Shell escape restricted by default in TeX Live 2022

Answer

Do not enable shell escape globally for shared templates. Assume restricted mode is permanent and treat shell escape as an opt-in, per-invocation capability for trusted builds only. There is no stable per-project TeX configuration that enables shell escape without changing the engine invocation.

Confirmed facts

• TeX Live 2022 changed the default invocation for pdftex, xetex and luatex to run with shell escape disabled unless --shell-escape is explicitly passed.
• \write18 calls are silently ignored when restricted, so documents compile but external steps are missing.
• The engine does not provide a .texrc or project file mechanism to enable shell escape; the flag must be supplied at engine start.
• Maintainers have not committed to restoring a permissive default.

Likely explanation for your symptoms

After upgrading from TeX Live 2021 or earlier, documents that relied on \write18 now compile without error but produce incomplete output because the external commands are no longer executed.

Steps for this case

1. Assume restricted mode permanently for template design. Prefer removing \write18 dependence. If external tools are required, document the explicit flag requirement in the template README.
2. Enable shell escape only for trusted documents, enforced at the orchestration layer, not in TeX source:

• Trusted, centrally controlled source: pass --shell-escape in the specific build command or CI job for that project.
• Untrusted or multi-user source: never pass --shell-escape. Use restricted mode only.

Enforcement in a shared build environment is done outside TeX:

• Separate pipelines for trusted vs untrusted builds.
• Run builds as an unprivileged user and/or in isolated containers if --shell-escape must be used.
• Avoid environment variables or wrapper scripts that enable shell escape globally; they reintroduce arbitrary code execution risk for all jobs.

Verification

pdflatex --version

Create test.tex with \write18{touch shell_test.txt} and run pdflatex test.tex. If shell_test.txt is not created, restriction is active. Run pdflatex --shell-escape test.tex to confirm the flag restores functionality.

Missing diagnostic that changes recommendation: Are these templates compiled in a multi-tenant environment where users can upload their own .tex files, or is the source controlled by a central authority?