Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Unquoted commit message is causing `npx all-contributors add` to fail on v7.0.0

Open Beginner friendly
  • Is something wrong?
#587 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
78/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
git, javascript, node.js
Domain
cli, tooling

Research direction

Start in dist/util/git.js at spawnGitCommand, where the issue identifies the shell command construction, and check the Git command call sites for commit and add. Replace shell-string execution with argument-based execution, as described in the issue. Reproduce with commit enabled and run npx all-contributors add octocat code; done means the commit succeeds with the full message and paths containing spaces are handled as arguments.

Written by the indexing model from the issue text.

Description

[!NOTE]
I have ran into this issue after upgrading from [email protected] to the latest v7 release.

I have asked LLM to perform an initial debug and generate the following report, which I have manually checked and modified for clarity.

Describe the bug

In v7.0.0, all-contributors add fails at the commit step when "commit": true is set in .all-contributorsrc. The files are updated and staged, then the commit fails with:

Error: error: pathspec 'add' did not match any file(s) known to git
error: pathspec '@octocat' did not match any file(s) known to git
error: pathspec 'as' did not match any file(s) known to git
error: pathspec 'a' did not match any file(s) known to git
error: pathspec 'contributor' did not match any file(s) known to git

The cause is in dist/util/git.js. spawnGitCommand builds one shell string and runs it through exec:

await promisify(exec)(`git ${args.join(' ')}`)

The commit message is passed in args (['commit', '-m', commitMessage]) but is never quoted. The shell splits it on spaces, so git receives commit -m feat: Add @octocat as a contributor. Only feat: is treated as the message, and the remaining words are treated as pathspecs.

This is a regression. 6.26.1 calls spawn('git', args) with an argument array, so no shell is involved and the message arrives intact.

To Reproduce

Steps to reproduce the behavior:

  1. Create a new directory with a git repository and a README that has the contributors markers: 
    mkdir ac-repro && cd ac-repro
git init && git remote add origin https://github.com/example/repo.git
npm init -y
npm i [email protected]
printf '# t\n\n## Contributors\n\n<!-- ALL-CONTRIBUTORS-LIST:START -->\n<!-- ALL-CONTRIBUTORS-LIST:END -->\n' > README.md
  2. Create .all-contributorsrc with commit enabled: 
    {
  "projectName": "repo",
  "projectOwner": "example",
  "repoType": "github",
  "repoHost": "https://github.com",
  "files": ["README.md"],
  "imageSize": 100,
  "commit": true,
  "commitConvention": "angular",
  "contributors": [],
  "contributorsPerLine": 7
}
  3. Commit the initial state: git add -A && git commit -m init
  4. Run npx all-contributors add octocat code
  5. See the error: 
    file:///.../node_modules/all-contributors-cli/dist/util/git.js:43
    throw new Error(msg)
          ^

Error: error: pathspec 'add' did not match any file(s) known to git
error: pathspec '@octocat' did not match any file(s) known to git
error: pathspec 'as' did not match any file(s) known to git
error: pathspec 'a' did not match any file(s) known to git
error: pathspec 'contributor' did not match any file(s) known to git

    at spawnGitCommand (.../dist/util/git.js:43:11)
  6. Run git status --short. Both files are staged but nothing was committed: 
    M  .all-contributorsrc
M  README.md

Expected behavior

git commit receives the whole message as a single argument and the commit is created, as it was in 6.x (for example docs: add @octocat as a contributor).

A fix is to pass the arguments to execFile or spawn instead of building a shell string, as 6.26.1 did.

Screenshots

Not applicable, the full error output is above.

Additional context

  • Node.js: v24.22.1
  • Workarounds for 7.0.0: pass --no-commit (or set "commit": false) and commit manually.
  • The same string-joining happens for git add, which receives absolutePathFiles from options.files and options.config. From reading the code (I did not test it), a project path containing a space would break git add the same way, and a path with shell metacharacters would be interpreted by the shell. Moving to execFile or spawn with an argument array fixes both.
Dominant language
JavaScript
Stars
424
Forks
151
Avg merge
2d 1h
Merged PRs (30d)
15

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from all-contributors/cli

All issues in all-contributors/cli

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.