Fix cross-spawn vulnerability (CVE-2024-21538) by removing child-process-promise

[thatmichael85]

Summary

• Removes child-process-promise@2.2.1 (unmaintained since 2017) and its transitive dependency cross-spawn@4.0.2, which has CVE-2024-21538 (ReDoS, HIGH severity)
• Replaces it with scripts/shared/childProcess.js, a lightweight wrapper around Node's built-in child_process module:
  • exec = util.promisify(child_process.exec) — drop-in replacement, returns {stdout, stderr}
  • spawn = thin Promise wrapper that resolves on exit code 0 and rejects with {code} on failure
• Migrates 9 files (single import-line change each) to the new shared utility
• Removes 2 devDependencies from package.json: child-process-promise and @types/child-process-promise
• Adds unit tests (scripts/__tests__/unit/childProcess.test.ts) covering exec/spawn success, failure, option forwarding, and graceful handling of the removed capture option

Files changed

File	Change
scripts/shared/childProcess.js	NEW — shared utility
scripts/__tests__/unit/childProcess.test.ts	NEW — 8 unit tests
scripts/build.js	Import change
scripts/override-react.js	Import change
scripts/npm/release.js	Import change
scripts/npm/update-changelog.js	Import change
scripts/npm/increment-version.js	Import change
scripts/npm/postversion.js	Import change
scripts/update-examples.mjs	Import change
scripts/__tests__/integration/setup.js	Import change
scripts/__tests__/integration/utils.js	Import change + removed unused capture option
package.json	Removed 2 devDependencies
pnpm-lock.yaml	Regenerated (cross-spawn@4.0.2 fully removed)

Test plan

• All 2589 unit tests pass (pnpm run test-unit) — 96 test files, 0 failures
• New childProcess.test.ts passes (8/8 tests)
• Verified child-process-promise and cross-spawn@4.0.2 are absent from pnpm-lock.yaml
• CI passes

Demo

[

cursorful-video-1772076047703.mp4

](url)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
lexical	Building	Preview, Comment	Feb 26, 2026 3:16am
lexical-playground	Building	Preview, Comment	Feb 26, 2026 3:16am