Shell: 5.9 - /usr/bin/zsh
  Binaries:
    Node: 24.11.0 - /home/<MY_USER>/.nvm/versions/node/v24.11.0/bin/node
    npm: 11.6.2 - /home/<MY_USER>/.nvm/versions/node/v24.11.0/bin/npm
    pnpm: 10.20.0 - /home/<MY_USER>/.local/share/pnpm/pnpm
  Browsers:
    Firefox: 144.0.2
    Firefox Developer Edition: 144.0.2

Validations

  • [x] Follow our Code of Conduct
  • [x] Read the Contributing Guide.
  • [x] Check that there isn't already an issue that reports the same bug to avoid creating duplicates.
  • [x] Check that this is a concrete bug. For Q&A, please open a GitHub Discussion instead.
  • [x] The provided reproduction is a minimal reproducible of the bug.

GKyomen avatar Nov 06 '25 17:11 GKyomen

(node:4708) [DEP0190] DeprecationWarning: Passing args to a child process with shell option true can lead to security vulnerabilities, as the arguments are not escaped, only concatenated.
    at normalizeSpawnArguments (node:child_process:644:15)
    at Object.spawn (node:child_process:789:13)
    at execa (file:///<node path>/gitmoji-cli/node_modules/execa/index.js:88:26)
    at withClient (file:///<node path>/gitmoji-cli/lib/commands/commit/withClient/index.js:14:11)
    at process.processTicksAndRejections (node:internal/process/task_queues:103:5)

Problem may come from execa package.

gluons avatar Nov 25 '25 16:11 gluons