Update to strip-ansi@6.0.1 for ansi-regex CVE-2021-3807

[mriedem]

The latest version of cliui requires strip-ansi 6.0.0 which requires ansi-regex 5.0.0 which has a CVE against it:

https://nvd.nist.gov/vuln/detail/CVE-2021-3807

Update the cliui dependency on strip-ansi to 6.0.1 which requires ansi-regex 5.0.1 to resolve the vulnerability in this dependency chain:

https://github.com/chalk/strip-ansi/blob/v6.0.1/package.json#L47

I'm here because of this dependency chain:

├─┬ @carbon/charts-vue@0.41.95
│ └─┬ @carbon/telemetry@0.0.0-alpha.6
│   └─┬ yargs@16.2.0
│     └─┬ cliui@7.0.4
│       └─┬ strip-ansi@6.0.0
│         └── ansi-regex@5.0.0

Updating to the latest @carbon/charts-vue@0.41.95 does not resolve that issue.

This may be related to issues #106 and #110.

[mriedem]

npm audit also mentions this as GHSA-93q8-gq69-wqmw.

[opravil-jan]

Hi,

any progress in updating dependencies please?

Thanks
Jonh

[mriedem]

Hi,

any progress in updating dependencies please?

Thanks Jonh

There are at least two open PRs but need a maintainer to run checks on them.

[constantinirimia]

Hi
Any updates on this?
Thank you!
Constantin