Vulnerability reported due to optionator v0.9.1 transitive dependency

[padamstx]

Chore summary The @stoplight/spectral-cli package has an indirect dependency on optionator v0.9.1, which has a vulnerability (CVE-2023-26115) due to its "word-wrap" dependency. Optionator v0.9.3 was recently released which fixes this by using a different "word-wrap" package.

The purpose of this issue is to request that spectral-cli be updated to avoid this CVE.

Tasks

• [ ] Upgrade dependencies so that optionator v0.9.3 is used in order to avoid CVE-2023-26115

Additional context n/a

[Jokinen]

In our research, we noticed this kind of a dependency path for word-wrap.

@stoplight/spectral-cli@6.8.0
└─┬ proxy-agent@5.0.0
  └─┬ pac-proxy-agent@5.0.0
    └─┬ pac-resolver@5.0.1
      └─┬ degenerator@3.0.4
        └─┬ escodegen@1.14.3
          └─┬ optionator@0.8.3
            └── word-wrap@1.2.3

[P0lip]

Should be addressed by #2513 which drops proxy-agent

[padamstx]

Thanks for addressing this, @P0lip !

[stoplight-bot]

:tada: This issue has been resolved in version 6.9.0 :tada:

The release is available on npm package (@latest dist-tag)

Your semantic-release bot :package::rocket: