Failed to create project due to null value of "global-modules-path"

[flik1337]

Node.js v20.16.0 npm v10.8.1

When I tried to create a new project using: static new blog --aria The error log shows:

D:\workspace\js>static new blog --aria
New setup initialized
Downloading aria template
Finished downloading template
Extracting template zip file
Finished unzipping
New site available inside blog folder
spawnSync npm.cmd EINVAL
node:internal/modules/cjs/loader:1148
  throw err;
  ^

Error: Cannot find module 'null/src/dev.js'
Require stack:
- C:\Users\flik\AppData\Roaming\npm\node_modules\@devdojo\static\src\new.js
- C:\Users\flik\AppData\Roaming\npm\node_modules\@devdojo\static\bin\static
    at Module._resolveFilename (node:internal/modules/cjs/loader:1145:15)
    at Module._load (node:internal/modules/cjs/loader:986:27)
    at Module.require (node:internal/modules/cjs/loader:1233:19)
    at require (node:internal/modules/helpers:179:18)
    at C:\Users\flik\AppData\Roaming\npm\node_modules\@devdojo\static\src\new.js:50:37
    at next (C:\Users\flik\AppData\Roaming\npm\node_modules\@devdojo\static\node_modules\rimraf\rimraf.js:72:7)
    at CB (C:\Users\flik\AppData\Roaming\npm\node_modules\@devdojo\static\node_modules\rimraf\rimraf.js:108:9)
    at FSReqCallback.oncomplete (node:fs:187:23) {
  code: 'MODULE_NOT_FOUND',
  requireStack: [
    'C:\\Users\\flik\\AppData\\Roaming\\npm\\node_modules\\@devdojo\\static\\src\\new.js',
    'C:\\Users\\flik\\AppData\\Roaming\\npm\\node_modules\\@devdojo\\static\\bin\\static'
  ]
}

Then I modified the new.js to log the output of the getPath function to see what it returns:

const path = require("global-modules-path").getPath("@devdojo/static");
console.log('Module path:', path); 

The output of Module path is null.

I've reinstall the global-modules-path,but it's still not working. I can only temporarily manually assign the devServer path to solve this problem.

[SQLkiwi]

The issue is caused by the April 2024 Node.js security update Command injection via args parameter of child_process.spawn without shell option enabled on Windows (CVE-2024-27980).

It is important to note that there has been a breaking change for Windows users who utilize child_process.spawn and child_process.spawnSync. Node.js will now error with EINVAL if a .bat or .cmd file is passed to child_process.spawn and child_process.spawnSync without the shell option set. If the input to spawn/spawnSync is sanitized, users can now pass { shell: true } as an option to prevent the occurrence of EINVALs errors.

The package global-modules-path has not been updated to account for this, so it returns null.

For now, hardcoding the path as you have done is a reasonable workaround.