DEP0190 deprecation warning on Node.js 24+ (spawn with args and shell: true)
Nobody has claimed this yet.
Assessment
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Newbie friendliness
- 88/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- javascript, node.js
Research direction
The issue identifies installDependencies in src/main.js and shows the spawn call that triggers the warning. Read that function and check how it invokes npm on Windows and other platforms. Update the invocation as suggested, then run npm create ol-app my-app on Node.js 24 or newer; done means the app installs and DEP0190 no longer appears.
Written by the indexing model from the issue text.
Description
Description
Running npm create ol-app on Node.js 24 or newer prints a deprecation warning. The app is created and installed correctly, but the warning is confusing for new users.
Steps to reproduce
npm create ol-app my-app
Output
npm notice run npx
npm notice run ^"create-ol-app^" my-app
(node:18796) [DEP0190] DeprecationWarning: Passing args to a child process with shell option true can lead to security vulnerabilities, as the arguments are not escaped, only concatenated.
(Use `node --trace-deprecation ...` to show where the warning was created)
Environment
- create-ol-app: 1.2.0
- Node.js: v24.21.0
- npm: 12.2.2
- OS: Windows 11 Pro
Cause
installDependencies in src/main.js calls spawn with an argument array together with shell: true:
const child = spawn('npm', ['ci'], {
cwd: dir,
stdio: 'inherit',
shell: true,
});
Since Node.js 24 this combination triggers DEP0190, because with shell: true the arguments are not escaped but only joined with spaces. There is no real risk here, as the only argument is the hardcoded ci.
Suggested fix
Pass the command as a single string, so there is no argument array:
- const child = spawn('npm', ['ci'], {
+ const child = spawn('npm ci', {
cwd: dir,
stdio: 'inherit',
shell: true,
});
The shell receives the same string (npm ci) as before, so behaviour is unchanged on all platforms and Node.js versions.
Removing shell: true instead is not an option on Windows: npm is npm.cmd there, and since the April 2024 security releases (Node.js 18.20.2, 20.12.2, 21.7.3) spawning a .cmd file without a shell throws EINVAL.
I am happy to open a pull request for this if you consider that useful.
- Dominant language
- JavaScript
- Stars
- 26
- Forks
- 5
- PR merge metrics
- No merged PRs in 30d
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from openlayers/create-ol-app
-
Difficulty 3/5 1-2 days Newbie friendliness 25/100
openlayers/create-ol-app#10 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 25/100
openlayers/create-ol-app#5 · 2 comments ·
All issues in openlayers/create-ol-app
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
VoteIT/voteit_frontend#446 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
simstudioai/sim#9831 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 1 day