Skip to content

Align upgrade command spawning with create-astro#16424

Merged
matthewp merged 1 commit intomainfrom
semgrep-upgrade-command-hardening
Apr 22, 2026
Merged

Align upgrade command spawning with create-astro#16424
matthewp merged 1 commit intomainfrom
semgrep-upgrade-command-hardening

Conversation

@matthewp
Copy link
Copy Markdown
Contributor

Changes

  • Replaces the shell-based command spawning in @astrojs/upgrade with the same Windows command resolution strategy used in create-astro.
  • Routes known package manager shims through cmd.exe /d /s /c on Windows, while preserving direct execution for non-shim binaries like Bun.

Testing

  • Installed dependencies in a fresh worktree to validate the split branch in isolation.
  • Ran Biome against packages/upgrade/src/shell.ts and the new changeset to confirm the branch stays formatted and lint-clean.

Docs

  • No docs update needed, because this only hardens internal command execution in @astrojs/upgrade.

@changeset-bot
Copy link
Copy Markdown

changeset-bot Bot commented Apr 20, 2026

🦋 Changeset detected

Latest commit: 5423beb

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@matthewp matthewp merged commit 3fcdaf1 into main Apr 22, 2026
22 checks passed
@matthewp matthewp deleted the semgrep-upgrade-command-hardening branch April 22, 2026 14:28
@astrobot-houston astrobot-houston mentioned this pull request Apr 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants