server-studio 1.2.3 → 1.2.4

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 Notable changes to Server Studio. Dates are release dates.
 
+## 1.2.4 — 2026-08-30
+
+- **Fixed:** on Windows, stopping a server could kill an unrelated process. The port was matched
+  with `findstr :5173`, which also matches `0.0.0.0:51730`, so a longer port sharing the prefix was
+  caught too. Reported and patched by @anupamme in #1.
+- `killPort` no longer builds a shell command at all, on any platform. The port was already
+  sanitised by `Number()`, so this is hardening rather than a fix.
+
 ## 1.2.3 — 2026-08-30
 
 - The badge shown after an update now says **quit & reopen** rather than "restart to finish".

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "server-studio",
-  "version": "1.2.3",
+  "version": "1.2.4",
   "description": "A tiny dashboard for your local dev servers. One click to run, stop and open them, with one permanent port per project.",
   "author": "Md Mahdi Hasan",
   "license": "MIT",

package/src/platform.js

@@ -4,7 +4,7 @@
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
-const { execFile, exec } = require('child_process');
+const { execFile } = require('child_process');
 
 const WIN = process.platform === 'win32';
 const MAC = process.platform === 'darwin';
@@ -86,15 +86,21 @@ function killPort(port, cb) {
   if (!p) return cb(new Error('bad port'));
   if (WIN) {
     // netstat lists the owning PID in the last column of LISTENING rows.
-    return exec('netstat -ano -p tcp | findstr LISTENING | findstr :' + p, (err, stdout) => {
+    // execFile (no shell) avoids ever building a shell command string from `port`.
+    return execFile('netstat', ['-ano', '-p', 'tcp'], (err, stdout) => {
       const pids = new Set(String(stdout || '').trim().split(/\r?\n/)
+        .filter(l => /LISTENING/.test(l) && l.includes(':' + p + ' '))
         .map(l => l.trim().split(/\s+/).pop())
         .filter(x => /^\d+$/.test(x) && x !== '0'));
       if (!pids.size) return cb(null);
-      exec([...pids].map(id => 'taskkill /PID ' + id + ' /T /F').join(' & '), () => cb(null));
+      execFile('taskkill', ['/T', '/F', ...[...pids].flatMap(id => ['/PID', id])], () => cb(null));
     });
   }
-  return exec('lsof -nti tcp:' + p + ' | xargs kill 2>/dev/null', () => cb(null));
+  return execFile('lsof', ['-nti', 'tcp:' + p], (err, stdout) => {
+    const pids = String(stdout || '').trim().split(/\r?\n/).filter(Boolean);
+    if (!pids.length) return cb(null);
+    execFile('kill', pids, () => cb(null));
+  });
 }
 
 /* ---------- native "choose a folder" dialog ---------- */