microsoft/rushstack

[rush] Latest Node LTS security patch for spawnSync breaks rush on Windows

ben-polinsky opened this issue · 1 comments

Summary

While running a build in CI, noticed rush failed on install/check. After debugging we see that spawnSync returns a status of EINVAL or invalid argument. That led us to https://nodejs.org/en/blog/release/v20.12.2. After downgrading to node v20.12.1, rush works as intended. This is also the case for node v18 LTS as it received the same patch. This can be reproduced locally on a windows machine.

Repro steps

(I don't have a windows box handy, so this is an estimate)

  • On windows machine create a rush project using node v20.12.2.
  • Setup a project with some dependencies.
  • Attempt to install dependencies through rush with install-run-rush.js script.
Question Answer
@microsoft/rush globally installed version? 5.120.0, but fails with at least 5.112.x as well
rushVersion from rush.json? 5.120.0, but fails with at least 5.112.x as well
useWorkspaces from rush.json? true in pnpm-config.json
Operating system? Windows
Would you consider contributing a PR? Yes, but have not begun to investigate. Just trying to get our builds through for now.
Node.js version (node -v)? 20.12.2; 18.20.1

node-red fix for same issue: node-red/node-red#4652