microsoft / microsoft/typespec

Track DEP0190 warnings from http-client-python install and prepare scripts

Open
#11,603 1 comment 1 reaction 1 assignee Claimed by @msyyc View on GitHub
bug emitter:client:python
Dominant language
Java
Stars
5.9k
Forks
394
Avg merge
1d 23h
Merged PRs (30d)
104

Description

## Description

Running `npm install` in `packages/http-client-python` emits Node.js `DEP0190` deprecation warnings from the package install and prepare setup scripts.

## Repro

```powershell
cd C:\dev\typespec\packages\http-client-python
npm install
```

## Observed output

```text
> @typespec/http-client-python@0.35.1 install
> node ./eng/scripts/setup/install-runner.js

(node:27040) [DEP0190] DeprecationWarning: Passing args to a child process with shell option true can lead to security vulnerabilities, as the arguments are not escaped, only concatenated.
(Use `node --trace-deprecation ...` to show where the warning was created)
Found Python on your local environment and created a venv with all requirements.

> @typespec/http-client-python@0.35.1 prepare
> node ./eng/scripts/setup/prepare-runner.js

(node:46868) [DEP0190] DeprecationWarning: Passing args to a child process with shell option true can lead to security vulnerabilities, as the arguments are not escaped, only concatenated.
(Use `node --trace-deprecation ...` to show where the warning was created)
```

## Expected behavior

`npm install` should complete without Node.js deprecation warnings.

## Notes

The warning points to child process usage with `shell: true` where arguments are passed separately. The relevant setup scripts appear to be:

- `packages/http-client-python/eng/scripts/setup/install-runner.js`
- `packages/http-client-python/eng/scripts/setup/prepare-runner.js`

This should be investigated and updated to avoid the deprecated child process pattern.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.