doc: clarify that any truthy value of shell is part of DEP0190

PR-URL: https://github.com/nodejs/node/pull/62249
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
This commit is contained in:
Antoine du Hamel authored and Juan José Arboleda committed 2026-07-19 17:30:51 -05:00
1 parent 7a29409ed3
commit 020d2b5eb9
1 file changed
+3 -2
+3 -2
View File
@@ -3803,7 +3803,7 @@ Type: Documentation-only
`process.features.tls_alpn`, `process.features.tls_ocsp`, and `process.features.tls_sni` are
deprecated, as their values are guaranteed to be identical to that of `process.features.tls`.
### DEP0190: Passing `args` to `node:child_process` `execFile`/`spawn` with `shell` option `true`
### DEP0190: Passing `args` to `node:child_process` `execFile`/`spawn` with `shell` option
<!-- YAML
changes:
@@ -3816,7 +3816,8 @@ changes:
Type: Documentation-only
When an `args` array is passed to [`child_process.execFile`][] or [`child_process.spawn`][] with the option
`{ shell: true }`, the values are not escaped, only space-separated, which can lead to shell injection.
`{ shell: true }` or `{ shell: '/path/to/shell' }`, the values are not escaped, only space-separated,
which can lead to shell injection.
### DEP0191: `repl.builtinModules`