fix(deps): update dependency execa to v10 by metamask-ci[bot] · Pull Request #10320 · MetaMask/core

metamask-ci · 2026-09-21T15:14:42Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
execa	`^5.0.0` → `^10.0.1`

Release Notes

sindresorhus/execa (execa)

`v10.0.1`

Compare Source

Fix preferLocal argument escaping edge-case on Windows (#1259) e771733

`v10.0.0`

Compare Source

Breaking

Require Node.js 22. (#1243) 04b4454
The subprocess is now a normal promise, instead of a ChildProcess instance augmented with promise methods. All the methods and properties documented by Execa are unchanged. Node.js-specific ChildProcess APIs (such as .on(), .send(), .ref() and .unref()) must now be accessed through the new subprocess.nodeChildProcess property. (#1255) ade74bf

const subprocess = execa('node', ['file.js']);
- subprocess.on('spawn', onSpawn);
+ subprocess.nodeChildProcess.on('spawn', onSpawn);

Removed execaCommand() and execaCommandSync(). Use the template string syntax instead, which splits on spaces. If the command is a dynamic string, split it with parseCommandString(). (#1244) 3ced394

- await execaCommand('npm run build');
+ await execa`npm run build`;

- await execaCommand(commandString);
+ await execa`${parseCommandString(commandString)}`;

Removed the old undocumented stdio: [..., 'ipc'] syntax. Use the ipc: true option instead. (#1245) dcf611c

- await execa('node', ['file.js'], {stdio: ['pipe', 'pipe', 'pipe', 'ipc']});
+ await execa('node', ['file.js'], {ipc: true});

When the input or inputFile option is combined with an inherited stdin (for example stdio: 'inherit'), the explicit input is now used, instead of being ignored. To combine multiple inputs, pass an array like stdin: ['inherit', {string: 'input'}]. (#1232) 3ed0544

Improvements

Terminate the subprocess' descendant processes by using the killDescendants option. This is useful when the subprocess spawns its own processes, such as when using the shell option. (#1256) 84fa0ec

await execa('npm', ['run', 'build'], {killDescendants: true, timeout: 5000});

Convert the subprocess to a web stream by using subprocess.readableStream(), subprocess.writableStream() or subprocess.transformStream(). (#1254) 29d9cfc

await execa`npm run build`
	.readableStream()
	.pipeTo(writableWebStream);

The value returned by subprocess.pipe() now exposes the destination subprocess' methods, so the piped output can be consumed directly: iterate over its output lines, convert it to a stream, or exchange IPC messages. (#1252) c31c94c

for await (const line of execa`npm run build`.pipe`sort`) {
	console.log(line);
}

Use an additional file descriptor as input by wrapping its stdio value as a {value, input: true} object. Direction-ambiguous values ('pipe', 'inherit', files and transforms) default to output on additional file descriptors. (#1246, #1249) 487a3a4 9fbf5ba

const subprocess = execa({stdio: ['pipe', 'pipe', 'pipe', {value: 'pipe', input: true}]})`npm run scaffold`;

const writable = subprocess.writable({to: 'fd3'});

The transform generator function's chunk argument is now typed based on the transform's mode, instead of always being unknown: string for line transforms, Uint8Array for binary transforms, and unknown in object mode. (#1247) 0a7b4f8

Fixes

Fixed fd-specific options (verbose, maxBuffer, etc.) when the ipc option is true: fd3 and ipc no longer target the same file descriptor. (#1241) b886883

`v9.6.1`

Compare Source

Fix VerboseOption type not being properly exported (#1215) 7891c39

`v9.6.0`

Compare Source

Update dependencies d49104a

`v9.5.3`

Compare Source

Fix Node 24-specific deprecation warning (#1199) 1ac5b91

`v9.5.2`

Compare Source

Bug fixes

Fix escaping newlines inside template strings. Thanks @aarondandy! (#1176)

`v9.5.1`

Compare Source

Bug fixes

Fix odd characters being printed in verbose mode on Windows (thanks @IIIMADDINIII). (#1167)

`v9.5.0`

Compare Source

Features

When redirecting stdout or stderr to a file, allow appending instead of overwriting. (#1166)

await execa({stdout: {file: 'output.txt', append: true}})`npm run build`;

`v9.4.1`

Compare Source

Bug fixes

Fix using process.execPath with Deno. Thanks @w3cj! (#1160)

`v9.4.0`

Compare Source

Features

We've created a separate package called nano-spawn. It is similar to Execa but with fewer features, for a much smaller package size. More info.

Bug fixes

Both execaNode() and the preferLocal option modify the PATH environment variable. This release includes some minor improvements to ensure that environment variable remains small (sindresorhus/npm-run-path#20). It also handles a few related edge cases better (sindresorhus/npm-run-path#21).

Documentation

Small documentation typo fix, thanks @rrthomas! (#1153)

`v9.3.1`

Compare Source

Thanks @holic and @jimhigson for your contributions!

Bugs

Do not crash when using a custom Node.js binary without ICU support. (#1144)

Bugs (types)

Fix type of the env option. It was currently failing for Remix or Next.js users. (by @holic) (#1141)

Documentation

Fix typo in "Inputs" documentation. (by @jimhigson) (#1145)
Document how to terminate hanging subprocesses. (#1140)
Document how to add custom logging. (#1131)

This release includes a new set of methods to exchange messages between the current process and a Node.js subprocess, also known as "IPC". This allows passing and returning almost any message type to/from a Node.js subprocess. Also, debugging IPC is now much easier.

Moreover, a new gracefulCancel option has also been added to terminate a subprocess gracefully.

For a deeper dive-in, please check and share the release post!

Thanks @iiroj for your contribution, @SimonSiefke and @adymorz for reporting the bugs fixed in this release, and @karlhorky for improving the documentation!

Deprecations

Passing 'ipc' to the stdio option has been deprecated. It will be removed in the next major release. Instead, the ipc: true option should be used. (#1056)

- await execa('npm', ['run', 'build'], {stdio: ['pipe', 'pipe', 'pipe', 'ipc']});
+ await execa('npm', ['run', 'build'], {ipc: true});

The execaCommand() method has been deprecated. It will be removed in the next major release. If most cases, the template string syntax should be used instead.

- import {execaCommand} from 'execa';
+ import {execa} from 'execa';

- await execaCommand('npm run build');
+ await execa`npm run build`;

const taskName = 'build';
- await execaCommand(`npm run ${taskName}`);
+ await execa`npm run ${taskName}`;

const commandArguments = ['run', 'task with space'];
await execa`npm ${commandArguments}`;

If the file and/or multiple arguments are supplied as a single string, parseCommandString(command) can split that string into an array. More info. (#1054)

- import {execaCommand} from 'execa';
+ import {execa, parseCommandString} from 'execa';

const commandString = 'npm run task';
- await execaCommand(commandString);
+ const commandArray = parseCommandString(commandString); // ['npm', 'run', 'task']
+ await execa`${commandArray}`;

// Or alternatively:
const [file, ...commandArguments] = commandArray;
await execa(file, commandArguments);

Features

Add gracefulCancel option and getCancelSignal() method to terminate a subprocess gracefully. error.isGracefullyCanceled was also added. (#1109)
Add error.isForcefullyTerminated. It is true when the subprocess was terminated by the forceKillAfterDelay option. (#1111)
New methods to simplify exchanging messages between the current process and the subprocess. More info. (#1059, #1061, #1076, #1077, #1079, #1082, #1083, #1086, #1087, #1088, #1089, #1090, #1091, #1092, #1094, #1095, #1098, #1104, #1107)
- The current process sends messages with subprocess.sendMessage(message) and receives them with subprocess.getOneMessage(). subprocess.getEachMessage() listens to multiple messages.
- The subprocess uses sendMessage(message), getOneMessage() and getEachMessage() instead. Those are the same methods, but imported directly from the 'execa' module.
The ipcInput option sends an IPC message from the current process to the subprocess as it starts. This enables passing almost any input type to a Node.js subprocess. (#1068)
The result.ipcOutput array contains all the IPC messages sent by the subprocess to the current process. This enables returning almost any output type from a Node.js subprocess. (#1067, #1071, #1075)
The error message now contains every IPC message sent by the subprocess. (#1067)
The verbose: 'full' option now logs every IPC message sent by the subprocess, for debugging. More info here and there. (#1063)

Types

Add ExecaMethod, ExecaNodeMethod and ExecaScriptMethod, ExecaSyncMethod and ExecaScriptSyncMethod types. (#1066)
Export the Message type, for IPC. (#1059)
Fix type of forceKillAfterDelay: true option. (#1116)

Bug fixes

Fix passing a {file} to both the stdin and the stdout or stderr options. (#1058)
Fix multiple minor problems with the cancelSignal option. (#1108)
Fix accidental publishing of Vim backup files. (#1074)
Fix engines.node field in package.json. Supported Node.js version is ^18.19.0 or >=20.5.0. (by @iiroj) (#1101)

`v9.1.0`

Compare Source

Features (types)

Export TemplateExpression type. (#1049)

`v9.0.2`

Compare Source

Bug fixes (types)

Do not require using --lib dom for TypeScript users (#1043, #1044)
Fix type of the reject option (#1046)

`v9.0.1`

Compare Source

Bug fixes (types)

Fix types not being importable (#1033) 3bdab60
Fix complexity bug with types (#1037) 6cc519b
Fix complexity bug with types (#1035) fee011d

`v9.0.0`

Compare Source

This major release brings many important features including:

Split the output into lines, or progressively iterate over them.
Transform or filter the input/output using simple functions.
Print the output to the terminal while still retrieving it programmatically.
Redirect the input/output from/to a file.
Advanced piping between multiple subprocesses.
Improved verbose mode, for debugging.
More detailed errors, including when terminating subprocesses.
Enhanced template string syntax.
Global/shared options.
Web streams and Transform streams support.
Convert the subprocess to a stream.
New documentation with many examples.

Please check the release post for a high-level overview! For the full list of breaking changes, features and bug fixes, please read below.

Thanks @younggglcy, @koshic, @am0o0 and @codesmith-emmy for your help!

One of the maintainers @ehmicky is looking for a remote full-time position. Specialized in Node.js back-ends and CLIs, he led Netlify Build, Plugins and Configuration for 2.5 years. Feel free to contact him on his website or on LinkedIn!

Breaking changes (not types)

Dropped support for Node.js version <18.19.0 and 20.0.0 - 20.4.0. (834e372)
When the encoding option is 'buffer', the output (result.stdout, result.stderr, result.all) is now an Uint8Array instead of a Buffer. For more information, see this blog post. (by @younggglcy) (#586)

const {stdout} = await execa('node', ['file.js'], {encoding: 'buffer'});
console.log(stdout); // This is now an Uint8Array

Renamed some of the allowed values for the encoding option. (#586, #928)

- await execa('node', ['file.js'], {encoding: null});
+ await execa('node', ['file.js'], {encoding: 'buffer'});

- await execa('node', ['file.js'], {encoding: 'utf-8'});
+ await execa('node', ['file.js'], {encoding: 'utf8'});

- await execa('node', ['file.js'], {encoding: 'UTF8'});
+ await execa('node', ['file.js'], {encoding: 'utf8'});

- await execa('node', ['file.js'], {encoding: 'utf-16le'});
+ await execa('node', ['file.js'], {encoding: 'utf16le'});

- await execa('node', ['file.js'], {encoding: 'ucs2'});
+ await execa('node', ['file.js'], {encoding: 'utf16le'});

- await execa('node', ['file.js'], {encoding: 'ucs-2'});
+ await execa('node', ['file.js'], {encoding: 'utf16le'});

- await execa('node', ['file.js'], {encoding: 'binary'});
+ await execa('node', ['file.js'], {encoding: 'latin1'});

Passing a file path to subprocess.pipeStdout(), subprocess.pipeStderr() and subprocess.pipeAll() has been removed. Instead, a {file: './path'} object should be passed to the stdout or stderr option. (#752)

- await execa('node', ['file.js']).pipeStdout('output.txt');
+ await execa('node', ['file.js'], {stdout: {file: 'output.txt'}});

- await execa('node', ['file.js']).pipeStderr('output.txt');
+ await execa('node', ['file.js'], {stderr: {file: 'output.txt'}});

- await execa('node', ['file.js']).pipeAll('output.txt');
+ await execa('node', ['file.js'], {
+	stdout: {file: 'output.txt'},
+	stderr: {file: 'output.txt'},
+});

Passing a writable stream to subprocess.pipeStdout(), subprocess.pipeStderr() and subprocess.pipeAll() has been removed. Instead, the stream should be passed to the stdout or stderr option. If the stream does not have a file descriptor, ['pipe', stream] should be passed instead. (#752)

- await execa('node', ['file.js']).pipeStdout(stream);
+ await execa('node', ['file.js'], {stdout: ['pipe', stream]});

- await execa('node', ['file.js']).pipeStderr(stream);
+ await execa('node', ['file.js'], {stderr: ['pipe', stream]});

- await execa('node', ['file.js']).pipeAll(stream);
+ await execa('node', ['file.js'], {
+	stdout: ['pipe', stream],
+	stderr: ['pipe', stream],
+});

The subprocess.pipeStdout(), subprocess.pipeStderr() and subprocess.pipeAll() methods have been renamed to subprocess.pipe(). The command and its arguments can be passed to subprocess.pipe() directly, without calling execa() a second time. The from piping option can specify 'stdout' (the default value), 'stderr' or 'all'. (#757)

- await execa('node', ['file.js']).pipeStdout(execa('node', ['other.js']));
+ await execa('node', ['file.js']).pipe('node', ['other.js']);

- await execa('node', ['file.js']).pipeStderr(execa('node', ['other.js']));
+ await execa('node', ['file.js']).pipe('node', ['other.js'], {from: 'stderr'});

- await execa('node', ['file.js']).pipeAll(execa('node', ['other.js']));
+ await execa('node', ['file.js']).pipe('node', ['other.js'], {from: 'all'});

Renamed the signal option to cancelSignal. (#880)

- await execa('node', ['file.js'], {signal: abortController.signal});
+ await execa('node', ['file.js'], {cancelSignal: abortController.signal});

Renamed error.killed to error.isTerminated. (#625)

try {
	await execa('node', ['file.js']);
} catch (error) {
- if (error.killed) {
+ if (error.isTerminated) {
		// ...
	}
}

subprocess.cancel() has been removed. Please use either subprocess.kill() or the cancelSignal option instead. (#711)

- subprocess.cancel();
+ subprocess.kill();

Renamed the forceKillAfterTimeout option to forceKillAfterDelay. Also, it is now passed to execa() instead of subprocess.kill(). (#714, #723)

- const subprocess = execa('node', ['file.js']);
- subprocess.kill('SIGTERM', {forceKillAfterTimeout: 1000});
+ const subprocess = execa('node', ['file.js'], {forceKillAfterDelay: 1000});
+ subprocess.kill('SIGTERM');

The verbose option is now a string enum instead of a boolean. false has been renamed to 'none' and true has been renamed to 'short'. (#884)

- await execa('node', ['file.js'], {verbose: false});
+ await execa('node', ['file.js'], {verbose: 'none'});

- await execa('node', ['file.js'], {verbose: true});
+ await execa('node', ['file.js'], {verbose: 'short'});

The execPath option has been renamed to nodePath. It is now a noop unless the node option is true. Also, it now works even if the preferLocal option is false. (#812, #815)

- await execa('node', ['file.js'], {execPath: './path/to/node'});
+ await execa('node', ['file.js'], {nodePath: './path/to/node'});

The default value for the serialization option is now 'advanced' instead of 'json'. In particular, when calling subprocess.send(object) with an object that contains functions or symbols, those were previously silently removed. Now this will throw an exception. (#905)

- subprocess.send({example: true, getExample() {}});
+ subprocess.send({example: true});

If subprocess.stdout, subprocess.stderr or subprocess.all is manually piped, the .pipe() call must now happen as soon as subprocess is created. Otherwise, the output at the beginning of the subprocess might be missing. (#658, #747)

const subprocess = execa('node', ['file.js']);
- setTimeout(() => {
	subprocess.stdout.pipe(process.stdout);
- }, 0);

Signals passed to subprocess.kill() and to the killSignal option cannot be lowercase anymore. (#1025)

- const subprocess = execa('node', ['file.js'], {killSignal: 'sigterm'});
+ const subprocess = execa('node', ['file.js'], {killSignal: 'SIGTERM'});

- subprocess.kill('sigterm');
+ subprocess.kill('SIGTERM');

Features

Execution

Use the template string syntax with any method (including execa()), as opposed to only $. Conversely, $ can now use the regular array syntax. (#933)
A command's template string can span multiple lines. (#843)
Share options between multiple calls, or set global options, by using execa(options). (#933, #965)
Pass a file URL (as opposed to a file path string) to execa(), execaNode(), the inputFile option, the nodePath option or the shell option. (#630, #631, #632, #635)

Text lines

Split the output into text lines by using the lines option. (#741, #929, #931, #948, #951, #957)
Subprocess is now an async iterable, iterating over the output lines while the subprocess is running. (#923)

Piping multiple subprocesses

Simpler syntax: pass the command directly to subprocess.pipe() without calling execa(). A template string can also be used. (#840, #859, #864)
Wait for both subprocesses to complete. Error handling has been improved too. (#757, #778, #834, #854)
Retrieve the result of each subprocess (not only the last one) by using result.pipedFrom and error.pipedFrom. (#834)
Pipe 1 or many subprocesses to 1 or many subprocesses. (#834)
Pipe subprocesses using other file descriptors than stdin/stdout/stderr by using the from and to piping options. (#757, #834, #903, #920)
Cancel piping subprocesses by using the unpipeSignal piping option. (#834, #852)

Input/output

Pass an array with multiple values to the stdin, stdout and stderr options. For example, stdout: ['inherit', 'pipe'] prints the output to the terminal while still returning it as result.stdout. (#643, #765, #941, #954)
Redirect the input/output from/to a file by passing a {file: './path'} object or a file URL to the stdin, stdout or stderr option. (#610, #614, #621, #671, #1004)
Transform or filter the input/output by passing a generator function to the stdin, stdout or stderr option. (#693, #697, #698, #699, #709, #736, #737, #739, #740, #746, #748, #755, #756, #780, #783, #867, #915, #916, #917, #919, #924, #926, #945, #969)
Provide some binary input by passing an Uint8Array to the input or stdin option. (834e372, #670, #1029)
Provide some progressive input by passing a sync/async iterable to the stdin option. (#604, #944)
Provide multiple inputs by combining the stdin, input and inputFile options. (#666)
Return other file descriptors than result.stdout and result.stderr by using result.stdio. (#676)
Specify different values for stdout and stderr with the following options: verbose, lines, stripFinalNewline, maxBuffer, buffer. (#966, #970, #971, #972, #973, #974)

Streams

Redirect the input/output from/to a web stream by passing a ReadableStream or WritableStream to the stdin, stdout or stderr option. (#615, #619, #645)
Transform or filter the input/output by passing a Duplex, Node.js Transform or web TransformStream to the stdin, stdout or stderr option. (#937, #938)
Convert the subprocess to a stream by using subprocess.readable(), subprocess.writable() or subprocess.duplex(). (#912, #922, #958)

Verbose mode

Print the subprocess' completion, duration and errors with the verbose: 'short' or verbose: 'full' option. (#887, #890)
Print the subprocess' output with the verbose: 'full' option. (#884, #950, #962, #990)
Prettier formatting and colors with the verbose option. (#883, #893, #894)

Debugging

Retrieve the subprocess' duration by using result.durationMs and error.durationMs. (#896)
Retrieve the subprocess' current directory by using result.cwd. Previously only error.cwd was available. Also, result.cwd and error.cwd are now normalized to absolute file paths. (#803)
Printing result.escapedCommand in a terminal is now safe. (#875)

Errors

The ExecaError and ExecaSyncError classes are now exported. (#911)
Find the subprocess failure's root cause by using error.cause. (#911)
Know whether the subprocess failed due to the maxBuffer option by using error.isMaxBuffer. (#963)
Improved error.message: error.stdout and error.stderr are now interleaved if the all option is true. Additional file descriptors are now printed too. Also, the formatting has been improved. (#676, #705, #991, #992)
Control characters in error.message are now escaped, so they don't result in visual bugs when printed in a terminal. (#879)
Improved stack trace when an error event is emitted on subprocess.stdout or subprocess.stderr. (#814)

Termination

Specify an error message or stack trace when terminating a subprocess by passing an error instance to subprocess.kill(). (#811, #836, #1023)
The forceKillAfterDelay and killSignal options now apply to terminations due not only to subprocess.kill() but also to the cancelSignal, timeout, maxBuffer and cleanup options. (#714, #728)

Node.js files

Use the nodePath and nodeOptions options with any method, as opposed to only execaNode(), by passing the node: true option. (#804, #812, #815)
When using execaNode() or the node: true option, the current Node.js version is now inherited deeply. If the subprocess spawns other subprocesses, they will all use the same Node.js version. (#812, #815, #1011)

Synchronous execution

Use the all and buffer: false options with execaSync(), as opposed to only execa(). (#953, #956)
Added the $.s alias for $.sync. (#594)

Inter-process communication

Use the ipc: true option, as opposed to the more verbose stdio: ['pipe', 'pipe', 'pipe', 'ipc'] option. (#794)

Input validation

Improved the validation of the input, timeout, cwd, detached, cancelSignal and encoding options. (#668, #715, #803, #928, #940)
Improved the validation of the arguments passed to execa() and the other exported methods. (#838, #873, #899)
Improved the validation of signals passed to subprocess.kill() and to the killSignal option. (#1025)

Bug fixes

Fixed passing undefined values as options. This now uses the option's default value. (#712)
Fixed the process crashing when the inputFile option points to a missing file. (#609)
Fixed the process crashing when the buffer option is false and subprocess.stdout errors. (#729)
Fixed the process crashing when passing 'overlapped' to the stdout or stderr option with execaSync().

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

socket-security · 2026-09-21T15:15:22Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	execa@10.0.1

View full report

socket-security · 2026-09-21T15:15:24Z

Warning

MetaMask internal reviewing guidelines:

Do not ignore-all
Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
@SocketSecurity ignore npm/PACKAGE@VERSION

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Environment variable access: npm `which-command` reads PATH Env Vars: PATH Location: Package overview From: package.json → `npm/execa@10.0.1` → `npm/which-command@0.1.0` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/which-command@0.1.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm `which-command` reads Path Env Vars: Path Location: Package overview From: package.json → `npm/execa@10.0.1` → `npm/which-command@0.1.0` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/which-command@0.1.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm `which-command` reads PATHEXT Env Vars: PATHEXT Location: Package overview From: package.json → `npm/execa@10.0.1` → `npm/which-command@0.1.0` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/which-command@0.1.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

## Explanation Renovate pull requests reach this workflow but the job skips. The gate matches `dependabot[bot]`, and Renovate pull requests are authored by `metamask-ci[bot]`, the identity of the token it runs with. Confirmed on the first batch: the workflow triggered on `renovate/execa-10.x`, `renovate/unzipper-0.x-lockfile` and `renovate/tstyche-7.x-lockfile` and skipped all three, while MetaMask#10320 sits red on `Check changelog`. So the gate also matches a `renovate/` branch prefix now. Everything else about the job already applies: Renovate leaves the same changelog gap, and `yarn dedupe` and the constraints fixer are harmless no ops when there is nothing to repair. The file name and `environment: dependabot` are both left alone on purpose, and now carry a comment saying why. The token exchange policy keys on the `environment` claim and globs on the workflow path, so renaming either one breaks the token request before the job starts. One behaviour worth noting: Renovate's default `rebaseWhen: auto` stops updating a branch once someone else pushes to it, so the repairs will not be clobbered the way Dependabot clobbers them. ## References Follows MetaMask#10317. Part of WPC-1161. ## Checklist - [ ] I've updated the test suite for new or updated code as appropriate - [x] I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate - [ ] I've communicated my changes to consumers by [updating changelogs for packages I've changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md) - [ ] I've introduced [breaking changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md) in this PR and have prepared draft pull requests for clients and consumer packages to resolve them  --- > [!NOTE] > **Medium Risk** > The workflow can push commits to dependency-update branches using elevated token permissions, but behavior matches the existing Dependabot path with a narrower trigger. > > **Overview** > Extends the existing **repair constraints, lockfile and changelogs** workflow so it runs on **Renovate** PRs, not only Dependabot. The job gate now also matches branches whose head ref starts with `renovate/`, because Renovate PRs are opened by `metamask-ci[bot]` rather than `dependabot[bot]`. > > Repair commits are authored as **`github-actions[bot]`** instead of `metamask-ci[bot]`, so Renovate’s auto-rebase stops overwriting the fixes after an “external” commit. The workflow display name is generalized; the file path and `environment: dependabot` are unchanged so OIDC token exchange keeps working. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit bcbce01. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>

## Explanation By default Renovate leaves a manifest alone when the new version already satisfies the declared range, so MetaMask#10318 bumped `ts-jest` to 29.4.12 in `yarn.lock` and touched no `package.json` at all. That keeps the declared minimum at the old version and produces no changelog entry, since nothing published changed. We want a changelog entry for every dependency bump, so `rangeStrategy: bump` moves the range with the release: `^29.4.11` becomes `^29.4.12` across every workspace that declares it, the same as Dependabot does today. Out of range updates like MetaMask#10320 already behaved this way. `peerDependencies` are exempted back to `widen`. An explicit `rangeStrategy` overrides Renovate's peer handling ([`npm/range.ts`](https://github.com/renovatebot/renovate/blob/main/lib/modules/manager/npm/range.ts)), and 11 peer entries here have simple ranges that would be narrowed rather than broadened, `@babel/runtime ^7.0.0` most obviously. The other 11 are complex ranges like `^16.8.0 || ^17.0.0` and widen regardless. The cost is diff size. A single patch now rewrites the same line in every manifest that declares the dependency, and each of those packages needs an entry. MetaMask#10322 is what writes them. > [!IMPORTANT] > Depends on MetaMask#10322. Without it the repair workflow still skips Renovate pull requests, and every one of them lands red on `Check changelog`. ## References Depends on MetaMask#10322. Follows MetaMask#10317. Part of WPC-1161. ## Checklist - [ ] I've updated the test suite for new or updated code as appropriate - [x] I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate - [ ] I've communicated my changes to consumers by [updating changelogs for packages I've changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md) - [ ] I've introduced [breaking changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md) in this PR and have prepared draft pull requests for clients and consumer packages to resolve them  --- > [!NOTE] > **Low Risk** > Tooling-only change to Renovate; it does not alter runtime code, but it will enlarge dependency PR diffs across workspaces. > > **Overview** > Renovate is configured to **raise semver ranges in `package.json`** when a newer release still satisfies the existing constraint (`rangeStrategy: bump`), matching Dependabot behavior so lockfile-only bumps no longer skip manifest updates and downstream changelog tooling can see a published change. > > A **peer-only override** sets `rangeStrategy: widen` for `peerDependencies`, undoing the global bump so wide peer ranges stay broadened instead of tightened. > > **Note:** This is meant to work with the changelog repair workflow in MetaMask#10322; without that, Renovate PRs may fail `Check changelog`. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 9ab221a. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>

metamask-ci Bot requested a review from a team as a code owner September 21, 2026 15:14

metamask-ci Bot deployed to default-branch September 21, 2026 15:14 Active

fix(deps): update dependency execa to v10

01e5b27

metamask-ci Bot force-pushed the renovate/execa-10.x branch from e6922dc to 01e5b27 Compare September 21, 2026 15:16

This was referenced Sep 21, 2026

fix: repair Renovate pull requests too #10322

Merged

feat: bump dependency ranges in Renovate pull requests #10323

Merged

cryptodev-2s closed this Sep 21, 2026

Navigation Menu

Repository navigation

fix(deps): update dependency execa to v10 - #10320

fix(deps): update dependency execa to v10#10320
metamask-ci[bot] wants to merge 1 commit into
mainfrom
renovate/execa-10.x

metamask-ci Bot commented Sep 21, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Sep 21, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Sep 21, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

metamask-ci Bot commented Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Breaking

Improvements

Fixes

Bug fixes

Bug fixes

Features

Bug fixes

Features

Bug fixes

Documentation

Bugs

Bugs (types)

Documentation

Features

Deprecations

Features

Types

Bug fixes

Features (types)

Bug fixes (types)

Bug fixes (types)

Breaking changes (not types)

Features

Execution

Text lines

Piping multiple subprocesses

Input/output

Streams

Verbose mode

Debugging

Errors

Termination

Node.js files

Synchronous execution

Inter-process communication

Input validation

Bug fixes

Configuration

Uh oh!

socket-security Bot commented Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

metamask-ci Bot commented Sep 21, 2026 •

edited

Loading

socket-security Bot commented Sep 21, 2026 •

edited

Loading

socket-security Bot commented Sep 21, 2026 •

edited

Loading