Repository navigation
deps: update bin-links, promise-spawn, and pacote - #10152
Merged
Merged
Conversation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 330b549f-83dd-4218-81b7-003cc008f869
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 330b549f-83dd-4218-81b7-003cc008f869
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 330b549f-83dd-4218-81b7-003cc008f869
martinrrm
marked this pull request as ready for review
October 21, 2026 19:02
jeffkl
approved these changes
Oct 21, 2026
nkolev92
approved these changes
Oct 21, 2026
reggi
approved these changes
Oct 21, 2026
This was referenced Oct 27, 2026
jeffkl
approved these changes
Oct 27, 2026
This was referenced Oct 28, 2026
martinrrm
added a commit
that referenced
this pull request
Nov 3, 2026
…10044) ## Summary When `npx <package>` infers an executable from package `bin` metadata, the executable name becomes part of a synthetic npm script. On Windows, that script is ultimately interpreted by `cmd.exe`. This change protects the inferred executable token according to the selected shell instead of forwarding it unquoted. Supporting dependency PR: npm/promise-spawn#166 ## Changes ### `lib/run-script.js` - Escape the executable token when no explicit `call` script was supplied. - Select the escaping strategy from `scriptShell`, including POSIX shells selected on Windows. - For `cmd.exe`, protect command separators, spaces, command keywords, and other cmd metacharacters. - Reject executable names containing double quotes, percent signs, exclamation marks, or control characters that cannot be safely represented as a cmd executable token. - Preserve `call` as an intentionally supplied shell script; its arguments are not treated as inferred executable names. ### `lib/index.js` - On a matching npx-cache hit, select the inferred command from the installed package manifest rather than mutable registry metadata. This cache-manifest adjustment is related hardening and may be split into a separate change during review if preferred. ### Tests and documentation - Add unit coverage for cmd.exe token encoding and rejection cases. - Add coverage for POSIX escaping when a POSIX shell is selected on Windows. - Add normalized-bin registry regressions covering command separators and cache metadata mismatches. - Document the shell-specific executable handling and rejected cmd.exe characters. ## Dependency status The required promise-spawn fix is released and bundled as @npmcli/promise-spawn@10.0.1 through #10152. This branch is rebased onto latest and no longer carries a duplicate bundled dependency diff. ## Validation - Focused and full libnpmexec tests, eslint, and template-oss postlint pass locally on Node 24.15.0. - Mutation testing confirms the shell and cache regressions fail without the production changes. - Added PowerShell-specific construction coverage and a Windows runtime test for inferred executable invocation. - The npm/cli CI matrix passes on Linux, macOS, and Windows across all configured Node versions. - No vulnerability reproduction or malicious command execution was run. ## Review status Ready for review. --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 3e53db77-0fe4-4320-8ada-f2962ddd303c Copilot-Session: 155db33f-8c59-4859-a9b9-374c3a77e721
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Update three bundled runtime dependencies to their released patch versions:
bin-links7.0.07.0.1getPaths()(npm/bin-links#187).@npmcli/promise-spawn10.0.010.0.1pacote22.0.022.0.1Validation
Passed using the checkout's npm through the local verification runner:
install,ci,exec, andauditcommand tests, plus root eslint.node,arborist/reify, andarborist/rebuildtests, plus workspace eslint.run-script,registry, andlocaltests, plus workspace eslint.git diff --check; exactly three dependency commits; installed and locked versions match; no lockfile package additions/removals or unrelated version changes.Focused tests disable coverage and do not establish full-package coverage or full CI readiness. Full suites, template-oss postlint, other consumer workspace suites, native Windows behavior, and the multi-platform/Node matrix and smoke/publish-dry-run checks remain outside this local validation scope.