Error running serverless-webpack on Windows with latest Node LTS due to security update

[massimocode]

This is a Bug Report (TLDR at end)

Description

For bug reports:

• What went wrong? Can't run serverless-webpack on latest LTS Node due to a breaking change in a security update. See: Command run failed with error : spawn EINVAL nodejs/node#52554
• What did you expect should have happened? Should run fine
• What was the config you used? Doesn't matter
• What stacktrace or error message from your provider did you see?

× Stack api-dev failed to deploy (12s)
Environment: win32, node 20.13.1, framework 3.38.0 (local), plugin 7.2.3, SDK 4.5.1
Credentials: Local, "default" profile
Docs:        docs.serverless.com
Support:     forum.serverless.com
Bugs:        github.com/serverless/serverless/issues

Error:
Error: spawn EINVAL
    at ChildProcess.spawn (node:internal/child_process:421:11)
    at Object.spawn (node:child_process:761:9)
    at childProcess.spawn (C:\REDACTED\api\node_modules\cli-progress-footer\lib\private\cli-progress-footer\disable-props.js:73:50)
    at C:\REDACTED\api\node_modules\serverless-webpack\lib\utils.js:73:32
    at Promise._execute (C:\REDACTED\api\node_modules\bluebird\js\release\debuggability.js:384:9)
    at Promise._resolveFromExecutor (C:\REDACTED\api\node_modules\bluebird\js\release\promise.js:518:18)
    at new Promise (C:\REDACTED\api\node_modules\bluebird\js\release\promise.js:103:10)
    at Object.spawnProcess (C:\REDACTED\api\node_modules\serverless-webpack\lib\utils.js:72:10)
    at NPM.install (C:\REDACTED\api\node_modules\serverless-webpack\lib\packagers\npm.js:143:18)
    at C:\REDACTED\api\node_modules\serverless-webpack\lib\packExternalModules.js:404:20
    at tryCatcher (C:\REDACTED\api\node_modules\bluebird\js\release\util.js:16:23)
    at Promise._settlePromiseFromHandler (C:\REDACTED\api\node_modules\bluebird\js\release\promise.js:547:31)
    at Promise._settlePromise (C:\REDACTED\api\node_modules\bluebird\js\release\promise.js:604:18)
    at Promise._settlePromise0 (C:\REDACTED\api\node_modules\bluebird\js\release\promise.js:649:10)
    at Promise._settlePromises (C:\REDACTED\api\node_modules\bluebird\js\release\promise.js:729:18)
    at _drainQueueStep (C:\REDACTED\api\node_modules\bluebird\js\release\async.js:93:12)
    at _drainQueue (C:\REDACTED\api\node_modules\bluebird\js\release\async.js:86:9)
    at Async._drainQueues (C:\REDACTED\api\node_modules\bluebird\js\release\async.js:102:5)
    at Async.drainQueues [as _onImmediate] (C:\REDACTED\api\node_modules\bluebird\js\release\async.js:15:14)
    at process.processImmediate (node:internal/timers:478:21)

Similar or dependent issue(s):
nodejs/node#52554
serverless/serverless#12434
medikoo/cli-progress-footer#2

Additional Data

• Serverless-Webpack Version you're using: 5.13.0
• Webpack version you're using: 5.91.0
• Serverless Framework Version you're using: 3.38.0
• Operating System: Windows 10 x64
• Stack Trace (if available): Already provided above

TLDR - It's a quick fix

Basically, Node team stopped allowing .cmd files to be spawned for security reasons. They can still be spawned if the shell: true option is provided. I don't think this is a bug in cli-progress-loader, as it has no idea what command is being executed. The passing of this parameter should probably be the responsibility of serverless-webpack as it's this library that is the one deciding to spawn the .cmd file.

For now I'm going to downgrade my Node version and proceed with life, but I've done the investigation, if one of the regular maintainers are happy to pick this up that would be great for the community.

It seem to be a case of just inserting { shell: true } as an option in these places:

[j0k3r]

Good catch, I'll see what can I do

[j0k3r]

@massimocode it should be fixed in 5.14.0, thanks