[BUG] Address CVE-2021-3807 about npmlog HOT 3 CLOSED

I wanted to drop a ping in here as well, to try and figure out if at this point the idea of moving away from gauge has gotten traction, or if expectation is that gauge will be patched. Definitely unfortunate that these dependencies seem unmaintained.

from npmlog.

In the meantime, Yarn projects can specify the following temporary workaround in package.json:

  "resolutions": {
    "ansi-regex": "^5.0.1"
  },

npm projects can achieve a similar effect via npm-force-resolutions.

from npmlog.

Good news: 3 days ago wide-align bumped its dependency on string-width to v4, which was already patched. I am closing this issue since I have verified that all packages in the dependency chain, including npmlog, no longer trigger an audit failure at their latest versions. If anyone feels that a port to cli-progress would be warranted, I trust they will file a separate issue.

from npmlog.