pnpm/setup prints deprecation warnings with Node.js 24 on GitHub actions

[ludofischer]

The GitHub action logs show these lines after the Running pnpm install --no-runtime.. step:

[DEP0190] DeprecationWarning: Passing args to a child process with shell option true can lead to security vulnerabilities, as the arguments are not escaped, only concatenated.

Ideally, using the pnpm/setup action should not cause warnings to be printed.

Version pnpm/setup 2.0.0

[kirillgroshkov]

Still reproducible with v2.1.0 on the Node 24 runner, in both the main step (pnpm install) and the post step (pnpm store prune).

The warning comes from the two remaining spawnSync('pnpm', args, { shell: true }) call sites:

• src/pnpm-install/index.ts
• src/pnpm-store-prune/index.ts

Node 24 deprecates passing an args array together with shell: true (DEP0190), because the args are concatenated into the shell command rather than escaped.

Proposed fix: drop the shell and let @actions/exec resolve pnpm on PATH. It is already a dependency (used in cache-restore and lockfile-verification-cache), it handles the Windows .cmd shim without shell: true, and it keeps the property the comment in pnpm-install relies on: $PNPM_HOME/bin is first on PATH, so a self-updated pnpm still resolves.

import { exec } from '@actions/exec'

// pnpm-install/index.ts (runPnpmInstall becomes async; runMain already awaits around it)
const status = await exec('pnpm', args, { cwd: workingDirectory, ignoreReturnCode: true })
if (status !== 0) {
  setFailed(`${command} exited with status ${status}`)
}

// pnpm-store-prune/index.ts
const status = await exec('pnpm', ['store', 'prune'], { ignoreReturnCode: true })

exec inherits stdio by default, so the log output stays the same, and a non-zero exit surfaces as the return value instead of a throw with ignoreReturnCode.

The alternative that needs no new import is what install-runtime already does: spawn the executable by path (path.join(binDest, process.platform === 'win32' ? 'pnpm.exe' : 'pnpm')) with no shell. That would bypass a self-updated pnpm in $PNPM_HOME/bin, so @actions/exec looks like the better fit.