[Snyk] Fix for 1 vulnerabilities

[snyk-bot]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • packages/cli/package.json
  • packages/cli/package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	768/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: inquirer

The new version differs by 250 commits.

• 65a4d59 Publish
• e2099ed Update dependencies
• 8270551 Produce error on prompt in non-tty environment. (General support for type applications. Polymer/tools#891)
• 6a883e6 Update lint-staged to the latest version 🚀 (Do behaviors require stand-in properties? Polymer/tools#886)
• 4b8b47f Publish
• 833385b Workaround node.js bug with readline (--deleteExisting option deletes manually written typings Polymer/tools#882)
• ee55149 Add inquirer-table-prompt plugin (Handle behavior arrays Polymer/tools#884)
• 942908f Publish
• a70ee52 Revert "Workaround node.js bug that closes main input and output stream. (Windows Support Polymer/tools#879)" (Add HTMLElementTagNameMap interface Polymer/tools#881)
• 0bc1b01 Publish
• 3d0ff8c Workaround node.js bug that closes main input and output stream. (Windows Support Polymer/tools#879)
• 7ec6ea0 Publish
• e2e07e3 Fix Move @types dependencies to devDependencies Polymer/tools#862 - Do not throw when returning undefined from filter functions
• af16d5b Fix More principled resolution of references Polymer/tools#845 - Fix broken asynchronous validation
• 904e473 fix multi rawList bug (Port removeFakeNodes to dom5 from polymer-bundler Polymer/tools#861) (insertBefore, append, and replace do not work with document fragments Polymer/tools#867)
• 45af563 Bugfix: Choices.push() breaks index if a disabled item was already in the Choices (Make new Parser and Serializer instances per call to parse, parseFragment, and serialize Polymer/tools#869)
• 8248ee5 Update Readme: Add FOSSA check and remove Node 6 support notice.
• 05f34b6 Bump dependencies
• f04c5cf Remove broken unit tests
• 3ab4549 Add new editor prompt
• 6a2aa06 Add screenshots to mono repo package readmes
• d76c929 Refactor new expand prompt with the hooks
• 7cf9d99 Fix input prompt final answer formatting
• c172c75 Update new confirm prompt to use the hook API

See the full diff

Package name: update-notifier

The new version differs by 49 commits.

• adf7803 4.0.0
• fb5161c Remove the `callback` option ([Snyk] Security upgrade express from 4.17.1 to 4.20.0 #158)
• 39682de Rename `boxenOpts` option to `boxenOptions`
• bc1721a Avoid showing notification if current version is the latest (Capture and assert on error output. Polymer/tools#174)
• ccaf686 Update dependencies
• b1525e6 Disable when `NODE_ENV` is `test` (Edge supports ES6, but not object spread operator Polymer/tools#173)
• bf73119 Fix install command for npm global ([Snyk] Security upgrade http-proxy-middleware from 0.17.4 to 2.0.7 #165)
• 592b025 3.0.1
• f8b4e60 Update Travis matrix
• a6d6b49 Update URL to TTY ([Snyk] Security upgrade express from 4.17.1 to 4.21.1 #163)
• f9d168a Remove object spread to support node >=8.0.0 <8.6.0 ([Snyk] Security upgrade del from 3.0.0 to 8.0.0 #164)
• 1712928 Tidelift tasks
• 72f83d1 Create funding.yml
• a7bb3ee 3.0.0
• ad8ed1b Suggest yarn when installed with yarn ([Snyk] Security upgrade gulp-eslint from 4.0.2 to 6.0.0 #132)
• 5f06620 Exit the update check process if it does not respond after 30s ([Snyk] Security upgrade express from 4.17.1 to 4.21.0 #156)
• 79e89ad Fix failing test ([Snyk] Security upgrade express from 4.17.1 to 4.21.0 #155)
• c8faa84 Add `distTag` option ([Snyk] Fix for 7 vulnerabilities #151)
• 14632e4 Add failing test for [Snyk] Fix for 4 vulnerabilities #153 ([Snyk] Fix for 4 vulnerabilities #154)
• aafd8a0 Require Node.js 8
• 0d49f51 Add Tidelift mention in the readme
• 8df01b3 Fix docs position of `shouldNotifyInNpmScript` ([Snyk] Security upgrade @octokit/rest from 14.0.9 to 16.0.0 #143)
• d371834 Docs: isGlobal option does not default to true ([Snyk] Fix for 14 vulnerabilities #142)
• 5cd6577 2.5.0

See the full diff

Package name: yeoman-generator

The new version differs by 250 commits.

• aad5fac 5.0.0
• 4f4a802 Add transform to expected priority.
• 57d240c Remove only from test.
• 812751f Lint fix
• 33d050f Implement getFeatures for singleton support.
• 99ac2c5 Add transform priority.
• 5136342 Bump peter-evans/create-pull-request from v3.8.0 to v3.8.2 (Delete Polymer/tools#1278)
• fa408bd Bump actions/stale from v3.0.15 to v3.0.16 (Update to sw-precache ^5.0.0 for Chrome 59 and latest Firefox support Polymer/tools#1275)
• d7103f3 Drop reference from yeoman-test repository
• b36f294 Bump yeoman-environment to 3.0.0-rc.1
• ee0d1ad Hide shared options and drop support for kebab case options.
• 310f72d Fix spawn destinationRoot.
• 8f4afe9 Switch composeWith to use environment.
• e9d0a15 Remove support for chainning at composeWith.
• c2245e1 Switch from node 10 to 12 at Travis.
• 5be7b07 5.0.0-rc.0
• 8a448b4 Bump yeoman-environment to 3.0.0-rc.0
• 6d6c4b0 Changes to queueTransformStream
• 632d60d Add option to skip parsing options.
• 7050e53 Pass destinationRoot to spawn-command by default.
• 097cd20 Implement package-json mixin.
• 52c90a2 Add merge support to Storage.
• f4336d9 5.0.0-beta.1
• 1952724 Change version to 5.0.0-beta.0

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic