Latest version of cli is pulling in insecure packages that have available patches about vercel

[justinoboyle]

This is very important for organizations that have security policies that require packages to be updated with all security patches.

[soulofmischief]

Thanks for staying on top of this @G-Rath

[G-Rath]

Thanks, but unfortunately I'm not confident that they'll get addressed anytime soon - we're currently in the process of reviewing moving our Vercel apps to Netlify since they setup a whole internal workflow to stay on top of these updates in response to my equivalent issue about their cli (which is even more impressive given they use a shrink-wrap.json where Vercel just pins their top level dependences).

I will continue to update this issue for the foreseeable future though