fix(build): collect-npm-licences could not run on Windows - #233
Merged
Conversation
execFileSync does not consult PATHEXT, so the bare name 'npm' is ENOENT on Windows, where the executable is npm.cmd. Packaging died there — before electron-builder was reached — which is why the Windows installer workflow had never produced an installer. Found by dispatching that workflow for the first time.
johan-bell
added a commit
that referenced
this pull request
Sep 3, 2026
#233 named the executable npm.cmd, which fixed ENOENT and earned EINVAL instead: since Node 20.12 (CVE-2024-27980) spawning a .cmd without a shell is refused outright. A shell is what resolves it. The arguments are fixed flags with nothing to quote, which is why the quoting objection in #233 was the wrong reason to avoid this.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Dispatching the Windows installer workflow for the first time found this immediately.
execFileSyncdoes not consultPATHEXT, so the bare namenpmcannot be resolved on Windows, where the executable isnpm.cmd. Packaging died in the licence collector — before electron-builder was reached — which is why that workflow has never produced an installer.One line:
process.platform === 'win32' ? 'npm.cmd' : 'npm'. Named explicitly rather thanshell: true, which would drag quoting rules into it for no benefit.Verified the collector still runs on macOS: 286 packages walked,
LICENSES-npm.txtwritten.This also means the
electron/release→app-electron/releaseupload-path fix in #232 has still never been exercised — the job failed two steps before it. Both are on the path to the first Windows build.