fix: upgrade @inquirer/prompts to ^8 to resolve CVE-2025-54798 - #46
fix: upgrade @inquirer/prompts to ^8 to resolve CVE-2025-54798#46thedoc31 wants to merge 1 commit into
Conversation
Bumps @inquirer/prompts from ^5 to ^8, removing the tmp <=0.2.3 transitive dependency chain that carries CVE-2025-54798 (arbitrary temp file/dir write via symlink). Adds a moduleNameMapper mock for @oclif/table to fix list.test.js suite failure caused by string-width 8.x using the /v regex flag, which Jest 29 VM modules cannot parse. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
|
@shazron Do you have a plan for when this can be merged and released? |
|
@thedoc31 I am no longer with Adobe - cc @MichaelGoberling |
|
The package.json for this plugin indicates support for Node 20.0.0+, but on 20.0.0 - 20.16.0 commands requiring input (via inquirer) will not work with an error such as: Error: Database provisioning failed: The requested module 'node:util' does not provide an export named 'styleText'In addition (not related to the changes here) but the dependency I would recommend to bump Also just wanted to note - Because it's an update to a core aio plugin that could potentially break users, it may effect how quickly we're able to release this. Need to double check what versions we will release both this and the aio cli at, based on the breaking changes |
|
@MichaelGoberling Ew, that's not good. I guess that's something the unit tests couldn't catch? As far as node versioning is concerned, I'm fine with updating the |
|
@thedoc31 Yes I looked and it seems we mock the inquirer prompts module for unit tests. So the actual code in that module doesn't get run and thus it wouldn't surface in unit tests I talked with the team and it sounds like a minor is okay actually. For the plugin we would do it here, and then since we use caret versioning in the aio-cli repo, it will get picked up automatically on any So yes lets update the engines and then this is g2g imo Also, I checked the CLI metrics and I see less than 3% of clients on 20.0.0 - 20.16.0 |
3 participants
Summary
@inquirer/promptsfrom^5to^8, removing thetmp <=0.2.3transitive dependency chain that carries CVE-2025-54798 (GHSA-52f5-9888-hmc6): arbitrary temp file/dir write via symlink in thedirparameter (CVSS 2.5 Low)moduleNameMapperin Jest config +test/__mocks__/oclif-table.jsto fix a pre-existinglist.test.jssuite failure caused bystring-width@8.xusing the/vregex flag, which Jest 29's VM module sandbox cannot parseVulnerability chain resolved
@inquirer/prompts@8dropped@inquirer/editorentirely, removing the whole chain.npm auditreports 0 vulnerabilities after this change.Compatibility
Only
inputandconfirmare used in this codebase — both call signatures are unchanged through v6, v7, and v8. The project already has"type": "module"andengines: ">=20.0.0", satisfying v8's requirements.Test plan
npm audit— 0 vulnerabilitieslist.test.js🤖 Generated with Claude Code