carloscuesta / carloscuesta/gitmoji-cli

([DEP0190] DeprecationWarning when using node 24

Open
#1,491 1 comment 3 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
4.8k
Forks
212
PR merge metrics
No merged PRs in 30d

Description

### Describe the bug

Not sure if this is occurring because of node, but the only script that gave me this warning so far was the gitmoji. The warning follows:

`(node:36681) [DEP0190] DeprecationWarning: Passing args to a child process with shell option true can lead to security vulnerabilities, as the arguments are not escaped, only concatenated.`

### Reproduction

Install gitmoji
Use node 24 (I'm using --lts from nvm)
use gitmoji -c
place a title and confirm

### System Info

```Shell
System:
OS: Linux 6.14 Ubuntu 24.04.3 LTS 24.04.3 LTS (Noble Numbat)
CPU: (12) x64 13th Gen Intel(R) Core(TM) i5-1334U
Memory: 4.93 GB / 15.31 GB
Container: Yes
Shell: 5.9 - /usr/bin/zsh
Binaries:
Node: 24.11.0 - /home//.nvm/versions/node/v24.11.0/bin/node
npm: 11.6.2 - /home//.nvm/versions/node/v24.11.0/bin/npm
pnpm: 10.20.0 - /home//.local/share/pnpm/pnpm
Browsers:
Firefox: 144.0.2
Firefox Developer Edition: 144.0.2
```

### Validations

- [x] Follow our [Code of Conduct](https://github.com/carloscuesta/gitmoji-cli/blob/master/CODE_OF_CONDUCT.md)
- [x] Read the [Contributing Guide](https://github.com/carloscuesta/gitmoji-cli/blob/master/.github/CONTRIBUTING.md).
- [x] Check that there isn't already an issue that reports the same bug to avoid creating duplicates.
- [x] Check that this is a concrete bug. For Q&A, please open a GitHub Discussion instead.
- [x] The provided reproduction is a [minimal reproducible](https://stackoverflow.com/help/minimal-reproducible-example) of the bug.

Contributor guide

Open the contributing guide

Research direction

Reproduce the warning with Node 24 by installing gitmoji and running `gitmoji -c`, then trace the command path reached after entering and confirming a title. Identify where the child process is launched with the shell option and verify that the command completes without the DEP0190 warning.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js
Domain
cli
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.