microsoft / microsoft/typespec
Track DEP0190 warnings from http-client-python install and prepare scripts
- Dominant language
- Java
- Stars
- 5.9k
- Forks
- 394
- Avg merge
- 1d 23h
- Merged PRs (30d)
- 104
Description
## Description
Running `npm install` in `packages/http-client-python` emits Node.js `DEP0190` deprecation warnings from the package install and prepare setup scripts.
## Repro
```powershell
cd C:\dev\typespec\packages\http-client-python
npm install
```
## Observed output
```text
> @typespec/http-client-python@0.35.1 install
> node ./eng/scripts/setup/install-runner.js
(node:27040) [DEP0190] DeprecationWarning: Passing args to a child process with shell option true can lead to security vulnerabilities, as the arguments are not escaped, only concatenated.
(Use `node --trace-deprecation ...` to show where the warning was created)
Found Python on your local environment and created a venv with all requirements.
> @typespec/http-client-python@0.35.1 prepare
> node ./eng/scripts/setup/prepare-runner.js
(node:46868) [DEP0190] DeprecationWarning: Passing args to a child process with shell option true can lead to security vulnerabilities, as the arguments are not escaped, only concatenated.
(Use `node --trace-deprecation ...` to show where the warning was created)
```
## Expected behavior
`npm install` should complete without Node.js deprecation warnings.
## Notes
The warning points to child process usage with `shell: true` where arguments are passed separately. The relevant setup scripts appear to be:
- `packages/http-client-python/eng/scripts/setup/install-runner.js`
- `packages/http-client-python/eng/scripts/setup/prepare-runner.js`
This should be investigated and updated to avoid the deprecated child process pattern.
Contributor guide
Assessment
This issue has not been assessed yet.