Skip to content

fix: _termui_impl.open_url() — 'start' on Windows is a cmd built-in, not an executable#3186

Open
karpierz wants to merge 1 commit intopallets:stablefrom
karpierz:fixes_for_windows
Open

fix: _termui_impl.open_url() — 'start' on Windows is a cmd built-in, not an executable#3186
karpierz wants to merge 1 commit intopallets:stablefrom
karpierz:fixes_for_windows

Conversation

@karpierz
Copy link
Copy Markdown

fix: _termui_impl.open_url() — 'start' on Windows is a cmd built-in command, not an executable

@davidism davidism linked an issue Jan 27, 2026 that may be closed by this pull request
@kdeldycke kdeldycke changed the base branch from main to stable April 16, 2026 09:34
@kdeldycke kdeldycke changed the title fix: _termui_impl.open_url() — 'start' on Windows is a cmd built-in, not an executable fix: _termui_impl.open_url() — 'start' on Windows is a cmd built-in, not an executable Apr 21, 2026
@kdeldycke kdeldycke added bug windows Issues pertaining to the Windows environment security Pull requests that address a security vulnerability labels Apr 21, 2026
@kdeldycke
Copy link
Copy Markdown
Collaborator

shell=True has been eliminated entirely in Click code base with #3245. So there is no reason to re-introduce it. Can you give use more details about the reason we need this?

@kdeldycke kdeldycke added this to the 8.4.0 milestone Apr 21, 2026
@kdeldycke
Copy link
Copy Markdown
Collaborator

kdeldycke commented Apr 21, 2026

OK got it. Click code is broken on Windows because start is a cmd.exe built-in, not a standalone executable. So without a shell=True the subprocess.call will fail. So that's a legitimate bug report.

But there is a better fix. Instead of re-introducing shell=True, we can use os.startfile().

Closes pallets#3164

Co-Authored-By: Adam Karpierz <akarpierz@gmail.com>
@kdeldycke
Copy link
Copy Markdown
Collaborator

I just re-implemented the fix. This PR is ready to be merged in the next devlopment cycle of Click.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug security Pull requests that address a security vulnerability windows Issues pertaining to the Windows environment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

click.launch() does not work for (non local) urls on Windows

2 participants