Skip to content

[Bug] Please upgrade yargs to resolve ansi-regex CVE #130

@thom-nic

Description

@thom-nic
  • I'd be willing to submit the fix

GHSA-93q8-gq69-wqmw

Describe the bug

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │  Inefficient Regular Expression Complexity in                │
│               │ chalk/ansi-regex                                             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ ansi-regex                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=4.1.1                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ mochapack [dev]                                              │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ mochapack > yargs > cliui > wrap-ansi > string-width >       │
│               │ strip-ansi > ansi-regex                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://github.com/advisories/GHSA-93q8-gq69-wqmw            │
└───────────────┴──────────────────────────────────────────────────────────────┘

yargs@15 or 16 have updated the dependency tree to bump ansi-regex to v5:

  └─┬ yargs@16.2.0
│   └─┬ cliui@7.0.4
│     ├─┬ strip-ansi@6.0.1
│     │ └── ansi-regex@5.0.1 
│     └─┬ wrap-ansi@7.0.0
│       └─┬ strip-ansi@6.0.1
│         └── ansi-regex@5.0.1 

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions