fix: _termui_impl.open_url() — 'start' on Windows is a cmd built-in, not an executable

CHANGES.rst

@@ -42,6 +42,9 @@ Unreleased
     passed directly to readline instead of being printed separately, allowing
     proper backspace, line editing, and line wrapping behavior. :issue:`2968`
     :pr:`2969`
+-   Use :func:`os.startfile` on Windows to open URLs in :func:`open_url`,
+    replacing the ``start`` built-in which cannot be invoked without
+    ``shell=True``. :issue:`3164` :pr:`3186`
 
 Version 8.3.3
 -------------

src/click/_termui_impl.py

@@ -720,17 +720,16 @@ def _unquote_file(url: str) -> str:
         if locate:
             url = _unquote_file(url)
             args = ["explorer", f"/select,{url}"]
+            try:
+                return subprocess.call(args)
+            except OSError:
+                return 127
         else:
-            args = ["start"]
-            if wait:
-                args.append("/WAIT")
-            args.append("")
-            args.append(url)
-        try:
-            return subprocess.call(args)
-        except OSError:
-            # Command not found
-            return 127
+            try:
+                os.startfile(url)  # type: ignore[attr-defined]
+            except OSError:
+                return 127
+            return 0
     elif CYGWIN:
         if locate:
             url = _unquote_file(url)