fix: upgrade @inquirer/prompts to ^8 to resolve CVE-2025-54798

[thedoc31]

Summary

• Bumps @inquirer/prompts from ^5 to ^8, removing the tmp <=0.2.3 transitive dependency chain that carries CVE-2025-54798 (GHSA-52f5-9888-hmc6): arbitrary temp file/dir write via symlink in the dir parameter (CVSS 2.5 Low)
• Adds moduleNameMapper in Jest config + test/__mocks__/oclif-table.js to fix a pre-existing list.test.js suite failure caused by string-width@8.x using the /v regex flag, which Jest 29's VM module sandbox cannot parse

Vulnerability chain resolved

tmp <=0.2.3  (CVE-2025-54798)
  └── external-editor
        └── @inquirer/editor <=4.2.15
              └── @inquirer/prompts <=6.0.1  ← was ^5, now ^8

@inquirer/prompts@8 dropped @inquirer/editor entirely, removing the whole chain. npm audit reports 0 vulnerabilities after this change.

Compatibility

Only input and confirm are used in this codebase — both call signatures are unchanged through v6, v7, and v8. The project already has "type": "module" and engines: ">=20.0.0", satisfying v8's requirements.

Test plan

• npm audit — 0 vulnerabilities
• 471/471 tests pass (32/32 suites), including the previously failing list.test.js

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[thedoc31]

@shazron Do you have a plan for when this can be merged and released?

[shazron]

@thedoc31 I am no longer with Adobe - cc @MichaelGoberling

[MichaelGoberling]

@thedoc31

The package.json for this plugin indicates support for Node 20.0.0+, but on 20.0.0 - 20.16.0 commands requiring input (via inquirer) will not work with an error such as:

Error: Database provisioning failed: The requested module 'node:util' does not provide an export named 'styleText'

In addition (not related to the changes here) but the dependency @azure/core-auth@1.11.0 already requires node >22

I would recommend to bump node.engines high enough to cover both the new inquirer required engines as well as the azure dependency

Also just wanted to note - Because it's an update to a core aio plugin that could potentially break users, it may effect how quickly we're able to release this. Need to double check what versions we will release both this and the aio cli at, based on the breaking changes

[thedoc31]

@MichaelGoberling Ew, that's not good. I guess that's something the unit tests couldn't catch?

As far as node versioning is concerned, I'm fine with updating the node.engines to >=22, since 22 is officially in maintenance phase now [1], but who knows what ripple effects that could have for other aio-cli plugins. That seems like something that might warrant an aio-cli@12 branch, or at minimum an aio-cli@11.2.0

[1]
https://nodejs.org/en/about/previous-releases