carloscuesta / carloscuesta/gitmoji-cli
([DEP0190] DeprecationWarning when using node 24
- Dominant language
- JavaScript
- Stars
- 4.8k
- Forks
- 212
- PR merge metrics
- No merged PRs in 30d
Description
### Describe the bug
Not sure if this is occurring because of node, but the only script that gave me this warning so far was the gitmoji. The warning follows:
`(node:36681) [DEP0190] DeprecationWarning: Passing args to a child process with shell option true can lead to security vulnerabilities, as the arguments are not escaped, only concatenated.`
### Reproduction
Install gitmoji
Use node 24 (I'm using --lts from nvm)
use gitmoji -c
place a title and confirm
### System Info
```Shell
System:
OS: Linux 6.14 Ubuntu 24.04.3 LTS 24.04.3 LTS (Noble Numbat)
CPU: (12) x64 13th Gen Intel(R) Core(TM) i5-1334U
Memory: 4.93 GB / 15.31 GB
Container: Yes
Shell: 5.9 - /usr/bin/zsh
Binaries:
Node: 24.11.0 - /home//.nvm/versions/node/v24.11.0/bin/node
npm: 11.6.2 - /home//.nvm/versions/node/v24.11.0/bin/npm
pnpm: 10.20.0 - /home//.local/share/pnpm/pnpm
Browsers:
Firefox: 144.0.2
Firefox Developer Edition: 144.0.2
```
### Validations
- [x] Follow our [Code of Conduct](https://github.com/carloscuesta/gitmoji-cli/blob/master/CODE_OF_CONDUCT.md)
- [x] Read the [Contributing Guide](https://github.com/carloscuesta/gitmoji-cli/blob/master/.github/CONTRIBUTING.md).
- [x] Check that there isn't already an issue that reports the same bug to avoid creating duplicates.
- [x] Check that this is a concrete bug. For Q&A, please open a GitHub Discussion instead.
- [x] The provided reproduction is a [minimal reproducible](https://stackoverflow.com/help/minimal-reproducible-example) of the bug.
Contributor guide
Research direction
Reproduce the warning with Node 24 by installing gitmoji and running `gitmoji -c`, then trace the command path reached after entering and confirming a title. Identify where the child process is launched with the shell option and verify that the command completes without the DEP0190 warning.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- cli
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100