From 2e474b442fa86e81411b75cf5b57516dc0891492 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jo=C3=A3o=20Moreno?= <joao.moreno@microsoft.com>
Date: Wed, 13 Sep 2023 15:52:15 +0100
Subject: [PATCH] use execFile instead of exec (#898)

* use execFile instead of exec

* fix for windows
---
 src/package.ts | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/package.ts b/src/package.ts
index 15aeb02f..eebf97ec 100644
--- a/src/package.ts
+++ b/src/package.ts
@@ -381,18 +381,18 @@ export async function versionBump(options: IVersionBumpOptions): Promise<void> {
 			}
 	}
 
-	let command = `npm version ${options.version}`; // CodeQL [SM03609] options.version is checked above.
+	// call `npm version` to do our dirty work
+	const args = ['version', options.version];
 
 	if (options.commitMessage) {
-		command = `${command} -m "${options.commitMessage.replace(/"/g, '')}"`;
+		args.push('-m', options.commitMessage);
 	}
 
 	if (!(options.gitTagVersion ?? true)) {
-		command = `${command} --no-git-tag-version`;
+		args.push('--no-git-tag-version');
 	}
 
-	// call `npm version` to do our dirty work
-	const { stdout, stderr } = await promisify(cp.exec)(command, { cwd });
+	const { stdout, stderr } = await promisify(cp.execFile)(process.platform === 'win32' ? 'npm.cmd' : 'npm', args, { cwd });
 
 	if (!process.env['VSCE_TESTS']) {
 		process.stdout.write(stdout);