Minimist dependent package vulnerability due to older version usage

[vishwas16]

Hi,

We are using commitizen package in our microservice api. As we know commitizen has a dependency on minimist package and it shows us a vulnerablility during our docker image scan.

Could you guys please update your package to a newer version or may be upgrade the minimist package to it's fixed version which is 1.2.6?

Hope to see the resolution soon on this issue. Thanks !

[vadim-shilov]

Hello,

The same problem! npm audit defines this vulnerability as critical and blocks CI.

Looking forward to the fix :)

Thanks!

[HeartSquared]

Looks like the package.json shows that the upgrade has been done, but we're just lacking a release 🙏🏻

[iiLearner]

Hopefully this gets looked into asap

[ryansonshine]

I wouldn't count on a release anytime soon; see https://github.com/commitizen/cz-cli/issues/914#issuecomment-1131383383 for more details.

[Zhengqbbb]

We're just lacking a release 🤯

[kdmcguire]

I believe this is fixed in the new release, 4.2.5.

[sawilde]

I note that your renovate bot has updated the minimist package to 1.2.7 do you know when we may see a release?

I would suggest that you allow "dependencies" to be updateable using "^x.x.x" syntax rather than pinning them thus allowing consumers of this package to take security updates without having to wait on yourselves.