Package dependency triggers NPM advisory (1179) about dredd

[jsevedge]

FYI, it looks like optimist is deprecated (no new versions in 7 years) with a recommendation to use minimist instead.

[jsevedge]

@abtris or another maintainer... looking for some guidance here. It appears optimist is used as the command line parser for this projects CLI, would you be open to a pull request where that is swapped out for a more current package (such as yargs, minimist, etc.)? Seems like swapping that out is the best way to get rid of this security alert for good. If not, any other suggestions?

[abtris]

I see in Dependabot:

Dependabot cannot update minimist to a non-vulnerable version
The latest possible version that can be installed is 0.0.10 because of the following conflicting dependencies:

[email protected] requires minimist@^1.2.5 via a transitive dependency on [email protected]
[email protected] requires minimist@^1.2.0 via a transitive dependency on [email protected]
[email protected] requires minimist@^1.2.5 via a transitive dependency on [email protected]
[email protected] requires minimist@^1.1.3 via a transitive dependency on [email protected]
[email protected] requires minimist@^1.1.3 via a transitive dependency on [email protected]
The earliest fixed version is 0.2.1.

[abtris]

@opichals @kuba-kubula any advise on this?

[kylef]

I did some prior analysis in #1695 (comment) with suggestion on how to proceed. Looks like yargs as a replacement might be a bit problematic due to licensing (although this may have changed). Last I checked minimist shouldn't be much of a problem, and it's already in the dependency tree albeit an older version.