fix(react-email): nodejs 25 warning about argument concatenation

[gabrielmfern]

I've been trying to use Node.js 25 and I've noticed that every time I used the email-dev script, there was a warning:

(node:93213) [DEP0190] DeprecationWarning: Passing args to a child process with shell option true can lead to security vulnerabilities, as the arguments are not escaped, only concatenated.
    at normalizeSpawnArguments (node:child_process:644:15)
    at Object.spawn (node:child_process:789:13)
    at .../react-email/packages/react-email/dev/index.js:12:27
    at ModuleJob.run (node:internal/modules/esm/module_job:377:25)
    at async onImport.tracePromise.__proto__ (node:internal/modules/esm/loader:671:26)
    at async asyncRunEntryPointWithESMLoader (node:internal/modules/run_main:101:5) 

This is referring to:

react-email/packages/react-email/dev/index.js

Lines 12 to 16 in 30724df

	const tsx = child_process.spawn(tsxPath, [root, ...process.argv.slice(2)], {
	shell: true,
	cwd: process.cwd(),
	stdio: 'inherit',
	});

Which is using shell: true here, and which causes the warning. In this specific use case, we can simply remove shell: true since we're using the direct path to the binary and aren't using any shell specific features.

---

Summary by cubic

Removed shell: true from the react-email dev script to stop the Node.js 25 DEP0190 warning and avoid unsafe argument concatenation. We now spawn tsx directly via its path; no shell features are needed.

^{Written for commit 5cbab69. Summary will update automatically on new commits.}

[changeset-bot]

⚠️ No Changeset found

Latest commit: 5cbab69

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
react-email	Ready	Preview	Comment	Nov 4, 2025 4:54pm
react-email-demo	Ready	Preview	Comment	Nov 4, 2025 4:54pm

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/resend/react-email@2642

commit: 5cbab69

[cubic-dev-ai]

No issues found across 1 file