[renovate]

This PR contains the following updates:

Package	Type	Update	Change	OpenSSF
execa	dependencies	major	^9.5.1 → ^10.0.0

---

Release Notes

sindresorhus/execa (execa)

v10.2.1

Compare Source

• Fix types compatibility with exactOptionalPropertyTypes 2b6988b

---

v10.2.0

Compare Source

Behavior changes

These are bug fixes, but they might affect code that relied on the previous incorrect behavior.

• Exceeding maxBuffer now terminates the subprocess with killSignal, instead of leaving it running and the promise pending f6de9be
• maxBuffer: 0 now limits the output of synchronous methods, like asynchronous methods 224dd20
• Options of $ set to undefined now use $'s defaults, such as inheriting stdin f61a6e9

Fixes

• Fix invalid file descriptor objects, such as closed file handles, crashing the current process instead of throwing d0a5968
• Fix synchronous transforms: errors being hidden, filtered output being returned on failure, mixed text and byte chunks being reordered, and final() being skipped without input 0ba2b6e ed80079 9c54833
• Fix result.all changing objects when only stdout or stderr is buffered 8629132
• Fix writing objects to a web WritableStream 5ea2900
• Fix an invalid subprocess.duplex() option making later stream conversions hang 5e4345b
• Fix execaNode() not running its file when the current process uses --print e747872

Types

• Fix result and subprocess types when the options are a union, including IPC f5772f3 355d917 cb8aaf6
• Fix result types when options bound with execa(options) are overridden or reset with undefined 708fed7
• Fix subprocess.stdin types with the input and inputFile options 236c831
• Fix chunk types of subprocess.iterable() with object-mode transforms a2912e5
• Fix fd-specific option types, and execaNode() types with node: undefined 80b01e9 523cf9b

---

v10.1.1

Compare Source

• Fix execaNode() and the node option missing IPC in their types 2633abb
• Fix escapedCommand and verbose quoting arguments when using the shell option b2c3a54
• Fix wrong-typed options and arguments being silently ignored or coerced b57d643
• Fix the verbose option printing colors when stderr is not a terminal a2eda67
• Fix stdin iterables and input transforms edge cases 6925cc3
• Fix IPC edge cases 5f80cde
• Fix .pipe() and stream conversion edge cases d3ec10d
• Fix template strings, parseCommandString() and execaNode() edge cases fb92da1
• Fix invalid timeout and forceKillAfterDelay values d9a5689
• Fix errors, early errors and result.all edge cases c4262ff

---

v10.1.0

Compare Source

Behavior changes

These are bug fixes, but they might affect code that relied on the previous incorrect behavior.

• extendEnv: false without the env option no longer inherits process.env, per docs 67acf60
• Windows: Arguments of .cmd and .bat files are now escaped like Rust does, which fixes batch files reading %~1 (#​1261) 93bddc4
• Invalid stdio values, such as negative file descriptors, now throw c6bd387
• Using the same file as input and output now throws, even when the paths are written differently 587045a
• Synchronous methods now enforce per-file-descriptor maxBuffer values 9547e51
• Synchronous methods now throw on the signal option, like asynchronous methods 59de065
• Synchronous methods now write the raw output bytes to files, like asynchronous methods af6264a

Fixes

• Fix subprocess.kill() signaling the current process group when the subprocess failed to spawn 5464d43
• Fix crashes when spawning fails with EMFILE/ENFILE (#​1262), or when a file target cannot be opened 15c46cd 1cee524
• Fix error.stdout and error.stderr being undefined when synchronous methods fail to spawn (#​1263) bfe4633
• Fix the subprocess promise hanging until an output stream is read 004f3b3
• Fix subprocess.pipe() with the stdio option, and destination subprocesses left running 8d3f0a9 ecda56b
• Fix result.all when only some file descriptors are buffered or split into lines 758768f
• Fix the encoding option and line splitting in transforms 6adb3c3
• Fix input and output transforms with synchronous methods 516a5e2 e0b5dbc
• Fix template strings with emojis and line continuations b67f199
• Fix killDescendants signaling unrelated processes on Windows 9c5c71c
• Fix IPC with serialization: 'json', strict: true and the verbose option 9842f1a 698a1b8 b548d8b
• Fix the subprocess error being hidden when the current directory was deleted 91d9ded
• Fix shebang scripts on Windows when the file is small 7c1a631

---

v10.0.1

Compare Source

• Fix preferLocal argument escaping edge-case on Windows (#​1259) e771733

---

v10.0.0

Compare Source

Breaking

• Require Node.js 22. (#​1243) 04b4454

• The subprocess is now a normal promise, instead of a ChildProcess instance augmented with promise methods. All the methods and properties documented by Execa are unchanged. Node.js-specific ChildProcess APIs (such as .on(), .send(), .ref() and .unref()) must now be accessed through the new subprocess.nodeChildProcess property. (#​1255) ade74bf

const subprocess = execa('node', ['file.js']);
- subprocess.on('spawn', onSpawn);
+ subprocess.nodeChildProcess.on('spawn', onSpawn);

• Removed execaCommand() and execaCommandSync(). Use the template string syntax instead, which splits on spaces. If the command is a dynamic string, split it with parseCommandString(). (#​1244) 3ced394

- await execaCommand('npm run build');
+ await execa`npm run build`;

- await execaCommand(commandString);
+ await execa`${parseCommandString(commandString)}`;

• Removed the old undocumented stdio: [..., 'ipc'] syntax. Use the ipc: true option instead. (#​1245) dcf611c

- await execa('node', ['file.js'], {stdio: ['pipe', 'pipe', 'pipe', 'ipc']});
+ await execa('node', ['file.js'], {ipc: true});

• When the input or inputFile option is combined with an inherited stdin (for example stdio: 'inherit'), the explicit input is now used, instead of being ignored. To combine multiple inputs, pass an array like stdin: ['inherit', {string: 'input'}]. (#​1232) 3ed0544

Improvements

• Terminate the subprocess' descendant processes by using the killDescendants option. This is useful when the subprocess spawns its own processes, such as when using the shell option. (#​1256) 84fa0ec

await execa('npm', ['run', 'build'], {killDescendants: true, timeout: 5000});

• Convert the subprocess to a web stream by using subprocess.readableStream(), subprocess.writableStream() or subprocess.transformStream(). (#​1254) 29d9cfc

await execa`npm run build`
	.readableStream()
	.pipeTo(writableWebStream);

• The value returned by subprocess.pipe() now exposes the destination subprocess' methods, so the piped output can be consumed directly: iterate over its output lines, convert it to a stream, or exchange IPC messages. (#​1252) c31c94c

for await (const line of execa`npm run build`.pipe`sort`) {
	console.log(line);
}

• Use an additional file descriptor as input by wrapping its stdio value as a {value, input: true} object. Direction-ambiguous values ('pipe', 'inherit', files and transforms) default to output on additional file descriptors. (#​1246, #​1249) 487a3a4 9fbf5ba

const subprocess = execa({stdio: ['pipe', 'pipe', 'pipe', {value: 'pipe', input: true}]})`npm run scaffold`;

const writable = subprocess.writable({to: 'fd3'});

• The transform generator function's chunk argument is now typed based on the transform's mode, instead of always being unknown: string for line transforms, Uint8Array for binary transforms, and unknown in object mode. (#​1247) 0a7b4f8

Fixes

• Fixed fd-specific options (verbose, maxBuffer, etc.) when the ipc option is true: fd3 and ipc no longer target the same file descriptor. (#​1241) b886883

---

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	execa@​10.2.1

View full report