Il 11/01/2018 03:41, Paul Wise ha scritto: > On Wed, Jan 10, 2018 at 9:56 PM, Paolo Greppi wrote: > >> A Node.js module that provides a simple and platform-agnostic way >> to build shell commands with arguments that pass through your shell >> unaltered and with no unsafe side effects, whether you are running >> on Windows or a Unix-based OS. > > Uh, it would be much better to bypass the shell and use > child_process.execFile(). > Please ask anything depending on node-puka to instead use that. > > http://bonedaddy.net/pabs3/log/2014/02/17/pid-preservation-society/
Thanks for the suggestion, it's a useful optimization and I'd love to drop this ITP and do without puka ! But I don't feel I can patch yarn myself to use execFile rather than exec: this is a change that upstream should implement. So I have posted this: https://github.com/yarnpkg/yarn/issues/5208 Let's see how they react Paolo