Conflict between `child_process` API guidance and DEP0190

[ericcornelissen]

Affected URL(s)

https://nodejs.org/docs/latest-v24.x/api/child_process.html#spawning-bat-and-cmd-files-on-windows

Description of the problem

The suggestions here include using spawn with shell: true, however doing so is deprecated with DEP0190. This conflicting messaging is confusing and makes this difficult-to-use-safely API even more confusing to use for non-experts.

I don't know what the right call is here. My guess is that DEP0190 was created to nudge people away from using spawn with shell: true by either using it safely or explicitly using the insecure exec command. Since the only alternative in the documentation is exec I'd suggest removing the suggestion to use spawn with shell: true entirely.

[juanarbol]

Nice catch.

Can you send a PR fixing this? :)

[ericcornelissen]

Can do 👍

[Knagis]

But exec doesn't have stdio option, so it isn't a proper replacement.