meta git commands fail with Error: spawn EINVAL on latest Node versions in Windows

[ocsurfnut]

🐛 Bug Report

╰─❯ meta git pull
Error: spawn EINVAL
    at ChildProcess.spawn (node:internal/child_process:421:11)
    at spawn (node:child_process:761:9)
    at Command.executeSubCommand (C:\Users\WISMITH\AppData\Roaming\npm\node_modules\meta\node_modules\commander\index.js:565:12)
    at Command.parse (C:\Users\WISMITH\AppData\Roaming\npm\node_modules\meta\node_modules\commander\index.js:489:17)
    at exports.run (C:\Users\WISMITH\AppData\Roaming\npm\node_modules\meta\index.js:47:11)
    at Object.<anonymous> (C:\Users\WISMITH\AppData\Roaming\npm\node_modules\meta\bin\meta:8:15)
    at Module._compile (node:internal/modules/cjs/loader:1369:14)
    at Module._extensions..js (node:internal/modules/cjs/loader:1427:10)
    at Module.load (node:internal/modules/cjs/loader:1206:32)
    at Module._load (node:internal/modules/cjs/loader:1022:12) {
  errno: -4071,
  code: 'EINVAL',
  syscall: 'spawn'

To Reproduce

Steps to reproduce the behavior:

Start with

╰─❯ node --version
v20.12.2

on a Windows machine

then execute meta git ...

Expected behavior

Command processes as normal.

[ocsurfnut]

This is due to Node patching CVE-2024-27980 on Windows: https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2

It can be worked around by adding { shell: true } to any spawn() commands. Since you've got a super old version of commander.js forked, you could add here: https://github.com/mateodelnorte/commander.js/blob/master/index.js#L563 and https://github.com/mateodelnorte/commander.js/blob/master/index.js#L565 .

Made that change locally in node_modules/commander and resolved the issue for me. I would contribute, but I cannot push a branch to your fork.

Incidentally, any plans to update to latest commander.js?

[turejaku]

Hello,

I'm currently experiencing the same issue.
Is there any chance to fix it in the near future?

[Sumant-HSV]

Kindly Fix this

[ddc-aaroncope]

knock knock...anyone maintaining this repo any longer?

[navy1978]

Hi, it seems this can be easily fixed :" users can now pass { shell: true } as an option to prevent the occurrence of EINVALs errors."

https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2

can you please fix it? Or can we create a PR for this?