DEP0190: spawnServer passes args array with shell:true, triggering Node v26 deprecation warning
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 72/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Quiet
- Tech stack
- node.js, typescript
Research direction
Start in packages/run/src/adapter/index.ts at the spawnServer function and compare the distributed packages/run/dist/adapter/index.js. Check how the command and args are passed when shell is enabled, then verify that npm run preview no longer emits DEP0190 on Node.js v26 while still starting successfully.
Written by the indexing model from the issue text.
Description
Bug
Running npm run preview (i.e. marko-run preview) logs the following deprecation warning on Node.js v26:
(node:24456) [DEP0190] DeprecationWarning: Passing args to a child process with shell option true can lead to security vulnerabilities, as the arguments are not escaped, only concatenated.
Root cause
In packages/run/src/adapter/index.ts (distributed as dist/adapter/index.js), the spawnServer function calls:
cp.spawn(cmd, args, {
shell: true,
...
});
Node.js v26 introduced DEP0190 which warns when a separate args array is passed alongside shell: true, because the args are concatenated (not escaped) before being handed to the shell, which can be a security risk.
Fix
Either:
-
Merge cmd + args into a single string when using
shell: true:cp.spawn([cmd, ...args].join(" "), [], { shell: true, ... }); -
Drop
shell: trueif it is only needed for Windows.cmd/.batresolution, and use{ shell: process.platform === "win32" }— but then also merge args into the command string on that path.
Environment
@marko/run: 0.11.0- Node.js: v26.2.0
- OS: macOS Darwin 25.5.0
- Dominant language
- TypeScript
- Stars
- 175
- Forks
- 17
- Avg merge
- 5h 26m
- Merged PRs (30d)
- 5
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from marko-js/run
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
-
Difficulty 3/5 1-2 days Newbie friendliness 55/100
-
Difficulty 4/5 3-5 days Newbie friendliness 38/100
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
Similar issues
-
clawsweeper:fix-shape-clear clawsweeper:queueable-fix clawsweeper:source-repro impact:ux-friction issue-rating: 🦞 diamond lobster no-stale P3
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
community first-timers-only good first issue hacktoberfest help wanted low hanging fruit up-for-grabs
Difficulty 1/5 Under an hour Newbie friendliness 76/100
-
code-quality refactoring
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
github/gh-aw-firewall#8816 ·
-
integration:quickjs org:external priority:backlog topic:code-interpreter topic:middleware type:feature
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
langchain-ai/deepagents#6450 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100
vercel/react-tweet#225 ·