Repository navigation
Conflict between child_process API guidance and DEP0190 #58735
Description
Activity
Nice catch.
Can you send a PR fixing this? :)
Can do 👍
But
execdoesn't havestdiooption, so it isn't a proper replacement.Interesting point,
execSyncdoes have that option, tho I guess using the sync version might not always be desirable... Could it be added to theexecAPI?See #58763 (comment) - turns out that
spawnaccepts the command line arguments directly in the command parameter, and args array can be omitted. So that likely is the best option for the docs.- added a commit that references this issue
on Mar 13, 2026 - added a commit that references this issue
on Mar 23, 2026 - added a commit that references this issue
on Mar 25, 2026 - added 2 commits that reference this issue
on Mar 28, 2026 - added a commit that references this issue
on Apr 28, 2026 - added a commit that references this issue
on Jul 29, 2026
Affected URL(s)
https://nodejs.org/docs/latest-v24.x/api/child_process.html#spawning-bat-and-cmd-files-on-windows
Description of the problem
The suggestions here include using
spawnwithshell: true, however doing so is deprecated with DEP0190. This conflicting messaging is confusing and makes this difficult-to-use-safely API even more confusing to use for non-experts.I don't know what the right call is here. My guess is that DEP0190 was created to nudge people away from using
spawnwithshell: trueby either using it safely or explicitly using the insecureexeccommand. Since the only alternative in the documentation isexecI'd suggest removing the suggestion to usespawnwithshell: trueentirely.