typed-cli icon indicating copy to clipboard operation
typed-cli copied to clipboard

yargs-parser security update

Open jamie-pate opened this issue 3 years ago • 1 comments

npm audit is now complaining about a security advisory in the 14.0.0 version of yargs-parser... seems like the fix is to upgrade to >= 15.0.1: https://github.com/advisories/GHSA-p9pc-299p-vxgp

BREAKING CHANGES rework collect-unknown-options into unknown-options-as-args, providing more comprehensive functionality

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Prototype Pollution in yargs-parser                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ yargs-parser                                                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=15.0.1                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ typed-cli                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ typed-cli > yargs-parser                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://github.com/advisories/GHSA-p9pc-299p-vxgp            │
└───────────────┴──────────────────────────────────────────────────────────────┘

jamie-pate avatar Nov 23 '21 22:11 jamie-pate

@jamie-pate can you provide full steps to reproduce this output?

My npm audit tells about some other moderate stuff.

From what I can tell typed-cli depends on 20+ version of yargs-parser: https://github.com/int0h/typed-cli/blob/master/package.json#L30

If you want you can try to upgrade the deps yourself and submit a PR. If it's going to be only deps update and it passes the tests I'll merge it.

int0h avatar Dec 03 '21 16:12 int0h