tic-tac-toe-io / rds-agent

Agent for Remote Device Diagnosis
MIT License
0 stars 0 forks source link

Replace optimist with yargs because of CVE: prototype pollution #1

Closed yagamy4680 closed 3 years ago

yagamy4680 commented 3 years ago

According to CVE-1179 from npm, we need to upgrade minimist to 0.2.1, 1.2.3 or later. But, current optimist depends on super old version of minimist: 0.0.1.

And, the author of optimist already deprecates this module, so it's better to migrate from optimist to yargs for command line argument parsing.