[BUG] DeprecationWarning: DEP0190 in Claude CLI due to shell: true usage

Description:

When launching the Claude CLI, the following deprecation warning appears in the terminal:

pgsql
Copiar
Editar
(node:9740) [DEP0190] DeprecationWarning: Passing args to a child process with shell option true can lead to security vulnerabilities, as the arguments are not escaped, only concatenated.
(Use node --trace-deprecation ... to show where the warning was created)
This warning refers to the use of child_process.spawn() or similar Node.js methods with the { shell: true } option.

Why this matters:

Using shell: true without proper argument escaping can introduce security risks, especially if any arguments are user-controlled or dynamically constructed. This warning was added by Node.js as part of a broader effort to highlight insecure coding patterns (see DEP0190).

Recommended fix:

Remove shell: true unless it's strictly required for shell syntax (e.g., pipes, redirection).

If shell: true is truly necessary, ensure all arguments are sanitized and escaped properly using a library like shell-escape.

Consider switching to child_process.spawn() or execFile() without shell mode, as these are more secure and avoid the warning.

Reproduction steps:

Launch the Claude CLI (e.g., from VSCode or terminal).

Observe the deprecation warning immediately upon startup.

Environment:

OS: Windows 10

Node.js version: [insert your Node version here]

Claude CLI version: att