From 7df18dd94016e3393bad6dc81488188494713185 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Sat, 14 Mar 2026 11:01:01 +0100
Subject: [PATCH 1/2] doc: clarify that any truthy value of `shell` is part of
 DEP0190

---
 doc/api/deprecations.md | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/doc/api/deprecations.md b/doc/api/deprecations.md
index 892ecb9f2b4fc6..793cdebec36391 100644
--- a/doc/api/deprecations.md
+++ b/doc/api/deprecations.md
@@ -4175,7 +4175,7 @@ Type: Documentation-only
 `process.features.tls_alpn`, `process.features.tls_ocsp`, and `process.features.tls_sni` are
 deprecated, as their values are guaranteed to be identical to that of `process.features.tls`.
 
-### DEP0190: Passing `args` to `node:child_process` `execFile`/`spawn` with `shell` option `true`
+### DEP0190: Passing `args` to `node:child_process` `execFile`/`spawn` with `shell` option
 
 <!-- YAML
 changes:
@@ -4192,7 +4192,8 @@ changes:
 Type: Runtime
 
 When an `args` array is passed to [`child_process.execFile`][] or [`child_process.spawn`][] with the option
-`{ shell: true }`, the values are not escaped, only space-separated, which can lead to shell injection.
+`{ shell: true }` or `{ shell: '/bin/zsh' }`, the values are not escaped, only space-separated,
+which can lead to shell injection.
 
 ### DEP0191: `repl.builtinModules`
 

From dbe55c44417659cec2025113bacb9c89e7534b03 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Sat, 14 Mar 2026 11:54:12 +0100
Subject: [PATCH 2/2] Update doc/api/deprecations.md
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: René <contact.9a5d6388@renegade334.me.uk>
---
 doc/api/deprecations.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/api/deprecations.md b/doc/api/deprecations.md
index 793cdebec36391..cf1c3bba887d90 100644
--- a/doc/api/deprecations.md
+++ b/doc/api/deprecations.md
@@ -4192,7 +4192,7 @@ changes:
 Type: Runtime
 
 When an `args` array is passed to [`child_process.execFile`][] or [`child_process.spawn`][] with the option
-`{ shell: true }` or `{ shell: '/bin/zsh' }`, the values are not escaped, only space-separated,
+`{ shell: true }` or `{ shell: '/path/to/shell' }`, the values are not escaped, only space-separated,
 which can lead to shell injection.
 
 ### DEP0191: `repl.builtinModules`