From 9845f6456dbf3d8b5f81a7b65511c8fd7d27b935 Mon Sep 17 00:00:00 2001
From: Ragunandhan Mahadevan <mragunandhan24@github.com>
Date: Tue, 20 Jan 2026 09:41:41 -0800
Subject: [PATCH 1/2] fix: show a warning when a delimiter is present in the
 path

---
 lib/set-path.js         |  8 ++++++++
 test/make-spawn-args.js | 38 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 46 insertions(+)

diff --git a/lib/set-path.js b/lib/set-path.js
index c59c270..0344cc0 100644
--- a/lib/set-path.js
+++ b/lib/set-path.js
@@ -1,3 +1,4 @@
+const { log } = require('proc-log')
 const { resolve, dirname, delimiter } = require('path')
 // the path here is relative, even though it does not need to be
 // in order to make the posix tests pass in windows
@@ -14,6 +15,13 @@ const setPATH = (projectPath, binPaths, env) => {
 
   const pathArr = []
   if (binPaths) {
+    for (const bin of binPaths) {
+      if (bin.includes(delimiter)) {
+        const event = env.npm_lifecycle_event
+        const context = event ? `"${event}" script` : 'script execution'
+        log.warn('run-script', `Path contains delimiter ("${delimiter}"), ${context} may not behave as expected.`)
+      }
+    }
     pathArr.push(...binPaths)
   }
   // unshift the ./node_modules/.bin from every folder
diff --git a/test/make-spawn-args.js b/test/make-spawn-args.js
index 110f28f..036f66f 100644
--- a/test/make-spawn-args.js
+++ b/test/make-spawn-args.js
@@ -1,5 +1,7 @@
 const t = require('tap')
 const spawk = require('spawk')
+const { delimiter } = require('node:path')
+const setPATH = require('../lib/set-path.js')
 const runScript = require('..')
 
 const pkg = {
@@ -141,4 +143,40 @@ t.test('spawn args', async t => {
     }))
     t.ok(spawk.done())
   })
+
+  await t.test('binPaths containing delimiter logs warning', async t => {
+    const warnings = []
+    const onWarn = (...args) => warnings.push(args)
+    process.on('log', onWarn)
+    t.teardown(() => process.off('log', onWarn))
+
+    spawk.spawn(
+      /.*/,
+      false,
+      e => (e.env.PATH || e.env.Path).includes(`/path/with${delimiter}delimiter`)
+    )
+    await t.resolves(() => runScript({
+      pkg,
+      binPaths: [`/path/with${delimiter}delimiter`],
+      path: testdir,
+      event: 'test',
+    }))
+    const warning = warnings.find(w => w[0] === 'warn' && w[1] === 'run-script' && w[2].includes('delimiter'))
+    t.ok(warning, 'warning should be logged when binPath contains delimiter')
+    t.match(warning[2], '"test" script')
+    t.ok(spawk.done())
+  })
+
+  await t.test('binPaths containing delimiter uses generic message without event', async t => {
+    const warnings = []
+    const onWarn = (...args) => warnings.push(args)
+    process.on('log', onWarn)
+    t.teardown(() => process.off('log', onWarn))
+
+    setPATH(testdir, [`/path/with${delimiter}delimiter`], {})
+
+    const warning = warnings.find(w => w[0] === 'warn' && w[1] === 'run-script' && w[2].includes('delimiter'))
+    t.ok(warning, 'warning should be logged with generic message when no event')
+    t.match(warning[2], 'script execution')
+  })
 })

From 2499504fc1693364e400127296bac4f3a03205c5 Mon Sep 17 00:00:00 2001
From: Michael Smith <owlstronaut@github.com>
Date: Thu, 26 Feb 2026 08:43:05 -0800
Subject: [PATCH 2/2] chore: template-oss-apply

---
 .github/workflows/ci-release.yml | 10 +++++-----
 .github/workflows/ci.yml         | 10 +++++-----
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/ci-release.yml b/.github/workflows/ci-release.yml
index e9ab5ff..3f01e20 100644
--- a/.github/workflows/ci-release.yml
+++ b/.github/workflows/ci-release.yml
@@ -85,7 +85,7 @@ jobs:
             os: macos-latest
             shell: bash
           - name: macOS
-            os: macos-13
+            os: macos-15-intel
             shell: bash
           - name: Windows
             os: windows-latest
@@ -96,13 +96,13 @@ jobs:
           - 22.9.0
           - 22.x
         exclude:
-          - platform: { name: macOS, os: macos-13, shell: bash }
+          - platform: { name: macOS, os: macos-15-intel, shell: bash }
             node-version: 20.17.0
-          - platform: { name: macOS, os: macos-13, shell: bash }
+          - platform: { name: macOS, os: macos-15-intel, shell: bash }
             node-version: 20.x
-          - platform: { name: macOS, os: macos-13, shell: bash }
+          - platform: { name: macOS, os: macos-15-intel, shell: bash }
             node-version: 22.9.0
-          - platform: { name: macOS, os: macos-13, shell: bash }
+          - platform: { name: macOS, os: macos-15-intel, shell: bash }
             node-version: 22.x
     runs-on: ${{ matrix.platform.os }}
     defaults:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 92a33b5..07a869f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -61,7 +61,7 @@ jobs:
             os: macos-latest
             shell: bash
           - name: macOS
-            os: macos-13
+            os: macos-15-intel
             shell: bash
           - name: Windows
             os: windows-latest
@@ -72,13 +72,13 @@ jobs:
           - 22.9.0
           - 22.x
         exclude:
-          - platform: { name: macOS, os: macos-13, shell: bash }
+          - platform: { name: macOS, os: macos-15-intel, shell: bash }
             node-version: 20.17.0
-          - platform: { name: macOS, os: macos-13, shell: bash }
+          - platform: { name: macOS, os: macos-15-intel, shell: bash }
             node-version: 20.x
-          - platform: { name: macOS, os: macos-13, shell: bash }
+          - platform: { name: macOS, os: macos-15-intel, shell: bash }
             node-version: 22.9.0
-          - platform: { name: macOS, os: macos-13, shell: bash }
+          - platform: { name: macOS, os: macos-15-intel, shell: bash }
             node-version: 22.x
     runs-on: ${{ matrix.platform.os }}
     defaults: