fix(lambda-nodejs): use direct spawn for local bundling by Abogical · Pull Request #37292 · aws/aws-cdk

Abogical · 2026-03-19T16:09:07Z

Reason for this change

The local bundling path builds a single shell command string and executes it via spawnSync("bash", ["-c", command]). User-controlled bundling properties are interpolated into this string without sanitization. Using direct spawnSync with argument arrays is the idiomatic Node.js approach and avoids shell interpretation entirely.

Description of changes

Replace shell-based command execution in the local bundling path with direct spawnSync calls using argument arrays.

PackageManager.runBinCommand() returns string[] instead of a joined string. Docker-path callers use .join(" ").
New BundlingStep discriminated union type: shell (commandHooks), spawn (esbuild/tsc/install), fs (file operations).
createLocalBundlingSteps() builds the step sequence for local bundling using toCliArgsArray() and getTsconfigCompilerOptionsArray() (no shell quoting needed).
tryBundle() executes steps sequentially by type.
Docker bundling path's command is escaped, the default command relies on bash already existing so we can escape it with the bash syntax.
commandHooks remain shell-executed (user-provided by contract).

Describe any new or updated permissions being added

N/A

Description of how you validated changes

All 125 existing aws-lambda-nodejs tests pass (6 suites).
Updated Local bundling test to assert direct spawn calls.
Added 6 new tests: esbuild options via spawn, nodeModules with fs operations, commandHooks via shell, preCompilation with tsc spawn, shell metacharacter handling, and pnpm workspace/cleanup.
Full lerna run build --scope=aws-cdk-lib passes.
Locally created a stack comparing the docker and local asset output

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

### Issue # Closes cdklabs/cdk-ops#4931. ### Reason for this change The local bundling path builds a single shell command string and executes it via `spawnSync("bash", ["-c", command])`. User-controlled bundling properties are interpolated into this string without sanitization. Using direct `spawnSync` with argument arrays is the idiomatic Node.js approach and avoids shell interpretation entirely. ### Description of changes Replace shell-based command execution in the local bundling path with direct `spawnSync` calls using argument arrays. - `PackageManager.runBinCommand()` returns `string[]` instead of a joined string. Docker-path callers use `.join(" ")`. - New `BundlingStep` discriminated union type: `shell` (commandHooks), `spawn` (esbuild/tsc/install), `fs` (file operations). - `createLocalBundlingSteps()` builds the step sequence for local bundling using `toCliArgsArray()` and `getTsconfigCompilerOptionsArray()` (no shell quoting needed). - `tryBundle()` executes steps sequentially by type. - Docker bundling path is completely unchanged. - `commandHooks` remain shell-executed (user-provided by contract). ### Describe any new or updated permissions being added N/A ### Description of how you validated changes - All 125 existing aws-lambda-nodejs tests pass (6 suites). - Updated `Local bundling` test to assert direct spawn calls. - Added 6 new tests: esbuild options via spawn, nodeModules with fs operations, commandHooks via shell, preCompilation with tsc spawn, shell metacharacter handling, and pnpm workspace/cleanup. - Full `lerna run build --scope=aws-cdk-lib` passes. ### Checklist - [x] My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES --- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

aws-cdk-automation

(This review is outdated)

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

packages/aws-cdk-lib/aws-lambda-nodejs/lib/bundling.ts

rix0rrr · 2026-03-20T09:38:57Z

packages/aws-cdk-lib/aws-lambda-nodejs/lib/bundling.ts

+            case 'shell':
+              for (const cmd of step.commands) {
+                exec(
+                  osPlatform === 'win32' ? 'cmd' : 'bash',


Technically speaking you should use process.env.COMSPEC as your shell on Windows.

Added process.env.COMSPEC

rix0rrr · 2026-03-20T09:41:12Z

packages/aws-cdk-lib/aws-lambda-nodejs/lib/bundling.ts

+  /**
+   * Creates structured bundling steps for local execution via direct spawn (no shell).
+   */
+  private createLocalBundlingSteps(


This new function giatn is not matched by an equally giant function disappearing.

I would expect this to be a rewrite of something else?

The local bundling steps are different than the one using docker. So both functions will remain, one will not replace the other.

Oh. So we will have 2 functions like this:

function esBuildCommandForLocalExecution(): string[]; function esBuildCommandForDockerExecution(): string;

With mostly the same logic, but a different return type?

If that's true, then next time we add an option or make a change, we need to do it in 2 places?

I see, I'll deduplicate any common functions here.

Refactored the functions with deduplication.

rix0rrr · 2026-03-20T09:45:37Z

packages/aws-cdk-lib/aws-lambda-nodejs/lib/bundling.ts

+                exec(
+                  osPlatform === 'win32' ? 'cmd' : 'bash',
+                  [osPlatform === 'win32' ? '/c' : '-c', cmd],
+                  { ...execOptions, windowsVerbatimArguments: osPlatform === 'win32' },


No cwd here?

cwd is part of execOptions.

If so then it should also be part of execOptions in the "spawn" branch of the switch?

rix0rrr · 2026-03-20T09:46:03Z

packages/aws-cdk-lib/aws-lambda-nodejs/lib/bundling.ts

+                ...(step.cwd ? { cwd: step.cwd } : {}),
+              });
+              break;
+            case 'fs':


Suggested change

case 'fs':

case 'callback':

?

- Use getTsconfigCompilerOptionsArray in Docker path instead of naive string splitting to properly handle compiler option values with spaces - Wrap callback step operations with try-catch for contextual error messages during local bundling file operations - Add regression tests for Docker preCompilation tsconfig handling - Add test for callback failure error context - Add getTsconfigCompilerOptionsArray parity tests in util.test.ts - Remove unused getTsconfigCompilerOptions import from bundling.ts

mergify · 2026-03-25T09:34:26Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

mergify · 2026-03-25T09:34:38Z

mergify · 2026-03-25T10:17:05Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

github-actions · 2026-03-25T10:17:24Z

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

Abogical temporarily deployed to automation March 19, 2026 16:09 — with GitHub Actions Inactive

github-actions bot added the p2 label Mar 19, 2026

aws-cdk-automation requested a review from a team March 19, 2026 16:09

github-actions bot added the star-contributor [Pilot] contributed between 25-49 PRs to the CDK label Mar 19, 2026

Abogical temporarily deployed to automation March 19, 2026 16:09 — with GitHub Actions Inactive

mergify bot added the contribution/core This is a PR that came from AWS. label Mar 19, 2026

mergify bot temporarily deployed to automation March 19, 2026 16:10 Inactive

aws-cdk-automation previously requested changes Mar 19, 2026

View reviewed changes

aws-cdk-automation added the pr/needs-further-review PR requires additional review from our team specialists due to the scope or complexity of changes. label Mar 19, 2026

aws-cdk-automation temporarily deployed to automation March 19, 2026 16:37 — with GitHub Actions Inactive

Abogical changed the title ~~fix(aws-lambda-nodejs): use direct spawn for local bundling~~ fix(lambda-nodejs): use direct spawn for local bundling Mar 19, 2026

Abogical temporarily deployed to automation March 19, 2026 18:12 — with GitHub Actions Inactive

Abogical added the pr-linter/exemption-requested The contributor has requested an exemption to the PR Linter feedback. label Mar 19, 2026

Abogical temporarily deployed to automation March 19, 2026 18:12 — with GitHub Actions Inactive

Abogical removed the pr-linter/exemption-requested The contributor has requested an exemption to the PR Linter feedback. label Mar 19, 2026

Abogical temporarily deployed to automation March 19, 2026 18:12 — with GitHub Actions Inactive

Abogical temporarily deployed to automation March 19, 2026 18:13 — with GitHub Actions Inactive

Abogical added the pr-linter/exempt-integ-test The PR linter will not require integ test changes label Mar 19, 2026

Abogical temporarily deployed to automation March 19, 2026 18:13 — with GitHub Actions Inactive

aws-cdk-automation added the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Mar 19, 2026

aws-cdk-automation temporarily deployed to automation March 19, 2026 18:14 — with GitHub Actions Inactive

aws-cdk-automation temporarily deployed to automation March 19, 2026 18:15 — with GitHub Actions Inactive

rix0rrr reviewed Mar 20, 2026

View reviewed changes

address comments and fix arg parsing

8c2cbaf

aws-cdk-automation temporarily deployed to automation March 23, 2026 16:07 — with GitHub Actions Inactive

Abogical temporarily deployed to automation March 24, 2026 10:15 — with GitHub Actions Inactive

Abogical force-pushed the fix-bundling-cmd branch from b54e3bf to b5e8509 Compare March 24, 2026 10:35

Abogical temporarily deployed to automation March 24, 2026 10:35 — with GitHub Actions Inactive

Abogical force-pushed the fix-bundling-cmd branch from b5e8509 to d9444c0 Compare March 24, 2026 10:49

Abogical temporarily deployed to automation March 24, 2026 10:49 — with GitHub Actions Inactive

Abogical temporarily deployed to automation March 24, 2026 10:50 — with GitHub Actions Inactive

Abogical force-pushed the fix-bundling-cmd branch from d9444c0 to d84a5db Compare March 24, 2026 15:59

Abogical temporarily deployed to automation March 24, 2026 16:00 — with GitHub Actions Inactive

rix0rrr added the pr/do-not-merge This PR should not be merged at this time. label Mar 25, 2026

rix0rrr temporarily deployed to automation March 25, 2026 08:18 — with GitHub Actions Inactive

rix0rrr approved these changes Mar 25, 2026

View reviewed changes

rix0rrr temporarily deployed to automation March 25, 2026 08:18 — with GitHub Actions Inactive

aws-cdk-automation removed the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Mar 25, 2026

aws-cdk-automation temporarily deployed to automation March 25, 2026 08:20 — with GitHub Actions Inactive

Abogical removed the pr/do-not-merge This PR should not be merged at this time. label Mar 25, 2026

Abogical temporarily deployed to automation March 25, 2026 09:31 — with GitHub Actions Inactive

Merge branch 'main' into fix-bundling-cmd

4217431

mergify bot temporarily deployed to automation March 25, 2026 09:34 Inactive

mergify bot merged commit 9bf4263 into main Mar 25, 2026
18 of 19 checks passed

mergify bot deleted the fix-bundling-cmd branch March 25, 2026 10:17

Conversation

Abogical commented Mar 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reason for this change

Description of changes

Describe any new or updated permissions being added

Description of how you validated changes

Checklist

Uh oh!

aws-cdk-automation left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mergify bot commented Mar 25, 2026

Uh oh!

mergify bot commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merge Queue Status

Uh oh!

mergify bot commented Mar 25, 2026

Uh oh!

Uh oh!

github-actions bot commented Mar 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Abogical commented Mar 19, 2026 •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading

mergify bot commented Mar 25, 2026 •

edited

Loading