cli
cli copied to clipboard
Upgrade ora in cli-types
Description
ora version 3 pulls in a vulnerable version of strip-ansi (v4).
https://github.com/react-native-community/cli/blob/master/packages/cli-types/package.json#L9
This dependency is fixed in ora version 6: https://github.com/sindresorhus/ora/commit/090860b50257f75f02dd5cd76b76025ca95311f0
Note that ora is used in all of cli, cli-types and platform-ios.
I looked at upgrading it in cli, but it seems the ora.Ora
class used here is no longer exported, so I'm not sure how that should be solved (I'm not that experienced with the Node ecosystem/TypeScript). If anyone has a pointer how that should be done, I'm happy to try and fix that.
I believe I've fixed most of that here, but I still have a few test failures to figure out: https://github.com/react-native-community/cli/pull/1522
Fixed with #1522
There hasn't been any activity on this issue in the past 3 months, so it has been marked as stale and it will be closed automatically if no further activity occurs in the next 7 days.