Update for Node.js CVE-2024-27980

[SQLkiwi]

Please update in light of the April 2024 Node.js security patch Command injection via args parameter of child_process.spawn without shell option enabled on Windows (CVE-2024-27980).

It is important to note that there has been a breaking change for Windows users who utilize child_process.spawn and child_process.spawnSync. Node.js will now error with EINVAL if a .bat or .cmd file is passed to child_process.spawn and child_process.spawnSync without the shell option set. If the input to spawn/spawnSync is sanitized, users can now pass { shell: true } as an option to prevent the occurrence of EINVALs errors.

Until {shell: true} is passed as an option, the childProcess.spawnSync call in index.js will encounter error EINVAL and return null.